diff --git a/.scratch/tech-global-audit/审计覆盖清单.json b/.scratch/tech-global-audit/审计覆盖清单.json
deleted file mode 100644
index f17c825..0000000
--- a/.scratch/tech-global-audit/审计覆盖清单.json
+++ /dev/null
@@ -1,15974 +0,0 @@
-[
-  {
-    "key": "application:internal/application/agentrecharge/approval_decision.go:31:Handle",
-    "kind": "application",
-    "code_entry": "internal/application/agentrecharge/approval_decision.go:31 Handle",
-    "owner": "agentrecharge",
-    "summary": "业务方法 Handle",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agentrecharge.handle",
-    "action_name": "执行业务方法（Handle）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agentrecharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/agentrecharge/confirm_online_payment.go:76:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/agentrecharge/confirm_online_payment.go:76 Execute",
-    "owner": "agentrecharge",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agentrecharge.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agentrecharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/agentrecharge/offline_creation.go:50:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/agentrecharge/offline_creation.go:50 Execute",
-    "owner": "agentrecharge",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agentrecharge.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agentrecharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/agentrecharge/online_creation.go:61:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/agentrecharge/online_creation.go:61 Execute",
-    "owner": "agentrecharge",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agentrecharge.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agentrecharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/agentrecharge/recover_online_payment.go:30:ProcessBatch",
-    "kind": "application",
-    "code_entry": "internal/application/agentrecharge/recover_online_payment.go:30 ProcessBatch",
-    "owner": "agentrecharge",
-    "summary": "业务方法 ProcessBatch",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agentrecharge.process_batch",
-    "action_name": "执行业务方法（ProcessBatch）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agentrecharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/approval/create.go:143:CreateContextInTx",
-    "kind": "application",
-    "code_entry": "internal/application/approval/create.go:143 CreateContextInTx",
-    "owner": "approval",
-    "summary": "业务方法 CreateContextInTx",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "approval.create_context_in_tx",
-    "action_name": "执行业务方法（CreateContextInTx）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "approval",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/approval/create.go:70:CreateInTx",
-    "kind": "application",
-    "code_entry": "internal/application/approval/create.go:70 CreateInTx",
-    "owner": "approval",
-    "summary": "业务方法 CreateInTx",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "approval.create_in_tx",
-    "action_name": "执行业务方法（CreateInTx）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "approval",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/approval/sync_decision.go:90:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/approval/sync_decision.go:90 Execute",
-    "owner": "approval",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "approval.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "approval",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/auditarchive/integration.go:50:ArchivePreviousIntegrationDay",
-    "kind": "application",
-    "code_entry": "internal/application/auditarchive/integration.go:50 ArchivePreviousIntegrationDay",
-    "owner": "auditarchive",
-    "summary": "业务方法 ArchivePreviousIntegrationDay",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auditarchive.archive_previous_integration_day",
-    "action_name": "执行业务方法（ArchivePreviousIntegrationDay）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "auditarchive",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/auditarchive/integration.go:56:ArchiveIntegrationDate",
-    "kind": "application",
-    "code_entry": "internal/application/auditarchive/integration.go:56 ArchiveIntegrationDate",
-    "owner": "auditarchive",
-    "summary": "业务方法 ArchiveIntegrationDate",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auditarchive.archive_integration_date",
-    "action_name": "执行业务方法（ArchiveIntegrationDate）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "auditarchive",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/auditarchive/retention.go:55:CleanupPreviousMonth",
-    "kind": "application",
-    "code_entry": "internal/application/auditarchive/retention.go:55 CleanupPreviousMonth",
-    "owner": "auditarchive",
-    "summary": "业务方法 CleanupPreviousMonth",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auditarchive.cleanup_previous_month",
-    "action_name": "执行业务方法（CleanupPreviousMonth）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "auditarchive",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/auditarchive/retention.go:91:CleanupMonth",
-    "kind": "application",
-    "code_entry": "internal/application/auditarchive/retention.go:91 CleanupMonth",
-    "owner": "auditarchive",
-    "summary": "业务方法 CleanupMonth",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auditarchive.cleanup_month",
-    "action_name": "执行业务方法（CleanupMonth）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "auditarchive",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/auditarchive/service.go:104:ArchiveDate",
-    "kind": "application",
-    "code_entry": "internal/application/auditarchive/service.go:104 ArchiveDate",
-    "owner": "auditarchive",
-    "summary": "业务方法 ArchiveDate",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auditarchive.archive_date",
-    "action_name": "执行业务方法（ArchiveDate）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "auditarchive",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/auditarchive/service.go:98:ArchivePreviousDay",
-    "kind": "application",
-    "code_entry": "internal/application/auditarchive/service.go:98 ArchivePreviousDay",
-    "owner": "auditarchive",
-    "summary": "业务方法 ArchivePreviousDay",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auditarchive.archive_previous_day",
-    "action_name": "执行业务方法（ArchivePreviousDay）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "auditarchive",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/cardobservation/series.go:127:Trigger",
-    "kind": "application",
-    "code_entry": "internal/application/cardobservation/series.go:127 Trigger",
-    "owner": "cardobservation",
-    "summary": "业务方法 Trigger",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "cardobservation.trigger",
-    "action_name": "执行业务方法（Trigger）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "cardobservation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/cardobservation/series.go:132:TriggerEvent",
-    "kind": "application",
-    "code_entry": "internal/application/cardobservation/series.go:132 TriggerEvent",
-    "owner": "cardobservation",
-    "summary": "业务方法 TriggerEvent",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "cardobservation.trigger_event",
-    "action_name": "执行业务方法（TriggerEvent）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "cardobservation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/cardobservation/series.go:205:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/cardobservation/series.go:205 Execute",
-    "owner": "cardobservation",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "cardobservation.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "cardobservation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/outbox/recovery.go:146:ReleaseExpiredLeases",
-    "kind": "application",
-    "code_entry": "internal/application/outbox/recovery.go:146 ReleaseExpiredLeases",
-    "owner": "outbox",
-    "summary": "业务方法 ReleaseExpiredLeases",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "outbox.release_expired_leases",
-    "action_name": "执行业务方法（ReleaseExpiredLeases）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "outbox",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/outbox/recovery.go:88:Replay",
-    "kind": "application",
-    "code_entry": "internal/application/outbox/recovery.go:88 Replay",
-    "owner": "outbox",
-    "summary": "业务方法 Replay",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "outbox.replay",
-    "action_name": "执行业务方法（Replay）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "outbox",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/refundapproval/creation.go:58:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/refundapproval/creation.go:58 Execute",
-    "owner": "refundapproval",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "refundapproval.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refundapproval",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/role/default_credit.go:34:Update",
-    "kind": "application",
-    "code_entry": "internal/application/role/default_credit.go:34 Update",
-    "owner": "role",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/shop/create.go:32:Create",
-    "kind": "application",
-    "code_entry": "internal/application/shop/create.go:32 Create",
-    "owner": "shop",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/shop/update.go:29:Update",
-    "kind": "application",
-    "code_entry": "internal/application/shop/update.go:29 Update",
-    "owner": "shop",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/systemconfig/update.go:71:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/systemconfig/update.go:71 Execute",
-    "owner": "systemconfig",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "systemconfig.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "systemconfig",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wallet/change_credit.go:46:Execute",
-    "kind": "application",
-    "code_entry": "internal/application/wallet/change_credit.go:46 Execute",
-    "owner": "wallet",
-    "summary": "业务方法 Execute",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wallet.execute",
-    "action_name": "执行业务方法（Execute）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "wallet",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wallet/debit.go:82:DebitInTx",
-    "kind": "application",
-    "code_entry": "internal/application/wallet/debit.go:82 DebitInTx",
-    "owner": "wallet",
-    "summary": "业务方法 DebitInTx",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wallet.debit_in_tx",
-    "action_name": "执行业务方法（DebitInTx）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "wallet",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wallet/refund.go:89:RefundInTx",
-    "kind": "application",
-    "code_entry": "internal/application/wallet/refund.go:89 RefundInTx",
-    "owner": "wallet",
-    "summary": "业务方法 RefundInTx",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wallet.refund_in_tx",
-    "action_name": "执行业务方法（RefundInTx）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "wallet",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wallet/reservation.go:108:ReleaseInTx",
-    "kind": "application",
-    "code_entry": "internal/application/wallet/reservation.go:108 ReleaseInTx",
-    "owner": "wallet",
-    "summary": "业务方法 ReleaseInTx",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wallet.release_in_tx",
-    "action_name": "执行业务方法（ReleaseInTx）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "wallet",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wallet/reservation.go:70:FreezeInTx",
-    "kind": "application",
-    "code_entry": "internal/application/wallet/reservation.go:70 FreezeInTx",
-    "owner": "wallet",
-    "summary": "业务方法 FreezeInTx",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wallet.freeze_in_tx",
-    "action_name": "执行业务方法（FreezeInTx）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "wallet",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wecom/connection.go:253:SaveDefaultCreator",
-    "kind": "application",
-    "code_entry": "internal/application/wecom/connection.go:253 SaveDefaultCreator",
-    "owner": "wecom",
-    "summary": "业务方法 SaveDefaultCreator",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wecom.save_default_creator",
-    "action_name": "执行业务方法（SaveDefaultCreator）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wecom/connection.go:93:Save",
-    "kind": "application",
-    "code_entry": "internal/application/wecom/connection.go:93 Save",
-    "owner": "wecom",
-    "summary": "业务方法 Save",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wecom.save",
-    "action_name": "执行业务方法（Save）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wecom/directory.go:57:Sync",
-    "kind": "application",
-    "code_entry": "internal/application/wecom/directory.go:57 Sync",
-    "owner": "wecom",
-    "summary": "业务方法 Sync",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wecom.sync",
-    "action_name": "执行业务方法（Sync）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "application:internal/application/wecom/scene.go:111:Save",
-    "kind": "application",
-    "code_entry": "internal/application/wecom/scene.go:111 Save",
-    "owner": "wecom",
-    "summary": "业务方法 Save",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wecom.save",
-    "action_name": "执行业务方法（Save）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "domain:internal/domain/wallet/wallet.go:128:ChangeCredit",
-    "kind": "domain",
-    "code_entry": "internal/domain/wallet/wallet.go:128 ChangeCredit",
-    "owner": "wallet",
-    "summary": "业务方法 ChangeCredit",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "由 Application 组合根负责",
-    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
-    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
-  },
-  {
-    "key": "domain:internal/domain/wallet/wallet.go:26:Debit",
-    "kind": "domain",
-    "code_entry": "internal/domain/wallet/wallet.go:26 Debit",
-    "owner": "wallet",
-    "summary": "业务方法 Debit",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "由 Application 组合根负责",
-    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
-    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
-  },
-  {
-    "key": "domain:internal/domain/wallet/wallet.go:44:Credit",
-    "kind": "domain",
-    "code_entry": "internal/domain/wallet/wallet.go:44 Credit",
-    "owner": "wallet",
-    "summary": "业务方法 Credit",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "由 Application 组合根负责",
-    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
-    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
-  },
-  {
-    "key": "domain:internal/domain/wallet/wallet.go:62:Freeze",
-    "kind": "domain",
-    "code_entry": "internal/domain/wallet/wallet.go:62 Freeze",
-    "owner": "wallet",
-    "summary": "业务方法 Freeze",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "由 Application 组合根负责",
-    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
-    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
-  },
-  {
-    "key": "domain:internal/domain/wallet/wallet.go:80:Release",
-    "kind": "domain",
-    "code_entry": "internal/domain/wallet/wallet.go:80 Release",
-    "owner": "wallet",
-    "summary": "业务方法 Release",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "由 Application 组合根负责",
-    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
-    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
-  },
-  {
-    "key": "http:internal/routes/account.go:102:POST:/:id/roles",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:102 h.AssignRoles",
-    "owner": "account",
-    "method": "POST",
-    "path": "/:id/roles",
-    "summary": "为账号分配角色",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.assign_roles",
-    "action_name": "为账号分配角色",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/account.go:111:GET:/:id/roles",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:111 h.GetRoles",
-    "owner": "account",
-    "method": "GET",
-    "path": "/:id/roles",
-    "summary": "获取账号角色",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/account.go:120:DELETE:/:account_id/roles/:role_id",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:120 h.RemoveRole",
-    "owner": "account",
-    "method": "DELETE",
-    "path": "/:account_id/roles/:role_id",
-    "summary": "移除账号角色",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.remove_role",
-    "action_name": "移除账号角色",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/account.go:31:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:31 h.Create",
-    "owner": "account",
-    "method": "POST",
-    "summary": "创建账号",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.create",
-    "action_name": "创建账号",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/account.go:40:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:40 h.List",
-    "owner": "account",
-    "method": "GET",
-    "summary": "查询账号列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/account.go:49:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:49 h.Get",
-    "owner": "account",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取账号详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/account.go:58:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:58 h.Update",
-    "owner": "account",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新账号",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.update",
-    "action_name": "更新账号",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/account.go:66:PUT:/:id/wecom-binding",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:66 h.BindWeCom",
-    "owner": "account",
-    "method": "PUT",
-    "path": "/:id/wecom-binding",
-    "summary": "绑定账号企业微信成员",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.bind_we_com",
-    "action_name": "绑定账号企业微信成员",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/account.go:75:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:75 h.Delete",
-    "owner": "account",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除账号",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.delete",
-    "action_name": "删除账号",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/account.go:84:PUT:/:id/password",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:84 h.UpdatePassword",
-    "owner": "account",
-    "method": "PUT",
-    "path": "/:id/password",
-    "summary": "修改账号密码",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.update_password",
-    "action_name": "修改账号密码",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/account.go:93:PUT:/:id/status",
-    "kind": "http",
-    "code_entry": "internal/routes/account.go:93 h.UpdateStatus",
-    "owner": "account",
-    "method": "PUT",
-    "path": "/:id/status",
-    "summary": "修改账号状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "account.update_status",
-    "action_name": "修改账号状态",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/agent_recharge.go:24:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/agent_recharge.go:24 handler.Create",
-    "owner": "agent_recharge",
-    "method": "POST",
-    "summary": "创建代理充值订单",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "agent_recharge.create",
-    "action_name": "创建代理充值订单",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agent_recharge",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/agent_recharge.go:32:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/agent_recharge.go:32 handler.List",
-    "owner": "agent_recharge",
-    "method": "GET",
-    "summary": "查询代理充值订单列表",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/agent_recharge.go:41:GET:/payment-methods",
-    "kind": "http",
-    "code_entry": "internal/routes/agent_recharge.go:41 handler.PaymentMethods",
-    "owner": "agent_recharge",
-    "method": "GET",
-    "path": "/payment-methods",
-    "summary": "查询代理在线充值可用支付方式",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/agent_recharge.go:48:GET:/:id/payment-status",
-    "kind": "http",
-    "code_entry": "internal/routes/agent_recharge.go:48 handler.PaymentStatus",
-    "owner": "agent_recharge",
-    "method": "GET",
-    "path": "/:id/payment-status",
-    "summary": "查询代理充值本地支付与到账状态",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/agent_recharge.go:56:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/agent_recharge.go:56 handler.Get",
-    "owner": "agent_recharge",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "查询代理充值订单详情",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/agent_recharge.go:64:POST:/:id/offline-pay",
-    "kind": "http",
-    "code_entry": "internal/routes/agent_recharge.go:64 handler.OfflinePay",
-    "owner": "agent_recharge",
-    "method": "POST",
-    "path": "/:id/offline-pay",
-    "summary": "确认线下充值",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "agent_recharge.offline_pay",
-    "action_name": "确认线下充值",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agent_recharge",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/agent_recharge.go:72:POST:/:id/reject",
-    "kind": "http",
-    "code_entry": "internal/routes/agent_recharge.go:72 handler.Reject",
-    "owner": "agent_recharge",
-    "method": "POST",
-    "path": "/:id/reject",
-    "summary": "驳回代理充值订单",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "agent_recharge.reject",
-    "action_name": "驳回代理充值订单",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agent_recharge",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:104:GET:/:identifier/wallet",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:104 walletHandler.GetWallet",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/:identifier/wallet",
-    "summary": "资产钱包概况",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset.go:113:GET:/:identifier/wallet/transactions",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:113 walletHandler.ListTransactions",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/:identifier/wallet/transactions",
-    "summary": "资产钱包流水列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset.go:122:GET:/:identifier/orders",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:122 handler.Orders",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/:identifier/orders",
-    "summary": "资产历史订单",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset.go:131:GET:/:identifier/operation-logs",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:131 handler.OperationLogs",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/:identifier/operation-logs",
-    "summary": "查询平台旧资产操作日志",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset.go:140:PATCH:/:identifier/polling-status",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:140 handler.UpdatePollingStatus",
-    "owner": "asset",
-    "method": "PATCH",
-    "path": "/:identifier/polling-status",
-    "summary": "更新资产轮询状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.update_polling_status",
-    "action_name": "更新资产轮询状态",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:149:PATCH:/:identifier/realname-mode",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:149 handler.UpdateRealnamePolicy",
-    "owner": "asset",
-    "method": "PATCH",
-    "path": "/:identifier/realname-mode",
-    "summary": "更新资产实名认证策略",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.update_realname_policy",
-    "action_name": "更新资产实名认证策略",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:158:PATCH:/:identifier/realname-status",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:158 handler.UpdateRealnameStatus",
-    "owner": "asset",
-    "method": "PATCH",
-    "path": "/:identifier/realname-status",
-    "summary": "手动更新卡实名状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.update_realname_status",
-    "action_name": "手动更新卡实名状态",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:15:GET:/resolve/:identifier",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:15 handler.Resolve",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/resolve/:identifier",
-    "summary": "解析资产",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset.go:24:GET:/:identifier/realtime-status",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:24 handler.RealtimeStatus",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/:identifier/realtime-status",
-    "summary": "资产实时状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.realtime_status",
-    "action_name": "资产实时状态",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:33:POST:/:identifier/refresh",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:33 handler.Refresh",
-    "owner": "asset",
-    "method": "POST",
-    "path": "/:identifier/refresh",
-    "summary": "刷新资产状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.refresh",
-    "action_name": "刷新资产状态",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:42:GET:/:identifier/packages",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:42 handler.Packages",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/:identifier/packages",
-    "summary": "资产套餐列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset.go:51:GET:/:identifier/current-package",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:51 handler.CurrentPackage",
-    "owner": "asset",
-    "method": "GET",
-    "path": "/:identifier/current-package",
-    "summary": "当前生效套餐",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset.go:59:PATCH:/:identifier/packages/:package_usage_id/expires-at",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:59 handler.UpdatePackageExpiresAt",
-    "owner": "asset",
-    "method": "PATCH",
-    "path": "/:identifier/packages/:package_usage_id/expires-at",
-    "summary": "修改资产套餐过期时间",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.update_package_expires_at",
-    "action_name": "修改资产套餐过期时间",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:68:PATCH:/:identifier/packages/:package_usage_id/used-data",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:68 handler.UpdatePackageUsage",
-    "owner": "asset",
-    "method": "PATCH",
-    "path": "/:identifier/packages/:package_usage_id/used-data",
-    "summary": "修改资产套餐已用量",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.update_package_usage",
-    "action_name": "修改资产套餐已用量",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:77:POST:/:identifier/stop",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:77 handler.Stop",
-    "owner": "asset",
-    "method": "POST",
-    "path": "/:identifier/stop",
-    "summary": "停机",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.stop",
-    "action_name": "停机",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:86:POST:/:identifier/start",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:86 handler.Start",
-    "owner": "asset",
-    "method": "POST",
-    "path": "/:identifier/start",
-    "summary": "复机",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.start",
-    "action_name": "复机",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset.go:95:PATCH:/:identifier/deactivate",
-    "kind": "http",
-    "code_entry": "internal/routes/asset.go:95 handler.Deactivate",
-    "owner": "asset",
-    "method": "PATCH",
-    "path": "/:identifier/deactivate",
-    "summary": "停用资产",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset.deactivate",
-    "action_name": "停用资产",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset_allocation_record.go:15:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/asset_allocation_record.go:15 handler.List",
-    "owner": "asset_allocation_record",
-    "method": "GET",
-    "summary": "分配记录列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset_allocation_record.go:23:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/asset_allocation_record.go:23 handler.GetByID",
-    "owner": "asset_allocation_record",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "分配记录详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset_package_batch_order.go:13:POST:/asset-package-batch-orders",
-    "kind": "http",
-    "code_entry": "internal/routes/asset_package_batch_order.go:13 handler.Create",
-    "owner": "asset_package_batch_order",
-    "method": "POST",
-    "path": "/asset-package-batch-orders",
-    "summary": "创建资产套餐批量订购任务",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "asset_package_batch_order.create",
-    "action_name": "创建资产套餐批量订购任务",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "asset_package_batch_order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/asset_package_batch_order.go:17:GET:/asset-package-batch-orders",
-    "kind": "http",
-    "code_entry": "internal/routes/asset_package_batch_order.go:17 handler.List",
-    "owner": "asset_package_batch_order",
-    "method": "GET",
-    "path": "/asset-package-batch-orders",
-    "summary": "查询资产套餐批量订购任务列表",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/asset_package_batch_order.go:21:GET:/asset-package-batch-orders/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/asset_package_batch_order.go:21 handler.Get",
-    "owner": "asset_package_batch_order",
-    "method": "GET",
-    "path": "/asset-package-batch-orders/:id",
-    "summary": "查询资产套餐批量订购任务详情",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:16:GET:/:resource_type/:identifier",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:16 handler.AgentResourceActivities",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/:resource_type/:identifier",
-    "summary": "查询代理资源活动",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:22:GET:/:resource_type/:identifier",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:22 handler.EnterpriseResourceActivities",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/:resource_type/:identifier",
-    "summary": "查询企业资源活动",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:31:GET:/events",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:31 handler.ListEvents",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/events",
-    "summary": "查询全局审计事件",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:36:GET:/events/:event_id",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:36 handler.GetEvent",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/events/:event_id",
-    "summary": "查询审计事件详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:41:GET:/actors/:kind/:id/events",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:41 handler.ListActorEvents",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/actors/:kind/:id/events",
-    "summary": "查询操作者行为时间线",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:47:GET:/resources/search",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:47 handler.SearchResources",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/resources/search",
-    "summary": "精确搜索注册资源",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:52:GET:/resources/:resource_type/:resource_id/timeline",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:52 handler.ResourceTimeline",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/resources/:resource_type/:resource_id/timeline",
-    "summary": "查询通用资源时间线",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:57:GET:/requests/:request_id/timeline",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:57 handler.RequestTimeline",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/requests/:request_id/timeline",
-    "summary": "查询请求关联时间线",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:62:GET:/correlations/:correlation_id/timeline",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:62 handler.CorrelationTimeline",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/correlations/:correlation_id/timeline",
-    "summary": "查询业务关联时间线",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:67:GET:/finance/timeline",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:67 handler.FinanceTimeline",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/finance/timeline",
-    "summary": "查询资金调查时间线",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:72:GET:/risks/overview",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:72 handler.RiskOverview",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/risks/overview",
-    "summary": "查询风险调查总览",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:77:GET:/risks/events",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:77 handler.RiskEvents",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/risks/events",
-    "summary": "查询风险事件明细",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:83:GET:/integrations/overview",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:83 handler.IntegrationOverview",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/integrations/overview",
-    "summary": "查询外部集成交互总览",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:88:GET:/integrations",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:88 handler.ListIntegrations",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/integrations",
-    "summary": "查询外部集成交互列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/audit.go:93:GET:/integrations/:integration_id",
-    "kind": "http",
-    "code_entry": "internal/routes/audit.go:93 handler.GetIntegration",
-    "owner": "audit",
-    "method": "GET",
-    "path": "/integrations/:integration_id",
-    "summary": "查询外部集成交互详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "仅超级管理员和平台账号可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/auth.go:15:POST:/login",
-    "kind": "http",
-    "code_entry": "internal/routes/auth.go:15 handler.Login",
-    "owner": "auth",
-    "method": "POST",
-    "path": "/login",
-    "summary": "统一登录（后台+H5）",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "auth.login",
-    "action_name": "统一登录（后台+H5）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "auth",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/auth.go:23:POST:/refresh-token",
-    "kind": "http",
-    "code_entry": "internal/routes/auth.go:23 handler.RefreshToken",
-    "owner": "auth",
-    "method": "POST",
-    "path": "/refresh-token",
-    "summary": "刷新 Token",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "auth.refresh_token",
-    "action_name": "刷新 Token",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "auth",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/auth.go:34:POST:/logout",
-    "kind": "http",
-    "code_entry": "internal/routes/auth.go:34 handler.Logout",
-    "owner": "auth",
-    "method": "POST",
-    "path": "/logout",
-    "summary": "统一登出",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "auth.logout",
-    "action_name": "统一登出",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "auth",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/auth.go:42:GET:/me",
-    "kind": "http",
-    "code_entry": "internal/routes/auth.go:42 handler.GetMe",
-    "owner": "auth",
-    "method": "GET",
-    "path": "/me",
-    "summary": "获取用户信息",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/auth.go:50:PUT:/password",
-    "kind": "http",
-    "code_entry": "internal/routes/auth.go:50 handler.ChangePassword",
-    "owner": "auth",
-    "method": "PUT",
-    "path": "/password",
-    "summary": "修改密码",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "auth.change_password",
-    "action_name": "修改密码",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "auth",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/authorization.go:15:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/authorization.go:15 handler.List",
-    "owner": "authorization",
-    "method": "GET",
-    "summary": "授权记录列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/authorization.go:23:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/authorization.go:23 handler.GetDetail",
-    "owner": "authorization",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "授权记录详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/authorization.go:31:PUT:/:id/remark",
-    "kind": "http",
-    "code_entry": "internal/routes/authorization.go:31 handler.UpdateRemark",
-    "owner": "authorization",
-    "method": "PUT",
-    "path": "/:id/remark",
-    "summary": "修改授权备注",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "authorization.update_remark",
-    "action_name": "修改授权备注",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "authorization",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/carrier.go:15:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/carrier.go:15 handler.List",
-    "owner": "carrier",
-    "method": "GET",
-    "summary": "运营商列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/carrier.go:23:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/carrier.go:23 handler.Create",
-    "owner": "carrier",
-    "method": "POST",
-    "summary": "创建运营商",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "carrier.create",
-    "action_name": "创建运营商",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/carrier.go:31:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/carrier.go:31 handler.Get",
-    "owner": "carrier",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取运营商详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/carrier.go:39:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/carrier.go:39 handler.Update",
-    "owner": "carrier",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新运营商",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "carrier.update",
-    "action_name": "更新运营商",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/carrier.go:47:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/carrier.go:47 handler.Delete",
-    "owner": "carrier",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除运营商",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "carrier.delete",
-    "action_name": "删除运营商",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/carrier.go:55:PUT:/:id/status",
-    "kind": "http",
-    "code_entry": "internal/routes/carrier.go:55 handler.UpdateStatus",
-    "owner": "carrier",
-    "method": "PUT",
-    "path": "/:id/status",
-    "summary": "更新运营商状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "carrier.update_status",
-    "action_name": "更新运营商状态",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/commission.go:15:GET:/withdrawal-requests",
-    "kind": "http",
-    "code_entry": "internal/routes/commission.go:15 handler.ListWithdrawalRequests",
-    "owner": "commission",
-    "method": "GET",
-    "path": "/withdrawal-requests",
-    "summary": "提现申请列表",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/commission.go:23:POST:/withdrawal-requests/:id/approve",
-    "kind": "http",
-    "code_entry": "internal/routes/commission.go:23 handler.ApproveWithdrawal",
-    "owner": "commission",
-    "method": "POST",
-    "path": "/withdrawal-requests/:id/approve",
-    "summary": "审批通过提现申请",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "commission.approve_withdrawal",
-    "action_name": "审批通过提现申请",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/commission.go:31:POST:/withdrawal-requests/:id/reject",
-    "kind": "http",
-    "code_entry": "internal/routes/commission.go:31 handler.RejectWithdrawal",
-    "owner": "commission",
-    "method": "POST",
-    "path": "/withdrawal-requests/:id/reject",
-    "summary": "拒绝提现申请",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "commission.reject_withdrawal",
-    "action_name": "拒绝提现申请",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/commission.go:45:POST:/withdrawal-settings",
-    "kind": "http",
-    "code_entry": "internal/routes/commission.go:45 handler.Create",
-    "owner": "commission",
-    "method": "POST",
-    "path": "/withdrawal-settings",
-    "summary": "新增提现配置",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "commission.create",
-    "action_name": "新增提现配置",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/commission.go:53:GET:/withdrawal-settings",
-    "kind": "http",
-    "code_entry": "internal/routes/commission.go:53 handler.List",
-    "owner": "commission",
-    "method": "GET",
-    "path": "/withdrawal-settings",
-    "summary": "提现配置列表",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/commission.go:61:GET:/withdrawal-settings/current",
-    "kind": "http",
-    "code_entry": "internal/routes/commission.go:61 handler.GetCurrent",
-    "owner": "commission",
-    "method": "GET",
-    "path": "/withdrawal-settings/current",
-    "summary": "获取当前生效的提现配置",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/device.go:118:GET:/import/tasks",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:118 importHandler.List",
-    "owner": "device",
-    "method": "GET",
-    "path": "/import/tasks",
-    "summary": "导入任务列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/device.go:127:POST:/import/allocations",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:127 importHandler.CreateAllocation",
-    "owner": "device",
-    "method": "POST",
-    "path": "/import/allocations",
-    "summary": "创建CSV设备批量分配或回收任务",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.create_allocation",
-    "action_name": "创建CSV设备批量分配或回收任务",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:136:GET:/import/tasks/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:136 importHandler.GetByID",
-    "owner": "device",
-    "method": "GET",
-    "path": "/import/tasks/:id",
-    "summary": "导入任务详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/device.go:145:PATCH:/series-binding",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:145 handler.BatchSetSeriesBinding",
-    "owner": "device",
-    "method": "PATCH",
-    "path": "/series-binding",
-    "summary": "批量设置设备的套餐系列绑定",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.batch_set_series_binding",
-    "action_name": "批量设置设备的套餐系列绑定",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:154:GET:/by-identifier/:identifier/gateway-slots",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:154 handler.GetGatewaySlots",
-    "owner": "device",
-    "method": "GET",
-    "path": "/by-identifier/:identifier/gateway-slots",
-    "summary": "查询卡槽信息",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/device.go:163:PUT:/by-identifier/:identifier/wifi",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:163 handler.SetWiFi",
-    "owner": "device",
-    "method": "PUT",
-    "path": "/by-identifier/:identifier/wifi",
-    "summary": "设置 WiFi",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.set_wi_fi",
-    "action_name": "设置 WiFi",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:16:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:16 handler.List",
-    "owner": "device",
-    "method": "GET",
-    "summary": "设备列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/device.go:172:POST:/by-identifier/:identifier/switch-card",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:172 handler.SwitchCard",
-    "owner": "device",
-    "method": "POST",
-    "path": "/by-identifier/:identifier/switch-card",
-    "summary": "切卡",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.switch_card",
-    "action_name": "切卡",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:181:POST:/by-identifier/:identifier/switch-mode",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:181 handler.SetSwitchMode",
-    "owner": "device",
-    "method": "POST",
-    "path": "/by-identifier/:identifier/switch-mode",
-    "summary": "设置切卡模式",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.set_switch_mode",
-    "action_name": "设置切卡模式",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:190:POST:/by-identifier/:identifier/reboot",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:190 handler.RebootDevice",
-    "owner": "device",
-    "method": "POST",
-    "path": "/by-identifier/:identifier/reboot",
-    "summary": "重启设备",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.reboot_device",
-    "action_name": "重启设备",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:199:POST:/by-identifier/:identifier/reset",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:199 handler.ResetDevice",
-    "owner": "device",
-    "method": "POST",
-    "path": "/by-identifier/:identifier/reset",
-    "summary": "恢复出厂",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.reset_device",
-    "action_name": "恢复出厂",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:24:POST:/batch-update-realname-policy",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:24 handler.BatchUpdateRealnamePolicy",
-    "owner": "device",
-    "method": "POST",
-    "path": "/batch-update-realname-policy",
-    "summary": "批量更新设备实名认证策略",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.batch_update_realname_policy",
-    "action_name": "批量更新设备实名认证策略",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:33:DELETE:/:virtual_no",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:33 handler.Delete",
-    "owner": "device",
-    "method": "DELETE",
-    "path": "/:virtual_no",
-    "summary": "删除设备",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.delete",
-    "action_name": "删除设备",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:42:GET:/:virtual_no/cards",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:42 handler.ListCards",
-    "owner": "device",
-    "method": "GET",
-    "path": "/:virtual_no/cards",
-    "summary": "获取设备绑定的卡列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/device.go:50:POST:/:virtual_no/cards",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:50 handler.BindCard",
-    "owner": "device",
-    "method": "POST",
-    "path": "/:virtual_no/cards",
-    "summary": "绑定卡到设备",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.bind_card",
-    "action_name": "绑定卡到设备",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:59:DELETE:/:virtual_no/cards/:iccid",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:59 handler.UnbindCard",
-    "owner": "device",
-    "method": "DELETE",
-    "path": "/:virtual_no/cards/:iccid",
-    "summary": "解绑设备上的卡",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.unbind_card",
-    "action_name": "解绑设备上的卡",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:68:POST:/allocate",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:68 handler.Allocate",
-    "owner": "device",
-    "method": "POST",
-    "path": "/allocate",
-    "summary": "批量分配设备",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.allocate",
-    "action_name": "批量分配设备",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:77:POST:/recall",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:77 handler.Recall",
-    "owner": "device",
-    "method": "POST",
-    "path": "/recall",
-    "summary": "批量回收设备",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.recall",
-    "action_name": "批量回收设备",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/device.go:86:POST:/import",
-    "kind": "http",
-    "code_entry": "internal/routes/device.go:86 importHandler.Import",
-    "owner": "device",
-    "method": "POST",
-    "path": "/import",
-    "summary": "批量导入设备",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "device.import",
-    "action_name": "批量导入设备",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise.go:15:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise.go:15 handler.Create",
-    "owner": "enterprise",
-    "method": "POST",
-    "summary": "新增企业客户",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise.create",
-    "action_name": "新增企业客户",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "enterprise",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise.go:23:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise.go:23 handler.List",
-    "owner": "enterprise",
-    "method": "GET",
-    "summary": "查询企业客户列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/enterprise.go:31:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise.go:31 handler.Update",
-    "owner": "enterprise",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "编辑企业信息",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise.update",
-    "action_name": "编辑企业信息",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "enterprise",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise.go:39:PUT:/:id/status",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise.go:39 handler.UpdateStatus",
-    "owner": "enterprise",
-    "method": "PUT",
-    "path": "/:id/status",
-    "summary": "启用/禁用企业",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise.update_status",
-    "action_name": "启用/禁用企业",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "enterprise",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise.go:47:PUT:/:id/password",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise.go:47 handler.UpdatePassword",
-    "owner": "enterprise",
-    "method": "PUT",
-    "path": "/:id/password",
-    "summary": "修改企业账号密码",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise.update_password",
-    "action_name": "修改企业账号密码",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "enterprise",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise_card.go:15:POST:/:id/allocate-cards",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise_card.go:15 handler.AllocateCards",
-    "owner": "enterprise_card",
-    "method": "POST",
-    "path": "/:id/allocate-cards",
-    "summary": "授权卡给企业",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise_card.allocate_cards",
-    "action_name": "授权卡给企业",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise_card.go:23:POST:/:id/recall-cards",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise_card.go:23 handler.RecallCards",
-    "owner": "enterprise_card",
-    "method": "POST",
-    "path": "/:id/recall-cards",
-    "summary": "回收卡授权",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise_card.recall_cards",
-    "action_name": "回收卡授权",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise_card.go:31:GET:/:id/cards",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise_card.go:31 handler.ListCards",
-    "owner": "enterprise_card",
-    "method": "GET",
-    "path": "/:id/cards",
-    "summary": "企业卡列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/enterprise_device.go:15:POST:/:id/allocate-devices",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise_device.go:15 handler.AllocateDevices",
-    "owner": "enterprise_device",
-    "method": "POST",
-    "path": "/:id/allocate-devices",
-    "summary": "授权设备给企业",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise_device.allocate_devices",
-    "action_name": "授权设备给企业",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise_device.go:23:POST:/:id/recall-devices",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise_device.go:23 handler.RecallDevices",
-    "owner": "enterprise_device",
-    "method": "POST",
-    "path": "/:id/recall-devices",
-    "summary": "撤销设备授权",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "enterprise_device.recall_devices",
-    "action_name": "撤销设备授权",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_device",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/enterprise_device.go:31:GET:/:id/devices",
-    "kind": "http",
-    "code_entry": "internal/routes/enterprise_device.go:31 handler.ListDevices",
-    "owner": "enterprise_device",
-    "method": "GET",
-    "path": "/:id/devices",
-    "summary": "企业设备列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/exchange.go:11:POST:/exchanges",
-    "kind": "http",
-    "code_entry": "internal/routes/exchange.go:11 handler.Create",
-    "owner": "exchange",
-    "method": "POST",
-    "path": "/exchanges",
-    "summary": "创建换货单",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "exchange.create",
-    "action_name": "创建换货单",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/exchange.go:19:GET:/exchanges",
-    "kind": "http",
-    "code_entry": "internal/routes/exchange.go:19 handler.List",
-    "owner": "exchange",
-    "method": "GET",
-    "path": "/exchanges",
-    "summary": "获取换货单列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/exchange.go:27:GET:/exchanges/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/exchange.go:27 handler.Get",
-    "owner": "exchange",
-    "method": "GET",
-    "path": "/exchanges/:id",
-    "summary": "获取换货单详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/exchange.go:35:POST:/exchanges/:id/ship",
-    "kind": "http",
-    "code_entry": "internal/routes/exchange.go:35 handler.Ship",
-    "owner": "exchange",
-    "method": "POST",
-    "path": "/exchanges/:id/ship",
-    "summary": "换货发货",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "exchange.ship",
-    "action_name": "换货发货",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/exchange.go:43:POST:/exchanges/:id/complete",
-    "kind": "http",
-    "code_entry": "internal/routes/exchange.go:43 handler.Complete",
-    "owner": "exchange",
-    "method": "POST",
-    "path": "/exchanges/:id/complete",
-    "summary": "确认换货完成",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "exchange.complete",
-    "action_name": "确认换货完成",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/exchange.go:51:POST:/exchanges/:id/cancel",
-    "kind": "http",
-    "code_entry": "internal/routes/exchange.go:51 handler.Cancel",
-    "owner": "exchange",
-    "method": "POST",
-    "path": "/exchanges/:id/cancel",
-    "summary": "取消换货",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "exchange.cancel",
-    "action_name": "取消换货",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/exchange.go:59:POST:/exchanges/:id/renew",
-    "kind": "http",
-    "code_entry": "internal/routes/exchange.go:59 handler.Renew",
-    "owner": "exchange",
-    "method": "POST",
-    "path": "/exchanges/:id/renew",
-    "summary": "旧资产转新",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "exchange.renew",
-    "action_name": "旧资产转新",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/export_task.go:15:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/export_task.go:15 handler.Create",
-    "owner": "export_task",
-    "method": "POST",
-    "summary": "创建导出任务",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "export_task.create",
-    "action_name": "创建导出任务",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_task",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/export_task.go:24:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/export_task.go:24 handler.List",
-    "owner": "export_task",
-    "method": "GET",
-    "summary": "导出任务列表",
-    "audit_event": "N/A",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/export_task.go:33:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/export_task.go:33 handler.GetByID",
-    "owner": "export_task",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "导出任务详情",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "export_task.get_by_i_d",
-    "action_name": "导出任务详情",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_task",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/export_task.go:42:POST:/:id/cancel",
-    "kind": "http",
-    "code_entry": "internal/routes/export_task.go:42 handler.Cancel",
-    "owner": "export_task",
-    "method": "POST",
-    "path": "/:id/cancel",
-    "summary": "取消导出任务",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "export_task.cancel",
-    "action_name": "取消导出任务",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_task",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/health.go:16:GET:/health",
-    "kind": "http",
-    "code_entry": "internal/routes/health.go:16 *ast.FuncLit",
-    "owner": "health",
-    "method": "GET",
-    "path": "/health",
-    "summary": "健康检查",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/health.go:29:GET:/ready",
-    "kind": "http",
-    "code_entry": "internal/routes/health.go:29 *ast.FuncLit",
-    "owner": "health",
-    "method": "GET",
-    "path": "/ready",
-    "summary": "就绪检查",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:105:POST:/standalone/recall",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:105 handler.RecallCards",
-    "owner": "iot_card",
-    "method": "POST",
-    "path": "/standalone/recall",
-    "summary": "批量回收单卡",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "iot_card.recall_cards",
-    "action_name": "批量回收单卡",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:113:PATCH:/series-binding",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:113 handler.BatchSetSeriesBinding",
-    "owner": "iot_card",
-    "method": "PATCH",
-    "path": "/series-binding",
-    "summary": "批量设置卡的套餐系列绑定",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "iot_card.batch_set_series_binding",
-    "action_name": "批量设置卡的套餐系列绑定",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:122:GET:/:iccid/realname-link",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:122 handler.GetRealnameLink",
-    "owner": "iot_card",
-    "method": "GET",
-    "path": "/:iccid/realname-link",
-    "summary": "获取实名认证链接",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "iot_card.get_realname_link",
-    "action_name": "获取实名认证链接",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:130:PUT:/:iccid/speed-tier",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:130 handler.SetSpeedTier",
-    "owner": "iot_card",
-    "method": "PUT",
-    "path": "/:iccid/speed-tier",
-    "summary": "设置卡固定限速档位",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "iot_card.set_speed_tier",
-    "action_name": "设置卡固定限速档位",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:16:GET:/standalone",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:16 handler.ListStandalone",
-    "owner": "iot_card",
-    "method": "GET",
-    "path": "/standalone",
-    "summary": "单卡列表（未绑定设备）",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:24:POST:/batch-update-realname-policy",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:24 handler.BatchUpdateRealnamePolicy",
-    "owner": "iot_card",
-    "method": "POST",
-    "path": "/batch-update-realname-policy",
-    "summary": "批量更新卡实名认证策略",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "iot_card.batch_update_realname_policy",
-    "action_name": "批量更新卡实名认证策略",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:33:POST:/import",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:33 importHandler.Import",
-    "owner": "iot_card",
-    "method": "POST",
-    "path": "/import",
-    "summary": "批量导入IoT卡（ICCID+MSISDN）",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "iot_card.import",
-    "action_name": "批量导入IoT卡（ICCID+MSISDN）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:79:GET:/import-tasks",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:79 importHandler.List",
-    "owner": "iot_card",
-    "method": "GET",
-    "path": "/import-tasks",
-    "summary": "导入任务列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:88:GET:/import-tasks/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:88 importHandler.GetByID",
-    "owner": "iot_card",
-    "method": "GET",
-    "path": "/import-tasks/:id",
-    "summary": "导入任务详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/iot_card.go:97:POST:/standalone/allocate",
-    "kind": "http",
-    "code_entry": "internal/routes/iot_card.go:97 handler.AllocateCards",
-    "owner": "iot_card",
-    "method": "POST",
-    "path": "/standalone/allocate",
-    "summary": "批量分配单卡",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "iot_card.allocate_cards",
-    "action_name": "批量分配单卡",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/notification.go:17:GET:/unread-count",
-    "kind": "http",
-    "code_entry": "internal/routes/notification.go:17 handler.UnreadCount",
-    "owner": "notification",
-    "method": "GET",
-    "path": "/unread-count",
-    "summary": "查询通知未读数",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/notification.go:25:GET:/unread-summary",
-    "kind": "http",
-    "code_entry": "internal/routes/notification.go:25 handler.UnreadSummary",
-    "owner": "notification",
-    "method": "GET",
-    "path": "/unread-summary",
-    "summary": "查询通知未读分类汇总",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/notification.go:33:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/notification.go:33 handler.List",
-    "owner": "notification",
-    "method": "GET",
-    "summary": "查询通知列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/notification.go:42:PUT:/read-all",
-    "kind": "http",
-    "code_entry": "internal/routes/notification.go:42 handler.MarkAllRead",
-    "owner": "notification",
-    "method": "PUT",
-    "path": "/read-all",
-    "summary": "批量标记通知已读",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "notification.mark_all_read",
-    "action_name": "批量标记通知已读",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "notification",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/notification.go:51:GET:/:id/target",
-    "kind": "http",
-    "code_entry": "internal/routes/notification.go:51 handler.Target",
-    "owner": "notification",
-    "method": "GET",
-    "path": "/:id/target",
-    "summary": "解析通知受控目标",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/notification.go:60:PUT:/:id/read",
-    "kind": "http",
-    "code_entry": "internal/routes/notification.go:60 handler.MarkRead",
-    "owner": "notification",
-    "method": "PUT",
-    "path": "/:id/read",
-    "summary": "标记单条通知已读",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "notification.mark_read",
-    "action_name": "标记单条通知已读",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "notification",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/open.go:103:POST:/cards/resume",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:103 handler.ResumeCard",
-    "owner": "open",
-    "method": "POST",
-    "path": "/cards/resume",
-    "summary": "机卡分离卡复机",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "open.resume_card",
-    "action_name": "机卡分离卡复机",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "open",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/open.go:112:GET:/packages",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:112 handler.ListPackages",
-    "owner": "open",
-    "method": "GET",
-    "path": "/packages",
-    "summary": "查询套餐列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/open.go:121:POST:/wallet/package-orders",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:121 handler.CreateWalletPackageOrders",
-    "owner": "open",
-    "method": "POST",
-    "path": "/wallet/package-orders",
-    "summary": "钱包套餐购买",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "open.create_wallet_package_orders",
-    "action_name": "钱包套餐购买",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "open",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/open.go:130:GET:/wallet/balance",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:130 handler.GetWalletBalance",
-    "owner": "open",
-    "method": "GET",
-    "path": "/wallet/balance",
-    "summary": "查询预充值钱包余额",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/open.go:138:GET:/wallet/transactions",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:138 handler.ListWalletTransactions",
-    "owner": "open",
-    "method": "GET",
-    "path": "/wallet/transactions",
-    "summary": "查询预充值钱包流水",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/open.go:147:GET:/devices/traffic",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:147 handler.GetDeviceTraffic",
-    "owner": "open",
-    "method": "GET",
-    "path": "/devices/traffic",
-    "summary": "查询设备套餐内流量",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/open.go:156:POST:/devices/switch-card",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:156 handler.SwitchDeviceCard",
-    "owner": "open",
-    "method": "POST",
-    "path": "/devices/switch-card",
-    "summary": "切网（多卡设备切换 ICCID）",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "open.switch_device_card",
-    "action_name": "切网（多卡设备切换 ICCID）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "open",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/open.go:164:POST:/devices/reboot",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:164 handler.RebootDevice",
-    "owner": "open",
-    "method": "POST",
-    "path": "/devices/reboot",
-    "summary": "重启设备",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "open.reboot_device",
-    "action_name": "重启设备",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "open",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/open.go:172:POST:/devices/reset",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:172 handler.ResetDevice",
-    "owner": "open",
-    "method": "POST",
-    "path": "/devices/reset",
-    "summary": "恢复出厂设置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "open.reset_device",
-    "action_name": "恢复出厂设置",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "open",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/open.go:76:GET:/cards/traffic",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:76 handler.GetCardTraffic",
-    "owner": "open",
-    "method": "GET",
-    "path": "/cards/traffic",
-    "summary": "查询单卡或设备流量",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/open.go:85:GET:/cards/status",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:85 handler.GetCardStatus",
-    "owner": "open",
-    "method": "GET",
-    "path": "/cards/status",
-    "summary": "查询单卡状态",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/open.go:94:GET:/cards/realname-status",
-    "kind": "http",
-    "code_entry": "internal/routes/open.go:94 handler.GetRealnameStatus",
-    "owner": "open",
-    "method": "GET",
-    "path": "/cards/realname-status",
-    "summary": "查询单卡实名状态",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/order.go:101:POST:/alipay",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:101 handler.AlipayCallback",
-    "owner": "order",
-    "method": "POST",
-    "path": "/alipay",
-    "summary": "支付宝回调",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.alipay_callback",
-    "action_name": "支付宝回调",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:109:POST:/fuiou-pay",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:109 handler.FuiouPayCallback",
-    "owner": "order",
-    "method": "POST",
-    "path": "/fuiou-pay",
-    "summary": "富友支付回调",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.fuiou_pay_callback",
-    "action_name": "富友支付回调",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:14:POST:/orders",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:14 handler.Create",
-    "owner": "order",
-    "method": "POST",
-    "path": "/orders",
-    "summary": "创建订单",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.create",
-    "action_name": "创建订单",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:22:GET:/orders",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:22 handler.List",
-    "owner": "order",
-    "method": "GET",
-    "path": "/orders",
-    "summary": "获取订单列表",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/order.go:30:GET:/orders/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:30 handler.Get",
-    "owner": "order",
-    "method": "GET",
-    "path": "/orders/:id",
-    "summary": "获取订单详情",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/order.go:38:POST:/orders/:id/cancel",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:38 handler.Cancel",
-    "owner": "order",
-    "method": "POST",
-    "path": "/orders/:id/cancel",
-    "summary": "取消订单",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.cancel",
-    "action_name": "取消订单",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:46:POST:/orders/purchase-check",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:46 handler.PurchaseCheck",
-    "owner": "order",
-    "method": "POST",
-    "path": "/orders/purchase-check",
-    "summary": "套餐购买预检",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/order.go:57:POST:/carriers/ctcc/realname",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:57 handler.Realname",
-    "owner": "order",
-    "method": "POST",
-    "path": "/carriers/ctcc/realname",
-    "summary": "电信实名结果回调",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.realname",
-    "action_name": "电信实名结果回调",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:69:POST:/carriers/cmcc/realname",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:69 handler.Realname",
-    "owner": "order",
-    "method": "POST",
-    "path": "/carriers/cmcc/realname",
-    "summary": "移动实名结果回调",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.realname",
-    "action_name": "移动实名结果回调",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:77:POST:/carriers/cucc/realname",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:77 handler.Realname",
-    "owner": "order",
-    "method": "POST",
-    "path": "/carriers/cucc/realname",
-    "summary": "联通实名结果回调",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.realname",
-    "action_name": "联通实名结果回调",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:85:POST:/carriers/cucc/realname/remove",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:85 handler.Remove",
-    "owner": "order",
-    "method": "POST",
-    "path": "/carriers/cucc/realname/remove",
-    "summary": "联通解除实名回调",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.remove",
-    "action_name": "联通解除实名回调",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order.go:93:POST:/wechat-pay",
-    "kind": "http",
-    "code_entry": "internal/routes/order.go:93 handler.WechatPayCallback",
-    "owner": "order",
-    "method": "POST",
-    "path": "/wechat-pay",
-    "summary": "微信支付回调",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order.wechat_pay_callback",
-    "action_name": "微信支付回调",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order_package_invalidate.go:16:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/order_package_invalidate.go:16 handler.Create",
-    "owner": "order_package_invalidate",
-    "method": "POST",
-    "summary": "创建订单套餐批量失效任务",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "order_package_invalidate.create",
-    "action_name": "创建订单套餐批量失效任务",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order_package_invalidate",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/order_package_invalidate.go:25:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/order_package_invalidate.go:25 handler.List",
-    "owner": "order_package_invalidate",
-    "method": "GET",
-    "summary": "查询订单套餐失效任务列表",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/order_package_invalidate.go:33:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/order_package_invalidate.go:33 handler.GetByID",
-    "owner": "order_package_invalidate",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "查询订单套餐失效任务详情",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/package.go:15:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:15 handler.List",
-    "owner": "package",
-    "method": "GET",
-    "summary": "套餐列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/package.go:23:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:23 handler.Create",
-    "owner": "package",
-    "method": "POST",
-    "summary": "创建套餐",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package.create",
-    "action_name": "创建套餐",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package.go:31:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:31 handler.Get",
-    "owner": "package",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取套餐详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/package.go:39:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:39 handler.Update",
-    "owner": "package",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新套餐",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package.update",
-    "action_name": "更新套餐",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package.go:47:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:47 handler.Delete",
-    "owner": "package",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除套餐",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package.delete",
-    "action_name": "删除套餐",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package.go:55:PATCH:/:id/status",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:55 handler.UpdateStatus",
-    "owner": "package",
-    "method": "PATCH",
-    "path": "/:id/status",
-    "summary": "更新套餐状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package.update_status",
-    "action_name": "更新套餐状态",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package.go:63:PATCH:/:id/shelf",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:63 handler.UpdateShelfStatus",
-    "owner": "package",
-    "method": "PATCH",
-    "path": "/:id/shelf",
-    "summary": "更新套餐上架状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package.update_shelf_status",
-    "action_name": "更新套餐上架状态",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package.go:71:PATCH:/:id/retail-price",
-    "kind": "http",
-    "code_entry": "internal/routes/package.go:71 handler.UpdateRetailPrice",
-    "owner": "package",
-    "method": "PATCH",
-    "path": "/:id/retail-price",
-    "summary": "修改零售价（代理）",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package.update_retail_price",
-    "action_name": "修改零售价（代理）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package_expiry.go:13:GET:/expiring-assets",
-    "kind": "http",
-    "code_entry": "internal/routes/package_expiry.go:13 handler.ListExpiring",
-    "owner": "package_expiry",
-    "method": "GET",
-    "path": "/expiring-assets",
-    "summary": "查询临期资产列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/package_expiry.go:22:POST:/expiring-assets/reminder-scan",
-    "kind": "http",
-    "code_entry": "internal/routes/package_expiry.go:22 handler.TriggerPackageExpiryReminder",
-    "owner": "package_expiry",
-    "method": "POST",
-    "path": "/expiring-assets/reminder-scan",
-    "summary": "手动触发每日临期提醒扫描",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package_expiry.trigger_package_expiry_reminder",
-    "action_name": "手动触发每日临期提醒扫描",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_expiry",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package_series.go:15:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/package_series.go:15 handler.List",
-    "owner": "package_series",
-    "method": "GET",
-    "summary": "套餐系列列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/package_series.go:23:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/package_series.go:23 handler.Create",
-    "owner": "package_series",
-    "method": "POST",
-    "summary": "创建套餐系列",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package_series.create",
-    "action_name": "创建套餐系列",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package_series.go:31:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/package_series.go:31 handler.Get",
-    "owner": "package_series",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取套餐系列详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/package_series.go:39:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/package_series.go:39 handler.Update",
-    "owner": "package_series",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新套餐系列",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package_series.update",
-    "action_name": "更新套餐系列",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package_series.go:47:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/package_series.go:47 handler.Delete",
-    "owner": "package_series",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除套餐系列",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package_series.delete",
-    "action_name": "删除套餐系列",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package_series.go:55:PATCH:/:id/status",
-    "kind": "http",
-    "code_entry": "internal/routes/package_series.go:55 handler.UpdateStatus",
-    "owner": "package_series",
-    "method": "PATCH",
-    "path": "/:id/status",
-    "summary": "更新套餐系列状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "package_series.update_status",
-    "action_name": "更新套餐系列状态",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/package_usage.go:16:GET:/:id/daily-records",
-    "kind": "http",
-    "code_entry": "internal/routes/package_usage.go:16 handler.GetDailyRecords",
-    "owner": "package_usage",
-    "method": "GET",
-    "path": "/:id/daily-records",
-    "summary": "获取套餐流量详单",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/permission.go:17:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/permission.go:17 h.Create",
-    "owner": "permission",
-    "method": "POST",
-    "summary": "创建权限",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "permission.create",
-    "action_name": "创建权限",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "permission",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/permission.go:25:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/permission.go:25 h.List",
-    "owner": "permission",
-    "method": "GET",
-    "summary": "权限列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/permission.go:33:GET:/tree",
-    "kind": "http",
-    "code_entry": "internal/routes/permission.go:33 h.GetTree",
-    "owner": "permission",
-    "method": "GET",
-    "path": "/tree",
-    "summary": "获取权限树",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/permission.go:41:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/permission.go:41 h.Get",
-    "owner": "permission",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取权限详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/permission.go:49:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/permission.go:49 h.Update",
-    "owner": "permission",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新权限",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "permission.update",
-    "action_name": "更新权限",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "permission",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/permission.go:57:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/permission.go:57 h.Delete",
-    "owner": "permission",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除权限",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "permission.delete",
-    "action_name": "删除权限",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "permission",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:107:POST:/logout",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:107 handlers.ClientAuth.Logout",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/logout",
-    "summary": "退出登录",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.logout",
-    "action_name": "退出登录",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:123:GET:/profile",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:123 handlers.PersonalCustomer.GetProfile",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/profile",
-    "summary": "获取个人资料",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:133:PUT:/profile",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:133 handlers.PersonalCustomer.UpdateProfile",
-    "owner": "personal",
-    "method": "PUT",
-    "path": "/profile",
-    "summary": "更新个人资料",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.update_profile",
-    "action_name": "更新个人资料",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:142:GET:/asset/info",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:142 handlers.ClientAsset.GetAssetInfo",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/asset/info",
-    "summary": "资产信息",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:150:GET:/asset/packages",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:150 handlers.ClientAsset.GetAvailablePackages",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/asset/packages",
-    "summary": "资产可购套餐列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:158:GET:/asset/package-history",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:158 handlers.ClientAsset.GetPackageHistory",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/asset/package-history",
-    "summary": "资产套餐历史",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:166:POST:/asset/refresh",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:166 handlers.ClientAsset.RefreshAsset",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/asset/refresh",
-    "summary": "资产刷新",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.refresh_asset",
-    "action_name": "资产刷新",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:174:GET:/wallet/detail",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:174 handlers.ClientWallet.GetWalletDetail",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/wallet/detail",
-    "summary": "钱包详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:182:GET:/wallet/transactions",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:182 handlers.ClientWallet.GetWalletTransactions",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/wallet/transactions",
-    "summary": "钱包流水列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:190:GET:/wallet/recharge-check",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:190 handlers.ClientWallet.GetRechargeCheck",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/wallet/recharge-check",
-    "summary": "充值前校验",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:198:POST:/wallet/recharge",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:198 handlers.ClientWallet.CreateRecharge",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/wallet/recharge",
-    "summary": "创建充值订单",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.create_recharge",
-    "action_name": "创建充值订单",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:206:GET:/wallet/recharges",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:206 handlers.ClientWallet.GetRechargeList",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/wallet/recharges",
-    "summary": "充值记录列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:214:GET:/recharge-orders",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:214 handlers.ClientRechargeOrder.ListRechargeOrders",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/recharge-orders",
-    "summary": "充值订单列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:222:GET:/recharge-orders/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:222 handlers.ClientRechargeOrder.GetRechargeOrderDetail",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/recharge-orders/:id",
-    "summary": "充值订单详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:230:POST:/orders/create",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:230 handlers.ClientOrder.CreateOrder",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/orders/create",
-    "summary": "创建订单",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.create_order",
-    "action_name": "创建订单",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:238:GET:/orders",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:238 handlers.ClientOrder.ListOrders",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/orders",
-    "summary": "订单列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:246:GET:/orders/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:246 handlers.ClientOrder.GetOrderDetail",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/orders/:id",
-    "summary": "订单详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:254:POST:/orders/:id/pay",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:254 handlers.ClientOrder.PayOrder",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/orders/:id/pay",
-    "summary": "订单支付",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.pay_order",
-    "action_name": "订单支付",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:25:GET:/wechat/appid",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:25 handlers.ClientWechat.GetAppID",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/wechat/appid",
-    "summary": "获取当前生效的公众号 AppID",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:262:GET:/exchange/pending",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:262 handlers.ClientExchange.GetPending",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/exchange/pending",
-    "summary": "查询待处理换货单",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:270:POST:/exchange/:id/shipping-info",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:270 handlers.ClientExchange.SubmitShippingInfo",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/exchange/:id/shipping-info",
-    "summary": "提交收货信息",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.submit_shipping_info",
-    "action_name": "提交收货信息",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:278:GET:/realname/link",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:278 handlers.ClientRealname.GetRealnameLink",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/realname/link",
-    "summary": "获取实名认证链接",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.get_realname_link",
-    "action_name": "获取实名认证链接",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:286:GET:/device/cards",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:286 handlers.ClientDevice.GetDeviceCards",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/device/cards",
-    "summary": "获取设备卡列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:294:POST:/device/reboot",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:294 handlers.ClientDevice.RebootDevice",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/device/reboot",
-    "summary": "设备重启",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.reboot_device",
-    "action_name": "设备重启",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:302:POST:/device/factory-reset",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:302 handlers.ClientDevice.FactoryResetDevice",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/device/factory-reset",
-    "summary": "恢复出厂设置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.factory_reset_device",
-    "action_name": "恢复出厂设置",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:310:POST:/device/wifi",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:310 handlers.ClientDevice.SetWiFi",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/device/wifi",
-    "summary": "设备WiFi配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.set_wi_fi",
-    "action_name": "设备WiFi配置",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:318:POST:/device/switch-card",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:318 handlers.ClientDevice.SwitchCard",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/device/switch-card",
-    "summary": "设备切卡",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.switch_card",
-    "action_name": "设备切卡",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:34:GET:/wechat/jssdk-config",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:34 handlers.ClientWechat.GetJSSDKConfig",
-    "owner": "personal",
-    "method": "GET",
-    "path": "/wechat/jssdk-config",
-    "summary": "获取微信 JSSDK 签名配置",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:43:POST:authBasePath+\"/verify-asset\"",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:43 handlers.ClientAuth.VerifyAsset",
-    "owner": "personal",
-    "method": "POST",
-    "path": "authBasePath+\"/verify-asset\"",
-    "summary": "资产验证",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal.go:51:POST:authBasePath+\"/wechat-login\"",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:51 handlers.ClientAuth.WechatLogin",
-    "owner": "personal",
-    "method": "POST",
-    "path": "authBasePath+\"/wechat-login\"",
-    "summary": "公众号登录",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.wechat_login",
-    "action_name": "公众号登录",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:59:POST:authBasePath+\"/miniapp-login\"",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:59 handlers.ClientAuth.MiniappLogin",
-    "owner": "personal",
-    "method": "POST",
-    "path": "authBasePath+\"/miniapp-login\"",
-    "summary": "小程序登录",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.miniapp_login",
-    "action_name": "小程序登录",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:67:POST:authBasePath+\"/send-code\"",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:67 handlers.ClientAuth.SendCode",
-    "owner": "personal",
-    "method": "POST",
-    "path": "authBasePath+\"/send-code\"",
-    "summary": "发送验证码",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.send_code",
-    "action_name": "发送验证码",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:77:POST:authBasePath+\"/dev-login\"",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:77 handlers.ClientAuth.DevLogin",
-    "owner": "personal",
-    "method": "POST",
-    "path": "authBasePath+\"/dev-login\"",
-    "summary": "开发环境测试登录",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.dev_login",
-    "action_name": "开发环境测试登录",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:91:POST:/bind-phone",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:91 handlers.ClientAuth.BindPhone",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/bind-phone",
-    "summary": "绑定手机号",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.bind_phone",
-    "action_name": "绑定手机号",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal.go:99:POST:/change-phone",
-    "kind": "http",
-    "code_entry": "internal/routes/personal.go:99 handlers.ClientAuth.ChangePhone",
-    "owner": "personal",
-    "method": "POST",
-    "path": "/change-phone",
-    "summary": "更换手机号",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal.change_phone",
-    "action_name": "更换手机号",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "personal_customer/personal_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal_notification.go:16:GET:/unread-count",
-    "kind": "http",
-    "code_entry": "internal/routes/personal_notification.go:16 handler.UnreadCount",
-    "owner": "personal_notification",
-    "method": "GET",
-    "path": "/unread-count",
-    "summary": "查询个人客户通知未读数",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal_notification.go:24:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/personal_notification.go:24 handler.List",
-    "owner": "personal_notification",
-    "method": "GET",
-    "summary": "查询个人客户通知列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/personal_notification.go:34:PUT:/read-all",
-    "kind": "http",
-    "code_entry": "internal/routes/personal_notification.go:34 handler.MarkAllRead",
-    "owner": "personal_notification",
-    "method": "PUT",
-    "path": "/read-all",
-    "summary": "全部标记个人客户通知已读",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal_notification.mark_all_read",
-    "action_name": "全部标记个人客户通知已读",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal_notification",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/personal_notification.go:42:PUT:/:id/read",
-    "kind": "http",
-    "code_entry": "internal/routes/personal_notification.go:42 handler.MarkRead",
-    "owner": "personal_notification",
-    "method": "PUT",
-    "path": "/:id/read",
-    "summary": "标记个人客户单条通知已读",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "personal_notification.mark_read",
-    "action_name": "标记个人客户单条通知已读",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal_notification",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "当前个人客户本人范围内可见",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_alert.go:17:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_alert.go:17 handler.CreateRule",
-    "owner": "polling_alert",
-    "method": "POST",
-    "summary": "创建轮询告警规则",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_alert.create_rule",
-    "action_name": "创建轮询告警规则",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_alert",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_alert.go:25:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_alert.go:25 handler.ListRules",
-    "owner": "polling_alert",
-    "method": "GET",
-    "summary": "获取轮询告警规则列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_alert.go:33:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_alert.go:33 handler.GetRule",
-    "owner": "polling_alert",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取轮询告警规则详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_alert.go:41:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_alert.go:41 handler.UpdateRule",
-    "owner": "polling_alert",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新轮询告警规则",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_alert.update_rule",
-    "action_name": "更新轮询告警规则",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_alert",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_alert.go:49:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_alert.go:49 handler.DeleteRule",
-    "owner": "polling_alert",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除轮询告警规则",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_alert.delete_rule",
-    "action_name": "删除轮询告警规则",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_alert",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_alert.go:59:GET:/polling-alert-history",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_alert.go:59 handler.ListHistory",
-    "owner": "polling_alert",
-    "method": "GET",
-    "path": "/polling-alert-history",
-    "summary": "获取轮询告警历史",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:17:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:17 handler.CreateConfig",
-    "owner": "polling_cleanup",
-    "method": "POST",
-    "summary": "创建数据清理配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_cleanup.create_config",
-    "action_name": "创建数据清理配置",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_cleanup",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:25:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:25 handler.ListConfigs",
-    "owner": "polling_cleanup",
-    "method": "GET",
-    "summary": "获取数据清理配置列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:33:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:33 handler.GetConfig",
-    "owner": "polling_cleanup",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取数据清理配置详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:41:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:41 handler.UpdateConfig",
-    "owner": "polling_cleanup",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新数据清理配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_cleanup.update_config",
-    "action_name": "更新数据清理配置",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_cleanup",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:49:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:49 handler.DeleteConfig",
-    "owner": "polling_cleanup",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除数据清理配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_cleanup.delete_config",
-    "action_name": "删除数据清理配置",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_cleanup",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:58:GET:/data-cleanup-logs",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:58 handler.ListLogs",
-    "owner": "polling_cleanup",
-    "method": "GET",
-    "path": "/data-cleanup-logs",
-    "summary": "获取数据清理日志列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:67:GET:/data-cleanup/preview",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:67 handler.Preview",
-    "owner": "polling_cleanup",
-    "method": "GET",
-    "path": "/data-cleanup/preview",
-    "summary": "预览待清理数据",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:75:GET:/data-cleanup/progress",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:75 handler.GetProgress",
-    "owner": "polling_cleanup",
-    "method": "GET",
-    "path": "/data-cleanup/progress",
-    "summary": "获取数据清理进度",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_cleanup.go:83:POST:/data-cleanup/trigger",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_cleanup.go:83 handler.TriggerCleanup",
-    "owner": "polling_cleanup",
-    "method": "POST",
-    "path": "/data-cleanup/trigger",
-    "summary": "手动触发数据清理",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_cleanup.trigger_cleanup",
-    "action_name": "手动触发数据清理",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_cleanup",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_concurrency.go:16:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_concurrency.go:16 handler.List",
-    "owner": "polling_concurrency",
-    "method": "GET",
-    "summary": "获取轮询并发配置列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_concurrency.go:24:POST:/reset",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_concurrency.go:24 handler.Reset",
-    "owner": "polling_concurrency",
-    "method": "POST",
-    "path": "/reset",
-    "summary": "重置轮询并发计数",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_concurrency.reset",
-    "action_name": "重置轮询并发计数",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_concurrency",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_concurrency.go:32:GET:/:task_type",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_concurrency.go:32 handler.Get",
-    "owner": "polling_concurrency",
-    "method": "GET",
-    "path": "/:task_type",
-    "summary": "获取指定任务类型的并发配置",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_concurrency.go:40:PUT:/:task_type",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_concurrency.go:40 handler.Update",
-    "owner": "polling_concurrency",
-    "method": "PUT",
-    "path": "/:task_type",
-    "summary": "更新轮询并发配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_concurrency.update",
-    "action_name": "更新轮询并发配置",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_concurrency",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_config.go:16:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_config.go:16 handler.List",
-    "owner": "polling_config",
-    "method": "GET",
-    "summary": "获取轮询配置列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_config.go:24:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_config.go:24 handler.Create",
-    "owner": "polling_config",
-    "method": "POST",
-    "summary": "创建轮询配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_config.create",
-    "action_name": "创建轮询配置",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_config.go:32:GET:/enabled",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_config.go:32 handler.ListEnabled",
-    "owner": "polling_config",
-    "method": "GET",
-    "path": "/enabled",
-    "summary": "获取所有启用的配置",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_config.go:40:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_config.go:40 handler.Get",
-    "owner": "polling_config",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取轮询配置详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_config.go:48:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_config.go:48 handler.Update",
-    "owner": "polling_config",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新轮询配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_config.update",
-    "action_name": "更新轮询配置",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_config.go:56:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_config.go:56 handler.Delete",
-    "owner": "polling_config",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除轮询配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_config.delete",
-    "action_name": "删除轮询配置",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_config.go:64:PUT:/:id/status",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_config.go:64 handler.UpdateStatus",
-    "owner": "polling_config",
-    "method": "PUT",
-    "path": "/:id/status",
-    "summary": "更新轮询配置状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_config.update_status",
-    "action_name": "更新轮询配置状态",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_manual_trigger.go:16:POST:/single",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_manual_trigger.go:16 handler.TriggerSingle",
-    "owner": "polling_manual_trigger",
-    "method": "POST",
-    "path": "/single",
-    "summary": "单卡手动触发",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_manual_trigger.trigger_single",
-    "action_name": "单卡手动触发",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_manual_trigger",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_manual_trigger.go:24:POST:/batch",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_manual_trigger.go:24 handler.TriggerBatch",
-    "owner": "polling_manual_trigger",
-    "method": "POST",
-    "path": "/batch",
-    "summary": "批量手动触发",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_manual_trigger.trigger_batch",
-    "action_name": "批量手动触发",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_manual_trigger",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_manual_trigger.go:32:POST:/by-condition",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_manual_trigger.go:32 handler.TriggerByCondition",
-    "owner": "polling_manual_trigger",
-    "method": "POST",
-    "path": "/by-condition",
-    "summary": "条件筛选触发",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_manual_trigger.trigger_by_condition",
-    "action_name": "条件筛选触发",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_manual_trigger",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_manual_trigger.go:40:GET:/status",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_manual_trigger.go:40 handler.GetStatus",
-    "owner": "polling_manual_trigger",
-    "method": "GET",
-    "path": "/status",
-    "summary": "获取手动触发状态",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_manual_trigger.go:48:GET:/history",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_manual_trigger.go:48 handler.ListHistory",
-    "owner": "polling_manual_trigger",
-    "method": "GET",
-    "path": "/history",
-    "summary": "获取手动触发历史",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_manual_trigger.go:56:POST:/cancel",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_manual_trigger.go:56 handler.CancelTrigger",
-    "owner": "polling_manual_trigger",
-    "method": "POST",
-    "path": "/cancel",
-    "summary": "取消手动触发任务",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "polling_manual_trigger.cancel_trigger",
-    "action_name": "取消手动触发任务",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_manual_trigger",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/polling_monitoring.go:16:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_monitoring.go:16 handler.GetOverview",
-    "owner": "polling_monitoring",
-    "method": "GET",
-    "summary": "获取轮询总览统计",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_monitoring.go:24:GET:/queues",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_monitoring.go:24 handler.GetQueueStatuses",
-    "owner": "polling_monitoring",
-    "method": "GET",
-    "path": "/queues",
-    "summary": "获取轮询队列状态",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_monitoring.go:32:GET:/tasks",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_monitoring.go:32 handler.GetTaskStatuses",
-    "owner": "polling_monitoring",
-    "method": "GET",
-    "path": "/tasks",
-    "summary": "获取轮询任务统计",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/polling_monitoring.go:40:GET:/init-progress",
-    "kind": "http",
-    "code_entry": "internal/routes/polling_monitoring.go:40 handler.GetInitProgress",
-    "owner": "polling_monitoring",
-    "method": "GET",
-    "path": "/init-progress",
-    "summary": "获取轮询初始化进度",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/refund.go:28:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/refund.go:28 handler.Create",
-    "owner": "refund",
-    "method": "POST",
-    "summary": "创建退款申请",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "refund.create",
-    "action_name": "创建退款申请",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/refund.go:36:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/refund.go:36 handler.List",
-    "owner": "refund",
-    "method": "GET",
-    "summary": "退款申请列表",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/refund.go:44:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/refund.go:44 handler.GetByID",
-    "owner": "refund",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "退款申请详情",
-    "audit_event": "N/A",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/refund.go:52:POST:/:id/approve",
-    "kind": "http",
-    "code_entry": "internal/routes/refund.go:52 handler.Approve",
-    "owner": "refund",
-    "method": "POST",
-    "path": "/:id/approve",
-    "summary": "审批通过退款申请",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "refund.approve",
-    "action_name": "审批通过退款申请",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/refund.go:60:POST:/:id/reject",
-    "kind": "http",
-    "code_entry": "internal/routes/refund.go:60 handler.Reject",
-    "owner": "refund",
-    "method": "POST",
-    "path": "/:id/reject",
-    "summary": "审批拒绝退款申请",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "refund.reject",
-    "action_name": "审批拒绝退款申请",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/refund.go:68:POST:/:id/return",
-    "kind": "http",
-    "code_entry": "internal/routes/refund.go:68 handler.Return",
-    "owner": "refund",
-    "method": "POST",
-    "path": "/:id/return",
-    "summary": "退回退款申请",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "refund.return",
-    "action_name": "退回退款申请",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/refund.go:76:POST:/:id/resubmit",
-    "kind": "http",
-    "code_entry": "internal/routes/refund.go:76 handler.Resubmit",
-    "owner": "refund",
-    "method": "POST",
-    "path": "/:id/resubmit",
-    "summary": "重新提交退款申请",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "refund.resubmit",
-    "action_name": "重新提交退款申请",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:18:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:18 h.Create",
-    "owner": "role",
-    "method": "POST",
-    "summary": "创建角色",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.create",
-    "action_name": "创建角色",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:26:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:26 h.List",
-    "owner": "role",
-    "method": "GET",
-    "summary": "角色列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/role.go:34:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:34 h.Get",
-    "owner": "role",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取角色详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/role.go:42:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:42 h.Update",
-    "owner": "role",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新角色",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.update",
-    "action_name": "更新角色",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:50:PUT:/:id/status",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:50 h.UpdateStatus",
-    "owner": "role",
-    "method": "PUT",
-    "path": "/:id/status",
-    "summary": "更新角色状态",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.update_status",
-    "action_name": "更新角色状态",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:58:PUT:/:id/default-credit",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:58 h.UpdateDefaultCredit",
-    "owner": "role",
-    "method": "PUT",
-    "path": "/:id/default-credit",
-    "summary": "更新客户角色的新建代理默认信用模板",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.update_default_credit",
-    "action_name": "更新客户角色的新建代理默认信用模板",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:66:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:66 h.Delete",
-    "owner": "role",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除角色",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.delete",
-    "action_name": "删除角色",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:75:POST:/:id/permissions",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:75 h.AssignPermissions",
-    "owner": "role",
-    "method": "POST",
-    "path": "/:id/permissions",
-    "summary": "分配权限",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.assign_permissions",
-    "action_name": "分配权限",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:83:GET:/:id/permissions",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:83 h.GetPermissions",
-    "owner": "role",
-    "method": "GET",
-    "path": "/:id/permissions",
-    "summary": "获取角色权限",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/role.go:91:DELETE:/:role_id/permissions/:perm_id",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:91 h.RemovePermission",
-    "owner": "role",
-    "method": "DELETE",
-    "path": "/:role_id/permissions/:perm_id",
-    "summary": "移除权限",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.remove_permission",
-    "action_name": "移除权限",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/role.go:99:DELETE:/:role_id/permissions",
-    "kind": "http",
-    "code_entry": "internal/routes/role.go:99 h.BatchRemovePermissions",
-    "owner": "role",
-    "method": "DELETE",
-    "path": "/:role_id/permissions",
-    "summary": "批量移除权限",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "role.batch_remove_permissions",
-    "action_name": "批量移除权限",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:108:POST:/:shop_id/roles",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:108 handler.AssignShopRoles",
-    "owner": "shop",
-    "method": "POST",
-    "path": "/:shop_id/roles",
-    "summary": "分配店铺默认角色",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.assign_shop_roles",
-    "action_name": "分配店铺默认角色",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:116:GET:/:shop_id/roles",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:116 handler.GetShopRoles",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/:shop_id/roles",
-    "summary": "查询店铺默认角色",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:124:DELETE:/:shop_id/roles/:role_id",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:124 handler.DeleteShopRole",
-    "owner": "shop",
-    "method": "DELETE",
-    "path": "/:shop_id/roles/:role_id",
-    "summary": "删除店铺默认角色",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.delete_shop_role",
-    "action_name": "删除店铺默认角色",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:137:GET:/fund-summary",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:137 agentFundManagement",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/fund-summary",
-    "summary": "代理商资金概况",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:146:GET:/:shop_id/withdrawal-requests",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:146 handler.ListWithdrawalRequests",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/:shop_id/withdrawal-requests",
-    "summary": "代理商提现记录",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:154:GET:/:shop_id/commission-records",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:154 handler.ListCommissionRecords",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/:shop_id/commission-records",
-    "summary": "代理商佣金明细",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:162:GET:/:shop_id/main-wallet/transactions",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:162 handler.ListMainWalletTransactions",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/:shop_id/main-wallet/transactions",
-    "summary": "代理商预充值钱包流水",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:170:GET:/:shop_id/commission-stats",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:170 handler.GetCommissionStats",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/:shop_id/commission-stats",
-    "summary": "代理商佣金统计",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:178:GET:/:shop_id/commission-daily-stats",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:178 handler.GetCommissionDailyStats",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/:shop_id/commission-daily-stats",
-    "summary": "代理商每日佣金统计",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:186:POST:/:shop_id/withdrawal-requests",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:186 handler.CreateWithdrawal",
-    "owner": "shop",
-    "method": "POST",
-    "path": "/:shop_id/withdrawal-requests",
-    "summary": "发起提现申请",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.create_withdrawal",
-    "action_name": "发起提现申请",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:18:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:18 coreShopManagement",
-    "owner": "shop",
-    "method": "GET",
-    "summary": "店铺列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:197:POST:/:id/resolve",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:197 handler.ResolveCommissionRecord",
-    "owner": "shop",
-    "method": "POST",
-    "path": "/:id/resolve",
-    "summary": "修正待审佣金记录",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.resolve_commission_record",
-    "action_name": "修正待审佣金记录",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:27:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:27 coreShopManagement",
-    "owner": "shop",
-    "method": "POST",
-    "summary": "创建店铺",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.core_shop_management",
-    "action_name": "创建店铺",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:36:GET:/business-owner-candidates",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:36 coreShopManagement",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/business-owner-candidates",
-    "summary": "查询店铺业务员候选",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:45:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:45 coreShopManagement",
-    "owner": "shop",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新店铺",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.core_shop_management",
-    "action_name": "更新店铺",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:54:PUT:/:id/credit-limit",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:54 handler.UpdateCreditLimit",
-    "owner": "shop",
-    "method": "PUT",
-    "path": "/:id/credit-limit",
-    "summary": "调整既有店铺实际信用额度",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.update_credit_limit",
-    "action_name": "调整既有店铺实际信用额度",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:63:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:63 coreShopManagement",
-    "owner": "shop",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除店铺",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop.core_shop_management",
-    "action_name": "删除店铺",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop.go:72:GET:/cascade",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:72 coreShopManagement",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/cascade",
-    "summary": "店铺联级查询",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop.go:85:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/shop.go:85 coreShopManagement",
-    "owner": "shop",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "查询店铺详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop_package_batch_allocation.go:15:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_package_batch_allocation.go:15 handler.BatchAllocate",
-    "owner": "shop_package_batch_allocation",
-    "method": "POST",
-    "summary": "批量分配套餐",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop_package_batch_allocation.batch_allocate",
-    "action_name": "批量分配套餐",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_package_batch_allocation",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop_package_batch_allocation.go:23:PATCH:/shop-package-allocations/:id/expiry-base",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_package_batch_allocation.go:23 handler.UpdateExpiryBase",
-    "owner": "shop_package_batch_allocation",
-    "method": "PATCH",
-    "path": "/shop-package-allocations/:id/expiry-base",
-    "summary": "修改套餐分配生效条件覆盖",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop_package_batch_allocation.update_expiry_base",
-    "action_name": "修改套餐分配生效条件覆盖",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_package_batch_allocation",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop_package_batch_pricing.go:15:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_package_batch_pricing.go:15 handler.BatchUpdatePricing",
-    "owner": "shop_package_batch_pricing",
-    "method": "POST",
-    "summary": "批量调价",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop_package_batch_pricing.batch_update_pricing",
-    "action_name": "批量调价",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_package_batch_pricing",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop_series_grant.go:15:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_series_grant.go:15 handler.List",
-    "owner": "shop_series_grant",
-    "method": "GET",
-    "summary": "查询代理系列授权列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop_series_grant.go:23:GET:/package-options",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_series_grant.go:23 handler.ListPackageOptions",
-    "owner": "shop_series_grant",
-    "method": "GET",
-    "path": "/package-options",
-    "summary": "查询代理系列授权套餐候选项",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop_series_grant.go:32:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_series_grant.go:32 handler.Create",
-    "owner": "shop_series_grant",
-    "method": "POST",
-    "summary": "创建代理系列授权",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop_series_grant.create",
-    "action_name": "创建代理系列授权",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_series_grant",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop_series_grant.go:40:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_series_grant.go:40 handler.Get",
-    "owner": "shop_series_grant",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "查询代理系列授权详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/shop_series_grant.go:48:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_series_grant.go:48 handler.Update",
-    "owner": "shop_series_grant",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新代理系列授权",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop_series_grant.update",
-    "action_name": "更新代理系列授权",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_series_grant",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop_series_grant.go:56:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_series_grant.go:56 handler.Delete",
-    "owner": "shop_series_grant",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除代理系列授权",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop_series_grant.delete",
-    "action_name": "删除代理系列授权",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_series_grant",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/shop_series_grant.go:64:PUT:/:id/packages",
-    "kind": "http",
-    "code_entry": "internal/routes/shop_series_grant.go:64 handler.ManagePackages",
-    "owner": "shop_series_grant",
-    "method": "PUT",
-    "path": "/:id/packages",
-    "summary": "管理授权套餐（新增/更新/删除）",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "shop_series_grant.manage_packages",
-    "action_name": "管理授权套餐（新增/更新/删除）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_series_grant",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/storage.go:15:POST:/batch-download-urls",
-    "kind": "http",
-    "code_entry": "internal/routes/storage.go:15 handler.GetBatchDownloadURLs",
-    "owner": "storage",
-    "method": "POST",
-    "path": "/batch-download-urls",
-    "summary": "批量获取文件下载预签名 URL",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "storage.get_batch_download_u_r_ls",
-    "action_name": "批量获取文件下载预签名 URL",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "storage",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/storage.go:95:POST:/upload-url",
-    "kind": "http",
-    "code_entry": "internal/routes/storage.go:95 handler.GetUploadURL",
-    "owner": "storage",
-    "method": "POST",
-    "path": "/upload-url",
-    "summary": "获取文件上传预签名 URL",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "storage.get_upload_u_r_l",
-    "action_name": "获取文件上传预签名 URL",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "storage",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/super_admin.go:15:POST:/operation-password",
-    "kind": "http",
-    "code_entry": "internal/routes/super_admin.go:15 handler.SetOperationPassword",
-    "owner": "super_admin",
-    "method": "POST",
-    "path": "/operation-password",
-    "summary": "设置/修改全局操作密码",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "super_admin.set_operation_password",
-    "action_name": "设置/修改全局操作密码",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "super_admin",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/super_admin.go:22:GET:/operation-password/status",
-    "kind": "http",
-    "code_entry": "internal/routes/super_admin.go:22 handler.GetOperationPasswordStatus",
-    "owner": "super_admin",
-    "method": "GET",
-    "path": "/operation-password/status",
-    "summary": "查询操作密码是否已设置",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/system_config.go:16:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/system_config.go:16 handler.List",
-    "owner": "system_config",
-    "method": "GET",
-    "summary": "查询受控系统配置",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/system_config.go:24:PUT:/:key",
-    "kind": "http",
-    "code_entry": "internal/routes/system_config.go:24 handler.Update",
-    "owner": "system_config",
-    "method": "PUT",
-    "path": "/:key",
-    "summary": "更新受控系统配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "system_config.update",
-    "action_name": "更新受控系统配置",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "system_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:26:GET:/active",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:26 handler.GetActive",
-    "owner": "wechat_config",
-    "method": "GET",
-    "path": "/active",
-    "summary": "获取当前生效的支付配置",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:34:GET:",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:34 handler.List",
-    "owner": "wechat_config",
-    "method": "GET",
-    "summary": "获取支付配置列表",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:42:POST:",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:42 handler.Create",
-    "owner": "wechat_config",
-    "method": "POST",
-    "summary": "创建支付配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wechat_config.create",
-    "action_name": "创建支付配置",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:50:GET:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:50 handler.Get",
-    "owner": "wechat_config",
-    "method": "GET",
-    "path": "/:id",
-    "summary": "获取支付配置详情",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:58:PUT:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:58 handler.Update",
-    "owner": "wechat_config",
-    "method": "PUT",
-    "path": "/:id",
-    "summary": "更新支付配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wechat_config.update",
-    "action_name": "更新支付配置",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:66:DELETE:/:id",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:66 handler.Delete",
-    "owner": "wechat_config",
-    "method": "DELETE",
-    "path": "/:id",
-    "summary": "删除支付配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wechat_config.delete",
-    "action_name": "删除支付配置",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:74:POST:/:id/activate",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:74 handler.Activate",
-    "owner": "wechat_config",
-    "method": "POST",
-    "path": "/:id/activate",
-    "summary": "激活支付配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wechat_config.activate",
-    "action_name": "激活支付配置",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wechat_config.go:82:POST:/:id/deactivate",
-    "kind": "http",
-    "code_entry": "internal/routes/wechat_config.go:82 handler.Deactivate",
-    "owner": "wechat_config",
-    "method": "POST",
-    "path": "/:id/deactivate",
-    "summary": "停用支付配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wechat_config.deactivate",
-    "action_name": "停用支付配置",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:24:POST:/applications",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:24 handler.Save",
-    "owner": "wecom",
-    "method": "POST",
-    "path": "/applications",
-    "summary": "创建或更新企业微信应用配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom.save",
-    "action_name": "创建或更新企业微信应用配置",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:31:GET:/applications",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:31 handler.List",
-    "owner": "wecom",
-    "method": "GET",
-    "path": "/applications",
-    "summary": "查询企业微信应用配置",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom.list",
-    "action_name": "查询企业微信应用配置",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:38:POST:/applications/:id/test",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:38 handler.Test",
-    "owner": "wecom",
-    "method": "POST",
-    "path": "/applications/:id/test",
-    "summary": "测试企业微信应用连接",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom.test",
-    "action_name": "测试企业微信应用连接",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:45:PUT:/applications/:id/default-creator",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:45 handler.SaveDefaultCreator",
-    "owner": "wecom",
-    "method": "PUT",
-    "path": "/applications/:id/default-creator",
-    "summary": "保存企业微信应用默认审批发起人",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom.save_default_creator",
-    "action_name": "保存企业微信应用默认审批发起人",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:52:POST:/applications/:id/members/sync",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:52 handler.SyncMembers",
-    "owner": "wecom",
-    "method": "POST",
-    "path": "/applications/:id/members/sync",
-    "summary": "同步企业微信应用可见成员",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom.sync_members",
-    "action_name": "同步企业微信应用可见成员",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:59:GET:/applications/:id/members",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:59 handler.ListMembers",
-    "owner": "wecom",
-    "method": "GET",
-    "path": "/applications/:id/members",
-    "summary": "分页查询企业微信应用可见成员",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:66:POST:/applications/:id/templates/inspect",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:66 handler.InspectTemplate",
-    "owner": "wecom",
-    "method": "POST",
-    "path": "/applications/:id/templates/inspect",
-    "summary": "读取企业微信审批模板控件",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom.inspect_template",
-    "action_name": "读取企业微信审批模板控件",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:73:GET:/scenes/:business_type/fields",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:73 handler.ListSceneFields",
-    "owner": "wecom",
-    "method": "GET",
-    "path": "/scenes/:business_type/fields",
-    "summary": "查询企业微信审批场景可映射字段",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:80:PUT:/scenes/:business_type",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:80 handler.SaveScene",
-    "owner": "wecom",
-    "method": "PUT",
-    "path": "/scenes/:business_type",
-    "summary": "保存并校验企业微信审批场景模板映射",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom.save_scene",
-    "action_name": "保存并校验企业微信审批场景模板映射",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "http:internal/routes/wecom.go:87:GET:/scenes",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom.go:87 handler.ListScenes",
-    "owner": "wecom",
-    "method": "GET",
-    "path": "/scenes",
-    "summary": "分页查询企业微信审批场景配置",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "登录账号快照/admin_api",
-    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/wecom_callback.go:12:GET:/wecom/approval/:application_id",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom_callback.go:12 handler.Verify",
-    "owner": "wecom_callback",
-    "method": "GET",
-    "path": "/wecom/approval/:application_id",
-    "summary": "验证企业微信审批回调地址",
-    "audit_event": "N/A",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "actor_source": "external_system/callback",
-    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
-    "transaction": "N/A",
-    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
-    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
-  },
-  {
-    "key": "http:internal/routes/wecom_callback.go:18:POST:/wecom/approval/:application_id",
-    "kind": "http",
-    "code_entry": "internal/routes/wecom_callback.go:18 handler.Receive",
-    "owner": "wecom_callback",
-    "method": "POST",
-    "path": "/wecom/approval/:application_id",
-    "summary": "接收企业微信审批状态变化回调",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
-    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
-    "action_code": "wecom_callback.receive",
-    "action_name": "接收企业微信审批状态变化回调",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "wecom_callback",
-    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
-    "actor_source": "external_system/callback",
-    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
-    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
-    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
-    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
-    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "integration_log:internal/handler/app/client_wallet_payment_audit.go:57:h.paymentIntegration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/app/client_wallet_payment_audit.go:57 h.paymentIntegration.Start",
-    "owner": "app",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/app/client_wallet_payment_audit.go:76:h.paymentIntegration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/app/client_wallet_payment_audit.go:76 h.paymentIntegration.Complete",
-    "owner": "app",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/carrier_switch.go:76:repository.ClaimExpiredInboundPending",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/carrier_switch.go:76 repository.ClaimExpiredInboundPending",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cmcc_realname.go:125:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cmcc_realname.go:125 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cmcc_realname.go:133:h.integration.ClaimExpiredInboundPending",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cmcc_realname.go:133 h.integration.ClaimExpiredInboundPending",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cmcc_realname.go:142:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cmcc_realname.go:142 h.integration.Complete",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cmcc_realname.go:68:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cmcc_realname.go:68 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cmcc_realname.go:84:h.integration.ClaimExpiredInboundPending",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cmcc_realname.go:84 h.integration.ClaimExpiredInboundPending",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/ctcc_realname.go:158:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/ctcc_realname.go:158 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/ctcc_realname.go:181:h.integration.ClaimExpiredInboundPending",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/ctcc_realname.go:181 h.integration.ClaimExpiredInboundPending",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/ctcc_realname.go:185:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/ctcc_realname.go:185 h.integration.Complete",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/ctcc_realname.go:91:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/ctcc_realname.go:91 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname.go:124:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname.go:124 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname.go:148:h.integration.ClaimExpiredInboundPending",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname.go:148 h.integration.ClaimExpiredInboundPending",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname.go:157:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname.go:157 h.integration.Complete",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname.go:69:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname.go:69 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:101:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname_removal.go:101 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:123:h.integration.ClaimExpiredInboundPending",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname_removal.go:123 h.integration.ClaimExpiredInboundPending",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:127:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname_removal.go:127 h.integration.Complete",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:65:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/cucc_realname_removal.go:65 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/payment.go:238:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/payment.go:238 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/payment.go:306:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/payment.go:306 h.integration.Complete",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/payment.go:328:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/payment.go:328 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/payment.go:364:h.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/payment.go:364 h.integration.RecordInbound",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/payment.go:374:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/payment.go:374 h.integration.Complete",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/handler/callback/payment.go:385:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/handler/callback/payment.go:385 h.integration.Complete",
-    "owner": "callback",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:174:r.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:174 r.integration.Complete",
-    "owner": "cardobservation",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:207:r.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:207 r.integration.Complete",
-    "owner": "cardobservation",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:220:r.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:220 r.integration.Start",
-    "owner": "cardobservation",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:530:r.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:530 r.integration.Start",
-    "owner": "cardobservation",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:107:a.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/alipay_wap.go:107 a.integration.Start",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:120:a.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/alipay_wap.go:120 a.integration.Complete",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:65:a.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/alipay_wap.go:65 a.integration.Complete",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:81:a.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/alipay_wap.go:81 a.integration.Complete",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:173:a.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/wechat_web.go:173 a.integration.Start",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:186:a.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/wechat_web.go:186 a.integration.Complete",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:52:a.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/wechat_web.go:52 a.integration.Complete",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:78:a.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/payment/wechat_web.go:78 a.integration.Complete",
-    "owner": "payment",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:112:u.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:112 u.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:131:u.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:131 u.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:138:u.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:138 u.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:96:u.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:96 u.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_detail_client.go:126:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_detail_client.go:126 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_detail_client.go:57:c.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_detail_client.go:57 c.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_detail_client.go:92:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_detail_client.go:92 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_detail_task.go:118:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_detail_task.go:118 h.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_detail_task.go:82:h.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_detail_task.go:82 h.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_info_client.go:112:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_info_client.go:112 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_info_client.go:172:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_info_client.go:172 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_info_client.go:76:c.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_info_client.go:76 c.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:110:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:110 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:139:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:139 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:149:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:149 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:81:c.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:81 c.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:96:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:96 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/callback_service.go:90:s.integration.RecordInbound",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/callback_service.go:90 s.integration.RecordInbound",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:121:c.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/directory_client.go:121 c.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:266:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/directory_client.go:266 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:278:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/directory_client.go:278 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:79:c.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/directory_client.go:79 c.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/template_client.go:233:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/template_client.go:233 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/template_client.go:58:c.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/template_client.go:58 c.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/template_client.go:87:c.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/template_client.go:87 c.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/token_provider.go:165:p.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/token_provider.go:165 p.integration.Start",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/token_provider.go:250:p.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/token_provider.go:250 p.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/infrastructure/wecom/token_provider.go:263:p.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/infrastructure/wecom/token_provider.go:263 p.integration.Complete",
-    "owner": "wecom",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/client_order/payment_audit.go:52:s.paymentIntegration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/service/client_order/payment_audit.go:52 s.paymentIntegration.Start",
-    "owner": "client_order",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/client_order/payment_audit.go:72:s.paymentIntegration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/service/client_order/payment_audit.go:72 s.paymentIntegration.Complete",
-    "owner": "client_order",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/device/gateway_audit.go:109:s.gatewayIntegration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/service/device/gateway_audit.go:109 s.gatewayIntegration.Start",
-    "owner": "device",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/device/gateway_audit.go:142:s.gatewayIntegration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/service/device/gateway_audit.go:142 s.gatewayIntegration.Complete",
-    "owner": "device",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/iot_card/gateway_integration.go:38:s.speedTierIntegration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/service/iot_card/gateway_integration.go:38 s.speedTierIntegration.Start",
-    "owner": "iot_card",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/iot_card/gateway_integration.go:71:s.speedTierIntegration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/service/iot_card/gateway_integration.go:71 s.speedTierIntegration.Complete",
-    "owner": "iot_card",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/iot_card/speed_tier.go:45:s.speedTierIntegration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/service/iot_card/speed_tier.go:45 s.speedTierIntegration.Start",
-    "owner": "iot_card",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/iot_card/speed_tier.go:81:s.speedTierIntegration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/service/iot_card/speed_tier.go:81 s.speedTierIntegration.Complete",
-    "owner": "iot_card",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/iot_card/stop_resume_audit.go:151:s.integration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/service/iot_card/stop_resume_audit.go:151 s.integration.Start",
-    "owner": "iot_card",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/iot_card/stop_resume_audit.go:184:s.integration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/service/iot_card/stop_resume_audit.go:184 s.integration.Complete",
-    "owner": "iot_card",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/order/payment_audit.go:30:s.paymentIntegration.Start",
-    "kind": "integration_log",
-    "code_entry": "internal/service/order/payment_audit.go:30 s.paymentIntegration.Start",
-    "owner": "order",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "integration_log:internal/service/order/payment_audit.go:53:s.paymentIntegration.Complete",
-    "kind": "integration_log",
-    "code_entry": "internal/service/order/payment_audit.go:53 s.paymentIntegration.Complete",
-    "owner": "order",
-    "summary": "记录外部交互尝试或终态",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
-    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
-    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
-    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
-    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
-    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
-    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
-    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
-    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
-    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
-    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:340:constants.OutboxEventTypeApprovalSubmissionRequested",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:340 consumer",
-    "owner": "constants._outbox_event_type_approval_submission_requested",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeApprovalSubmissionRequested",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:384:constants.OutboxEventTypeApprovalTerminalDecision",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:384 decisionConsumer",
-    "owner": "constants._outbox_event_type_approval_terminal_decision",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeApprovalTerminalDecision",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:453:constants.OutboxEventTypeCardRealnameChanged",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:453 consumer",
-    "owner": "constants._outbox_event_type_card_realname_changed",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardRealnameChanged",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:463:constants.OutboxEventTypeCardTrafficIncremented",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:463 trafficConsumer",
-    "owner": "constants._outbox_event_type_card_traffic_incremented",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardTrafficIncremented",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:468:constants.OutboxEventTypeCardNetworkChanged",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:468 networkConsumer",
-    "owner": "constants._outbox_event_type_card_network_changed",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardNetworkChanged",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:478:constants.OutboxEventTypeCardSeriesRequested",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:478 seriesConsumer",
-    "owner": "constants._outbox_event_type_card_series_requested",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardSeriesRequested",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:488:constants.OutboxEventTypeAgentRechargePaymentConfirmed",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:488 agentRechargeConsumer",
-    "owner": "constants._outbox_event_type_agent_recharge_payment_confirmed",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentRechargePaymentConfirmed",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:493:constants.OutboxEventTypeAgentMainWalletDebited",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:493 debitConsumer",
-    "owner": "constants._outbox_event_type_agent_main_wallet_debited",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletDebited",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:498:constants.OutboxEventTypeAgentMainWalletReservationChanged",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:498 reservationConsumer",
-    "owner": "constants._outbox_event_type_agent_main_wallet_reservation_changed",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletReservationChanged",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:503:constants.OutboxEventTypeAgentMainWalletCredited",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:503 creditConsumer",
-    "owner": "constants._outbox_event_type_agent_main_wallet_credited",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletCredited",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:508:constants.OutboxEventTypeAgentMainWalletRefunded",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:508 refundConsumer",
-    "owner": "constants._outbox_event_type_agent_main_wallet_refunded",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletRefunded",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:521:constants.OutboxEventTypeAdminDirectNotification",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:521 consumer",
-    "owner": "constants._outbox_event_type_admin_direct_notification",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAdminDirectNotification",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:525:constants.OutboxEventTypePersonalCustomerDirectNotification",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:525 consumer",
-    "owner": "constants._outbox_event_type_personal_customer_direct_notification",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypePersonalCustomerDirectNotification",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "outbox_consumer:cmd/worker/main.go:529:constants.OutboxEventTypeAdminDynamicNotification",
-    "kind": "outbox_consumer",
-    "code_entry": "cmd/worker/main.go:529 consumer",
-    "owner": "constants._outbox_event_type_admin_dynamic_notification",
-    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAdminDynamicNotification",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "必须：消费已提交的可靠事件",
-    "actor_source": "system_task/outbox_consumer",
-    "visibility": "内部系统装配入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
-    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
-    "before_after_policy": "N/A：注册入口不修改业务事实",
-    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
-    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:696:constants.TaskTypeAgentRechargeRecovery",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:696",
-    "owner": "agent_recharge_recovery",
-    "summary": "按 @every 1m 调度 constants.TaskTypeAgentRechargeRecovery",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:706:constants.TaskTypeOrderExpire",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:706",
-    "owner": "order_expire",
-    "summary": "按 @every 1m 调度 constants.TaskTypeOrderExpire",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:713:constants.TaskTypeAlertCheck",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:713",
-    "owner": "alert_check",
-    "summary": "按 @every 1m 调度 constants.TaskTypeAlertCheck",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:720:constants.TaskTypeWeComApprovalRecovery",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:720",
-    "owner": "we_com_approval_recovery",
-    "summary": "按 @every 2m 调度 constants.TaskTypeWeComApprovalRecovery",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:729:constants.TaskTypeDataCleanup",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:729",
-    "owner": "data_cleanup",
-    "summary": "按 0 2 * * * 调度 constants.TaskTypeDataCleanup",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:736:constants.TaskTypeNotificationCleanup",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:736",
-    "owner": "notification_cleanup",
-    "summary": "按 15 2 * * * 调度 constants.TaskTypeNotificationCleanup",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:744:constants.TaskTypePackageExpiryReminder",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:744",
-    "owner": "package_expiry_reminder",
-    "summary": "按 CRON_TZ=Asia/Shanghai 0 3 * * * 调度 constants.TaskTypePackageExpiryReminder",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:753:constants.TaskTypeDailyTrafficFlush",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:753",
-    "owner": "daily_traffic_flush",
-    "summary": "按 0 2 * * * 调度 constants.TaskTypeDailyTrafficFlush",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:765:constants.TaskTypeAuditDailyArchive",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:765",
-    "owner": "audit_daily_archive",
-    "summary": "按 CRON_TZ=Asia/Shanghai 0 4 * * * 调度 constants.TaskTypeAuditDailyArchive",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:775:constants.TaskTypeIntegrationDailyArchive",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:775",
-    "owner": "integration_daily_archive",
-    "summary": "按 CRON_TZ=Asia/Shanghai 30 4 * * * 调度 constants.TaskTypeIntegrationDailyArchive",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:785:constants.TaskTypeIntegrationMonthlyFinalize",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:785",
-    "owner": "integration_monthly_finalize",
-    "summary": "按 CRON_TZ=Asia/Shanghai 0 5 1 * * 调度 constants.TaskTypeIntegrationMonthlyFinalize",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "schedule:cmd/worker/main.go:795:constants.TaskTypeAuditMonthlyRetention",
-    "kind": "scheduled_job",
-    "code_entry": "cmd/worker/main.go:795",
-    "owner": "audit_monthly_retention",
-    "summary": "按 CRON_TZ=Asia/Shanghai 0 6 1 * * 调度 constants.TaskTypeAuditMonthlyRetention",
-    "audit_event": "N/A",
-    "domain_ledger": "N/A",
-    "integration_log": "N/A",
-    "outbox": "N/A",
-    "actor_source": "system_task/scheduled_job",
-    "visibility": "内部系统入口，不直接对用户展示",
-    "transaction": "N/A",
-    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
-    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
-    "before_after_policy": "N/A：调度入口不修改业务事实",
-    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
-    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
-  },
-  {
-    "key": "service:internal/service/account/service.go:102:Create",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:102 Create",
-    "owner": "account",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:1085:CreateSystemAccount",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:1085 CreateSystemAccount",
-    "owner": "account",
-    "summary": "业务方法 CreateSystemAccount",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.create_system_account",
-    "action_name": "执行业务方法（CreateSystemAccount）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:212:BindWeCom",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:212 BindWeCom",
-    "owner": "account",
-    "summary": "业务方法 BindWeCom",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.bind_we_com",
-    "action_name": "执行业务方法（BindWeCom）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:284:Update",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:284 Update",
-    "owner": "account",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:384:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:384 Delete",
-    "owner": "account",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:484:AssignRoles",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:484 AssignRoles",
-    "owner": "account",
-    "summary": "业务方法 AssignRoles",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.assign_roles",
-    "action_name": "执行业务方法（AssignRoles）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:553:RemoveRole",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:553 RemoveRole",
-    "owner": "account",
-    "summary": "业务方法 RemoveRole",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.remove_role",
-    "action_name": "执行业务方法（RemoveRole）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:840:UpdatePassword",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:840 UpdatePassword",
-    "owner": "account",
-    "summary": "业务方法 UpdatePassword",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.update_password",
-    "action_name": "执行业务方法（UpdatePassword）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/account/service.go:932:UpdateStatus",
-    "kind": "service",
-    "code_entry": "internal/service/account/service.go:932 UpdateStatus",
-    "owner": "account",
-    "summary": "业务方法 UpdateStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "account.update_status",
-    "action_name": "执行业务方法（UpdateStatus）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "account",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/agent_open_api/service.go:218:ResumeCard",
-    "kind": "service",
-    "code_entry": "internal/service/agent_open_api/service.go:218 ResumeCard",
-    "owner": "agent_open_api",
-    "summary": "业务方法 ResumeCard",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agent_open_api.resume_card",
-    "action_name": "执行业务方法（ResumeCard）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "agent_open_api",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/agent_open_api/service.go:348:CreateWalletPackageOrders",
-    "kind": "service",
-    "code_entry": "internal/service/agent_open_api/service.go:348 CreateWalletPackageOrders",
-    "owner": "agent_open_api",
-    "summary": "业务方法 CreateWalletPackageOrders",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agent_open_api.create_wallet_package_orders",
-    "action_name": "执行业务方法（CreateWalletPackageOrders）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "agent_open_api",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/agent_open_api/service.go:558:ResetDevice",
-    "kind": "service",
-    "code_entry": "internal/service/agent_open_api/service.go:558 ResetDevice",
-    "owner": "agent_open_api",
-    "summary": "业务方法 ResetDevice",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agent_open_api.reset_device",
-    "action_name": "执行业务方法（ResetDevice）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "agent_open_api",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/agent_recharge/service.go:260:HandlePaymentCallback",
-    "kind": "service",
-    "code_entry": "internal/service/agent_recharge/service.go:260 HandlePaymentCallback",
-    "owner": "agent_recharge",
-    "summary": "业务方法 HandlePaymentCallback",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agent_recharge.handle_payment_callback",
-    "action_name": "执行业务方法（HandlePaymentCallback）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agent_recharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/agent_recharge/service.go:365:Reject",
-    "kind": "service",
-    "code_entry": "internal/service/agent_recharge/service.go:365 Reject",
-    "owner": "agent_recharge",
-    "summary": "业务方法 Reject",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agent_recharge.reject",
-    "action_name": "执行业务方法（Reject）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agent_recharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/agent_recharge/service.go:93:Create",
-    "kind": "service",
-    "code_entry": "internal/service/agent_recharge/service.go:93 Create",
-    "owner": "agent_recharge",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "agent_recharge.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agent_recharge",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/asset/lifecycle_service.go:35:DeactivateIotCard",
-    "kind": "service",
-    "code_entry": "internal/service/asset/lifecycle_service.go:35 DeactivateIotCard",
-    "owner": "asset",
-    "summary": "业务方法 DeactivateIotCard",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "asset.deactivate_iot_card",
-    "action_name": "执行业务方法（DeactivateIotCard）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/asset/lifecycle_service.go:72:DeactivateDevice",
-    "kind": "service",
-    "code_entry": "internal/service/asset/lifecycle_service.go:72 DeactivateDevice",
-    "owner": "asset",
-    "summary": "业务方法 DeactivateDevice",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "asset.deactivate_device",
-    "action_name": "执行业务方法（DeactivateDevice）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/asset/service.go:111:Resolve",
-    "kind": "service",
-    "code_entry": "internal/service/asset/service.go:111 Resolve",
-    "owner": "asset",
-    "summary": "业务方法 Resolve",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "asset.resolve",
-    "action_name": "执行业务方法（Resolve）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/asset/service.go:612:Refresh",
-    "kind": "service",
-    "code_entry": "internal/service/asset/service.go:612 Refresh",
-    "owner": "asset",
-    "summary": "业务方法 Refresh",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "asset.refresh",
-    "action_name": "执行业务方法（Refresh）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/asset/service.go:906:UpdatePackageExpiresAt",
-    "kind": "service",
-    "code_entry": "internal/service/asset/service.go:906 UpdatePackageExpiresAt",
-    "owner": "asset",
-    "summary": "业务方法 UpdatePackageExpiresAt",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "asset.update_package_expires_at",
-    "action_name": "执行业务方法（UpdatePackageExpiresAt）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/asset/service.go:942:UpdatePackageUsage",
-    "kind": "service",
-    "code_entry": "internal/service/asset/service.go:942 UpdatePackageUsage",
-    "owner": "asset",
-    "summary": "业务方法 UpdatePackageUsage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "asset.update_package_usage",
-    "action_name": "执行业务方法（UpdatePackageUsage）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "asset",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/asset_package_batch_order/service.go:50:Create",
-    "kind": "service",
-    "code_entry": "internal/service/asset_package_batch_order/service.go:50 Create",
-    "owner": "asset_package_batch_order",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "asset_package_batch_order.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "asset_package_batch_order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/auth/service.go:168:Logout",
-    "kind": "service",
-    "code_entry": "internal/service/auth/service.go:168 Logout",
-    "owner": "auth",
-    "summary": "业务方法 Logout",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auth.logout",
-    "action_name": "执行业务方法（Logout）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/auth/service.go:194:RefreshToken",
-    "kind": "service",
-    "code_entry": "internal/service/auth/service.go:194 RefreshToken",
-    "owner": "auth",
-    "summary": "业务方法 RefreshToken",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auth.refresh_token",
-    "action_name": "执行业务方法（RefreshToken）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/auth/service.go:218:ChangePassword",
-    "kind": "service",
-    "code_entry": "internal/service/auth/service.go:218 ChangePassword",
-    "owner": "auth",
-    "summary": "业务方法 ChangePassword",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auth.change_password",
-    "action_name": "执行业务方法（ChangePassword）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/auth/service.go:60:Login",
-    "kind": "service",
-    "code_entry": "internal/service/auth/service.go:60 Login",
-    "owner": "auth",
-    "summary": "业务方法 Login",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "auth.login",
-    "action_name": "执行业务方法（Login）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/carrier/service.go:139:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/carrier/service.go:139 Delete",
-    "owner": "carrier",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "carrier.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/carrier/service.go:202:UpdateStatus",
-    "kind": "service",
-    "code_entry": "internal/service/carrier/service.go:202 UpdateStatus",
-    "owner": "carrier",
-    "summary": "业务方法 UpdateStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "carrier.update_status",
-    "action_name": "执行业务方法（UpdateStatus）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/carrier/service.go:30:Create",
-    "kind": "service",
-    "code_entry": "internal/service/carrier/service.go:30 Create",
-    "owner": "carrier",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "carrier.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/carrier/service.go:89:Update",
-    "kind": "service",
-    "code_entry": "internal/service/carrier/service.go:89 Update",
-    "owner": "carrier",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "carrier.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "carrier",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_auth/service.go:274:SendCode",
-    "kind": "service",
-    "code_entry": "internal/service/client_auth/service.go:274 SendCode",
-    "owner": "client_auth",
-    "summary": "业务方法 SendCode",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_auth.send_code",
-    "action_name": "执行业务方法（SendCode）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "client_auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_auth/service.go:298:BindPhone",
-    "kind": "service",
-    "code_entry": "internal/service/client_auth/service.go:298 BindPhone",
-    "owner": "client_auth",
-    "summary": "业务方法 BindPhone",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_auth.bind_phone",
-    "action_name": "执行业务方法（BindPhone）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "client_auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_auth/service.go:385:ChangePhone",
-    "kind": "service",
-    "code_entry": "internal/service/client_auth/service.go:385 ChangePhone",
-    "owner": "client_auth",
-    "summary": "业务方法 ChangePhone",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_auth.change_phone",
-    "action_name": "执行业务方法（ChangePhone）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "client_auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_auth/service.go:528:Logout",
-    "kind": "service",
-    "code_entry": "internal/service/client_auth/service.go:528 Logout",
-    "owner": "client_auth",
-    "summary": "业务方法 Logout",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_auth.logout",
-    "action_name": "执行业务方法（Logout）",
-    "category": "security",
-    "risk": "normal",
-    "primary_resource": "client_auth",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_order/payment_provider.go:39:CreateJSAPIPayment",
-    "kind": "service",
-    "code_entry": "internal/service/client_order/payment_provider.go:39 CreateJSAPIPayment",
-    "owner": "client_order",
-    "summary": "业务方法 CreateJSAPIPayment",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_order.create_j_s_a_p_i_payment",
-    "action_name": "执行业务方法（CreateJSAPIPayment）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "client_order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_order/payment_provider.go:53:CreateJSAPIPayment",
-    "kind": "service",
-    "code_entry": "internal/service/client_order/payment_provider.go:53 CreateJSAPIPayment",
-    "owner": "client_order",
-    "summary": "业务方法 CreateJSAPIPayment",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_order.create_j_s_a_p_i_payment",
-    "action_name": "执行业务方法（CreateJSAPIPayment）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "client_order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_order/payment_provider.go:69:CreateJSAPIPayment",
-    "kind": "service",
-    "code_entry": "internal/service/client_order/payment_provider.go:69 CreateJSAPIPayment",
-    "owner": "client_order",
-    "summary": "业务方法 CreateJSAPIPayment",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_order.create_j_s_a_p_i_payment",
-    "action_name": "执行业务方法（CreateJSAPIPayment）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "client_order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_order/service.go:1352:PayOrder",
-    "kind": "service",
-    "code_entry": "internal/service/client_order/service.go:1352 PayOrder",
-    "owner": "client_order",
-    "summary": "业务方法 PayOrder",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_order.pay_order",
-    "action_name": "执行业务方法（PayOrder）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "client_order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/client_order/service.go:146:CreateOrder",
-    "kind": "service",
-    "code_entry": "internal/service/client_order/service.go:146 CreateOrder",
-    "owner": "client_order",
-    "summary": "业务方法 CreateOrder",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "client_order.create_order",
-    "action_name": "执行业务方法（CreateOrder）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "client_order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_calculation/service.go:347:TriggerOneTimeCommissionForCard",
-    "kind": "service",
-    "code_entry": "internal/service/commission_calculation/service.go:347 TriggerOneTimeCommissionForCard",
-    "owner": "commission_calculation",
-    "summary": "业务方法 TriggerOneTimeCommissionForCard",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_calculation.trigger_one_time_commission_for_card",
-    "action_name": "执行业务方法（TriggerOneTimeCommissionForCard）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_calculation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_calculation/service.go:426:TriggerOneTimeCommissionForDevice",
-    "kind": "service",
-    "code_entry": "internal/service/commission_calculation/service.go:426 TriggerOneTimeCommissionForDevice",
-    "owner": "commission_calculation",
-    "summary": "业务方法 TriggerOneTimeCommissionForDevice",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_calculation.trigger_one_time_commission_for_device",
-    "action_name": "执行业务方法（TriggerOneTimeCommissionForDevice）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_calculation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_calculation/service.go:763:CreditCommission",
-    "kind": "service",
-    "code_entry": "internal/service/commission_calculation/service.go:763 CreditCommission",
-    "owner": "commission_calculation",
-    "summary": "业务方法 CreditCommission",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_calculation.credit_commission",
-    "action_name": "执行业务方法（CreditCommission）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_calculation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_stats/service.go:37:UpdateStats",
-    "kind": "service",
-    "code_entry": "internal/service/commission_stats/service.go:37 UpdateStats",
-    "owner": "commission_stats",
-    "summary": "业务方法 UpdateStats",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_stats.update_stats",
-    "action_name": "执行业务方法（UpdateStats）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_stats",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_stats/service.go:64:ArchiveCompletedPeriod",
-    "kind": "service",
-    "code_entry": "internal/service/commission_stats/service.go:64 ArchiveCompletedPeriod",
-    "owner": "commission_stats",
-    "summary": "业务方法 ArchiveCompletedPeriod",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_stats.archive_completed_period",
-    "action_name": "执行业务方法（ArchiveCompletedPeriod）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_stats",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_withdrawal/service.go:152:Approve",
-    "kind": "service",
-    "code_entry": "internal/service/commission_withdrawal/service.go:152 Approve",
-    "owner": "commission_withdrawal",
-    "summary": "业务方法 Approve",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_withdrawal.approve",
-    "action_name": "执行业务方法（Approve）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_withdrawal",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_withdrawal/service.go:272:Reject",
-    "kind": "service",
-    "code_entry": "internal/service/commission_withdrawal/service.go:272 Reject",
-    "owner": "commission_withdrawal",
-    "summary": "业务方法 Reject",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_withdrawal.reject",
-    "action_name": "执行业务方法（Reject）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_withdrawal",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/commission_withdrawal_setting/service.go:35:Create",
-    "kind": "service",
-    "code_entry": "internal/service/commission_withdrawal_setting/service.go:35 Create",
-    "owner": "commission_withdrawal_setting",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "commission_withdrawal_setting.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_withdrawal_setting",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/customer_binding/audit.go:152:UnbindByVirtualNo",
-    "kind": "service",
-    "code_entry": "internal/service/customer_binding/audit.go:152 UnbindByVirtualNo",
-    "owner": "customer_binding",
-    "summary": "业务方法 UnbindByVirtualNo",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "customer_binding.unbind_by_virtual_no",
-    "action_name": "执行业务方法（UnbindByVirtualNo）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "customer_binding",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/customer_binding/service.go:220:Bind",
-    "kind": "service",
-    "code_entry": "internal/service/customer_binding/service.go:220 Bind",
-    "owner": "customer_binding",
-    "summary": "业务方法 Bind",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "customer_binding.bind",
-    "action_name": "执行业务方法（Bind）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "customer_binding",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/customer_binding/service.go:354:Migrate",
-    "kind": "service",
-    "code_entry": "internal/service/customer_binding/service.go:354 Migrate",
-    "owner": "customer_binding",
-    "summary": "业务方法 Migrate",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "customer_binding.migrate",
-    "action_name": "执行业务方法（Migrate）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "customer_binding",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/binding.go:186:UnbindCard",
-    "kind": "service",
-    "code_entry": "internal/service/device/binding.go:186 UnbindCard",
-    "owner": "device",
-    "summary": "业务方法 UnbindCard",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.unbind_card",
-    "action_name": "执行业务方法（UnbindCard）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/binding.go:80:BindCard",
-    "kind": "service",
-    "code_entry": "internal/service/device/binding.go:80 BindCard",
-    "owner": "device",
-    "summary": "业务方法 BindCard",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.bind_card",
-    "action_name": "执行业务方法（BindCard）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/realname_policy_batch.go:16:BatchUpdateRealnamePolicy",
-    "kind": "service",
-    "code_entry": "internal/service/device/realname_policy_batch.go:16 BatchUpdateRealnamePolicy",
-    "owner": "device",
-    "summary": "业务方法 BatchUpdateRealnamePolicy",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.batch_update_realname_policy",
-    "action_name": "执行业务方法（BatchUpdateRealnamePolicy）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/service.go:1339:StopDevice",
-    "kind": "service",
-    "code_entry": "internal/service/device/service.go:1339 StopDevice",
-    "owner": "device",
-    "summary": "业务方法 StopDevice",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.stop_device",
-    "action_name": "执行业务方法（StopDevice）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/service.go:1656:UpdateRealnamePolicy",
-    "kind": "service",
-    "code_entry": "internal/service/device/service.go:1656 UpdateRealnamePolicy",
-    "owner": "device",
-    "summary": "业务方法 UpdateRealnamePolicy",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.update_realname_policy",
-    "action_name": "执行业务方法（UpdateRealnamePolicy）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/service.go:417:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/device/service.go:417 Delete",
-    "owner": "device",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/service.go:480:AllocateDevices",
-    "kind": "service",
-    "code_entry": "internal/service/device/service.go:480 AllocateDevices",
-    "owner": "device",
-    "summary": "业务方法 AllocateDevices",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.allocate_devices",
-    "action_name": "执行业务方法（AllocateDevices）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/service.go:615:RecallDevices",
-    "kind": "service",
-    "code_entry": "internal/service/device/service.go:615 RecallDevices",
-    "owner": "device",
-    "summary": "业务方法 RecallDevices",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.recall_devices",
-    "action_name": "执行业务方法（RecallDevices）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device/service.go:986:BatchSetSeriesBinding",
-    "kind": "service",
-    "code_entry": "internal/service/device/service.go:986 BatchSetSeriesBinding",
-    "owner": "device",
-    "summary": "业务方法 BatchSetSeriesBinding",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device.batch_set_series_binding",
-    "action_name": "执行业务方法（BatchSetSeriesBinding）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device_import/service.go:109:CreateBatchAllocationTask",
-    "kind": "service",
-    "code_entry": "internal/service/device_import/service.go:109 CreateBatchAllocationTask",
-    "owner": "device_import",
-    "summary": "业务方法 CreateBatchAllocationTask",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device_import.create_batch_allocation_task",
-    "action_name": "执行业务方法（CreateBatchAllocationTask）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device_import",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/device_import/service.go:50:CreateImportTask",
-    "kind": "service",
-    "code_entry": "internal/service/device_import/service.go:50 CreateImportTask",
-    "owner": "device_import",
-    "summary": "业务方法 CreateImportTask",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "device_import.create_import_task",
-    "action_name": "执行业务方法（CreateImportTask）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device_import",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/email/service.go:32:SendWelcomeEmail",
-    "kind": "service",
-    "code_entry": "internal/service/email/service.go:32 SendWelcomeEmail",
-    "owner": "email",
-    "summary": "业务方法 SendWelcomeEmail",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "email.send_welcome_email",
-    "action_name": "执行业务方法（SendWelcomeEmail）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "email",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/email/service.go:66:SendPasswordResetEmail",
-    "kind": "service",
-    "code_entry": "internal/service/email/service.go:66 SendPasswordResetEmail",
-    "owner": "email",
-    "summary": "业务方法 SendPasswordResetEmail",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "email.send_password_reset_email",
-    "action_name": "执行业务方法（SendPasswordResetEmail）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "email",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/email/service.go:98:SendNotificationEmail",
-    "kind": "service",
-    "code_entry": "internal/service/email/service.go:98 SendNotificationEmail",
-    "owner": "email",
-    "summary": "业务方法 SendNotificationEmail",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "email.send_notification_email",
-    "action_name": "执行业务方法（SendNotificationEmail）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "email",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise/service.go:182:Update",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise/service.go:182 Update",
-    "owner": "enterprise",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "enterprise",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise/service.go:243:UpdateStatus",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise/service.go:243 UpdateStatus",
-    "owner": "enterprise",
-    "summary": "业务方法 UpdateStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise.update_status",
-    "action_name": "执行业务方法（UpdateStatus）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "enterprise",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise/service.go:311:UpdatePassword",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise/service.go:311 UpdatePassword",
-    "owner": "enterprise",
-    "summary": "业务方法 UpdatePassword",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise.update_password",
-    "action_name": "执行业务方法（UpdatePassword）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "enterprise",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise/service.go:45:Create",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise/service.go:45 Create",
-    "owner": "enterprise",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "enterprise",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_card/authorization_service.go:154:RevokeAuthorizations",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_card/authorization_service.go:154 RevokeAuthorizations",
-    "owner": "enterprise_card",
-    "summary": "业务方法 RevokeAuthorizations",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_card.revoke_authorizations",
-    "action_name": "执行业务方法（RevokeAuthorizations）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_card/authorization_service.go:409:UpdateRecordRemark",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_card/authorization_service.go:409 UpdateRecordRemark",
-    "owner": "enterprise_card",
-    "summary": "业务方法 UpdateRecordRemark",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_card.update_record_remark",
-    "action_name": "执行业务方法（UpdateRecordRemark）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_card/authorization_service.go:54:BatchAuthorize",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_card/authorization_service.go:54 BatchAuthorize",
-    "owner": "enterprise_card",
-    "summary": "业务方法 BatchAuthorize",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_card.batch_authorize",
-    "action_name": "执行业务方法（BatchAuthorize）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_card/service.go:207:AllocateCards",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_card/service.go:207 AllocateCards",
-    "owner": "enterprise_card",
-    "summary": "业务方法 AllocateCards",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_card.allocate_cards",
-    "action_name": "执行业务方法（AllocateCards）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_card/service.go:344:RecallCards",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_card/service.go:344 RecallCards",
-    "owner": "enterprise_card",
-    "summary": "业务方法 RecallCards",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_card.recall_cards",
-    "action_name": "执行业务方法（RecallCards）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_card/service.go:43:AllocateCardsPreview",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_card/service.go:43 AllocateCardsPreview",
-    "owner": "enterprise_card",
-    "summary": "业务方法 AllocateCardsPreview",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_card.allocate_cards_preview",
-    "action_name": "执行业务方法（AllocateCardsPreview）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_card/service.go:661:ResumeCard",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_card/service.go:661 ResumeCard",
-    "owner": "enterprise_card",
-    "summary": "业务方法 ResumeCard",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_card.resume_card",
-    "action_name": "执行业务方法（ResumeCard）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_device/service.go:407:RecallDevices",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_device/service.go:407 RecallDevices",
-    "owner": "enterprise_device",
-    "summary": "业务方法 RecallDevices",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_device.recall_devices",
-    "action_name": "执行业务方法（RecallDevices）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/enterprise_device/service.go:56:AllocateDevices",
-    "kind": "service",
-    "code_entry": "internal/service/enterprise_device/service.go:56 AllocateDevices",
-    "owner": "enterprise_device",
-    "summary": "业务方法 AllocateDevices",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "enterprise_device.allocate_devices",
-    "action_name": "执行业务方法（AllocateDevices）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "enterprise_device",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/exchange/service.go:269:Cancel",
-    "kind": "service",
-    "code_entry": "internal/service/exchange/service.go:269 Cancel",
-    "owner": "exchange",
-    "summary": "业务方法 Cancel",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "exchange.cancel",
-    "action_name": "执行业务方法（Cancel）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/exchange/service.go:529:SubmitShippingInfo",
-    "kind": "service",
-    "code_entry": "internal/service/exchange/service.go:529 SubmitShippingInfo",
-    "owner": "exchange",
-    "summary": "业务方法 SubmitShippingInfo",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "exchange.submit_shipping_info",
-    "action_name": "执行业务方法（SubmitShippingInfo）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/exchange/service.go:73:Create",
-    "kind": "service",
-    "code_entry": "internal/service/exchange/service.go:73 Create",
-    "owner": "exchange",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "exchange.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "exchange",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/export_task/service.go:251:CancelTask",
-    "kind": "service",
-    "code_entry": "internal/service/export_task/service.go:251 CancelTask",
-    "owner": "export_task",
-    "summary": "业务方法 CancelTask",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "export_task.cancel_task",
-    "action_name": "执行业务方法（CancelTask）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_task",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/export_task/service.go:58:CreateTask",
-    "kind": "service",
-    "code_entry": "internal/service/export_task/service.go:58 CreateTask",
-    "owner": "export_task",
-    "summary": "业务方法 CreateTask",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "export_task.create_task",
-    "action_name": "执行业务方法（CreateTask）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_task",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/realname_policy_batch.go:16:BatchUpdateRealnamePolicy",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/realname_policy_batch.go:16 BatchUpdateRealnamePolicy",
-    "owner": "iot_card",
-    "summary": "业务方法 BatchUpdateRealnamePolicy",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.batch_update_realname_policy",
-    "action_name": "执行业务方法（BatchUpdateRealnamePolicy）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1012:BatchSetSeriesBinding",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1012 BatchSetSeriesBinding",
-    "owner": "iot_card",
-    "summary": "业务方法 BatchSetSeriesBinding",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.batch_set_series_binding",
-    "action_name": "执行业务方法（BatchSetSeriesBinding）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1373:RefreshCardDataByID",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1373 RefreshCardDataByID",
-    "owner": "iot_card",
-    "summary": "业务方法 RefreshCardDataByID",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.refresh_card_data_by_i_d",
-    "action_name": "执行业务方法（RefreshCardDataByID）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1387:RefreshCardDataFromGateway",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1387 RefreshCardDataFromGateway",
-    "owner": "iot_card",
-    "summary": "业务方法 RefreshCardDataFromGateway",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.refresh_card_data_from_gateway",
-    "action_name": "执行业务方法（RefreshCardDataFromGateway）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1692:UpdatePollingStatus",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1692 UpdatePollingStatus",
-    "owner": "iot_card",
-    "summary": "业务方法 UpdatePollingStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.update_polling_status",
-    "action_name": "执行业务方法（UpdatePollingStatus）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1741:BatchUpdatePollingStatus",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1741 BatchUpdatePollingStatus",
-    "owner": "iot_card",
-    "summary": "业务方法 BatchUpdatePollingStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.batch_update_polling_status",
-    "action_name": "执行业务方法（BatchUpdatePollingStatus）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1780:DeleteCard",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1780 DeleteCard",
-    "owner": "iot_card",
-    "summary": "业务方法 DeleteCard",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.delete_card",
-    "action_name": "执行业务方法（DeleteCard）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1824:BatchDeleteCards",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1824 BatchDeleteCards",
-    "owner": "iot_card",
-    "summary": "业务方法 BatchDeleteCards",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.batch_delete_cards",
-    "action_name": "执行业务方法（BatchDeleteCards）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:1866:UpdateRealnamePolicy",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:1866 UpdateRealnamePolicy",
-    "owner": "iot_card",
-    "summary": "业务方法 UpdateRealnamePolicy",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.update_realname_policy",
-    "action_name": "执行业务方法（UpdateRealnamePolicy）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:514:AllocateCards",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:514 AllocateCards",
-    "owner": "iot_card",
-    "summary": "业务方法 AllocateCards",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.allocate_cards",
-    "action_name": "执行业务方法（AllocateCards）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/service.go:666:RecallCards",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/service.go:666 RecallCards",
-    "owner": "iot_card",
-    "summary": "业务方法 RecallCards",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.recall_cards",
-    "action_name": "执行业务方法（RecallCards）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/speed_tier.go:26:SetSpeedTier",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/speed_tier.go:26 SetSpeedTier",
-    "owner": "iot_card",
-    "summary": "业务方法 SetSpeedTier",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.set_speed_tier",
-    "action_name": "执行业务方法（SetSpeedTier）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card/stop_resume_service.go:411:ResumeCardIfStopped",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card/stop_resume_service.go:411 ResumeCardIfStopped",
-    "owner": "iot_card",
-    "summary": "业务方法 ResumeCardIfStopped",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card.resume_card_if_stopped",
-    "action_name": "执行业务方法（ResumeCardIfStopped）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/iot_card_import/service.go:72:CreateImportTask",
-    "kind": "service",
-    "code_entry": "internal/service/iot_card_import/service.go:72 CreateImportTask",
-    "owner": "iot_card_import",
-    "summary": "业务方法 CreateImportTask",
-    "audit_event": "必须",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "iot_card_import.create_import_task",
-    "action_name": "执行业务方法（CreateImportTask）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card_import",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/operation_password/service.go:27:Set",
-    "kind": "service",
-    "code_entry": "internal/service/operation_password/service.go:27 Set",
-    "owner": "operation_password",
-    "summary": "业务方法 Set",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "operation_password.set",
-    "action_name": "执行业务方法（Set）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "operation_password",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order/service.go:1240:CreatePendingOrder",
-    "kind": "service",
-    "code_entry": "internal/service/order/service.go:1240 CreatePendingOrder",
-    "owner": "order",
-    "summary": "业务方法 CreatePendingOrder",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order.create_pending_order",
-    "action_name": "执行业务方法（CreatePendingOrder）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order/service.go:1438:Cancel",
-    "kind": "service",
-    "code_entry": "internal/service/order/service.go:1438 Cancel",
-    "owner": "order",
-    "summary": "业务方法 Cancel",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order.cancel",
-    "action_name": "执行业务方法（Cancel）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order/service.go:1465:CancelExpiredOrders",
-    "kind": "service",
-    "code_entry": "internal/service/order/service.go:1465 CancelExpiredOrders",
-    "owner": "order",
-    "summary": "业务方法 CancelExpiredOrders",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order.cancel_expired_orders",
-    "action_name": "执行业务方法（CancelExpiredOrders）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order/service.go:153:CreateAdminOrder",
-    "kind": "service",
-    "code_entry": "internal/service/order/service.go:153 CreateAdminOrder",
-    "owner": "order",
-    "summary": "业务方法 CreateAdminOrder",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order.create_admin_order",
-    "action_name": "执行业务方法（CreateAdminOrder）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order/service.go:1913:HandlePaymentCallback",
-    "kind": "service",
-    "code_entry": "internal/service/order/service.go:1913 HandlePaymentCallback",
-    "owner": "order",
-    "summary": "业务方法 HandlePaymentCallback",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order.handle_payment_callback",
-    "action_name": "执行业务方法（HandlePaymentCallback）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order/service.go:1989:HandlePaymentRecordCallback",
-    "kind": "service",
-    "code_entry": "internal/service/order/service.go:1989 HandlePaymentRecordCallback",
-    "owner": "order",
-    "summary": "业务方法 HandlePaymentRecordCallback",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order.handle_payment_record_callback",
-    "action_name": "执行业务方法（HandlePaymentRecordCallback）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order/service.go:565:CreateH5Order",
-    "kind": "service",
-    "code_entry": "internal/service/order/service.go:565 CreateH5Order",
-    "owner": "order",
-    "summary": "业务方法 CreateH5Order",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order.create_h5_order",
-    "action_name": "执行业务方法（CreateH5Order）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/order_package_invalidate/service.go:53:Create",
-    "kind": "service",
-    "code_entry": "internal/service/order_package_invalidate/service.go:53 Create",
-    "owner": "order_package_invalidate",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "order_package_invalidate.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order_package_invalidate",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/activation_service.go:211:ActivateQueuedPackage",
-    "kind": "service",
-    "code_entry": "internal/service/package/activation_service.go:211 ActivateQueuedPackage",
-    "owner": "package",
-    "summary": "业务方法 ActivateQueuedPackage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.activate_queued_package",
-    "action_name": "执行业务方法（ActivateQueuedPackage）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/activation_service.go:298:ActivateSpecificPackage",
-    "kind": "service",
-    "code_entry": "internal/service/package/activation_service.go:298 ActivateSpecificPackage",
-    "owner": "package",
-    "summary": "业务方法 ActivateSpecificPackage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.activate_specific_package",
-    "action_name": "执行业务方法（ActivateSpecificPackage）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/activation_service.go:405:ActivateNextPendingMainPackage",
-    "kind": "service",
-    "code_entry": "internal/service/package/activation_service.go:405 ActivateNextPendingMainPackage",
-    "owner": "package",
-    "summary": "业务方法 ActivateNextPendingMainPackage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.activate_next_pending_main_package",
-    "action_name": "执行业务方法（ActivateNextPendingMainPackage）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/activation_service.go:74:ActivateByRealname",
-    "kind": "service",
-    "code_entry": "internal/service/package/activation_service.go:74 ActivateByRealname",
-    "owner": "package",
-    "summary": "业务方法 ActivateByRealname",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.activate_by_realname",
-    "action_name": "执行业务方法（ActivateByRealname）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/activation_service.go:774:InvalidatePackagesForRefund",
-    "kind": "service",
-    "code_entry": "internal/service/package/activation_service.go:774 InvalidatePackagesForRefund",
-    "owner": "package",
-    "summary": "业务方法 InvalidatePackagesForRefund",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.invalidate_packages_for_refund",
-    "action_name": "执行业务方法（InvalidatePackagesForRefund）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/activation_service.go:871:InvalidateAllPackagesByAsset",
-    "kind": "service",
-    "code_entry": "internal/service/package/activation_service.go:871 InvalidateAllPackagesByAsset",
-    "owner": "package",
-    "summary": "业务方法 InvalidateAllPackagesByAsset",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.invalidate_all_packages_by_asset",
-    "action_name": "执行业务方法（InvalidateAllPackagesByAsset）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/reset_service.go:134:ResetMonthlyUsage",
-    "kind": "service",
-    "code_entry": "internal/service/package/reset_service.go:134 ResetMonthlyUsage",
-    "owner": "package",
-    "summary": "业务方法 ResetMonthlyUsage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.reset_monthly_usage",
-    "action_name": "执行业务方法（ResetMonthlyUsage）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/reset_service.go:296:ResetYearlyUsage",
-    "kind": "service",
-    "code_entry": "internal/service/package/reset_service.go:296 ResetYearlyUsage",
-    "owner": "package",
-    "summary": "业务方法 ResetYearlyUsage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.reset_yearly_usage",
-    "action_name": "执行业务方法（ResetYearlyUsage）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/reset_service.go:52:ResetDailyUsage",
-    "kind": "service",
-    "code_entry": "internal/service/package/reset_service.go:52 ResetDailyUsage",
-    "owner": "package",
-    "summary": "业务方法 ResetDailyUsage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.reset_daily_usage",
-    "action_name": "执行业务方法（ResetDailyUsage）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/service.go:208:Update",
-    "kind": "service",
-    "code_entry": "internal/service/package/service.go:208 Update",
-    "owner": "package",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/service.go:342:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/package/service.go:342 Delete",
-    "owner": "package",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/service.go:44:Create",
-    "kind": "service",
-    "code_entry": "internal/service/package/service.go:44 Create",
-    "owner": "package",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/service.go:478:UpdateStatus",
-    "kind": "service",
-    "code_entry": "internal/service/package/service.go:478 UpdateStatus",
-    "owner": "package",
-    "summary": "业务方法 UpdateStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.update_status",
-    "action_name": "执行业务方法（UpdateStatus）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/service.go:514:UpdateShelfStatus",
-    "kind": "service",
-    "code_entry": "internal/service/package/service.go:514 UpdateShelfStatus",
-    "owner": "package",
-    "summary": "业务方法 UpdateShelfStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.update_shelf_status",
-    "action_name": "执行业务方法（UpdateShelfStatus）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/service.go:559:UpdateRetailPrice",
-    "kind": "service",
-    "code_entry": "internal/service/package/service.go:559 UpdateRetailPrice",
-    "owner": "package",
-    "summary": "业务方法 UpdateRetailPrice",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.update_retail_price",
-    "action_name": "执行业务方法（UpdateRetailPrice）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package/usage_service.go:78:DeductDataUsage",
-    "kind": "service",
-    "code_entry": "internal/service/package/usage_service.go:78 DeductDataUsage",
-    "owner": "package",
-    "summary": "业务方法 DeductDataUsage",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package.deduct_data_usage",
-    "action_name": "执行业务方法（DeductDataUsage）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package_series/service.go:105:Update",
-    "kind": "service",
-    "code_entry": "internal/service/package_series/service.go:105 Update",
-    "owner": "package_series",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package_series.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package_series/service.go:164:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/package_series/service.go:164 Delete",
-    "owner": "package_series",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package_series.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package_series/service.go:258:UpdateStatus",
-    "kind": "service",
-    "code_entry": "internal/service/package_series/service.go:258 UpdateStatus",
-    "owner": "package_series",
-    "summary": "业务方法 UpdateStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package_series.update_status",
-    "action_name": "执行业务方法（UpdateStatus）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/package_series/service.go:38:Create",
-    "kind": "service",
-    "code_entry": "internal/service/package_series/service.go:38 Create",
-    "owner": "package_series",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "package_series.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_series",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/permission/service.go:153:Update",
-    "kind": "service",
-    "code_entry": "internal/service/permission/service.go:153 Update",
-    "owner": "permission",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "permission.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "permission",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/permission/service.go:247:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/permission/service.go:247 Delete",
-    "owner": "permission",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "permission.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "permission",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/permission/service.go:65:Create",
-    "kind": "service",
-    "code_entry": "internal/service/permission/service.go:65 Create",
-    "owner": "permission",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "permission.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "permission",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/personal_customer/service.go:45:UpdateProfile",
-    "kind": "service",
-    "code_entry": "internal/service/personal_customer/service.go:45 UpdateProfile",
-    "owner": "personal_customer",
-    "summary": "业务方法 UpdateProfile",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "personal_customer.update_profile",
-    "action_name": "执行业务方法（UpdateProfile）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "personal_customer",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/alert_service.go:119:UpdateRule",
-    "kind": "service",
-    "code_entry": "internal/service/polling/alert_service.go:119 UpdateRule",
-    "owner": "polling",
-    "summary": "业务方法 UpdateRule",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.update_rule",
-    "action_name": "执行业务方法（UpdateRule）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/alert_service.go:173:DeleteRule",
-    "kind": "service",
-    "code_entry": "internal/service/polling/alert_service.go:173 DeleteRule",
-    "owner": "polling",
-    "summary": "业务方法 DeleteRule",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.delete_rule",
-    "action_name": "执行业务方法（DeleteRule）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/alert_service.go:57:CreateRule",
-    "kind": "service",
-    "code_entry": "internal/service/polling/alert_service.go:57 CreateRule",
-    "owner": "polling",
-    "summary": "业务方法 CreateRule",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.create_rule",
-    "action_name": "执行业务方法（CreateRule）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/asset_polling_service.go:60:UpdatePollingStatus",
-    "kind": "service",
-    "code_entry": "internal/service/polling/asset_polling_service.go:60 UpdatePollingStatus",
-    "owner": "polling",
-    "summary": "业务方法 UpdatePollingStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.update_polling_status",
-    "action_name": "执行业务方法（UpdatePollingStatus）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/cleanup_service.go:192:TriggerCleanup",
-    "kind": "service",
-    "code_entry": "internal/service/polling/cleanup_service.go:192 TriggerCleanup",
-    "owner": "polling",
-    "summary": "业务方法 TriggerCleanup",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.trigger_cleanup",
-    "action_name": "执行业务方法（TriggerCleanup）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/cleanup_service.go:38:CreateConfig",
-    "kind": "service",
-    "code_entry": "internal/service/polling/cleanup_service.go:38 CreateConfig",
-    "owner": "polling",
-    "summary": "业务方法 CreateConfig",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.create_config",
-    "action_name": "执行业务方法（CreateConfig）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/cleanup_service.go:67:UpdateConfig",
-    "kind": "service",
-    "code_entry": "internal/service/polling/cleanup_service.go:67 UpdateConfig",
-    "owner": "polling",
-    "summary": "业务方法 UpdateConfig",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.update_config",
-    "action_name": "执行业务方法（UpdateConfig）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/cleanup_service.go:98:DeleteConfig",
-    "kind": "service",
-    "code_entry": "internal/service/polling/cleanup_service.go:98 DeleteConfig",
-    "owner": "polling",
-    "summary": "业务方法 DeleteConfig",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.delete_config",
-    "action_name": "执行业务方法（DeleteConfig）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/concurrency_service.go:128:UpdateMaxConcurrency",
-    "kind": "service",
-    "code_entry": "internal/service/polling/concurrency_service.go:128 UpdateMaxConcurrency",
-    "owner": "polling",
-    "summary": "业务方法 UpdateMaxConcurrency",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.update_max_concurrency",
-    "action_name": "执行业务方法（UpdateMaxConcurrency）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/concurrency_service.go:175:ResetConcurrency",
-    "kind": "service",
-    "code_entry": "internal/service/polling/concurrency_service.go:175 ResetConcurrency",
-    "owner": "polling",
-    "summary": "业务方法 ResetConcurrency",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.reset_concurrency",
-    "action_name": "执行业务方法（ResetConcurrency）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/concurrency_service.go:264:SyncConfigToRedis",
-    "kind": "service",
-    "code_entry": "internal/service/polling/concurrency_service.go:264 SyncConfigToRedis",
-    "owner": "polling",
-    "summary": "业务方法 SyncConfigToRedis",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.sync_config_to_redis",
-    "action_name": "执行业务方法（SyncConfigToRedis）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/config_service.go:133:Update",
-    "kind": "service",
-    "code_entry": "internal/service/polling/config_service.go:133 Update",
-    "owner": "polling",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/config_service.go:226:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/polling/config_service.go:226 Delete",
-    "owner": "polling",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/config_service.go:310:UpdateStatus",
-    "kind": "service",
-    "code_entry": "internal/service/polling/config_service.go:310 UpdateStatus",
-    "owner": "polling",
-    "summary": "业务方法 UpdateStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.update_status",
-    "action_name": "执行业务方法（UpdateStatus）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/config_service.go:51:Create",
-    "kind": "service",
-    "code_entry": "internal/service/polling/config_service.go:51 Create",
-    "owner": "polling",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "asset",
-    "risk": "high",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/manual_trigger_service.go:175:TriggerBatch",
-    "kind": "service",
-    "code_entry": "internal/service/polling/manual_trigger_service.go:175 TriggerBatch",
-    "owner": "polling",
-    "summary": "业务方法 TriggerBatch",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.trigger_batch",
-    "action_name": "执行业务方法（TriggerBatch）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/manual_trigger_service.go:315:TriggerByCondition",
-    "kind": "service",
-    "code_entry": "internal/service/polling/manual_trigger_service.go:315 TriggerByCondition",
-    "owner": "polling",
-    "summary": "业务方法 TriggerByCondition",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.trigger_by_condition",
-    "action_name": "执行业务方法（TriggerByCondition）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/manual_trigger_service.go:452:CancelTrigger",
-    "kind": "service",
-    "code_entry": "internal/service/polling/manual_trigger_service.go:452 CancelTrigger",
-    "owner": "polling",
-    "summary": "业务方法 CancelTrigger",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.cancel_trigger",
-    "action_name": "执行业务方法（CancelTrigger）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/polling/manual_trigger_service.go:52:TriggerSingle",
-    "kind": "service",
-    "code_entry": "internal/service/polling/manual_trigger_service.go:52 TriggerSingle",
-    "owner": "polling",
-    "summary": "业务方法 TriggerSingle",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "polling.trigger_single",
-    "action_name": "执行业务方法（TriggerSingle）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/recharge_order/service.go:72:HandlePaymentCallback",
-    "kind": "service",
-    "code_entry": "internal/service/recharge_order/service.go:72 HandlePaymentCallback",
-    "owner": "recharge_order",
-    "summary": "业务方法 HandlePaymentCallback",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "recharge_order.handle_payment_callback",
-    "action_name": "执行业务方法（HandlePaymentCallback）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "recharge_order",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/refund/approval_decision.go:19:Handle",
-    "kind": "service",
-    "code_entry": "internal/service/refund/approval_decision.go:19 Handle",
-    "owner": "refund",
-    "summary": "业务方法 Handle",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "refund.handle",
-    "action_name": "执行业务方法（Handle）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/refund/service.go:115:Create",
-    "kind": "service",
-    "code_entry": "internal/service/refund/service.go:115 Create",
-    "owner": "refund",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "refund.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/refund/service.go:258:Approve",
-    "kind": "service",
-    "code_entry": "internal/service/refund/service.go:258 Approve",
-    "owner": "refund",
-    "summary": "业务方法 Approve",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "refund.approve",
-    "action_name": "执行业务方法（Approve）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/refund/service.go:588:Reject",
-    "kind": "service",
-    "code_entry": "internal/service/refund/service.go:588 Reject",
-    "owner": "refund",
-    "summary": "业务方法 Reject",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "refund.reject",
-    "action_name": "执行业务方法（Reject）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "refund",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/role/service.go:114:Update",
-    "kind": "service",
-    "code_entry": "internal/service/role/service.go:114 Update",
-    "owner": "role",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/role/service.go:173:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/role/service.go:173 Delete",
-    "owner": "role",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/role/service.go:255:AssignPermissions",
-    "kind": "service",
-    "code_entry": "internal/service/role/service.go:255 AssignPermissions",
-    "owner": "role",
-    "summary": "业务方法 AssignPermissions",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.assign_permissions",
-    "action_name": "执行业务方法（AssignPermissions）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/role/service.go:383:RemovePermission",
-    "kind": "service",
-    "code_entry": "internal/service/role/service.go:383 RemovePermission",
-    "owner": "role",
-    "summary": "业务方法 RemovePermission",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.remove_permission",
-    "action_name": "执行业务方法（RemovePermission）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/role/service.go:436:BatchRemovePermissions",
-    "kind": "service",
-    "code_entry": "internal/service/role/service.go:436 BatchRemovePermissions",
-    "owner": "role",
-    "summary": "业务方法 BatchRemovePermissions",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.batch_remove_permissions",
-    "action_name": "执行业务方法（BatchRemovePermissions）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/role/service.go:495:UpdateStatus",
-    "kind": "service",
-    "code_entry": "internal/service/role/service.go:495 UpdateStatus",
-    "owner": "role",
-    "summary": "业务方法 UpdateStatus",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.update_status",
-    "action_name": "执行业务方法（UpdateStatus）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/role/service.go:54:Create",
-    "kind": "service",
-    "code_entry": "internal/service/role/service.go:54 Create",
-    "owner": "role",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "role.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "security",
-    "risk": "high",
-    "primary_resource": "role",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop/service.go:104:Disable",
-    "kind": "service",
-    "code_entry": "internal/service/shop/service.go:104 Disable",
-    "owner": "shop",
-    "summary": "业务方法 Disable",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.disable",
-    "action_name": "执行业务方法（Disable）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop/service.go:125:Enable",
-    "kind": "service",
-    "code_entry": "internal/service/shop/service.go:125 Enable",
-    "owner": "shop",
-    "summary": "业务方法 Enable",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.enable",
-    "action_name": "执行业务方法（Enable）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop/service.go:300:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/shop/service.go:300 Delete",
-    "owner": "shop",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop/service.go:50:Update",
-    "kind": "service",
-    "code_entry": "internal/service/shop/service.go:50 Update",
-    "owner": "shop",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop/shop_role.go:19:AssignRolesToShop",
-    "kind": "service",
-    "code_entry": "internal/service/shop/shop_role.go:19 AssignRolesToShop",
-    "owner": "shop",
-    "summary": "业务方法 AssignRolesToShop",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.assign_roles_to_shop",
-    "action_name": "执行业务方法（AssignRolesToShop）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop/shop_role.go:95:DeleteShopRole",
-    "kind": "service",
-    "code_entry": "internal/service/shop/shop_role.go:95 DeleteShopRole",
-    "owner": "shop",
-    "summary": "业务方法 DeleteShopRole",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop.delete_shop_role",
-    "action_name": "执行业务方法（DeleteShopRole）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "shop",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_commission/service.go:412:CreateWithdrawalRequest",
-    "kind": "service",
-    "code_entry": "internal/service/shop_commission/service.go:412 CreateWithdrawalRequest",
-    "owner": "shop_commission",
-    "summary": "业务方法 CreateWithdrawalRequest",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_commission.create_withdrawal_request",
-    "action_name": "执行业务方法（CreateWithdrawalRequest）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "shop_commission",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_commission/service.go:627:ResolveCommissionRecord",
-    "kind": "service",
-    "code_entry": "internal/service/shop_commission/service.go:627 ResolveCommissionRecord",
-    "owner": "shop_commission",
-    "summary": "业务方法 ResolveCommissionRecord",
-    "audit_event": "必须",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_commission.resolve_commission_record",
-    "action_name": "执行业务方法（ResolveCommissionRecord）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "shop_commission",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_package_batch_allocation/service.go:47:UpdateExpiryBase",
-    "kind": "service",
-    "code_entry": "internal/service/shop_package_batch_allocation/service.go:47 UpdateExpiryBase",
-    "owner": "shop_package_batch_allocation",
-    "summary": "业务方法 UpdateExpiryBase",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_package_batch_allocation.update_expiry_base",
-    "action_name": "执行业务方法（UpdateExpiryBase）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_package_batch_allocation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_package_batch_allocation/service.go:97:BatchAllocate",
-    "kind": "service",
-    "code_entry": "internal/service/shop_package_batch_allocation/service.go:97 BatchAllocate",
-    "owner": "shop_package_batch_allocation",
-    "summary": "业务方法 BatchAllocate",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_package_batch_allocation.batch_allocate",
-    "action_name": "执行业务方法（BatchAllocate）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_package_batch_allocation",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_package_batch_pricing/service.go:44:BatchUpdatePricing",
-    "kind": "service",
-    "code_entry": "internal/service/shop_package_batch_pricing/service.go:44 BatchUpdatePricing",
-    "owner": "shop_package_batch_pricing",
-    "summary": "业务方法 BatchUpdatePricing",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_package_batch_pricing.batch_update_pricing",
-    "action_name": "执行业务方法（BatchUpdatePricing）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_package_batch_pricing",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_series_grant/service.go:1009:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/shop_series_grant/service.go:1009 Delete",
-    "owner": "shop_series_grant",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_series_grant.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_series_grant",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_series_grant/service.go:306:Create",
-    "kind": "service",
-    "code_entry": "internal/service/shop_series_grant/service.go:306 Create",
-    "owner": "shop_series_grant",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_series_grant.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_series_grant",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/shop_series_grant/service.go:734:Update",
-    "kind": "service",
-    "code_entry": "internal/service/shop_series_grant/service.go:734 Update",
-    "owner": "shop_series_grant",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "shop_series_grant.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "shop_series_grant",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/verification/service.go:36:SendCode",
-    "kind": "service",
-    "code_entry": "internal/service/verification/service.go:36 SendCode",
-    "owner": "verification",
-    "summary": "业务方法 SendCode",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "verification.send_code",
-    "action_name": "执行业务方法（SendCode）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "verification",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/wechat_config/service.go:191:Update",
-    "kind": "service",
-    "code_entry": "internal/service/wechat_config/service.go:191 Update",
-    "owner": "wechat_config",
-    "summary": "业务方法 Update",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wechat_config.update",
-    "action_name": "执行业务方法（Update）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/wechat_config/service.go:280:Delete",
-    "kind": "service",
-    "code_entry": "internal/service/wechat_config/service.go:280 Delete",
-    "owner": "wechat_config",
-    "summary": "业务方法 Delete",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wechat_config.delete",
-    "action_name": "执行业务方法（Delete）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/wechat_config/service.go:332:Activate",
-    "kind": "service",
-    "code_entry": "internal/service/wechat_config/service.go:332 Activate",
-    "owner": "wechat_config",
-    "summary": "业务方法 Activate",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wechat_config.activate",
-    "action_name": "执行业务方法（Activate）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/wechat_config/service.go:379:Deactivate",
-    "kind": "service",
-    "code_entry": "internal/service/wechat_config/service.go:379 Deactivate",
-    "owner": "wechat_config",
-    "summary": "业务方法 Deactivate",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wechat_config.deactivate",
-    "action_name": "执行业务方法（Deactivate）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "service:internal/service/wechat_config/service.go:67:Create",
-    "kind": "service",
-    "code_entry": "internal/service/wechat_config/service.go:67 Create",
-    "owner": "wechat_config",
-    "summary": "业务方法 Create",
-    "audit_event": "必须",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
-    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
-    "action_code": "wechat_config.create",
-    "action_name": "执行业务方法（Create）",
-    "category": "business",
-    "risk": "high",
-    "primary_resource": "wechat_config",
-    "affected_resource": "完整用例直接修改或引用的资源",
-    "actor_source": "由调用入口传入操作者与来源快照",
-    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
-    "transaction": "关键成功事件与业务事实同一 GORM 事务",
-    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
-    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
-    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
-    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:152:constants.TaskTypeOutboxDeliver",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:152 outboxHandler.Handle",
-    "owner": "outbox_deliver",
-    "summary": "处理异步任务 constants.TaskTypeOutboxDeliver",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "outbox_deliver.handle",
-    "action_name": "处理异步任务（constants.TaskTypeOutboxDeliver）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "outbox_deliver",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:418:constants.TaskTypeWeComApprovalSync",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:418 detailHandler.Handle",
-    "owner": "we_com_approval_sync",
-    "summary": "处理异步任务 constants.TaskTypeWeComApprovalSync",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "we_com_approval_sync.handle",
-    "action_name": "处理异步任务（constants.TaskTypeWeComApprovalSync）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "we_com_approval_sync",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:419:constants.TaskTypeWeComApprovalRecovery",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:419 recoveryHandler.Handle",
-    "owner": "we_com_approval_recovery",
-    "summary": "处理异步任务 constants.TaskTypeWeComApprovalRecovery",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "we_com_approval_recovery.handle",
-    "action_name": "处理异步任务（constants.TaskTypeWeComApprovalRecovery）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "we_com_approval_recovery",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:440:constants.TaskTypeAgentRechargeRecovery",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:440 handler.Handle",
-    "owner": "agent_recharge_recovery",
-    "summary": "处理异步任务 constants.TaskTypeAgentRechargeRecovery",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "agent_recharge_recovery.handle",
-    "action_name": "处理异步任务（constants.TaskTypeAgentRechargeRecovery）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "agent_recharge_recovery",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:812:constants.TaskTypeAuditDailyArchive",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:812 task.NewAuditDailyArchiveHandler.Handle",
-    "owner": "audit_daily_archive",
-    "summary": "处理异步任务 constants.TaskTypeAuditDailyArchive",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "audit_daily_archive.handle",
-    "action_name": "处理异步任务（constants.TaskTypeAuditDailyArchive）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "audit_daily_archive",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:814:constants.TaskTypeIntegrationDailyArchive",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:814 integrationHandler.HandleDaily",
-    "owner": "integration_daily_archive",
-    "summary": "处理异步任务 constants.TaskTypeIntegrationDailyArchive",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "integration_daily_archive.handle_daily",
-    "action_name": "处理异步任务（constants.TaskTypeIntegrationDailyArchive）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "integration_daily_archive",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:815:constants.TaskTypeIntegrationMonthlyFinalize",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:815 integrationHandler.HandleMonthlyFinalize",
-    "owner": "integration_monthly_finalize",
-    "summary": "处理异步任务 constants.TaskTypeIntegrationMonthlyFinalize",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "integration_monthly_finalize.handle_monthly_finalize",
-    "action_name": "处理异步任务（constants.TaskTypeIntegrationMonthlyFinalize）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "integration_monthly_finalize",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:816:constants.TaskTypeAuditMonthlyRetention",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:816 task.NewAuditMonthlyRetentionHandler.Handle",
-    "owner": "audit_monthly_retention",
-    "summary": "处理异步任务 constants.TaskTypeAuditMonthlyRetention",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "audit_monthly_retention.handle",
-    "action_name": "处理异步任务（constants.TaskTypeAuditMonthlyRetention）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "audit_monthly_retention",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:827:constants.TaskTypeAuditDailyArchive",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:827 task.NewAuditDailyArchiveHandler.Handle",
-    "owner": "audit_daily_archive",
-    "summary": "处理异步任务 constants.TaskTypeAuditDailyArchive",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "audit_daily_archive.handle",
-    "action_name": "处理异步任务（constants.TaskTypeAuditDailyArchive）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "audit_daily_archive",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:829:constants.TaskTypeIntegrationDailyArchive",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:829 integrationHandler.HandleDaily",
-    "owner": "integration_daily_archive",
-    "summary": "处理异步任务 constants.TaskTypeIntegrationDailyArchive",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "integration_daily_archive.handle_daily",
-    "action_name": "处理异步任务（constants.TaskTypeIntegrationDailyArchive）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "integration_daily_archive",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:830:constants.TaskTypeIntegrationMonthlyFinalize",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:830 integrationHandler.HandleMonthlyFinalize",
-    "owner": "integration_monthly_finalize",
-    "summary": "处理异步任务 constants.TaskTypeIntegrationMonthlyFinalize",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "integration_monthly_finalize.handle_monthly_finalize",
-    "action_name": "处理异步任务（constants.TaskTypeIntegrationMonthlyFinalize）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "integration_monthly_finalize",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:cmd/worker/main.go:831:constants.TaskTypeAuditMonthlyRetention",
-    "kind": "worker",
-    "code_entry": "cmd/worker/main.go:831 task.NewAuditMonthlyRetentionHandler.Handle",
-    "owner": "audit_monthly_retention",
-    "summary": "处理异步任务 constants.TaskTypeAuditMonthlyRetention",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "audit_monthly_retention.handle",
-    "action_name": "处理异步任务（constants.TaskTypeAuditMonthlyRetention）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "audit_monthly_retention",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:114:constants.TaskTypeIotCardImport",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:114 iotCardImportHandler.HandleIotCardImport",
-    "owner": "iot_card_import",
-    "summary": "处理异步任务 constants.TaskTypeIotCardImport",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "iot_card_import.handle_iot_card_import",
-    "action_name": "处理异步任务（constants.TaskTypeIotCardImport）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "iot_card_import",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:127:constants.TaskTypeOrderPackageInvalidate",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:127 orderPkgHandler.Handle",
-    "owner": "order_package_invalidate",
-    "summary": "处理异步任务 constants.TaskTypeOrderPackageInvalidate",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "order_package_invalidate.handle",
-    "action_name": "处理异步任务（constants.TaskTypeOrderPackageInvalidate）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order_package_invalidate",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:140:constants.TaskTypeAssetPackageBatchOrder",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:140 handler.Handle",
-    "owner": "asset_package_batch_order",
-    "summary": "处理异步任务 constants.TaskTypeAssetPackageBatchOrder",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "asset_package_batch_order.handle",
-    "action_name": "处理异步任务（constants.TaskTypeAssetPackageBatchOrder）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "asset_package_batch_order",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:160:constants.TaskTypeDeviceImport",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:160 deviceImportHandler.HandleDeviceImport",
-    "owner": "device_import",
-    "summary": "处理异步任务 constants.TaskTypeDeviceImport",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "device_import.handle_device_import",
-    "action_name": "处理异步任务（constants.TaskTypeDeviceImport）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "device_import",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:194:constants.TaskTypeExportDispatch",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:194 dispatchHandler.HandleExportDispatch",
-    "owner": "export_dispatch",
-    "summary": "处理异步任务 constants.TaskTypeExportDispatch",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "export_dispatch.handle_export_dispatch",
-    "action_name": "处理异步任务（constants.TaskTypeExportDispatch）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_dispatch",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:197:constants.TaskTypeExportShard",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:197 shardHandler.HandleExportShard",
-    "owner": "export_shard",
-    "summary": "处理异步任务 constants.TaskTypeExportShard",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "export_shard.handle_export_shard",
-    "action_name": "处理异步任务（constants.TaskTypeExportShard）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_shard",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:200:constants.TaskTypeExportFinalize",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:200 finalizeHandler.HandleExportFinalize",
-    "owner": "export_finalize",
-    "summary": "处理异步任务 constants.TaskTypeExportFinalize",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "业务任务及明细表是批量结果权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "export_finalize.handle_export_finalize",
-    "action_name": "处理异步任务（constants.TaskTypeExportFinalize）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "export_finalize",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:224:constants.TaskTypeCommissionStatsUpdate",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:224 updateHandler.HandleCommissionStatsUpdate",
-    "owner": "commission_stats_update",
-    "summary": "处理异步任务 constants.TaskTypeCommissionStatsUpdate",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "commission_stats_update.handle_commission_stats_update",
-    "action_name": "处理异步任务（constants.TaskTypeCommissionStatsUpdate）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_stats_update",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:227:constants.TaskTypeCommissionStatsSync",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:227 syncHandler.HandleCommissionStatsSync",
-    "owner": "commission_stats_sync",
-    "summary": "处理异步任务 constants.TaskTypeCommissionStatsSync",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "commission_stats_sync.handle_commission_stats_sync",
-    "action_name": "处理异步任务（constants.TaskTypeCommissionStatsSync）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_stats_sync",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:230:constants.TaskTypeCommissionStatsArchive",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:230 archiveHandler.HandleCommissionStatsArchive",
-    "owner": "commission_stats_archive",
-    "summary": "处理异步任务 constants.TaskTypeCommissionStatsArchive",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "commission_stats_archive.handle_commission_stats_archive",
-    "action_name": "处理异步任务（constants.TaskTypeCommissionStatsArchive）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission_stats_archive",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:240:constants.TaskTypeCommission",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:240 commissionCalculationHandler.HandleCommissionCalculation",
-    "owner": "commission",
-    "summary": "处理异步任务 constants.TaskTypeCommission",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "commission.handle_commission_calculation",
-    "action_name": "处理异步任务（constants.TaskTypeCommission）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "commission",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:261:constants.TaskTypePollingRealname",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:261 realnameHandler.Handle",
-    "owner": "polling_realname",
-    "summary": "处理异步任务 constants.TaskTypePollingRealname",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "必须：每次实际请求或未发送裁决均记录",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "polling_realname.handle",
-    "action_name": "处理异步任务（constants.TaskTypePollingRealname）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_realname",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:262:constants.TaskTypePollingCarddata",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:262 carddataHandler.Handle",
-    "owner": "polling_carddata",
-    "summary": "处理异步任务 constants.TaskTypePollingCarddata",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "必须：每次实际请求或未发送裁决均记录",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "polling_carddata.handle",
-    "action_name": "处理异步任务（constants.TaskTypePollingCarddata）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_carddata",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:263:constants.TaskTypePollingPackage",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:263 packageHandler.Handle",
-    "owner": "polling_package",
-    "summary": "处理异步任务 constants.TaskTypePollingPackage",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "必须：每次实际请求或未发送裁决均记录",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "polling_package.handle",
-    "action_name": "处理异步任务（constants.TaskTypePollingPackage）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_package",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:264:constants.TaskTypePollingProtect",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:264 protectHandler.Handle",
-    "owner": "polling_protect",
-    "summary": "处理异步任务 constants.TaskTypePollingProtect",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "必须：每次实际请求或未发送裁决均记录",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "polling_protect.handle",
-    "action_name": "处理异步任务（constants.TaskTypePollingProtect）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_protect",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:265:constants.TaskTypePollingCardStatus",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:265 cardStatusHandler.Handle",
-    "owner": "polling_card_status",
-    "summary": "处理异步任务 constants.TaskTypePollingCardStatus",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "必须：每次实际请求或未发送裁决均记录",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "polling_card_status.handle",
-    "action_name": "处理异步任务（constants.TaskTypePollingCardStatus）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "polling_card_status",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:279:constants.TaskTypePackageFirstActivation",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:279 packageActivationHandler.HandlePackageFirstActivation",
-    "owner": "package_first_activation",
-    "summary": "处理异步任务 constants.TaskTypePackageFirstActivation",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "package_first_activation.handle_package_first_activation",
-    "action_name": "处理异步任务（constants.TaskTypePackageFirstActivation）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_first_activation",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:282:constants.TaskTypePackageQueueActivation",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:282 packageActivationHandler.HandlePackageQueueActivation",
-    "owner": "package_queue_activation",
-    "summary": "处理异步任务 constants.TaskTypePackageQueueActivation",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "package_queue_activation.handle_package_queue_activation",
-    "action_name": "处理异步任务（constants.TaskTypePackageQueueActivation）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_queue_activation",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:288:constants.TaskTypeOrderExpire",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:288 orderExpireHandler.HandleOrderExpire",
-    "owner": "order_expire",
-    "summary": "处理异步任务 constants.TaskTypeOrderExpire",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "order_expire.handle_order_expire",
-    "action_name": "处理异步任务（constants.TaskTypeOrderExpire）",
-    "category": "finance",
-    "risk": "normal",
-    "primary_resource": "order_expire",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:294:constants.TaskTypeAlertCheck",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:294 alertCheckHandler.HandleAlertCheck",
-    "owner": "alert_check",
-    "summary": "处理异步任务 constants.TaskTypeAlertCheck",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "alert_check.handle_alert_check",
-    "action_name": "处理异步任务（constants.TaskTypeAlertCheck）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "alert_check",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:300:constants.TaskTypeDataCleanup",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:300 dataCleanupHandler.HandleDataCleanup",
-    "owner": "data_cleanup",
-    "summary": "处理异步任务 constants.TaskTypeDataCleanup",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "data_cleanup.handle_data_cleanup",
-    "action_name": "处理异步任务（constants.TaskTypeDataCleanup）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "data_cleanup",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:307:constants.TaskTypeNotificationCleanup",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:307 cleanupHandler.Handle",
-    "owner": "notification_cleanup",
-    "summary": "处理异步任务 constants.TaskTypeNotificationCleanup",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "notification_cleanup.handle",
-    "action_name": "处理异步任务（constants.TaskTypeNotificationCleanup）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "notification_cleanup",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:316:constants.TaskTypePackageExpiryReminder",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:316 handler.Handle",
-    "owner": "package_expiry_reminder",
-    "summary": "处理异步任务 constants.TaskTypePackageExpiryReminder",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "package_expiry_reminder.handle",
-    "action_name": "处理异步任务（constants.TaskTypePackageExpiryReminder）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "package_expiry_reminder",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:335:constants.TaskTypeAutoPurchaseAfterRecharge",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:335 autoPurchaseHandler.ProcessTask",
-    "owner": "auto_purchase_after_recharge",
-    "summary": "处理异步任务 constants.TaskTypeAutoPurchaseAfterRecharge",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "auto_purchase_after_recharge.process_task",
-    "action_name": "处理异步任务（constants.TaskTypeAutoPurchaseAfterRecharge）",
-    "category": "finance",
-    "risk": "high",
-    "primary_resource": "auto_purchase_after_recharge",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:342:constants.TaskTypeDailyTrafficFlush",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:342 dailyTrafficFlushHandler.HandleDailyTrafficFlush",
-    "owner": "daily_traffic_flush",
-    "summary": "处理异步任务 constants.TaskTypeDailyTrafficFlush",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "daily_traffic_flush.handle_daily_traffic_flush",
-    "action_name": "处理异步任务（constants.TaskTypeDailyTrafficFlush）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "daily_traffic_flush",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:70:constants.TaskTypeEmailSend",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:70 emailHandler.HandleEmailSend",
-    "owner": "email_send",
-    "summary": "处理异步任务 constants.TaskTypeEmailSend",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "email_send.handle_email_send",
-    "action_name": "处理异步任务（constants.TaskTypeEmailSend）",
-    "category": "business",
-    "risk": "normal",
-    "primary_resource": "email_send",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  },
-  {
-    "key": "worker:pkg/queue/handler.go:97:constants.TaskTypeCardObservationSeries",
-    "kind": "worker",
-    "code_entry": "pkg/queue/handler.go:97 handler.Handle",
-    "owner": "card_observation_series",
-    "summary": "处理异步任务 constants.TaskTypeCardObservationSeries",
-    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
-    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
-    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
-    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
-    "action_code": "card_observation_series.handle",
-    "action_name": "处理异步任务（constants.TaskTypeCardObservationSeries）",
-    "category": "asset",
-    "risk": "normal",
-    "primary_resource": "card_observation_series",
-    "affected_resource": "任务载荷定位的直接业务资源",
-    "actor_source": "system_task/asynq",
-    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
-    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
-    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
-    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
-    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
-    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
-  }
-]
diff --git a/README.md b/README.md
index c850030..a71f569 100644
--- a/README.md
+++ b/README.md
@@ -209,9 +209,9 @@ default:
 - 新增操作审计日志系统（记录所有账号操作：create/update/delete/assign_roles/remove_role）
 
 **文档**：
-- [迁移指南](docs/account-management-refactor/迁移指南.md) - 前端接口迁移步骤
-- [功能总结](docs/account-management-refactor/功能总结.md) - 重构内容和安全提升
-- [API 文档](docs/account-management-refactor/API文档.md) - 详细接口说明
+- 迁移指南 - 前端接口迁移步骤
+- 功能总结 - 重构内容和安全提升
+- API 文档 - 详细接口说明
 
 ---
 
@@ -224,24 +224,24 @@ default:
 - **统一错误处理**：全局 ErrorHandler 统一处理所有 API 错误，返回一致的 JSON 格式（包含错误码、消息、时间戳）；Panic 自动恢复防止服务崩溃；错误分类处理（客户端 4xx、服务端 5xx）和日志级别控制；敏感信息自动脱敏保护
 - **数据持久化**：GORM + PostgreSQL 集成，提供完整的 CRUD 操作、事务支持和数据库迁移能力
 - **异步任务处理**：Asynq 任务队列集成，支持任务提交、后台执行、自动重试和幂等性保障，实现邮件发送、数据同步等异步任务
-- **统一导出任务系统**：新增全局导出任务入口（`/api/admin/export-tasks`），支持 `scene=device/iot_card`、`format=xlsx/csv`、异步分片执行、任务取消、详情直出 24 小时下载链接；详见 [功能总结](docs/unified-export-task-system/功能总结.md) 与 [验收记录](docs/unified-export-task-system/验收记录.md)
-- **资产操作审计日志**：新增 `tb_asset_operation_log`，统一覆盖卡/设备敏感写操作与统一资产入口，记录 `success/failed/denied`、前后镜像、请求上下文、批量统计并支持敏感字段脱敏；详见 [功能总结](docs/add-asset-operation-audit-log/功能总结.md)、[接口回放示例](docs/add-asset-operation-audit-log/接口回放示例.md) 与 [SQL 验收脚本](docs/add-asset-operation-audit-log/手工验收脚本.sql)
-- **RBAC 权限系统**：完整的基于角色的访问控制，支持账号、角色、权限的多对多关联和层级关系；基于店铺层级的自动数据权限过滤，实现多租户数据隔离；使用 PostgreSQL WITH RECURSIVE 查询下级店铺并通过 Redis 缓存优化性能；完整的权限检查功能支持路由级别的细粒度权限控制，支持平台过滤（web/h5/all）和超级管理员自动跳过（详见 [功能总结](docs/004-rbac-data-permission/功能总结.md)、[使用指南](docs/004-rbac-data-permission/使用指南.md) 和 [权限检查使用指南](docs/permission-check-usage.md)）
-- **商户管理**：完整的商户（Shop）和商户账号管理功能，支持商户创建时自动创建初始坐席账号、删除商户时批量禁用关联账号、账号密码重置等功能（详见 [使用指南](docs/shop-management/使用指南.md) 和 [API 文档](docs/shop-management/API文档.md)）
-- **B 端认证系统**：完整的后台和 H5 认证功能，支持基于 Redis 的 Token 管理和双令牌机制（Access Token 24h + Refresh Token 7天）；包含登录、登出、Token 刷新、用户信息查询和密码修改功能；通过用户类型隔离确保后台（SuperAdmin、Platform、Agent）和 H5（Agent、Enterprise）的访问控制；**登录响应包含菜单树和按钮权限**（menus/buttons），前端无需二次处理直接渲染侧边栏和控制按钮显示；详见 [API 文档](docs/api/auth.md)、[使用指南](docs/auth-usage-guide.md)、[架构说明](docs/auth-architecture.md) 和 [菜单权限使用指南](docs/login-menu-button-response/使用指南.md)
-- **B 端认证系统**：完整的后台和 H5 认证功能，支持基于 Redis 的 Token 管理和双令牌机制（Access Token 24h + Refresh Token 7天）；包含登录、登出、Token 刷新、用户信息查询和密码修改功能；通过用户类型隔离确保后台（SuperAdmin、Platform、Agent）和 H5（Agent、Enterprise）的访问控制；详见 [API 文档](docs/api/auth.md)、[使用指南](docs/auth-usage-guide.md) 和 [架构说明](docs/auth-architecture.md)
+- **统一导出任务系统**：新增全局导出任务入口（`/api/admin/export-tasks`），支持 `scene=device/iot_card`、`format=xlsx/csv`、异步分片执行、任务取消、详情直出 24 小时下载链接；详见 功能总结 与 验收记录
+- **资产操作审计日志**：新增 `tb_asset_operation_log`，统一覆盖卡/设备敏感写操作与统一资产入口，记录 `success/failed/denied`、前后镜像、请求上下文、批量统计并支持敏感字段脱敏；详见 功能总结、接口回放示例 与 SQL 验收脚本
+- **RBAC 权限系统**：完整的基于角色的访问控制，支持账号、角色、权限的多对多关联和层级关系；基于店铺层级的自动数据权限过滤，实现多租户数据隔离；使用 PostgreSQL WITH RECURSIVE 查询下级店铺并通过 Redis 缓存优化性能；完整的权限检查功能支持路由级别的细粒度权限控制，支持平台过滤（web/h5/all）和超级管理员自动跳过（详见 功能总结、使用指南 和 权限检查使用指南）
+- **商户管理**：完整的商户（Shop）和商户账号管理功能，支持商户创建时自动创建初始坐席账号、删除商户时批量禁用关联账号、账号密码重置等功能（详见 使用指南 和 API 文档）
+- **B 端认证系统**：完整的后台和 H5 认证功能，支持基于 Redis 的 Token 管理和双令牌机制（Access Token 24h + Refresh Token 7天）；包含登录、登出、Token 刷新、用户信息查询和密码修改功能；通过用户类型隔离确保后台（SuperAdmin、Platform、Agent）和 H5（Agent、Enterprise）的访问控制；**登录响应包含菜单树和按钮权限**（menus/buttons），前端无需二次处理直接渲染侧边栏和控制按钮显示；详见 API 文档、使用指南、架构说明 和 菜单权限使用指南
+- **B 端认证系统**：完整的后台和 H5 认证功能，支持基于 Redis 的 Token 管理和双令牌机制（Access Token 24h + Refresh Token 7天）；包含登录、登出、Token 刷新、用户信息查询和密码修改功能；通过用户类型隔离确保后台（SuperAdmin、Platform、Agent）和 H5（Agent、Enterprise）的访问控制；详见 API 文档、使用指南 和 架构说明
 - **生命周期管理**：物联网卡/号卡的开卡、激活、停机、复机、销户
-- **代理商体系**：层级管理和分佣结算，支持差价佣金和一次性佣金两种佣金类型，详见 [套餐与佣金业务模型](docs/commission-package-model.md)
-- **代理开放接口**：新增 `/api/open/v1` 签名接口，代理店铺第三方系统可调用卡流量、卡状态、实名状态、套餐列表、预充值钱包余额/流水和钱包套餐购买能力。详见 [对接说明](docs/agent-open-api/功能总结.md) 与 [误发差价佣金修复说明](docs/agent-open-api/开放接口误发差价佣金修复说明.md)
+- **代理商体系**：层级管理和分佣结算，支持差价佣金和一次性佣金两种佣金类型，详见 套餐与佣金业务模型
+- **代理开放接口**：新增 `/api/open/v1` 签名接口，代理店铺第三方系统可调用卡流量、卡状态、实名状态、套餐列表、预充值钱包余额/流水和钱包套餐购买能力。详见 对接说明 与 误发差价佣金修复说明
 - **批量同步**：卡状态、实名状态、流量使用情况
-- **轮询系统**：IoT 卡实名状态、流量使用、套餐余额的定时轮询检查；支持配置化轮询策略、动态并发控制、告警系统、数据清理和手动触发功能；详见 [轮询系统文档](docs/polling-system/README.md)
-- **套餐系统升级**：完整的套餐生命周期管理，支持主套餐排队激活、加油包绑定主套餐、囤货待实名激活、流量按优先级扣减、自然月/按天有效期计算、日/月/年流量重置、客户端流量查询和套餐流量详单；详见 [套餐系统升级文档](docs/package-system-upgrade/)
-- **套餐价格回退与平台赠送策略**：新增价格配置状态、普通套餐成本价回退、赠送套餐独立语义、平台后台赠送订单发放和历史 0 价复核清单；详见 [功能总结](docs/package-price-fallback-and-platform-gift-policy/功能总结.md) 与 [最终验收清单](docs/package-price-fallback-and-platform-gift-policy/最终验收清单.md)
-- **分佣验证指引**：对代理分佣的冻结、解冻、提现校验流程进行了结构化说明与流程图，详见 [分佣逻辑正确与否验证](docs/优化说明/分佣逻辑正确与否验证.md)
-- **对象存储**：S3 兼容的对象存储服务集成（联通云 OSS），支持预签名 URL 上传、文件下载、临时文件处理；用于 ICCID 批量导入、数据导出等场景；详见 [使用指南](docs/object-storage/使用指南.md) 和 [前端接入指南](docs/object-storage/前端接入指南.md)
-- **微信集成**：完整的微信公众号 OAuth 认证和微信支付功能（JSAPI + H5），使用 PowerWeChat v3 SDK；支持个人客户微信授权登录、账号绑定、微信内支付和浏览器 H5 支付；支付回调自动验证签名和幂等性处理；详见 [使用指南](docs/wechat-integration/使用指南.md) 和 [API 文档](docs/wechat-integration/API文档.md)
-- **C 端微信 AppID 获取接口**：新增免登录接口 `GET /api/c/v1/wechat/appid`，仅返回当前生效微信配置中的公众号 `app_id`，供前端在拉起微信授权或初始化微信能力前动态获取；详见 [功能总结](docs/client-wechat-appid/功能总结.md)
-- **订单超时自动取消**：待支付订单（微信/支付宝）30 分钟超时自动取消，支持钱包余额解冻；使用 Asynq Scheduler 每分钟扫描，取代原有 time.Ticker 实现；同时将告警检查和数据清理迁移至 Asynq Scheduler 统一调度；详见 [功能总结](docs/order-expiration/功能总结.md)
+- **轮询系统**：IoT 卡实名状态、流量使用、套餐余额的定时轮询检查；支持配置化轮询策略、动态并发控制、告警系统、数据清理和手动触发功能；详见 轮询系统文档
+- **套餐系统升级**：完整的套餐生命周期管理，支持主套餐排队激活、加油包绑定主套餐、囤货待实名激活、流量按优先级扣减、自然月/按天有效期计算、日/月/年流量重置、客户端流量查询和套餐流量详单；详见 套餐系统升级文档
+- **套餐价格回退与平台赠送策略**：新增价格配置状态、普通套餐成本价回退、赠送套餐独立语义、平台后台赠送订单发放和历史 0 价复核清单；详见 功能总结 与 最终验收清单
+- **分佣验证指引**：对代理分佣的冻结、解冻、提现校验流程进行了结构化说明与流程图，详见 分佣逻辑正确与否验证
+- **对象存储**：S3 兼容的对象存储服务集成（联通云 OSS），支持预签名 URL 上传、文件下载、临时文件处理；用于 ICCID 批量导入、数据导出等场景；详见 使用指南 和 前端接入指南
+- **微信集成**：完整的微信公众号 OAuth 认证和微信支付功能（JSAPI + H5），使用 PowerWeChat v3 SDK；支持个人客户微信授权登录、账号绑定、微信内支付和浏览器 H5 支付；支付回调自动验证签名和幂等性处理；详见 使用指南 和 API 文档
+- **C 端微信 AppID 获取接口**：新增免登录接口 `GET /api/c/v1/wechat/appid`，仅返回当前生效微信配置中的公众号 `app_id`，供前端在拉起微信授权或初始化微信能力前动态获取；详见 功能总结
+- **订单超时自动取消**：待支付订单（微信/支付宝）30 分钟超时自动取消，支持钱包余额解冻；使用 Asynq Scheduler 每分钟扫描，取代原有 time.Ticker 实现；同时将告警检查和数据清理迁移至 Asynq Scheduler 统一调度；详见 功能总结
 
 ### 导出任务接口示例
 
@@ -330,8 +330,8 @@ tb_account (账号表 - 已修改)
 ```
 
 详细设计文档参见：
-- [设计文档](openspec/changes/add-user-organization-model/design.md)
-- [提案文档](openspec/changes/add-user-organization-model/proposal.md)
+- 设计文档
+- 提案文档
 
 ## 数据权限模型
 
@@ -369,8 +369,8 @@ allOrders, err := orderStore.List(ctx)  // 查询所有订单（仅限特殊场
 ```
 
 详细说明参见：
-- [数据权限清理总结](docs/remove-legacy-rbac-cleanup/清理总结.md)
-- [RBAC 权限使用指南](docs/004-rbac-data-permission/使用指南.md)
+- 数据权限清理总结
+- RBAC 权限使用指南
 
 ## 快速开始
 
@@ -413,7 +413,7 @@ export JUNHONG_DEFAULT_ADMIN_PHONE="自定义手机号"
 - 建议首次登录后立即修改默认密码
 - 初始化日志记录在 `logs/app.log` 中
 
-详细设置和测试说明请参阅 [快速开始指南](specs/001-fiber-middleware-integration/quickstart.md)。
+详细设置和测试说明请参阅 快速开始指南。
 
 ## 项目结构
 
@@ -761,7 +761,7 @@ services:
 
 ### 完整环境变量列表
 
-详见 [环境变量配置文档](docs/environment-variables.md)
+详见 环境变量配置文档
 
 ## 测试
 
@@ -807,7 +807,7 @@ go test -v ./tests/integration/...
 
 ### 测试连接管理
 
-测试使用全局单例连接池，性能提升 6-7 倍。详见 [测试连接管理规范](docs/testing/test-connection-guide.md)。
+测试使用全局单例连接池，性能提升 6-7 倍。详见 测试连接管理规范。
 
 **标准写法**:
 ```go
@@ -863,9 +863,9 @@ Handler (HTTP) → Service (业务逻辑) → Store (数据访问) → Model (
 - 在关键扩展点添加 TODO 标记
 
 **详细文档**：
-- [变更提案](openspec/changes/refactor-framework-cleanup/proposal.md)
-- [设计文档](openspec/changes/refactor-framework-cleanup/design.md)
-- [任务清单](openspec/changes/refactor-framework-cleanup/tasks.md)
+- 变更提案
+- 设计文档
+- 任务清单
 
 ## 开发规范
 
@@ -917,22 +917,22 @@ rdb.Set(ctx, key, status, time.Hour)
 
 ### 开发规范
 
-- **[API 文档生成规范](docs/api-documentation-guide.md)**：路由注册规范、DTO 规范、OpenAPI 文档生成流程
+- **API 文档生成规范**：路由注册规范、DTO 规范、OpenAPI 文档生成流程
 - **[数据库验证规范](AGENTS.md#数据库验证规范)**：使用 PostgreSQL MCP 验证接口逻辑和业务数据的正确性
 - **[开发规范总览](AGENTS.md)**：完整的项目开发规范（必读）
 
 ### 功能指南
 
-- **[快速开始指南](specs/001-fiber-middleware-integration/quickstart.md)**：详细设置和测试说明
-- **[限流指南](docs/rate-limiting.md)**：全面的限流配置和使用
-- **[错误处理使用指南](docs/003-error-handling/使用指南.md)**：错误码参考、Handler 使用、客户端处理、最佳实践
-- **[错误处理架构说明](docs/003-error-handling/架构说明.md)**：架构设计、性能优化、扩展性说明
-- **[订单操作者与产业链佣金语义修复](docs/feature-001-order-operator-and-chain-commission-semantics/功能总结.md)**：说明订单操作者账号化、佣金流程状态与业务结果拆分、以及手工验收口径
+- **快速开始指南**：详细设置和测试说明
+- **限流指南**：全面的限流配置和使用
+- **错误处理使用指南**：错误码参考、Handler 使用、客户端处理、最佳实践
+- **错误处理架构说明**：架构设计、性能优化、扩展性说明
+- **订单操作者与产业链佣金语义修复**：说明订单操作者账号化、佣金流程状态与业务结果拆分、以及手工验收口径
 
 ### 架构设计
 
-- **[实现计划](specs/001-fiber-middleware-integration/plan.md)**：设计决策和架构
-- **[数据模型](specs/001-fiber-middleware-integration/data-model.md)**：配置结构和 Redis 架构
+- **实现计划**：设计决策和架构
+- **数据模型**：配置结构和 Redis 架构
 
 ## 技术栈
 
diff --git a/internal/application/agentrecharge/offline_creation.go b/internal/application/agentrecharge/offline_creation.go
index d11c373..f39395a 100644
--- a/internal/application/agentrecharge/offline_creation.go
+++ b/internal/application/agentrecharge/offline_creation.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/bytedance/sonic"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	approvalapp "github.com/break/junhong_cmp_fiber/internal/application/approval"
 	"github.com/break/junhong_cmp_fiber/internal/model"
@@ -46,6 +47,94 @@ func NewOfflineCreationService(db *gorm.DB, approval approvalapp.Port, audit Rec
 	return &OfflineCreationService{db: db, approval: approval, audit: audit}
 }
 
+// TriggerHistorical 为历史待审批线下代充值补发一次企业微信审批。
+func (s *OfflineCreationService) TriggerHistorical(ctx context.Context, recordID uint) (*CreateOfflineResult, error) {
+	if s == nil || s.db == nil || s.approval == nil || s.audit == nil || recordID == 0 {
+		return nil, errors.New(errors.CodeServiceUnavailable, "员工线下代充值审批能力未配置")
+	}
+
+	var record model.AgentRechargeRecord
+	if err := s.db.WithContext(ctx).First(&record, recordID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, errors.New(errors.CodeNotFound, "充值记录不存在")
+		}
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "查询历史线下代充值申请失败")
+	}
+	if record.PaymentMethod != constants.RechargeMethodOffline || record.Status != constants.RechargeStatusPending || record.ApprovalInstanceID != nil {
+		return nil, errors.New(errors.CodeConflict, "充值申请状态不允许补发审批")
+	}
+	account, shop, wallet, err := s.loadHistoricalFacts(ctx, &record)
+	if err != nil {
+		return nil, err
+	}
+	preparation, err := s.approval.Prepare(ctx, approvalapp.PrepareRequest{
+		BusinessType: constants.ApprovalBusinessTypeOfflineRecharge, SubmitterAccountID: record.UserID,
+		CorrelationID: record.RechargeNo,
+	})
+	if err != nil {
+		return nil, err
+	}
+	command := CreateOfflineCommand{
+		SubmitterAccountID: record.UserID, SubmitterUserType: account.UserType, ShopID: record.ShopID,
+		RechargeNo: record.RechargeNo, Amount: record.Amount,
+		PaymentVoucherKeys: []string(record.PaymentVoucherKey), Remark: record.Remark,
+	}
+	submitterSnapshot, requestSnapshot, err := offlineApprovalSnapshots(command, account.Username, shop.ShopName)
+	if err != nil {
+		return nil, err
+	}
+
+	var approvalStatus int
+	err = s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var current model.AgentRechargeRecord
+		if err := tx.WithContext(ctx).Clauses(clause.Locking{Strength: "UPDATE"}).First(&current, recordID).Error; err != nil {
+			if err == gorm.ErrRecordNotFound {
+				return errors.New(errors.CodeNotFound, "充值记录不存在")
+			}
+			return errors.Wrap(errors.CodeDatabaseError, err, "锁定历史线下代充值申请失败")
+		}
+		if current.PaymentMethod != constants.RechargeMethodOffline || current.Status != constants.RechargeStatusPending || current.ApprovalInstanceID != nil {
+			return errors.New(errors.CodeConflict, "充值申请状态不允许补发审批")
+		}
+		reference, err := s.approval.CreateInTx(ctx, tx, approvalapp.CreateRequest{
+			Preparation: preparation, BusinessType: constants.ApprovalBusinessTypeOfflineRecharge,
+			BusinessID: current.ID, SubmitterAccountID: current.UserID,
+			SubmitterSnapshot: submitterSnapshot, RequestSnapshot: requestSnapshot,
+			CorrelationID: current.RechargeNo,
+		})
+		if err != nil {
+			return err
+		}
+		result := tx.WithContext(ctx).Model(&model.AgentRechargeRecord{}).
+			Where("id = ? AND payment_method = ? AND status = ? AND approval_instance_id IS NULL", current.ID, constants.RechargeMethodOffline, constants.RechargeStatusPending).
+			Update("approval_instance_id", reference.InstanceID)
+		if result.Error != nil {
+			return errors.Wrap(errors.CodeDatabaseError, result.Error, "关联线下代充值审批实例失败")
+		}
+		if result.RowsAffected != 1 {
+			return errors.New(errors.CodeConflict, "线下代充值审批实例关联已变化")
+		}
+		current.ApprovalInstanceID = &reference.InstanceID
+		record = current
+		approvalStatus = reference.Status
+		var instance model.ApprovalInstance
+		if err := tx.WithContext(ctx).First(&instance, reference.InstanceID).Error; err != nil {
+			return errors.Wrap(errors.CodeDatabaseError, err, "查询线下代充值审批审计快照失败")
+		}
+		return s.audit.WriteAgentRecharge(ctx, tx, RechargeAudit{
+			ActionCode: constants.AuditActionAgentRechargeCreated, Summary: "补发员工线下代充值审批",
+			Record: &current, Approval: &instance, Wallet: wallet,
+			AfterData: map[string]any{"status": current.Status, "approval_instance_id": current.ApprovalInstanceID},
+		})
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &CreateOfflineResult{
+		Record: &record, ShopName: shop.ShopName, SubmitterName: account.Username, ApprovalStatus: approvalStatus,
+	}, nil
+}
+
 // Execute 在业务写入前校验审批渠道，并在同一事务保存充值申请、审批实例和提交 Outbox。
 func (s *OfflineCreationService) Execute(ctx context.Context, command CreateOfflineCommand) (*CreateOfflineResult, error) {
 	if s == nil || s.db == nil || s.approval == nil || s.audit == nil {
@@ -140,6 +229,38 @@ func validateCreateOfflineCommand(command CreateOfflineCommand) error {
 	return nil
 }
 
+func (s *OfflineCreationService) loadHistoricalFacts(
+	ctx context.Context, record *model.AgentRechargeRecord,
+) (*model.Account, *model.Shop, *model.AgentWallet, error) {
+	if record == nil || record.UserID == 0 || record.ShopID == 0 || record.AgentWalletID == 0 {
+		return nil, nil, nil, errors.New(errors.CodeInvalidParam)
+	}
+	var account model.Account
+	if err := s.db.WithContext(ctx).Where("id = ? AND status = ?", record.UserID, constants.StatusEnabled).First(&account).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, nil, nil, errors.New(errors.CodeForbidden, "原创建账号不可用")
+		}
+		return nil, nil, nil, errors.Wrap(errors.CodeDatabaseError, err, "查询历史线下代充值创建人失败")
+	}
+	var shop model.Shop
+	if err := s.db.WithContext(ctx).Where("id = ?", record.ShopID).First(&shop).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, nil, nil, errors.New(errors.CodeNotFound, "目标店铺不存在")
+		}
+		return nil, nil, nil, errors.Wrap(errors.CodeDatabaseError, err, "查询历史线下代充值目标店铺失败")
+	}
+	var wallet model.AgentWallet
+	if err := s.db.WithContext(ctx).
+		Where("id = ? AND shop_id = ? AND wallet_type = ? AND status = ?", record.AgentWalletID, record.ShopID, constants.AgentWalletTypeMain, constants.AgentWalletStatusNormal).
+		First(&wallet).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, nil, nil, errors.New(errors.CodeWalletNotFound, "原充值主钱包不存在或不可用")
+		}
+		return nil, nil, nil, errors.Wrap(errors.CodeDatabaseError, err, "查询历史线下代充值主钱包失败")
+	}
+	return &account, &shop, &wallet, nil
+}
+
 func (s *OfflineCreationService) loadCreationFacts(
 	ctx context.Context,
 	command CreateOfflineCommand,
diff --git a/internal/application/refundapproval/creation.go b/internal/application/refundapproval/creation.go
index af6c774..9f239c6 100644
--- a/internal/application/refundapproval/creation.go
+++ b/internal/application/refundapproval/creation.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/bytedance/sonic"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 
 	approvalapp "github.com/break/junhong_cmp_fiber/internal/application/approval"
 	"github.com/break/junhong_cmp_fiber/internal/model"
@@ -55,6 +56,99 @@ func NewCreationService(db *gorm.DB, approval approvalapp.Port, audit AuditWrite
 }
 
 // Execute 在业务写入前校验审批渠道，并在同一事务冻结退款事实和审批事实。
+// TriggerHistorical 为历史待审批退款补发一次企业微信审批。
+func (s *CreationService) TriggerHistorical(ctx context.Context, refundID uint) (*CreateResult, error) {
+	if s == nil || s.db == nil || s.approval == nil || s.audit == nil || refundID == 0 {
+		return nil, errors.New(errors.CodeServiceUnavailable, "退款审批能力未配置")
+	}
+
+	var refund model.RefundRequest
+	if err := s.db.WithContext(ctx).First(&refund, refundID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, errors.New(errors.CodeNotFound, "退款申请不存在")
+		}
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "查询历史退款申请失败")
+	}
+	if refund.Status != model.RefundStatusPending || refund.ApprovalInstanceID != nil {
+		return nil, errors.New(errors.CodeConflict, "退款申请状态不允许补发审批")
+	}
+
+	account, err := s.loadSubmitter(ctx, refund.Creator)
+	if err != nil {
+		return nil, err
+	}
+	var order model.Order
+	if err := s.db.WithContext(ctx).First(&order, refund.OrderID).Error; err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, errors.New(errors.CodeNotFound, "退款关联订单不存在")
+		}
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "查询退款关联订单失败")
+	}
+	preparation, err := s.approval.Prepare(ctx, approvalapp.PrepareRequest{
+		BusinessType: constants.ApprovalBusinessTypeRefund, SubmitterAccountID: refund.Creator,
+		CorrelationID: refund.RefundNo,
+	})
+	if err != nil {
+		return nil, err
+	}
+	submitterSnapshot, requestSnapshot, err := refundSnapshots(&refund, account)
+	if err != nil {
+		return nil, err
+	}
+
+	var approvalStatus int
+	err = s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var current model.RefundRequest
+		if err := tx.WithContext(ctx).Clauses(clause.Locking{Strength: "UPDATE"}).First(&current, refundID).Error; err != nil {
+			if err == gorm.ErrRecordNotFound {
+				return errors.New(errors.CodeNotFound, "退款申请不存在")
+			}
+			return errors.Wrap(errors.CodeDatabaseError, err, "锁定历史退款申请失败")
+		}
+		if current.Status != model.RefundStatusPending || current.ApprovalInstanceID != nil {
+			return errors.New(errors.CodeConflict, "退款申请状态不允许补发审批")
+		}
+
+		var currentOrder model.Order
+		if err := tx.WithContext(ctx).First(&currentOrder, current.OrderID).Error; err != nil {
+			return errors.Wrap(errors.CodeDatabaseError, err, "查询退款关联订单失败")
+		}
+		reference, err := s.approval.CreateInTx(ctx, tx, approvalapp.CreateRequest{
+			Preparation: preparation, BusinessType: constants.ApprovalBusinessTypeRefund,
+			BusinessID: current.ID, SubmitterAccountID: current.Creator,
+			SubmitterSnapshot: submitterSnapshot, RequestSnapshot: requestSnapshot,
+			CorrelationID: current.RefundNo,
+		})
+		if err != nil {
+			return err
+		}
+		result := tx.WithContext(ctx).Model(&model.RefundRequest{}).
+			Where("id = ? AND status = ? AND approval_instance_id IS NULL", current.ID, model.RefundStatusPending).
+			Update("approval_instance_id", reference.InstanceID)
+		if result.Error != nil {
+			return errors.Wrap(errors.CodeDatabaseError, result.Error, "关联退款审批实例失败")
+		}
+		if result.RowsAffected != 1 {
+			return errors.New(errors.CodeConflict, "退款审批实例关联已变化")
+		}
+		current.ApprovalInstanceID = &reference.InstanceID
+		refund = current
+		order = currentOrder
+		approvalStatus = reference.Status
+		var instance model.ApprovalInstance
+		if err := tx.WithContext(ctx).First(&instance, reference.InstanceID).Error; err != nil {
+			return errors.Wrap(errors.CodeDatabaseError, err, "查询退款审批审计快照失败")
+		}
+		return s.audit.WriteRefundApplication(ctx, tx, ApplicationAudit{
+			Refund: &current, Order: &currentOrder, Approval: &instance, Submitter: account,
+		})
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &CreateResult{Refund: &refund, SubmitterName: account.Username, ApprovalStatus: approvalStatus}, nil
+}
+
 func (s *CreationService) Execute(ctx context.Context, command CreateCommand) (*CreateResult, error) {
 	if s == nil || s.db == nil || s.approval == nil || s.audit == nil {
 		return nil, errors.New(errors.CodeServiceUnavailable, "退款审批能力未配置")
diff --git a/internal/handler/admin/agent_recharge.go b/internal/handler/admin/agent_recharge.go
index ab9c59e..ecc3e2d 100644
--- a/internal/handler/admin/agent_recharge.go
+++ b/internal/handler/admin/agent_recharge.go
@@ -143,6 +143,20 @@ func (h *AgentRechargeHandler) Get(c *fiber.Ctx) error {
 	return response.Success(c, result)
 }
 
+// TriggerApproval 主动补发历史线下代理充值审批。
+// POST /api/admin/agent-recharges/:id/trigger-approval
+func (h *AgentRechargeHandler) TriggerApproval(c *fiber.Ctx) error {
+	id, err := strconv.ParseUint(c.Params("id"), 10, 64)
+	if err != nil || id == 0 {
+		return errors.New(errors.CodeInvalidParam, "无效的充值记录ID")
+	}
+	result, err := h.service.TriggerApproval(c.UserContext(), uint(id))
+	if err != nil {
+		return err
+	}
+	return response.Success(c, result)
+}
+
 // PaymentStatus 查询代理充值本地支付与到账状态。
 // GET /api/admin/agent-recharges/:id/payment-status
 func (h *AgentRechargeHandler) PaymentStatus(c *fiber.Ctx) error {
diff --git a/internal/handler/admin/refund.go b/internal/handler/admin/refund.go
index 52bca00..971d8ce 100644
--- a/internal/handler/admin/refund.go
+++ b/internal/handler/admin/refund.go
@@ -69,6 +69,20 @@ func (h *RefundHandler) GetByID(c *fiber.Ctx) error {
 	return response.Success(c, result)
 }
 
+// TriggerApproval 主动补发历史退款审批
+// POST /api/admin/refunds/:id/trigger-approval
+func (h *RefundHandler) TriggerApproval(c *fiber.Ctx) error {
+	id, err := strconv.ParseUint(c.Params("id"), 10, 64)
+	if err != nil || id == 0 {
+		return errors.New(errors.CodeInvalidParam, "无效的退款申请ID")
+	}
+	result, err := h.service.TriggerApproval(c.UserContext(), uint(id))
+	if err != nil {
+		return err
+	}
+	return response.Success(c, result)
+}
+
 // Approve 审批通过退款申请
 // POST /api/admin/refunds/:id/approve
 func (h *RefundHandler) Approve(c *fiber.Ctx) error {
diff --git a/internal/infrastructure/audit/writer_check_test.go b/internal/infrastructure/audit/writer_check_test.go
deleted file mode 100644
index 35baaf4..0000000
--- a/internal/infrastructure/audit/writer_check_test.go
+++ /dev/null
@@ -1,82 +0,0 @@
-package audit
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	"gorm.io/gorm"
-
-	accessauditapp "github.com/break/junhong_cmp_fiber/internal/application/accessaudit"
-	"github.com/break/junhong_cmp_fiber/internal/model"
-	"github.com/break/junhong_cmp_fiber/pkg/auditfailure"
-	"github.com/break/junhong_cmp_fiber/pkg/constants"
-)
-
-func TestAppendFailureDoesNotReturnToBusiness(t *testing.T) {
-	writer := NewWriter(nil, nil)
-	input := AppendInput{ActionCode: "missing_action"}
-	before := auditfailure.SecondaryWriteFailureCount()
-	if err := writer.Append(context.Background(), nil, input); err != nil {
-		t.Fatalf("Append 返回审计失败: %v", err)
-	}
-	if err := writer.WriteAccessChange(context.Background(), nil, accessauditapp.ChangeAudit{
-		ActionCode: constants.AuditActionPersonalCustomerAssetBound,
-		OperatorID: 1,
-	}); err != nil {
-		t.Fatalf("资源构造失败返回业务: %v", err)
-	}
-	if got := auditfailure.SecondaryWriteFailureCount(); got != before+2 {
-		t.Fatalf("二次失败记录次数 = %d, want %d", got, before+2)
-	}
-	if _, err := writer.AppendAndGet(context.Background(), nil, input); err == nil {
-		t.Fatal("AppendAndGet 未保留错误语义")
-	}
-}
-
-func TestPersonalCustomerAssetBoundProjectsOnlyPersonalResources(t *testing.T) {
-	action, ok := NewRegistry().Action(constants.AuditActionPersonalCustomerAssetBound)
-	if !ok {
-		t.Fatal("未注册个人客户资产绑定审计动作")
-	}
-	resources, err := accessResources(accessauditapp.ChangeAudit{
-		ActionCode:       constants.AuditActionPersonalCustomerAssetBound,
-		PersonalCustomer: &model.PersonalCustomer{Model: gorm.Model{ID: 1}, Nickname: "客户"},
-		PersonalDevices: []accessauditapp.PersonalCustomerDeviceChange{{
-			Binding: &model.PersonalCustomerDevice{Model: gorm.Model{ID: 2}, CustomerID: 1, VirtualNo: "DEVICE-1"},
-		}},
-		PersonalICCIDs: []accessauditapp.PersonalCustomerICCIDChange{{
-			Binding: &model.PersonalCustomerICCID{Model: gorm.Model{ID: 3}, CustomerID: 1, ICCID: "ICCID-1"},
-		}},
-		SubjectVisibility: constants.AuditSubjectDetail,
-		SubjectSummary:    "绑定个人客户资产",
-		SubjectData:       map[string]any{"asset_type": constants.AuditResourceIotCard, "asset_id": uint(9)},
-	}, action.PrimaryResource)
-	if err != nil {
-		t.Fatalf("构造绑定审计资源失败: %v", err)
-	}
-	projected, err := NewWriter(nil, nil).buildResources(resources, action)
-	if err != nil {
-		t.Fatalf("构造绑定审计投影失败: %v", err)
-	}
-	want := map[string]bool{
-		constants.AuditResourcePersonalCustomer:       true,
-		constants.AuditResourcePersonalCustomerDevice: true,
-		constants.AuditResourcePersonalCustomerICCID:  true,
-	}
-	for _, resource := range projected {
-		if resource.ResourceType == constants.AuditResourceIotCard || resource.ResourceType == constants.AuditResourceDevice {
-			t.Fatalf("绑定审计投影包含内部资源: %s", resource.ResourceType)
-		}
-		delete(want, resource.ResourceType)
-		if resource.ResourceType == constants.AuditResourcePersonalCustomer {
-			var subjectData map[string]any
-			if err := json.Unmarshal(resource.SubjectData, &subjectData); err != nil || resource.SubjectVisibility != constants.AuditSubjectDetail || subjectData["asset_type"] != constants.AuditResourceIotCard || subjectData["asset_id"] != float64(9) {
-				t.Fatalf("主个人客户主体投影不完整: %#v", resource)
-			}
-		}
-	}
-	for resourceType := range want {
-		t.Fatalf("绑定审计投影缺少合法资源: %s", resourceType)
-	}
-}
diff --git a/internal/routes/agent_recharge.go b/internal/routes/agent_recharge.go
index 206cdfd..3dd637d 100644
--- a/internal/routes/agent_recharge.go
+++ b/internal/routes/agent_recharge.go
@@ -61,6 +61,14 @@ func registerAgentRechargeRoutes(router fiber.Router, handler *admin.AgentRechar
 		Auth:    true,
 	})
 
+	Register(group, doc, groupPath, "POST", "/:id/trigger-approval", handler.TriggerApproval, RouteSpec{
+		Summary: "补发历史线下代理充值审批",
+		Tags:    []string{"代理预充值"},
+		Input:   new(dto.IDReq),
+		Output:  new(dto.AgentRechargeResponse),
+		Auth:    true,
+	})
+
 	Register(group, doc, groupPath, "POST", "/:id/offline-pay", handler.OfflinePay, RouteSpec{
 		Summary: "确认线下充值",
 		Tags:    []string{"代理预充值"},
diff --git a/internal/routes/refund.go b/internal/routes/refund.go
index 81ca7b6..76749bb 100644
--- a/internal/routes/refund.go
+++ b/internal/routes/refund.go
@@ -49,6 +49,14 @@ func registerRefundRoutes(router fiber.Router, handler *admin.RefundHandler, doc
 		Auth:    true,
 	})
 
+	Register(refund, doc, groupPath, "POST", "/:id/trigger-approval", handler.TriggerApproval, RouteSpec{
+		Summary: "补发历史退款审批",
+		Tags:    []string{"退款管理"},
+		Input:   new(dto.RefundIDRequest),
+		Output:  new(dto.RefundResponse),
+		Auth:    true,
+	})
+
 	Register(refund, doc, groupPath, "POST", "/:id/approve", handler.Approve, RouteSpec{
 		Summary: "审批通过退款申请",
 		Tags:    []string{"退款管理"},
diff --git a/internal/service/agent_recharge/service.go b/internal/service/agent_recharge/service.go
index e4fbbb4..df4cc8f 100644
--- a/internal/service/agent_recharge/service.go
+++ b/internal/service/agent_recharge/service.go
@@ -434,6 +434,27 @@ func (s *Service) appendCreditedAudit(ctx context.Context, tx *gorm.DB, record *
 	})
 }
 
+// TriggerApproval 为历史线下代理充值主动补发企业微信审批。
+func (s *Service) TriggerApproval(ctx context.Context, id uint) (*dto.AgentRechargeResponse, error) {
+	if s.offlineCreation == nil {
+		return nil, errors.New(errors.CodeServiceUnavailable, "员工线下代充值审批能力未配置")
+	}
+	record, err := s.agentRechargeStore.GetByID(ctx, id)
+	if err != nil {
+		return nil, errors.New(errors.CodeNotFound, "充值记录不存在")
+	}
+	result, err := s.offlineCreation.TriggerHistorical(ctx, record.ID)
+	if err != nil {
+		return nil, err
+	}
+	resp := toResponse(result.Record, result.ShopName)
+	resp.SubmitterName = result.SubmitterName
+	resp.ApprovalProvider = constants.IntegrationProviderWeCom
+	resp.ApprovalStatus = &result.ApprovalStatus
+	resp.ApprovalStatusName = constants.GetApprovalStatusName(result.ApprovalStatus)
+	return resp, nil
+}
+
 // GetByID 根据ID查询充值订单详情
 // GET /api/admin/agent-recharges/:id
 func (s *Service) GetByID(ctx context.Context, id uint) (*dto.AgentRechargeResponse, error) {
diff --git a/internal/service/customer_binding/audit_test.go b/internal/service/customer_binding/audit_test.go
deleted file mode 100644
index 0099c83..0000000
--- a/internal/service/customer_binding/audit_test.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package customer_binding
-
-import (
-	"context"
-	"database/sql"
-	"database/sql/driver"
-	"io"
-	"testing"
-
-	"gorm.io/driver/postgres"
-	"gorm.io/gorm"
-
-	accessauditapp "github.com/break/junhong_cmp_fiber/internal/application/accessaudit"
-	"github.com/break/junhong_cmp_fiber/internal/model"
-	"github.com/break/junhong_cmp_fiber/pkg/constants"
-)
-
-func init() { sql.Register("customer_binding_audit_test", customerAuditDriver{}) }
-
-type customerAuditDriver struct{}
-
-func (customerAuditDriver) Open(string) (driver.Conn, error) { return customerAuditConn{}, nil }
-
-type customerAuditConn struct{}
-
-func (customerAuditConn) Prepare(string) (driver.Stmt, error) { return nil, driver.ErrSkip }
-func (customerAuditConn) Close() error                        { return nil }
-func (customerAuditConn) Begin() (driver.Tx, error)           { return nil, driver.ErrSkip }
-func (customerAuditConn) QueryContext(context.Context, string, []driver.NamedValue) (driver.Rows, error) {
-	return &customerAuditRows{}, nil
-}
-
-type customerAuditRows struct{ sent bool }
-
-func (*customerAuditRows) Columns() []string { return []string{"id", "nickname"} }
-func (r *customerAuditRows) Close() error    { return nil }
-func (r *customerAuditRows) Next(dest []driver.Value) error {
-	if r.sent {
-		return io.EOF
-	}
-	r.sent = true
-	dest[0], dest[1] = int64(7), "客户"
-	return nil
-}
-
-type captureAuditWriter struct{ change accessauditapp.ChangeAudit }
-
-func (w *captureAuditWriter) WriteAccessChange(_ context.Context, _ *gorm.DB, change accessauditapp.ChangeAudit) error {
-	w.change = change
-	return nil
-}
-
-func TestWriteBindingAuditOmitsInternalAssets(t *testing.T) {
-	db, err := sql.Open("customer_binding_audit_test", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer db.Close()
-	tx, err := gorm.Open(postgres.New(postgres.Config{Conn: db}), &gorm.Config{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	writer := &captureAuditWriter{}
-	service := &Service{accessAudit: writer}
-	personalDevices := []accessauditapp.PersonalCustomerDeviceChange{{Binding: &model.PersonalCustomerDevice{Model: gorm.Model{ID: 2}, CustomerID: 7, VirtualNo: "DEVICE-1"}}}
-	personalICCIDs := []accessauditapp.PersonalCustomerICCIDChange{{Binding: &model.PersonalCustomerICCID{Model: gorm.Model{ID: 3}, CustomerID: 7, ICCID: "ICCID-1"}}}
-	cards := []accessauditapp.IotCardChange{{Card: &model.IotCard{Model: gorm.Model{ID: 9}}}}
-	devices := []accessauditapp.DeviceChange{{Device: &model.Device{Model: gorm.Model{ID: 10}}}}
-
-	if err := service.writeBindingAudit(context.Background(), tx, constants.AuditActionPersonalCustomerAssetBound, "绑定个人客户资产", 7, personalDevices, personalICCIDs, cards, devices); err != nil {
-		t.Fatalf("写入绑定审计失败: %v", err)
-	}
-	change := writer.change
-	if len(change.Cards) != 0 || len(change.Devices) != 0 {
-		t.Fatalf("绑定审计泄露内部资源: Cards=%d Devices=%d", len(change.Cards), len(change.Devices))
-	}
-	if change.PersonalCustomer == nil || change.PersonalCustomer.ID != 7 || len(change.PersonalDevices) != 1 || len(change.PersonalICCIDs) != 1 {
-		t.Fatalf("绑定审计未保留个人客户字段: %#v", change)
-	}
-	if change.SubjectData["asset_type"] != constants.AuditResourceIotCard || change.SubjectData["asset_id"] != uint(9) {
-		t.Fatalf("绑定审计未保留主体摘要: %#v", change.SubjectData)
-	}
-}
diff --git a/internal/service/refund/service.go b/internal/service/refund/service.go
index 8628b16..cef95ca 100644
--- a/internal/service/refund/service.go
+++ b/internal/service/refund/service.go
@@ -238,6 +238,27 @@ func (s *Service) List(ctx context.Context, req *dto.RefundListRequest) (*dto.Re
 }
 
 // GetByID 根据 ID 查询退款申请详情
+// TriggerApproval 为历史退款申请主动补发企业微信审批。
+func (s *Service) TriggerApproval(ctx context.Context, id uint) (*dto.RefundResponse, error) {
+	if s.refundApprovalCreation == nil {
+		return nil, errors.New(errors.CodeServiceUnavailable, "退款审批能力未配置")
+	}
+	refund, err := s.refundStore.GetByIDForOperation(ctx, id)
+	if err != nil {
+		return nil, errors.New(errors.CodeNotFound, "退款申请不存在")
+	}
+	result, err := s.refundApprovalCreation.TriggerHistorical(ctx, refund.ID)
+	if err != nil {
+		return nil, err
+	}
+	resp := buildRefundResponse(result.Refund)
+	resp.SubmitterName = result.SubmitterName
+	resp.ApprovalProvider = constants.IntegrationProviderWeCom
+	resp.ApprovalStatus = &result.ApprovalStatus
+	resp.ApprovalStatusName = constants.GetApprovalStatusName(result.ApprovalStatus)
+	return resp, nil
+}
+
 func (s *Service) GetByID(ctx context.Context, id uint) (*dto.RefundResponse, error) {
 	refund, err := s.refundStore.GetByID(ctx, id)
 	if err != nil {
diff --git a/openspec/changes/add-legacy-approval-trigger/.openspec.yaml b/openspec/changes/add-legacy-approval-trigger/.openspec.yaml
new file mode 100644
index 0000000..9567240
--- /dev/null
+++ b/openspec/changes/add-legacy-approval-trigger/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-18
diff --git a/openspec/changes/add-legacy-approval-trigger/design.md b/openspec/changes/add-legacy-approval-trigger/design.md
new file mode 100644
index 0000000..4f1ebf9
--- /dev/null
+++ b/openspec/changes/add-legacy-approval-trigger/design.md
@@ -0,0 +1,45 @@
+## Context
+
+历史记录在 `tb_refund_request` 或 `tb_agent_recharge_record` 中保持待审批但 `approval_instance_id` 为空。现有新建用例已经在单个事务中创建通用审批实例、企业微信上下文、审批提交 Outbox，并回填该关联；两个业务表的 `approval_instance_id` 均有唯一索引，通用审批实例还以业务类型和业务 ID 唯一。
+
+## Goals / Non-Goals
+
+**Goals:**
+- 以最小增量复用现有审批创建和可靠提交链路补发历史记录。
+- 以原创建账号构造企业微信发起人及审批快照。
+- 使并发请求和重复请求均不会形成第二张审批单。
+
+**Non-Goals:**
+- 不批量扫描或自动补发历史记录。
+- 不改变既有审批终态、企业微信提交重试或人工审批接口。
+- 不新增迁移、重置既有审批关联，或为提交失败创建第二张审批单。
+
+## Decisions
+
+### 在各业务审批创建用例中增加历史记录发起入口
+
+退款和线下代理充值分别新增面向既有记录的 Application 用例入口，复用各自已有的快照构造、提交人校验、通用审批 `Prepare`/`CreateInTx`、审计及 DTO 组装逻辑。Handler 只解析路径 ID 并调用服务；Service 负责加载完整业务事实和调用 Application。
+
+选择按业务保留两个小入口，而不引入跨退款/充值的通用“历史审批补发器”：二者的资格条件、快照和关联事实不同，现有两个创建用例已是最短复用边界。
+
+### 以事务内条件更新和既有唯一约束保证一次性
+
+发起前可在事务外执行审批渠道预检；事务内必须重新读取或条件更新业务记录，要求 `status=待审批 AND approval_instance_id IS NULL`，再创建通用审批及渠道上下文/Outbox，并回填 `approval_instance_id`。任一环节失败回滚，不消耗发起资格；成功提交后，由业务表关联唯一索引和通用审批业务唯一索引共同拒绝并发的第二次创建。
+
+不增加“已尝试”字段：用户确认以成功创建审批实例作为一次性边界，已有唯一关联就是持久化且可恢复的事实源。
+
+### 发起人和授权语义
+
+企业微信发起人固定为业务记录 `Creator`，不使用点击接口的账号；该账号不可用时失败关闭。接口沿用各自当前路由组的账号类型授权，不扩大既有退款或代理充值管理入口的访问范围。返回值沿用现有详情 DTO 的审批摘要字段，避免新增响应类型。
+
+## Risks / Trade-offs
+
+- [原创建账号已禁用或未绑定企业微信] → 不创建任何审批事实并返回错误；维护者修复账号/绑定后可再次操作。
+- [两个请求同时发起] → 事务条件和数据库唯一约束确保仅一个提交成功，调用方对另一个请求按冲突处理。
+- [提交 Outbox 后企微调用结果未知] → 沿用已有结果未知恢复流程，禁止通过本接口重建审批。
+
+## Migration Plan
+
+1. 发布 API 与 Worker 均包含该版本的应用代码，确保 Outbox 消费者已注册。
+2. 维护者在生产环境按发布运行说明，通过列表筛选待审批历史记录后逐单调用新接口，并核对返回的审批摘要与审计/Outbox 事实。
+3. 如需回滚，仅停止暴露新路由并回滚应用二进制；已成功创建的审批实例继续由既有 Worker 流程处理，不删除审批关联或重新发起。
diff --git a/openspec/changes/add-legacy-approval-trigger/proposal.md b/openspec/changes/add-legacy-approval-trigger/proposal.md
new file mode 100644
index 0000000..c6f27d8
--- /dev/null
+++ b/openspec/changes/add-legacy-approval-trigger/proposal.md
@@ -0,0 +1,28 @@
+## Why
+
+七月迭代上线前已创建且仍待审批的退款申请、员工线下代充值申请未关联通用审批实例，无法进入企业微信审批流。需要由管理员按单主动补发，同时避免同一业务重复创建审批单。
+
+## What Changes
+
+- 为待审批且尚未关联审批实例的历史退款申请新增主动发起企业微信审批接口。
+- 为待审批、线下支付且尚未关联审批实例的历史代理充值申请新增主动发起企业微信审批接口。
+- 主动发起时复用原业务创建人作为企业微信审批发起人；原创建人不可用或审批场景不可用时不创建审批实例。
+- 在同一事务创建通用审批实例、企业微信上下文、提交 Outbox 并回填业务记录的 `approval_instance_id`，以该唯一关联保证成功创建后不可再次发起。
+- 仅在业务保持待审批状态时允许主动发起；已关联审批实例、非线下充值或非待审批记录均拒绝。
+
+## Capabilities
+
+### New Capabilities
+
+- 无。
+
+### Modified Capabilities
+
+- `order-refund-exchange`: 退款申请可对历史待审批且未关联审批实例的记录主动创建一次企业微信审批。
+- `agent-funds-commission`: 历史待审批线下代理充值申请可主动创建一次企业微信审批。
+
+## Impact
+
+- 路由、退款与代理充值 Handler/Service，以及审批创建 Application 用例。
+- 新增两个后台 API 并同步 OpenAPI 文档生成入口。
+- 复用现有通用审批、企业微信审批上下文、Outbox、审计和既有 `approval_instance_id` 唯一索引；不新增外部依赖或数据库表结构。
diff --git a/openspec/changes/add-legacy-approval-trigger/specs/agent-funds-commission/spec.md b/openspec/changes/add-legacy-approval-trigger/specs/agent-funds-commission/spec.md
new file mode 100644
index 0000000..106dc34
--- /dev/null
+++ b/openspec/changes/add-legacy-approval-trigger/specs/agent-funds-commission/spec.md
@@ -0,0 +1,21 @@
+## ADDED Requirements
+
+### Requirement: 历史待审批线下代理充值可主动接入企业微信审批
+系统 SHALL 提供 `POST /api/admin/agent-recharges/{id}/trigger-approval`，使具有既有代理充值管理访问权限的后台账号可为历史线下代理充值申请主动创建企业微信审批。系统 MUST 仅在线下充值记录处于待审批状态且 `approval_instance_id` 为空时创建审批；审批发起人 MUST 使用该充值记录的原创建账号。创建成功后，系统 MUST 原子保存唯一审批实例、审批提交请求及充值记录的审批实例关联，并返回更新后的充值申请审批摘要。
+
+#### Scenario: 主动发起历史线下代理充值审批成功
+- **GIVEN** 线下代理充值申请处于待审批状态、未关联审批实例，且其原创建账号和企业微信线下充值审批场景均可用
+- **WHEN** 有既有代理充值管理访问权限的后台账号请求 `POST /api/admin/agent-recharges/{id}/trigger-approval`
+- **THEN** 系统创建以原创建账号为发起人的唯一企业微信审批并返回审批摘要，后续由既有可靠提交流程提交至企业微信
+
+#### Scenario: 在线、非待审批或已发起记录被拒绝
+- **WHEN** 请求主动发起的充值记录不是线下充值、不是待审批状态或已关联审批实例
+- **THEN** 系统返回状态冲突且不创建新的审批实例或提交请求
+
+#### Scenario: 并发主动发起同一充值审批
+- **WHEN** 两个请求同时为同一符合条件的线下代理充值申请主动发起审批
+- **THEN** 系统至多创建一个审批实例和一个审批提交请求，未成功创建关联的请求返回冲突
+
+#### Scenario: 原创建人或审批渠道不可用
+- **WHEN** 充值申请原创建账号不可用，或企业微信线下充值审批场景不可用
+- **THEN** 系统返回相应错误，充值申请保持未关联审批实例，修复条件后可再次发起
diff --git a/openspec/changes/add-legacy-approval-trigger/specs/order-refund-exchange/spec.md b/openspec/changes/add-legacy-approval-trigger/specs/order-refund-exchange/spec.md
new file mode 100644
index 0000000..811ced1
--- /dev/null
+++ b/openspec/changes/add-legacy-approval-trigger/specs/order-refund-exchange/spec.md
@@ -0,0 +1,21 @@
+## ADDED Requirements
+
+### Requirement: 历史待审批退款可主动接入企业微信审批
+系统 SHALL 提供 `POST /api/admin/refunds/{id}/trigger-approval`，使具有既有退款管理访问权限的后台账号可为历史退款申请主动创建企业微信审批。系统 MUST 仅在退款申请状态为待审批且 `approval_instance_id` 为空时创建审批；审批发起人 MUST 使用该退款申请的原创建账号。创建成功后，系统 MUST 原子保存唯一审批实例、审批提交请求及退款申请的审批实例关联，并返回更新后的退款申请审批摘要。
+
+#### Scenario: 主动发起历史退款审批成功
+- **GIVEN** 退款申请处于待审批状态、未关联审批实例，且其原创建账号和企业微信退款审批场景均可用
+- **WHEN** 有既有退款管理访问权限的后台账号请求 `POST /api/admin/refunds/{id}/trigger-approval`
+- **THEN** 系统创建以原创建账号为发起人的唯一企业微信审批并返回审批摘要，后续由既有可靠提交流程提交至企业微信
+
+#### Scenario: 非待审批或已发起记录被拒绝
+- **WHEN** 请求主动发起的退款申请不是待审批状态或已关联审批实例
+- **THEN** 系统返回状态冲突且不创建新的审批实例或提交请求
+
+#### Scenario: 并发主动发起同一退款审批
+- **WHEN** 两个请求同时为同一符合条件的退款申请主动发起审批
+- **THEN** 系统至多创建一个审批实例和一个审批提交请求，未成功创建关联的请求返回冲突
+
+#### Scenario: 原创建人或审批渠道不可用
+- **WHEN** 退款申请原创建账号不可用，或企业微信退款审批场景不可用
+- **THEN** 系统返回相应错误，退款申请保持未关联审批实例，修复条件后可再次发起
diff --git a/openspec/changes/add-legacy-approval-trigger/tasks.md b/openspec/changes/add-legacy-approval-trigger/tasks.md
new file mode 100644
index 0000000..03b6c88
--- /dev/null
+++ b/openspec/changes/add-legacy-approval-trigger/tasks.md
@@ -0,0 +1,16 @@
+## 1. 审批补发用例
+
+- [x] 1.1 在退款审批 Application 中实现历史待审批退款的主动发起：加载原创建人和订单事实、复用既有审批快照与 `Prepare`/`CreateInTx` 链路，并在同一事务内按待审批且未关联审批实例的条件回填关联和审计。
+- [x] 1.2 在线下代理充值 Application 中实现历史待审批充值的主动发起：校验线下支付、待审批和未关联审批实例，加载原创建人、店铺和钱包事实，并复用既有审批创建、快照、Outbox 与审计链路。
+- [x] 1.3 在退款和代理充值 Service 中接入补发用例，复核既有路由权限与资源查询范围，向调用方返回包含审批摘要的既有 DTO；将并发或已关联审批实例映射为状态冲突。
+
+## 2. HTTP 入口与文档
+
+- [x] 2.1 在退款 Handler 和路由注册 `POST /api/admin/refunds/{id}/trigger-approval`，完成路径 ID 绑定并交由 Service 处理。
+- [x] 2.2 在代理充值 Handler 和路由注册 `POST /api/admin/agent-recharges/{id}/trigger-approval`，完成路径 ID 绑定并交由 Service 处理。
+- [x] 2.3 同步 `cmd/api/docs.go` 与 `cmd/gendocs/main.go` 所依赖的路由元数据，确保两个接口及其响应模型生成到 OpenAPI 文档。
+
+## 3. 验证
+
+- [x] 3.1 以隔离环境或最小可运行验证覆盖：两个符合资格的历史记录各只创建一次审批实例和提交 Outbox；非待审批、已关联、在线充值、原创建人/场景不可用及并发重复请求不创建第二实例。
+- [ ] 3.2 执行 `gofmt -w`（变更的 Go 文件）、`go build ./cmd/api ./cmd/worker`、`go run cmd/gendocs/main.go`、`openspec validate --all` 和 `./scripts/context-health.sh`。
diff --git a/openspec/specs/agent-funds-commission/spec.md b/openspec/specs/agent-funds-commission/spec.md
index 1ac5729..4b0f3b1 100644
--- a/openspec/specs/agent-funds-commission/spec.md
+++ b/openspec/specs/agent-funds-commission/spec.md
@@ -97,13 +97,38 @@
 - **WHEN** 当前账号请求资金概况列表但未提供 `shop_id`
 - **THEN** 系统继续按既有分页、数据范围、店铺名称和主账号用户名条件返回结果
 
+### Requirement: 历史待审批线下代理充值可主动接入企业微信审批
+
+系统 SHALL 提供 `POST /api/admin/agent-recharges/{id}/trigger-approval`，使具有既有代理充值管理访问权限的后台账号可为历史线下代理充值申请主动创建企业微信审批。系统 MUST 仅在线下充值记录处于待审批状态且 `approval_instance_id` 为空时创建审批；审批发起人 MUST 使用该充值记录的原创建账号。创建成功后，系统 MUST 原子保存唯一审批实例、审批提交请求及充值记录的审批实例关联，并返回更新后的充值申请审批摘要。
+
+#### Scenario: 主动发起历史线下代理充值审批成功
+
+- **GIVEN** 线下代理充值申请处于待审批状态、未关联审批实例，且其原创建账号和企业微信线下充值审批场景均可用
+- **WHEN** 有既有代理充值管理访问权限的后台账号请求 `POST /api/admin/agent-recharges/{id}/trigger-approval`
+- **THEN** 系统创建以原创建账号为发起人的唯一企业微信审批并返回审批摘要，后续由既有可靠提交流程提交至企业微信
+
+#### Scenario: 在线、非待审批或已发起记录被拒绝
+
+- **WHEN** 请求主动发起的充值记录不是线下充值、不是待审批状态或已关联审批实例
+- **THEN** 系统返回状态冲突且不创建新的审批实例或提交请求
+
+#### Scenario: 并发主动发起同一充值审批
+
+- **WHEN** 两个请求同时为同一符合条件的线下代理充值申请主动发起审批
+- **THEN** 系统至多创建一个审批实例和一个审批提交请求，未成功创建关联的请求返回冲突
+
+#### Scenario: 原创建人或审批渠道不可用
+
+- **WHEN** 充值申请原创建账号不可用，或企业微信线下充值审批场景不可用
+- **THEN** 系统返回相应错误，充值申请保持未关联审批实例，修复条件后可再次发起
+
 ## 可达操作索引
 
 本节只用于入口导航，不是行为 Requirement；业务义务以上述 Requirements 为准。
 
 ### 代理预充值
 
-`GET /api/admin/agent-recharges`（查询代理充值订单列表）；`POST /api/admin/agent-recharges`（创建代理充值订单）；`GET /api/admin/agent-recharges/{id}`（查询代理充值订单详情）；`POST /api/admin/agent-recharges/{id}/offline-pay`（确认线下充值）；`GET /api/admin/agent-recharges/{id}/payment-status`（查询代理充值本地支付与到账状态）；`POST /api/admin/agent-recharges/{id}/reject`（驳回代理充值订单）；`GET /api/admin/agent-recharges/payment-methods`（查询代理在线充值可用支付方式）。
+`GET /api/admin/agent-recharges`（查询代理充值订单列表）；`POST /api/admin/agent-recharges`（创建代理充值订单）；`GET /api/admin/agent-recharges/{id}`（查询代理充值订单详情）；`POST /api/admin/agent-recharges/{id}/trigger-approval`（补发历史线下代理充值审批）；`POST /api/admin/agent-recharges/{id}/offline-pay`（确认线下充值）；`GET /api/admin/agent-recharges/{id}/payment-status`（查询代理充值本地支付与到账状态）；`POST /api/admin/agent-recharges/{id}/reject`（驳回代理充值订单）；`GET /api/admin/agent-recharges/payment-methods`（查询代理在线充值可用支付方式）。
 
 ### 代理商资金管理
 
diff --git a/openspec/specs/order-refund-exchange/spec.md b/openspec/specs/order-refund-exchange/spec.md
index e7f9ee5..48e7446 100644
--- a/openspec/specs/order-refund-exchange/spec.md
+++ b/openspec/specs/order-refund-exchange/spec.md
@@ -38,6 +38,31 @@
 - **WHEN** 该代理查询退款列表或退款申请详情
 - **THEN** 系统返回空列表或不存在，且不泄露任何退款申请
 
+### Requirement: 历史待审批退款可主动接入企业微信审批
+
+系统 SHALL 提供 `POST /api/admin/refunds/{id}/trigger-approval`，使具有既有退款管理访问权限的后台账号可为历史退款申请主动创建企业微信审批。系统 MUST 仅在退款申请状态为待审批且 `approval_instance_id` 为空时创建审批；审批发起人 MUST 使用该退款申请的原创建账号。创建成功后，系统 MUST 原子保存唯一审批实例、审批提交请求及退款申请的审批实例关联，并返回更新后的退款申请审批摘要。
+
+#### Scenario: 主动发起历史退款审批成功
+
+- **GIVEN** 退款申请处于待审批状态、未关联审批实例，且其原创建账号和企业微信退款审批场景均可用
+- **WHEN** 有既有退款管理访问权限的后台账号请求 `POST /api/admin/refunds/{id}/trigger-approval`
+- **THEN** 系统创建以原创建账号为发起人的唯一企业微信审批并返回审批摘要，后续由既有可靠提交流程提交至企业微信
+
+#### Scenario: 非待审批或已发起记录被拒绝
+
+- **WHEN** 请求主动发起的退款申请不是待审批状态或已关联审批实例
+- **THEN** 系统返回状态冲突且不创建新的审批实例或提交请求
+
+#### Scenario: 并发主动发起同一退款审批
+
+- **WHEN** 两个请求同时为同一符合条件的退款申请主动发起审批
+- **THEN** 系统至多创建一个审批实例和一个审批提交请求，未成功创建关联的请求返回冲突
+
+#### Scenario: 原创建人或审批渠道不可用
+
+- **WHEN** 退款申请原创建账号不可用，或企业微信退款审批场景不可用
+- **THEN** 系统返回相应错误，退款申请保持未关联审批实例，修复条件后可再次发起
+
 ## 可达操作索引
 
 本节只用于入口导航，不是行为 Requirement；业务义务以上述 Requirements 为准。
@@ -48,7 +73,7 @@
 
 ### 退款管理
 
-`GET /api/admin/refunds`（退款申请列表）；`POST /api/admin/refunds`（创建退款申请）；`GET /api/admin/refunds/{id}`（退款申请详情）；`POST /api/admin/refunds/{id}/approve`（审批通过退款申请）；`POST /api/admin/refunds/{id}/reject`（审批拒绝退款申请）；`POST /api/admin/refunds/{id}/resubmit`（重新提交退款申请）；`POST /api/admin/refunds/{id}/return`（退回退款申请）。
+`GET /api/admin/refunds`（退款申请列表）；`POST /api/admin/refunds`（创建退款申请）；`GET /api/admin/refunds/{id}`（退款申请详情）；`POST /api/admin/refunds/{id}/trigger-approval`（补发历史退款审批）；`POST /api/admin/refunds/{id}/approve`（审批通过退款申请）；`POST /api/admin/refunds/{id}/reject`（审批拒绝退款申请）；`POST /api/admin/refunds/{id}/resubmit`（重新提交退款申请）；`POST /api/admin/refunds/{id}/return`（退回退款申请）。
 
 ### 换货管理