[
  {
    "key": "application:internal/application/agentrecharge/approval_decision.go:31:Handle",
    "kind": "application",
    "code_entry": "internal/application/agentrecharge/approval_decision.go:31 Handle",
    "owner": "agentrecharge",
    "summary": "业务方法 Handle",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agentrecharge.handle",
    "action_name": "执行业务方法（Handle）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agentrecharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/agentrecharge/confirm_online_payment.go:76:Execute",
    "kind": "application",
    "code_entry": "internal/application/agentrecharge/confirm_online_payment.go:76 Execute",
    "owner": "agentrecharge",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agentrecharge.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agentrecharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/agentrecharge/offline_creation.go:50:Execute",
    "kind": "application",
    "code_entry": "internal/application/agentrecharge/offline_creation.go:50 Execute",
    "owner": "agentrecharge",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agentrecharge.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agentrecharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/agentrecharge/online_creation.go:61:Execute",
    "kind": "application",
    "code_entry": "internal/application/agentrecharge/online_creation.go:61 Execute",
    "owner": "agentrecharge",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agentrecharge.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agentrecharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/agentrecharge/recover_online_payment.go:30:ProcessBatch",
    "kind": "application",
    "code_entry": "internal/application/agentrecharge/recover_online_payment.go:30 ProcessBatch",
    "owner": "agentrecharge",
    "summary": "业务方法 ProcessBatch",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agentrecharge.process_batch",
    "action_name": "执行业务方法（ProcessBatch）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agentrecharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/approval/create.go:143:CreateContextInTx",
    "kind": "application",
    "code_entry": "internal/application/approval/create.go:143 CreateContextInTx",
    "owner": "approval",
    "summary": "业务方法 CreateContextInTx",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "approval.create_context_in_tx",
    "action_name": "执行业务方法（CreateContextInTx）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "approval",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/approval/create.go:70:CreateInTx",
    "kind": "application",
    "code_entry": "internal/application/approval/create.go:70 CreateInTx",
    "owner": "approval",
    "summary": "业务方法 CreateInTx",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "approval.create_in_tx",
    "action_name": "执行业务方法（CreateInTx）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "approval",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/approval/sync_decision.go:90:Execute",
    "kind": "application",
    "code_entry": "internal/application/approval/sync_decision.go:90 Execute",
    "owner": "approval",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "approval.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "approval",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/auditarchive/integration.go:50:ArchivePreviousIntegrationDay",
    "kind": "application",
    "code_entry": "internal/application/auditarchive/integration.go:50 ArchivePreviousIntegrationDay",
    "owner": "auditarchive",
    "summary": "业务方法 ArchivePreviousIntegrationDay",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auditarchive.archive_previous_integration_day",
    "action_name": "执行业务方法（ArchivePreviousIntegrationDay）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "auditarchive",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/auditarchive/integration.go:56:ArchiveIntegrationDate",
    "kind": "application",
    "code_entry": "internal/application/auditarchive/integration.go:56 ArchiveIntegrationDate",
    "owner": "auditarchive",
    "summary": "业务方法 ArchiveIntegrationDate",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auditarchive.archive_integration_date",
    "action_name": "执行业务方法（ArchiveIntegrationDate）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "auditarchive",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/auditarchive/retention.go:55:CleanupPreviousMonth",
    "kind": "application",
    "code_entry": "internal/application/auditarchive/retention.go:55 CleanupPreviousMonth",
    "owner": "auditarchive",
    "summary": "业务方法 CleanupPreviousMonth",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auditarchive.cleanup_previous_month",
    "action_name": "执行业务方法（CleanupPreviousMonth）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "auditarchive",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/auditarchive/retention.go:91:CleanupMonth",
    "kind": "application",
    "code_entry": "internal/application/auditarchive/retention.go:91 CleanupMonth",
    "owner": "auditarchive",
    "summary": "业务方法 CleanupMonth",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auditarchive.cleanup_month",
    "action_name": "执行业务方法（CleanupMonth）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "auditarchive",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/auditarchive/service.go:104:ArchiveDate",
    "kind": "application",
    "code_entry": "internal/application/auditarchive/service.go:104 ArchiveDate",
    "owner": "auditarchive",
    "summary": "业务方法 ArchiveDate",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auditarchive.archive_date",
    "action_name": "执行业务方法（ArchiveDate）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "auditarchive",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/auditarchive/service.go:98:ArchivePreviousDay",
    "kind": "application",
    "code_entry": "internal/application/auditarchive/service.go:98 ArchivePreviousDay",
    "owner": "auditarchive",
    "summary": "业务方法 ArchivePreviousDay",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auditarchive.archive_previous_day",
    "action_name": "执行业务方法（ArchivePreviousDay）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "auditarchive",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/cardobservation/series.go:127:Trigger",
    "kind": "application",
    "code_entry": "internal/application/cardobservation/series.go:127 Trigger",
    "owner": "cardobservation",
    "summary": "业务方法 Trigger",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "cardobservation.trigger",
    "action_name": "执行业务方法（Trigger）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "cardobservation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/cardobservation/series.go:132:TriggerEvent",
    "kind": "application",
    "code_entry": "internal/application/cardobservation/series.go:132 TriggerEvent",
    "owner": "cardobservation",
    "summary": "业务方法 TriggerEvent",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "cardobservation.trigger_event",
    "action_name": "执行业务方法（TriggerEvent）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "cardobservation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/cardobservation/series.go:205:Execute",
    "kind": "application",
    "code_entry": "internal/application/cardobservation/series.go:205 Execute",
    "owner": "cardobservation",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "cardobservation.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "cardobservation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/outbox/recovery.go:146:ReleaseExpiredLeases",
    "kind": "application",
    "code_entry": "internal/application/outbox/recovery.go:146 ReleaseExpiredLeases",
    "owner": "outbox",
    "summary": "业务方法 ReleaseExpiredLeases",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "outbox.release_expired_leases",
    "action_name": "执行业务方法（ReleaseExpiredLeases）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "outbox",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/outbox/recovery.go:88:Replay",
    "kind": "application",
    "code_entry": "internal/application/outbox/recovery.go:88 Replay",
    "owner": "outbox",
    "summary": "业务方法 Replay",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "outbox.replay",
    "action_name": "执行业务方法（Replay）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "outbox",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/refundapproval/creation.go:58:Execute",
    "kind": "application",
    "code_entry": "internal/application/refundapproval/creation.go:58 Execute",
    "owner": "refundapproval",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "refundapproval.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refundapproval",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/role/default_credit.go:34:Update",
    "kind": "application",
    "code_entry": "internal/application/role/default_credit.go:34 Update",
    "owner": "role",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.update",
    "action_name": "执行业务方法（Update）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/shop/create.go:32:Create",
    "kind": "application",
    "code_entry": "internal/application/shop/create.go:32 Create",
    "owner": "shop",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/shop/update.go:29:Update",
    "kind": "application",
    "code_entry": "internal/application/shop/update.go:29 Update",
    "owner": "shop",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/systemconfig/update.go:71:Execute",
    "kind": "application",
    "code_entry": "internal/application/systemconfig/update.go:71 Execute",
    "owner": "systemconfig",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "systemconfig.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "business",
    "risk": "high",
    "primary_resource": "systemconfig",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wallet/change_credit.go:46:Execute",
    "kind": "application",
    "code_entry": "internal/application/wallet/change_credit.go:46 Execute",
    "owner": "wallet",
    "summary": "业务方法 Execute",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wallet.execute",
    "action_name": "执行业务方法（Execute）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "wallet",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wallet/debit.go:82:DebitInTx",
    "kind": "application",
    "code_entry": "internal/application/wallet/debit.go:82 DebitInTx",
    "owner": "wallet",
    "summary": "业务方法 DebitInTx",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wallet.debit_in_tx",
    "action_name": "执行业务方法（DebitInTx）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "wallet",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wallet/refund.go:89:RefundInTx",
    "kind": "application",
    "code_entry": "internal/application/wallet/refund.go:89 RefundInTx",
    "owner": "wallet",
    "summary": "业务方法 RefundInTx",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wallet.refund_in_tx",
    "action_name": "执行业务方法（RefundInTx）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "wallet",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wallet/reservation.go:108:ReleaseInTx",
    "kind": "application",
    "code_entry": "internal/application/wallet/reservation.go:108 ReleaseInTx",
    "owner": "wallet",
    "summary": "业务方法 ReleaseInTx",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wallet.release_in_tx",
    "action_name": "执行业务方法（ReleaseInTx）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "wallet",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wallet/reservation.go:70:FreezeInTx",
    "kind": "application",
    "code_entry": "internal/application/wallet/reservation.go:70 FreezeInTx",
    "owner": "wallet",
    "summary": "业务方法 FreezeInTx",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wallet.freeze_in_tx",
    "action_name": "执行业务方法（FreezeInTx）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "wallet",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wecom/connection.go:253:SaveDefaultCreator",
    "kind": "application",
    "code_entry": "internal/application/wecom/connection.go:253 SaveDefaultCreator",
    "owner": "wecom",
    "summary": "业务方法 SaveDefaultCreator",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wecom.save_default_creator",
    "action_name": "执行业务方法（SaveDefaultCreator）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wecom/connection.go:93:Save",
    "kind": "application",
    "code_entry": "internal/application/wecom/connection.go:93 Save",
    "owner": "wecom",
    "summary": "业务方法 Save",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wecom.save",
    "action_name": "执行业务方法（Save）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wecom/directory.go:57:Sync",
    "kind": "application",
    "code_entry": "internal/application/wecom/directory.go:57 Sync",
    "owner": "wecom",
    "summary": "业务方法 Sync",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wecom.sync",
    "action_name": "执行业务方法（Sync）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "application:internal/application/wecom/scene.go:111:Save",
    "kind": "application",
    "code_entry": "internal/application/wecom/scene.go:111 Save",
    "owner": "wecom",
    "summary": "业务方法 Save",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wecom.save",
    "action_name": "执行业务方法（Save）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "domain:internal/domain/wallet/wallet.go:128:ChangeCredit",
    "kind": "domain",
    "code_entry": "internal/domain/wallet/wallet.go:128 ChangeCredit",
    "owner": "wallet",
    "summary": "业务方法 ChangeCredit",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "由 Application 组合根负责",
    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
  },
  {
    "key": "domain:internal/domain/wallet/wallet.go:26:Debit",
    "kind": "domain",
    "code_entry": "internal/domain/wallet/wallet.go:26 Debit",
    "owner": "wallet",
    "summary": "业务方法 Debit",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "由 Application 组合根负责",
    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
  },
  {
    "key": "domain:internal/domain/wallet/wallet.go:44:Credit",
    "kind": "domain",
    "code_entry": "internal/domain/wallet/wallet.go:44 Credit",
    "owner": "wallet",
    "summary": "业务方法 Credit",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "由 Application 组合根负责",
    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
  },
  {
    "key": "domain:internal/domain/wallet/wallet.go:62:Freeze",
    "kind": "domain",
    "code_entry": "internal/domain/wallet/wallet.go:62 Freeze",
    "owner": "wallet",
    "summary": "业务方法 Freeze",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "由 Application 组合根负责",
    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
  },
  {
    "key": "domain:internal/domain/wallet/wallet.go:80:Release",
    "kind": "domain",
    "code_entry": "internal/domain/wallet/wallet.go:80 Release",
    "owner": "wallet",
    "summary": "业务方法 Release",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "由 Application 组合根负责",
    "failure_strategy": "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口",
    "na_reason": "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入"
  },
  {
    "key": "http:internal/routes/account.go:102:POST:/:id/roles",
    "kind": "http",
    "code_entry": "internal/routes/account.go:102 h.AssignRoles",
    "owner": "account",
    "method": "POST",
    "path": "/:id/roles",
    "summary": "为账号分配角色",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.assign_roles",
    "action_name": "为账号分配角色",
    "category": "security",
    "risk": "high",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/account.go:111:GET:/:id/roles",
    "kind": "http",
    "code_entry": "internal/routes/account.go:111 h.GetRoles",
    "owner": "account",
    "method": "GET",
    "path": "/:id/roles",
    "summary": "获取账号角色",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/account.go:120:DELETE:/:account_id/roles/:role_id",
    "kind": "http",
    "code_entry": "internal/routes/account.go:120 h.RemoveRole",
    "owner": "account",
    "method": "DELETE",
    "path": "/:account_id/roles/:role_id",
    "summary": "移除账号角色",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.remove_role",
    "action_name": "移除账号角色",
    "category": "security",
    "risk": "high",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/account.go:31:POST:",
    "kind": "http",
    "code_entry": "internal/routes/account.go:31 h.Create",
    "owner": "account",
    "method": "POST",
    "summary": "创建账号",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.create",
    "action_name": "创建账号",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/account.go:40:GET:",
    "kind": "http",
    "code_entry": "internal/routes/account.go:40 h.List",
    "owner": "account",
    "method": "GET",
    "summary": "查询账号列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/account.go:49:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/account.go:49 h.Get",
    "owner": "account",
    "method": "GET",
    "path": "/:id",
    "summary": "获取账号详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/account.go:58:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/account.go:58 h.Update",
    "owner": "account",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新账号",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.update",
    "action_name": "更新账号",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/account.go:66:PUT:/:id/wecom-binding",
    "kind": "http",
    "code_entry": "internal/routes/account.go:66 h.BindWeCom",
    "owner": "account",
    "method": "PUT",
    "path": "/:id/wecom-binding",
    "summary": "绑定账号企业微信成员",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.bind_we_com",
    "action_name": "绑定账号企业微信成员",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/account.go:75:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/account.go:75 h.Delete",
    "owner": "account",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除账号",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.delete",
    "action_name": "删除账号",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/account.go:84:PUT:/:id/password",
    "kind": "http",
    "code_entry": "internal/routes/account.go:84 h.UpdatePassword",
    "owner": "account",
    "method": "PUT",
    "path": "/:id/password",
    "summary": "修改账号密码",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.update_password",
    "action_name": "修改账号密码",
    "category": "security",
    "risk": "high",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/account.go:93:PUT:/:id/status",
    "kind": "http",
    "code_entry": "internal/routes/account.go:93 h.UpdateStatus",
    "owner": "account",
    "method": "PUT",
    "path": "/:id/status",
    "summary": "修改账号状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "account.update_status",
    "action_name": "修改账号状态",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/agent_recharge.go:24:POST:",
    "kind": "http",
    "code_entry": "internal/routes/agent_recharge.go:24 handler.Create",
    "owner": "agent_recharge",
    "method": "POST",
    "summary": "创建代理充值订单",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "agent_recharge.create",
    "action_name": "创建代理充值订单",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agent_recharge",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/agent_recharge.go:32:GET:",
    "kind": "http",
    "code_entry": "internal/routes/agent_recharge.go:32 handler.List",
    "owner": "agent_recharge",
    "method": "GET",
    "summary": "查询代理充值订单列表",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/agent_recharge.go:41:GET:/payment-methods",
    "kind": "http",
    "code_entry": "internal/routes/agent_recharge.go:41 handler.PaymentMethods",
    "owner": "agent_recharge",
    "method": "GET",
    "path": "/payment-methods",
    "summary": "查询代理在线充值可用支付方式",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/agent_recharge.go:48:GET:/:id/payment-status",
    "kind": "http",
    "code_entry": "internal/routes/agent_recharge.go:48 handler.PaymentStatus",
    "owner": "agent_recharge",
    "method": "GET",
    "path": "/:id/payment-status",
    "summary": "查询代理充值本地支付与到账状态",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/agent_recharge.go:56:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/agent_recharge.go:56 handler.Get",
    "owner": "agent_recharge",
    "method": "GET",
    "path": "/:id",
    "summary": "查询代理充值订单详情",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/agent_recharge.go:64:POST:/:id/offline-pay",
    "kind": "http",
    "code_entry": "internal/routes/agent_recharge.go:64 handler.OfflinePay",
    "owner": "agent_recharge",
    "method": "POST",
    "path": "/:id/offline-pay",
    "summary": "确认线下充值",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "agent_recharge.offline_pay",
    "action_name": "确认线下充值",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agent_recharge",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/agent_recharge.go:72:POST:/:id/reject",
    "kind": "http",
    "code_entry": "internal/routes/agent_recharge.go:72 handler.Reject",
    "owner": "agent_recharge",
    "method": "POST",
    "path": "/:id/reject",
    "summary": "驳回代理充值订单",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "agent_recharge.reject",
    "action_name": "驳回代理充值订单",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agent_recharge",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:104:GET:/:identifier/wallet",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:104 walletHandler.GetWallet",
    "owner": "asset",
    "method": "GET",
    "path": "/:identifier/wallet",
    "summary": "资产钱包概况",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset.go:113:GET:/:identifier/wallet/transactions",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:113 walletHandler.ListTransactions",
    "owner": "asset",
    "method": "GET",
    "path": "/:identifier/wallet/transactions",
    "summary": "资产钱包流水列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset.go:122:GET:/:identifier/orders",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:122 handler.Orders",
    "owner": "asset",
    "method": "GET",
    "path": "/:identifier/orders",
    "summary": "资产历史订单",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset.go:131:GET:/:identifier/operation-logs",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:131 handler.OperationLogs",
    "owner": "asset",
    "method": "GET",
    "path": "/:identifier/operation-logs",
    "summary": "查询平台旧资产操作日志",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset.go:140:PATCH:/:identifier/polling-status",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:140 handler.UpdatePollingStatus",
    "owner": "asset",
    "method": "PATCH",
    "path": "/:identifier/polling-status",
    "summary": "更新资产轮询状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.update_polling_status",
    "action_name": "更新资产轮询状态",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:149:PATCH:/:identifier/realname-mode",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:149 handler.UpdateRealnamePolicy",
    "owner": "asset",
    "method": "PATCH",
    "path": "/:identifier/realname-mode",
    "summary": "更新资产实名认证策略",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.update_realname_policy",
    "action_name": "更新资产实名认证策略",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:158:PATCH:/:identifier/realname-status",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:158 handler.UpdateRealnameStatus",
    "owner": "asset",
    "method": "PATCH",
    "path": "/:identifier/realname-status",
    "summary": "手动更新卡实名状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.update_realname_status",
    "action_name": "手动更新卡实名状态",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:15:GET:/resolve/:identifier",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:15 handler.Resolve",
    "owner": "asset",
    "method": "GET",
    "path": "/resolve/:identifier",
    "summary": "解析资产",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset.go:24:GET:/:identifier/realtime-status",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:24 handler.RealtimeStatus",
    "owner": "asset",
    "method": "GET",
    "path": "/:identifier/realtime-status",
    "summary": "资产实时状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.realtime_status",
    "action_name": "资产实时状态",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:33:POST:/:identifier/refresh",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:33 handler.Refresh",
    "owner": "asset",
    "method": "POST",
    "path": "/:identifier/refresh",
    "summary": "刷新资产状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.refresh",
    "action_name": "刷新资产状态",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:42:GET:/:identifier/packages",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:42 handler.Packages",
    "owner": "asset",
    "method": "GET",
    "path": "/:identifier/packages",
    "summary": "资产套餐列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset.go:51:GET:/:identifier/current-package",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:51 handler.CurrentPackage",
    "owner": "asset",
    "method": "GET",
    "path": "/:identifier/current-package",
    "summary": "当前生效套餐",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset.go:59:PATCH:/:identifier/packages/:package_usage_id/expires-at",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:59 handler.UpdatePackageExpiresAt",
    "owner": "asset",
    "method": "PATCH",
    "path": "/:identifier/packages/:package_usage_id/expires-at",
    "summary": "修改资产套餐过期时间",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.update_package_expires_at",
    "action_name": "修改资产套餐过期时间",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:68:PATCH:/:identifier/packages/:package_usage_id/used-data",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:68 handler.UpdatePackageUsage",
    "owner": "asset",
    "method": "PATCH",
    "path": "/:identifier/packages/:package_usage_id/used-data",
    "summary": "修改资产套餐已用量",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.update_package_usage",
    "action_name": "修改资产套餐已用量",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:77:POST:/:identifier/stop",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:77 handler.Stop",
    "owner": "asset",
    "method": "POST",
    "path": "/:identifier/stop",
    "summary": "停机",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.stop",
    "action_name": "停机",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:86:POST:/:identifier/start",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:86 handler.Start",
    "owner": "asset",
    "method": "POST",
    "path": "/:identifier/start",
    "summary": "复机",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.start",
    "action_name": "复机",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset.go:95:PATCH:/:identifier/deactivate",
    "kind": "http",
    "code_entry": "internal/routes/asset.go:95 handler.Deactivate",
    "owner": "asset",
    "method": "PATCH",
    "path": "/:identifier/deactivate",
    "summary": "停用资产",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset.deactivate",
    "action_name": "停用资产",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset_allocation_record.go:15:GET:",
    "kind": "http",
    "code_entry": "internal/routes/asset_allocation_record.go:15 handler.List",
    "owner": "asset_allocation_record",
    "method": "GET",
    "summary": "分配记录列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset_allocation_record.go:23:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/asset_allocation_record.go:23 handler.GetByID",
    "owner": "asset_allocation_record",
    "method": "GET",
    "path": "/:id",
    "summary": "分配记录详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset_package_batch_order.go:13:POST:/asset-package-batch-orders",
    "kind": "http",
    "code_entry": "internal/routes/asset_package_batch_order.go:13 handler.Create",
    "owner": "asset_package_batch_order",
    "method": "POST",
    "path": "/asset-package-batch-orders",
    "summary": "创建资产套餐批量订购任务",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "asset_package_batch_order.create",
    "action_name": "创建资产套餐批量订购任务",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "asset_package_batch_order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/asset_package_batch_order.go:17:GET:/asset-package-batch-orders",
    "kind": "http",
    "code_entry": "internal/routes/asset_package_batch_order.go:17 handler.List",
    "owner": "asset_package_batch_order",
    "method": "GET",
    "path": "/asset-package-batch-orders",
    "summary": "查询资产套餐批量订购任务列表",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/asset_package_batch_order.go:21:GET:/asset-package-batch-orders/:id",
    "kind": "http",
    "code_entry": "internal/routes/asset_package_batch_order.go:21 handler.Get",
    "owner": "asset_package_batch_order",
    "method": "GET",
    "path": "/asset-package-batch-orders/:id",
    "summary": "查询资产套餐批量订购任务详情",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:16:GET:/:resource_type/:identifier",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:16 handler.AgentResourceActivities",
    "owner": "audit",
    "method": "GET",
    "path": "/:resource_type/:identifier",
    "summary": "查询代理资源活动",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:22:GET:/:resource_type/:identifier",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:22 handler.EnterpriseResourceActivities",
    "owner": "audit",
    "method": "GET",
    "path": "/:resource_type/:identifier",
    "summary": "查询企业资源活动",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:31:GET:/events",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:31 handler.ListEvents",
    "owner": "audit",
    "method": "GET",
    "path": "/events",
    "summary": "查询全局审计事件",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:36:GET:/events/:event_id",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:36 handler.GetEvent",
    "owner": "audit",
    "method": "GET",
    "path": "/events/:event_id",
    "summary": "查询审计事件详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:41:GET:/actors/:kind/:id/events",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:41 handler.ListActorEvents",
    "owner": "audit",
    "method": "GET",
    "path": "/actors/:kind/:id/events",
    "summary": "查询操作者行为时间线",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:47:GET:/resources/search",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:47 handler.SearchResources",
    "owner": "audit",
    "method": "GET",
    "path": "/resources/search",
    "summary": "精确搜索注册资源",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:52:GET:/resources/:resource_type/:resource_id/timeline",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:52 handler.ResourceTimeline",
    "owner": "audit",
    "method": "GET",
    "path": "/resources/:resource_type/:resource_id/timeline",
    "summary": "查询通用资源时间线",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:57:GET:/requests/:request_id/timeline",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:57 handler.RequestTimeline",
    "owner": "audit",
    "method": "GET",
    "path": "/requests/:request_id/timeline",
    "summary": "查询请求关联时间线",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:62:GET:/correlations/:correlation_id/timeline",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:62 handler.CorrelationTimeline",
    "owner": "audit",
    "method": "GET",
    "path": "/correlations/:correlation_id/timeline",
    "summary": "查询业务关联时间线",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:67:GET:/finance/timeline",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:67 handler.FinanceTimeline",
    "owner": "audit",
    "method": "GET",
    "path": "/finance/timeline",
    "summary": "查询资金调查时间线",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:72:GET:/risks/overview",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:72 handler.RiskOverview",
    "owner": "audit",
    "method": "GET",
    "path": "/risks/overview",
    "summary": "查询风险调查总览",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:77:GET:/risks/events",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:77 handler.RiskEvents",
    "owner": "audit",
    "method": "GET",
    "path": "/risks/events",
    "summary": "查询风险事件明细",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:83:GET:/integrations/overview",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:83 handler.IntegrationOverview",
    "owner": "audit",
    "method": "GET",
    "path": "/integrations/overview",
    "summary": "查询外部集成交互总览",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:88:GET:/integrations",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:88 handler.ListIntegrations",
    "owner": "audit",
    "method": "GET",
    "path": "/integrations",
    "summary": "查询外部集成交互列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/audit.go:93:GET:/integrations/:integration_id",
    "kind": "http",
    "code_entry": "internal/routes/audit.go:93 handler.GetIntegration",
    "owner": "audit",
    "method": "GET",
    "path": "/integrations/:integration_id",
    "summary": "查询外部集成交互详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "仅超级管理员和平台账号可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/auth.go:15:POST:/login",
    "kind": "http",
    "code_entry": "internal/routes/auth.go:15 handler.Login",
    "owner": "auth",
    "method": "POST",
    "path": "/login",
    "summary": "统一登录（后台+H5）",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "auth.login",
    "action_name": "统一登录（后台+H5）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "auth",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/auth.go:23:POST:/refresh-token",
    "kind": "http",
    "code_entry": "internal/routes/auth.go:23 handler.RefreshToken",
    "owner": "auth",
    "method": "POST",
    "path": "/refresh-token",
    "summary": "刷新 Token",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "auth.refresh_token",
    "action_name": "刷新 Token",
    "category": "security",
    "risk": "normal",
    "primary_resource": "auth",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/auth.go:34:POST:/logout",
    "kind": "http",
    "code_entry": "internal/routes/auth.go:34 handler.Logout",
    "owner": "auth",
    "method": "POST",
    "path": "/logout",
    "summary": "统一登出",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "auth.logout",
    "action_name": "统一登出",
    "category": "security",
    "risk": "normal",
    "primary_resource": "auth",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/auth.go:42:GET:/me",
    "kind": "http",
    "code_entry": "internal/routes/auth.go:42 handler.GetMe",
    "owner": "auth",
    "method": "GET",
    "path": "/me",
    "summary": "获取用户信息",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/auth.go:50:PUT:/password",
    "kind": "http",
    "code_entry": "internal/routes/auth.go:50 handler.ChangePassword",
    "owner": "auth",
    "method": "PUT",
    "path": "/password",
    "summary": "修改密码",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "auth.change_password",
    "action_name": "修改密码",
    "category": "security",
    "risk": "high",
    "primary_resource": "auth",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/authorization.go:15:GET:",
    "kind": "http",
    "code_entry": "internal/routes/authorization.go:15 handler.List",
    "owner": "authorization",
    "method": "GET",
    "summary": "授权记录列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/authorization.go:23:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/authorization.go:23 handler.GetDetail",
    "owner": "authorization",
    "method": "GET",
    "path": "/:id",
    "summary": "授权记录详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/authorization.go:31:PUT:/:id/remark",
    "kind": "http",
    "code_entry": "internal/routes/authorization.go:31 handler.UpdateRemark",
    "owner": "authorization",
    "method": "PUT",
    "path": "/:id/remark",
    "summary": "修改授权备注",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "authorization.update_remark",
    "action_name": "修改授权备注",
    "category": "security",
    "risk": "normal",
    "primary_resource": "authorization",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/carrier.go:15:GET:",
    "kind": "http",
    "code_entry": "internal/routes/carrier.go:15 handler.List",
    "owner": "carrier",
    "method": "GET",
    "summary": "运营商列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/carrier.go:23:POST:",
    "kind": "http",
    "code_entry": "internal/routes/carrier.go:23 handler.Create",
    "owner": "carrier",
    "method": "POST",
    "summary": "创建运营商",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "carrier.create",
    "action_name": "创建运营商",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/carrier.go:31:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/carrier.go:31 handler.Get",
    "owner": "carrier",
    "method": "GET",
    "path": "/:id",
    "summary": "获取运营商详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/carrier.go:39:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/carrier.go:39 handler.Update",
    "owner": "carrier",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新运营商",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "carrier.update",
    "action_name": "更新运营商",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/carrier.go:47:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/carrier.go:47 handler.Delete",
    "owner": "carrier",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除运营商",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "carrier.delete",
    "action_name": "删除运营商",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/carrier.go:55:PUT:/:id/status",
    "kind": "http",
    "code_entry": "internal/routes/carrier.go:55 handler.UpdateStatus",
    "owner": "carrier",
    "method": "PUT",
    "path": "/:id/status",
    "summary": "更新运营商状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "carrier.update_status",
    "action_name": "更新运营商状态",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/commission.go:15:GET:/withdrawal-requests",
    "kind": "http",
    "code_entry": "internal/routes/commission.go:15 handler.ListWithdrawalRequests",
    "owner": "commission",
    "method": "GET",
    "path": "/withdrawal-requests",
    "summary": "提现申请列表",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/commission.go:23:POST:/withdrawal-requests/:id/approve",
    "kind": "http",
    "code_entry": "internal/routes/commission.go:23 handler.ApproveWithdrawal",
    "owner": "commission",
    "method": "POST",
    "path": "/withdrawal-requests/:id/approve",
    "summary": "审批通过提现申请",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "commission.approve_withdrawal",
    "action_name": "审批通过提现申请",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/commission.go:31:POST:/withdrawal-requests/:id/reject",
    "kind": "http",
    "code_entry": "internal/routes/commission.go:31 handler.RejectWithdrawal",
    "owner": "commission",
    "method": "POST",
    "path": "/withdrawal-requests/:id/reject",
    "summary": "拒绝提现申请",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "commission.reject_withdrawal",
    "action_name": "拒绝提现申请",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/commission.go:45:POST:/withdrawal-settings",
    "kind": "http",
    "code_entry": "internal/routes/commission.go:45 handler.Create",
    "owner": "commission",
    "method": "POST",
    "path": "/withdrawal-settings",
    "summary": "新增提现配置",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "commission.create",
    "action_name": "新增提现配置",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/commission.go:53:GET:/withdrawal-settings",
    "kind": "http",
    "code_entry": "internal/routes/commission.go:53 handler.List",
    "owner": "commission",
    "method": "GET",
    "path": "/withdrawal-settings",
    "summary": "提现配置列表",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/commission.go:61:GET:/withdrawal-settings/current",
    "kind": "http",
    "code_entry": "internal/routes/commission.go:61 handler.GetCurrent",
    "owner": "commission",
    "method": "GET",
    "path": "/withdrawal-settings/current",
    "summary": "获取当前生效的提现配置",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/device.go:118:GET:/import/tasks",
    "kind": "http",
    "code_entry": "internal/routes/device.go:118 importHandler.List",
    "owner": "device",
    "method": "GET",
    "path": "/import/tasks",
    "summary": "导入任务列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/device.go:127:POST:/import/allocations",
    "kind": "http",
    "code_entry": "internal/routes/device.go:127 importHandler.CreateAllocation",
    "owner": "device",
    "method": "POST",
    "path": "/import/allocations",
    "summary": "创建CSV设备批量分配或回收任务",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.create_allocation",
    "action_name": "创建CSV设备批量分配或回收任务",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:136:GET:/import/tasks/:id",
    "kind": "http",
    "code_entry": "internal/routes/device.go:136 importHandler.GetByID",
    "owner": "device",
    "method": "GET",
    "path": "/import/tasks/:id",
    "summary": "导入任务详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/device.go:145:PATCH:/series-binding",
    "kind": "http",
    "code_entry": "internal/routes/device.go:145 handler.BatchSetSeriesBinding",
    "owner": "device",
    "method": "PATCH",
    "path": "/series-binding",
    "summary": "批量设置设备的套餐系列绑定",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.batch_set_series_binding",
    "action_name": "批量设置设备的套餐系列绑定",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:154:GET:/by-identifier/:identifier/gateway-slots",
    "kind": "http",
    "code_entry": "internal/routes/device.go:154 handler.GetGatewaySlots",
    "owner": "device",
    "method": "GET",
    "path": "/by-identifier/:identifier/gateway-slots",
    "summary": "查询卡槽信息",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/device.go:163:PUT:/by-identifier/:identifier/wifi",
    "kind": "http",
    "code_entry": "internal/routes/device.go:163 handler.SetWiFi",
    "owner": "device",
    "method": "PUT",
    "path": "/by-identifier/:identifier/wifi",
    "summary": "设置 WiFi",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.set_wi_fi",
    "action_name": "设置 WiFi",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:16:GET:",
    "kind": "http",
    "code_entry": "internal/routes/device.go:16 handler.List",
    "owner": "device",
    "method": "GET",
    "summary": "设备列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/device.go:172:POST:/by-identifier/:identifier/switch-card",
    "kind": "http",
    "code_entry": "internal/routes/device.go:172 handler.SwitchCard",
    "owner": "device",
    "method": "POST",
    "path": "/by-identifier/:identifier/switch-card",
    "summary": "切卡",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.switch_card",
    "action_name": "切卡",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:181:POST:/by-identifier/:identifier/switch-mode",
    "kind": "http",
    "code_entry": "internal/routes/device.go:181 handler.SetSwitchMode",
    "owner": "device",
    "method": "POST",
    "path": "/by-identifier/:identifier/switch-mode",
    "summary": "设置切卡模式",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.set_switch_mode",
    "action_name": "设置切卡模式",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:190:POST:/by-identifier/:identifier/reboot",
    "kind": "http",
    "code_entry": "internal/routes/device.go:190 handler.RebootDevice",
    "owner": "device",
    "method": "POST",
    "path": "/by-identifier/:identifier/reboot",
    "summary": "重启设备",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.reboot_device",
    "action_name": "重启设备",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:199:POST:/by-identifier/:identifier/reset",
    "kind": "http",
    "code_entry": "internal/routes/device.go:199 handler.ResetDevice",
    "owner": "device",
    "method": "POST",
    "path": "/by-identifier/:identifier/reset",
    "summary": "恢复出厂",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.reset_device",
    "action_name": "恢复出厂",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:24:POST:/batch-update-realname-policy",
    "kind": "http",
    "code_entry": "internal/routes/device.go:24 handler.BatchUpdateRealnamePolicy",
    "owner": "device",
    "method": "POST",
    "path": "/batch-update-realname-policy",
    "summary": "批量更新设备实名认证策略",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.batch_update_realname_policy",
    "action_name": "批量更新设备实名认证策略",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:33:DELETE:/:virtual_no",
    "kind": "http",
    "code_entry": "internal/routes/device.go:33 handler.Delete",
    "owner": "device",
    "method": "DELETE",
    "path": "/:virtual_no",
    "summary": "删除设备",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.delete",
    "action_name": "删除设备",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:42:GET:/:virtual_no/cards",
    "kind": "http",
    "code_entry": "internal/routes/device.go:42 handler.ListCards",
    "owner": "device",
    "method": "GET",
    "path": "/:virtual_no/cards",
    "summary": "获取设备绑定的卡列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/device.go:50:POST:/:virtual_no/cards",
    "kind": "http",
    "code_entry": "internal/routes/device.go:50 handler.BindCard",
    "owner": "device",
    "method": "POST",
    "path": "/:virtual_no/cards",
    "summary": "绑定卡到设备",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.bind_card",
    "action_name": "绑定卡到设备",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:59:DELETE:/:virtual_no/cards/:iccid",
    "kind": "http",
    "code_entry": "internal/routes/device.go:59 handler.UnbindCard",
    "owner": "device",
    "method": "DELETE",
    "path": "/:virtual_no/cards/:iccid",
    "summary": "解绑设备上的卡",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.unbind_card",
    "action_name": "解绑设备上的卡",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:68:POST:/allocate",
    "kind": "http",
    "code_entry": "internal/routes/device.go:68 handler.Allocate",
    "owner": "device",
    "method": "POST",
    "path": "/allocate",
    "summary": "批量分配设备",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.allocate",
    "action_name": "批量分配设备",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:77:POST:/recall",
    "kind": "http",
    "code_entry": "internal/routes/device.go:77 handler.Recall",
    "owner": "device",
    "method": "POST",
    "path": "/recall",
    "summary": "批量回收设备",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.recall",
    "action_name": "批量回收设备",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/device.go:86:POST:/import",
    "kind": "http",
    "code_entry": "internal/routes/device.go:86 importHandler.Import",
    "owner": "device",
    "method": "POST",
    "path": "/import",
    "summary": "批量导入设备",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "device.import",
    "action_name": "批量导入设备",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise.go:15:POST:",
    "kind": "http",
    "code_entry": "internal/routes/enterprise.go:15 handler.Create",
    "owner": "enterprise",
    "method": "POST",
    "summary": "新增企业客户",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise.create",
    "action_name": "新增企业客户",
    "category": "business",
    "risk": "normal",
    "primary_resource": "enterprise",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise.go:23:GET:",
    "kind": "http",
    "code_entry": "internal/routes/enterprise.go:23 handler.List",
    "owner": "enterprise",
    "method": "GET",
    "summary": "查询企业客户列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/enterprise.go:31:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/enterprise.go:31 handler.Update",
    "owner": "enterprise",
    "method": "PUT",
    "path": "/:id",
    "summary": "编辑企业信息",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise.update",
    "action_name": "编辑企业信息",
    "category": "business",
    "risk": "normal",
    "primary_resource": "enterprise",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise.go:39:PUT:/:id/status",
    "kind": "http",
    "code_entry": "internal/routes/enterprise.go:39 handler.UpdateStatus",
    "owner": "enterprise",
    "method": "PUT",
    "path": "/:id/status",
    "summary": "启用/禁用企业",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise.update_status",
    "action_name": "启用/禁用企业",
    "category": "business",
    "risk": "normal",
    "primary_resource": "enterprise",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise.go:47:PUT:/:id/password",
    "kind": "http",
    "code_entry": "internal/routes/enterprise.go:47 handler.UpdatePassword",
    "owner": "enterprise",
    "method": "PUT",
    "path": "/:id/password",
    "summary": "修改企业账号密码",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise.update_password",
    "action_name": "修改企业账号密码",
    "category": "business",
    "risk": "high",
    "primary_resource": "enterprise",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise_card.go:15:POST:/:id/allocate-cards",
    "kind": "http",
    "code_entry": "internal/routes/enterprise_card.go:15 handler.AllocateCards",
    "owner": "enterprise_card",
    "method": "POST",
    "path": "/:id/allocate-cards",
    "summary": "授权卡给企业",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise_card.allocate_cards",
    "action_name": "授权卡给企业",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise_card.go:23:POST:/:id/recall-cards",
    "kind": "http",
    "code_entry": "internal/routes/enterprise_card.go:23 handler.RecallCards",
    "owner": "enterprise_card",
    "method": "POST",
    "path": "/:id/recall-cards",
    "summary": "回收卡授权",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise_card.recall_cards",
    "action_name": "回收卡授权",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise_card.go:31:GET:/:id/cards",
    "kind": "http",
    "code_entry": "internal/routes/enterprise_card.go:31 handler.ListCards",
    "owner": "enterprise_card",
    "method": "GET",
    "path": "/:id/cards",
    "summary": "企业卡列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/enterprise_device.go:15:POST:/:id/allocate-devices",
    "kind": "http",
    "code_entry": "internal/routes/enterprise_device.go:15 handler.AllocateDevices",
    "owner": "enterprise_device",
    "method": "POST",
    "path": "/:id/allocate-devices",
    "summary": "授权设备给企业",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise_device.allocate_devices",
    "action_name": "授权设备给企业",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise_device.go:23:POST:/:id/recall-devices",
    "kind": "http",
    "code_entry": "internal/routes/enterprise_device.go:23 handler.RecallDevices",
    "owner": "enterprise_device",
    "method": "POST",
    "path": "/:id/recall-devices",
    "summary": "撤销设备授权",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "enterprise_device.recall_devices",
    "action_name": "撤销设备授权",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_device",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/enterprise_device.go:31:GET:/:id/devices",
    "kind": "http",
    "code_entry": "internal/routes/enterprise_device.go:31 handler.ListDevices",
    "owner": "enterprise_device",
    "method": "GET",
    "path": "/:id/devices",
    "summary": "企业设备列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "企业认证上下文范围内可见；内部审计字段不可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/exchange.go:11:POST:/exchanges",
    "kind": "http",
    "code_entry": "internal/routes/exchange.go:11 handler.Create",
    "owner": "exchange",
    "method": "POST",
    "path": "/exchanges",
    "summary": "创建换货单",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "exchange.create",
    "action_name": "创建换货单",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/exchange.go:19:GET:/exchanges",
    "kind": "http",
    "code_entry": "internal/routes/exchange.go:19 handler.List",
    "owner": "exchange",
    "method": "GET",
    "path": "/exchanges",
    "summary": "获取换货单列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/exchange.go:27:GET:/exchanges/:id",
    "kind": "http",
    "code_entry": "internal/routes/exchange.go:27 handler.Get",
    "owner": "exchange",
    "method": "GET",
    "path": "/exchanges/:id",
    "summary": "获取换货单详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/exchange.go:35:POST:/exchanges/:id/ship",
    "kind": "http",
    "code_entry": "internal/routes/exchange.go:35 handler.Ship",
    "owner": "exchange",
    "method": "POST",
    "path": "/exchanges/:id/ship",
    "summary": "换货发货",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "exchange.ship",
    "action_name": "换货发货",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/exchange.go:43:POST:/exchanges/:id/complete",
    "kind": "http",
    "code_entry": "internal/routes/exchange.go:43 handler.Complete",
    "owner": "exchange",
    "method": "POST",
    "path": "/exchanges/:id/complete",
    "summary": "确认换货完成",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "exchange.complete",
    "action_name": "确认换货完成",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/exchange.go:51:POST:/exchanges/:id/cancel",
    "kind": "http",
    "code_entry": "internal/routes/exchange.go:51 handler.Cancel",
    "owner": "exchange",
    "method": "POST",
    "path": "/exchanges/:id/cancel",
    "summary": "取消换货",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "exchange.cancel",
    "action_name": "取消换货",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/exchange.go:59:POST:/exchanges/:id/renew",
    "kind": "http",
    "code_entry": "internal/routes/exchange.go:59 handler.Renew",
    "owner": "exchange",
    "method": "POST",
    "path": "/exchanges/:id/renew",
    "summary": "旧资产转新",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "exchange.renew",
    "action_name": "旧资产转新",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/export_task.go:15:POST:",
    "kind": "http",
    "code_entry": "internal/routes/export_task.go:15 handler.Create",
    "owner": "export_task",
    "method": "POST",
    "summary": "创建导出任务",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "export_task.create",
    "action_name": "创建导出任务",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_task",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/export_task.go:24:GET:",
    "kind": "http",
    "code_entry": "internal/routes/export_task.go:24 handler.List",
    "owner": "export_task",
    "method": "GET",
    "summary": "导出任务列表",
    "audit_event": "N/A",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/export_task.go:33:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/export_task.go:33 handler.GetByID",
    "owner": "export_task",
    "method": "GET",
    "path": "/:id",
    "summary": "导出任务详情",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "export_task.get_by_i_d",
    "action_name": "导出任务详情",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_task",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/export_task.go:42:POST:/:id/cancel",
    "kind": "http",
    "code_entry": "internal/routes/export_task.go:42 handler.Cancel",
    "owner": "export_task",
    "method": "POST",
    "path": "/:id/cancel",
    "summary": "取消导出任务",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "export_task.cancel",
    "action_name": "取消导出任务",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_task",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/health.go:16:GET:/health",
    "kind": "http",
    "code_entry": "internal/routes/health.go:16 *ast.FuncLit",
    "owner": "health",
    "method": "GET",
    "path": "/health",
    "summary": "健康检查",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/health.go:29:GET:/ready",
    "kind": "http",
    "code_entry": "internal/routes/health.go:29 *ast.FuncLit",
    "owner": "health",
    "method": "GET",
    "path": "/ready",
    "summary": "就绪检查",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/iot_card.go:105:POST:/standalone/recall",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:105 handler.RecallCards",
    "owner": "iot_card",
    "method": "POST",
    "path": "/standalone/recall",
    "summary": "批量回收单卡",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "iot_card.recall_cards",
    "action_name": "批量回收单卡",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/iot_card.go:113:PATCH:/series-binding",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:113 handler.BatchSetSeriesBinding",
    "owner": "iot_card",
    "method": "PATCH",
    "path": "/series-binding",
    "summary": "批量设置卡的套餐系列绑定",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "iot_card.batch_set_series_binding",
    "action_name": "批量设置卡的套餐系列绑定",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/iot_card.go:122:GET:/:iccid/realname-link",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:122 handler.GetRealnameLink",
    "owner": "iot_card",
    "method": "GET",
    "path": "/:iccid/realname-link",
    "summary": "获取实名认证链接",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "iot_card.get_realname_link",
    "action_name": "获取实名认证链接",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/iot_card.go:130:PUT:/:iccid/speed-tier",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:130 handler.SetSpeedTier",
    "owner": "iot_card",
    "method": "PUT",
    "path": "/:iccid/speed-tier",
    "summary": "设置卡固定限速档位",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "iot_card.set_speed_tier",
    "action_name": "设置卡固定限速档位",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/iot_card.go:16:GET:/standalone",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:16 handler.ListStandalone",
    "owner": "iot_card",
    "method": "GET",
    "path": "/standalone",
    "summary": "单卡列表（未绑定设备）",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/iot_card.go:24:POST:/batch-update-realname-policy",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:24 handler.BatchUpdateRealnamePolicy",
    "owner": "iot_card",
    "method": "POST",
    "path": "/batch-update-realname-policy",
    "summary": "批量更新卡实名认证策略",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "iot_card.batch_update_realname_policy",
    "action_name": "批量更新卡实名认证策略",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/iot_card.go:33:POST:/import",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:33 importHandler.Import",
    "owner": "iot_card",
    "method": "POST",
    "path": "/import",
    "summary": "批量导入IoT卡（ICCID+MSISDN）",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "iot_card.import",
    "action_name": "批量导入IoT卡（ICCID+MSISDN）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/iot_card.go:79:GET:/import-tasks",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:79 importHandler.List",
    "owner": "iot_card",
    "method": "GET",
    "path": "/import-tasks",
    "summary": "导入任务列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/iot_card.go:88:GET:/import-tasks/:id",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:88 importHandler.GetByID",
    "owner": "iot_card",
    "method": "GET",
    "path": "/import-tasks/:id",
    "summary": "导入任务详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/iot_card.go:97:POST:/standalone/allocate",
    "kind": "http",
    "code_entry": "internal/routes/iot_card.go:97 handler.AllocateCards",
    "owner": "iot_card",
    "method": "POST",
    "path": "/standalone/allocate",
    "summary": "批量分配单卡",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "iot_card.allocate_cards",
    "action_name": "批量分配单卡",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/notification.go:17:GET:/unread-count",
    "kind": "http",
    "code_entry": "internal/routes/notification.go:17 handler.UnreadCount",
    "owner": "notification",
    "method": "GET",
    "path": "/unread-count",
    "summary": "查询通知未读数",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/notification.go:25:GET:/unread-summary",
    "kind": "http",
    "code_entry": "internal/routes/notification.go:25 handler.UnreadSummary",
    "owner": "notification",
    "method": "GET",
    "path": "/unread-summary",
    "summary": "查询通知未读分类汇总",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/notification.go:33:GET:",
    "kind": "http",
    "code_entry": "internal/routes/notification.go:33 handler.List",
    "owner": "notification",
    "method": "GET",
    "summary": "查询通知列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/notification.go:42:PUT:/read-all",
    "kind": "http",
    "code_entry": "internal/routes/notification.go:42 handler.MarkAllRead",
    "owner": "notification",
    "method": "PUT",
    "path": "/read-all",
    "summary": "批量标记通知已读",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "notification.mark_all_read",
    "action_name": "批量标记通知已读",
    "category": "business",
    "risk": "normal",
    "primary_resource": "notification",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/notification.go:51:GET:/:id/target",
    "kind": "http",
    "code_entry": "internal/routes/notification.go:51 handler.Target",
    "owner": "notification",
    "method": "GET",
    "path": "/:id/target",
    "summary": "解析通知受控目标",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/notification.go:60:PUT:/:id/read",
    "kind": "http",
    "code_entry": "internal/routes/notification.go:60 handler.MarkRead",
    "owner": "notification",
    "method": "PUT",
    "path": "/:id/read",
    "summary": "标记单条通知已读",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "notification.mark_read",
    "action_name": "标记单条通知已读",
    "category": "business",
    "risk": "normal",
    "primary_resource": "notification",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/open.go:103:POST:/cards/resume",
    "kind": "http",
    "code_entry": "internal/routes/open.go:103 handler.ResumeCard",
    "owner": "open",
    "method": "POST",
    "path": "/cards/resume",
    "summary": "机卡分离卡复机",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "open.resume_card",
    "action_name": "机卡分离卡复机",
    "category": "business",
    "risk": "normal",
    "primary_resource": "open",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/open.go:112:GET:/packages",
    "kind": "http",
    "code_entry": "internal/routes/open.go:112 handler.ListPackages",
    "owner": "open",
    "method": "GET",
    "path": "/packages",
    "summary": "查询套餐列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/open.go:121:POST:/wallet/package-orders",
    "kind": "http",
    "code_entry": "internal/routes/open.go:121 handler.CreateWalletPackageOrders",
    "owner": "open",
    "method": "POST",
    "path": "/wallet/package-orders",
    "summary": "钱包套餐购买",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "open.create_wallet_package_orders",
    "action_name": "钱包套餐购买",
    "category": "business",
    "risk": "high",
    "primary_resource": "open",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/open.go:130:GET:/wallet/balance",
    "kind": "http",
    "code_entry": "internal/routes/open.go:130 handler.GetWalletBalance",
    "owner": "open",
    "method": "GET",
    "path": "/wallet/balance",
    "summary": "查询预充值钱包余额",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/open.go:138:GET:/wallet/transactions",
    "kind": "http",
    "code_entry": "internal/routes/open.go:138 handler.ListWalletTransactions",
    "owner": "open",
    "method": "GET",
    "path": "/wallet/transactions",
    "summary": "查询预充值钱包流水",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/open.go:147:GET:/devices/traffic",
    "kind": "http",
    "code_entry": "internal/routes/open.go:147 handler.GetDeviceTraffic",
    "owner": "open",
    "method": "GET",
    "path": "/devices/traffic",
    "summary": "查询设备套餐内流量",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/open.go:156:POST:/devices/switch-card",
    "kind": "http",
    "code_entry": "internal/routes/open.go:156 handler.SwitchDeviceCard",
    "owner": "open",
    "method": "POST",
    "path": "/devices/switch-card",
    "summary": "切网（多卡设备切换 ICCID）",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "open.switch_device_card",
    "action_name": "切网（多卡设备切换 ICCID）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "open",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/open.go:164:POST:/devices/reboot",
    "kind": "http",
    "code_entry": "internal/routes/open.go:164 handler.RebootDevice",
    "owner": "open",
    "method": "POST",
    "path": "/devices/reboot",
    "summary": "重启设备",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "open.reboot_device",
    "action_name": "重启设备",
    "category": "business",
    "risk": "normal",
    "primary_resource": "open",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/open.go:172:POST:/devices/reset",
    "kind": "http",
    "code_entry": "internal/routes/open.go:172 handler.ResetDevice",
    "owner": "open",
    "method": "POST",
    "path": "/devices/reset",
    "summary": "恢复出厂设置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "open.reset_device",
    "action_name": "恢复出厂设置",
    "category": "business",
    "risk": "normal",
    "primary_resource": "open",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/open.go:76:GET:/cards/traffic",
    "kind": "http",
    "code_entry": "internal/routes/open.go:76 handler.GetCardTraffic",
    "owner": "open",
    "method": "GET",
    "path": "/cards/traffic",
    "summary": "查询单卡或设备流量",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/open.go:85:GET:/cards/status",
    "kind": "http",
    "code_entry": "internal/routes/open.go:85 handler.GetCardStatus",
    "owner": "open",
    "method": "GET",
    "path": "/cards/status",
    "summary": "查询单卡状态",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/open.go:94:GET:/cards/realname-status",
    "kind": "http",
    "code_entry": "internal/routes/open.go:94 handler.GetRealnameStatus",
    "owner": "open",
    "method": "GET",
    "path": "/cards/realname-status",
    "summary": "查询单卡实名状态",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/order.go:101:POST:/alipay",
    "kind": "http",
    "code_entry": "internal/routes/order.go:101 handler.AlipayCallback",
    "owner": "order",
    "method": "POST",
    "path": "/alipay",
    "summary": "支付宝回调",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.alipay_callback",
    "action_name": "支付宝回调",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:109:POST:/fuiou-pay",
    "kind": "http",
    "code_entry": "internal/routes/order.go:109 handler.FuiouPayCallback",
    "owner": "order",
    "method": "POST",
    "path": "/fuiou-pay",
    "summary": "富友支付回调",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.fuiou_pay_callback",
    "action_name": "富友支付回调",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:14:POST:/orders",
    "kind": "http",
    "code_entry": "internal/routes/order.go:14 handler.Create",
    "owner": "order",
    "method": "POST",
    "path": "/orders",
    "summary": "创建订单",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.create",
    "action_name": "创建订单",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:22:GET:/orders",
    "kind": "http",
    "code_entry": "internal/routes/order.go:22 handler.List",
    "owner": "order",
    "method": "GET",
    "path": "/orders",
    "summary": "获取订单列表",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/order.go:30:GET:/orders/:id",
    "kind": "http",
    "code_entry": "internal/routes/order.go:30 handler.Get",
    "owner": "order",
    "method": "GET",
    "path": "/orders/:id",
    "summary": "获取订单详情",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/order.go:38:POST:/orders/:id/cancel",
    "kind": "http",
    "code_entry": "internal/routes/order.go:38 handler.Cancel",
    "owner": "order",
    "method": "POST",
    "path": "/orders/:id/cancel",
    "summary": "取消订单",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.cancel",
    "action_name": "取消订单",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:46:POST:/orders/purchase-check",
    "kind": "http",
    "code_entry": "internal/routes/order.go:46 handler.PurchaseCheck",
    "owner": "order",
    "method": "POST",
    "path": "/orders/purchase-check",
    "summary": "套餐购买预检",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/order.go:57:POST:/carriers/ctcc/realname",
    "kind": "http",
    "code_entry": "internal/routes/order.go:57 handler.Realname",
    "owner": "order",
    "method": "POST",
    "path": "/carriers/ctcc/realname",
    "summary": "电信实名结果回调",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.realname",
    "action_name": "电信实名结果回调",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:69:POST:/carriers/cmcc/realname",
    "kind": "http",
    "code_entry": "internal/routes/order.go:69 handler.Realname",
    "owner": "order",
    "method": "POST",
    "path": "/carriers/cmcc/realname",
    "summary": "移动实名结果回调",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.realname",
    "action_name": "移动实名结果回调",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:77:POST:/carriers/cucc/realname",
    "kind": "http",
    "code_entry": "internal/routes/order.go:77 handler.Realname",
    "owner": "order",
    "method": "POST",
    "path": "/carriers/cucc/realname",
    "summary": "联通实名结果回调",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.realname",
    "action_name": "联通实名结果回调",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:85:POST:/carriers/cucc/realname/remove",
    "kind": "http",
    "code_entry": "internal/routes/order.go:85 handler.Remove",
    "owner": "order",
    "method": "POST",
    "path": "/carriers/cucc/realname/remove",
    "summary": "联通解除实名回调",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.remove",
    "action_name": "联通解除实名回调",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order.go:93:POST:/wechat-pay",
    "kind": "http",
    "code_entry": "internal/routes/order.go:93 handler.WechatPayCallback",
    "owner": "order",
    "method": "POST",
    "path": "/wechat-pay",
    "summary": "微信支付回调",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order.wechat_pay_callback",
    "action_name": "微信支付回调",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order_package_invalidate.go:16:POST:",
    "kind": "http",
    "code_entry": "internal/routes/order_package_invalidate.go:16 handler.Create",
    "owner": "order_package_invalidate",
    "method": "POST",
    "summary": "创建订单套餐批量失效任务",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "order_package_invalidate.create",
    "action_name": "创建订单套餐批量失效任务",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order_package_invalidate",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/order_package_invalidate.go:25:GET:",
    "kind": "http",
    "code_entry": "internal/routes/order_package_invalidate.go:25 handler.List",
    "owner": "order_package_invalidate",
    "method": "GET",
    "summary": "查询订单套餐失效任务列表",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/order_package_invalidate.go:33:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/order_package_invalidate.go:33 handler.GetByID",
    "owner": "order_package_invalidate",
    "method": "GET",
    "path": "/:id",
    "summary": "查询订单套餐失效任务详情",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/package.go:15:GET:",
    "kind": "http",
    "code_entry": "internal/routes/package.go:15 handler.List",
    "owner": "package",
    "method": "GET",
    "summary": "套餐列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/package.go:23:POST:",
    "kind": "http",
    "code_entry": "internal/routes/package.go:23 handler.Create",
    "owner": "package",
    "method": "POST",
    "summary": "创建套餐",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package.create",
    "action_name": "创建套餐",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package.go:31:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/package.go:31 handler.Get",
    "owner": "package",
    "method": "GET",
    "path": "/:id",
    "summary": "获取套餐详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/package.go:39:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/package.go:39 handler.Update",
    "owner": "package",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新套餐",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package.update",
    "action_name": "更新套餐",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package.go:47:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/package.go:47 handler.Delete",
    "owner": "package",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除套餐",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package.delete",
    "action_name": "删除套餐",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package.go:55:PATCH:/:id/status",
    "kind": "http",
    "code_entry": "internal/routes/package.go:55 handler.UpdateStatus",
    "owner": "package",
    "method": "PATCH",
    "path": "/:id/status",
    "summary": "更新套餐状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package.update_status",
    "action_name": "更新套餐状态",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package.go:63:PATCH:/:id/shelf",
    "kind": "http",
    "code_entry": "internal/routes/package.go:63 handler.UpdateShelfStatus",
    "owner": "package",
    "method": "PATCH",
    "path": "/:id/shelf",
    "summary": "更新套餐上架状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package.update_shelf_status",
    "action_name": "更新套餐上架状态",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package.go:71:PATCH:/:id/retail-price",
    "kind": "http",
    "code_entry": "internal/routes/package.go:71 handler.UpdateRetailPrice",
    "owner": "package",
    "method": "PATCH",
    "path": "/:id/retail-price",
    "summary": "修改零售价（代理）",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package.update_retail_price",
    "action_name": "修改零售价（代理）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package_expiry.go:13:GET:/expiring-assets",
    "kind": "http",
    "code_entry": "internal/routes/package_expiry.go:13 handler.ListExpiring",
    "owner": "package_expiry",
    "method": "GET",
    "path": "/expiring-assets",
    "summary": "查询临期资产列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/package_expiry.go:22:POST:/expiring-assets/reminder-scan",
    "kind": "http",
    "code_entry": "internal/routes/package_expiry.go:22 handler.TriggerPackageExpiryReminder",
    "owner": "package_expiry",
    "method": "POST",
    "path": "/expiring-assets/reminder-scan",
    "summary": "手动触发套餐临期提醒扫描",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package_expiry.trigger_package_expiry_reminder",
    "action_name": "手动触发套餐临期提醒扫描",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_expiry",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package_series.go:15:GET:",
    "kind": "http",
    "code_entry": "internal/routes/package_series.go:15 handler.List",
    "owner": "package_series",
    "method": "GET",
    "summary": "套餐系列列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/package_series.go:23:POST:",
    "kind": "http",
    "code_entry": "internal/routes/package_series.go:23 handler.Create",
    "owner": "package_series",
    "method": "POST",
    "summary": "创建套餐系列",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package_series.create",
    "action_name": "创建套餐系列",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package_series.go:31:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/package_series.go:31 handler.Get",
    "owner": "package_series",
    "method": "GET",
    "path": "/:id",
    "summary": "获取套餐系列详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/package_series.go:39:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/package_series.go:39 handler.Update",
    "owner": "package_series",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新套餐系列",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package_series.update",
    "action_name": "更新套餐系列",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package_series.go:47:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/package_series.go:47 handler.Delete",
    "owner": "package_series",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除套餐系列",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package_series.delete",
    "action_name": "删除套餐系列",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package_series.go:55:PATCH:/:id/status",
    "kind": "http",
    "code_entry": "internal/routes/package_series.go:55 handler.UpdateStatus",
    "owner": "package_series",
    "method": "PATCH",
    "path": "/:id/status",
    "summary": "更新套餐系列状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "package_series.update_status",
    "action_name": "更新套餐系列状态",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/package_usage.go:16:GET:/:id/daily-records",
    "kind": "http",
    "code_entry": "internal/routes/package_usage.go:16 handler.GetDailyRecords",
    "owner": "package_usage",
    "method": "GET",
    "path": "/:id/daily-records",
    "summary": "获取套餐流量详单",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/permission.go:17:POST:",
    "kind": "http",
    "code_entry": "internal/routes/permission.go:17 h.Create",
    "owner": "permission",
    "method": "POST",
    "summary": "创建权限",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "permission.create",
    "action_name": "创建权限",
    "category": "security",
    "risk": "high",
    "primary_resource": "permission",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/permission.go:25:GET:",
    "kind": "http",
    "code_entry": "internal/routes/permission.go:25 h.List",
    "owner": "permission",
    "method": "GET",
    "summary": "权限列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/permission.go:33:GET:/tree",
    "kind": "http",
    "code_entry": "internal/routes/permission.go:33 h.GetTree",
    "owner": "permission",
    "method": "GET",
    "path": "/tree",
    "summary": "获取权限树",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/permission.go:41:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/permission.go:41 h.Get",
    "owner": "permission",
    "method": "GET",
    "path": "/:id",
    "summary": "获取权限详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/permission.go:49:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/permission.go:49 h.Update",
    "owner": "permission",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新权限",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "permission.update",
    "action_name": "更新权限",
    "category": "security",
    "risk": "high",
    "primary_resource": "permission",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/permission.go:57:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/permission.go:57 h.Delete",
    "owner": "permission",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除权限",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "permission.delete",
    "action_name": "删除权限",
    "category": "security",
    "risk": "high",
    "primary_resource": "permission",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:107:POST:/logout",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:107 handlers.ClientAuth.Logout",
    "owner": "personal",
    "method": "POST",
    "path": "/logout",
    "summary": "退出登录",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.logout",
    "action_name": "退出登录",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:123:GET:/profile",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:123 handlers.PersonalCustomer.GetProfile",
    "owner": "personal",
    "method": "GET",
    "path": "/profile",
    "summary": "获取个人资料",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:133:PUT:/profile",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:133 handlers.PersonalCustomer.UpdateProfile",
    "owner": "personal",
    "method": "PUT",
    "path": "/profile",
    "summary": "更新个人资料",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.update_profile",
    "action_name": "更新个人资料",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:142:GET:/asset/info",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:142 handlers.ClientAsset.GetAssetInfo",
    "owner": "personal",
    "method": "GET",
    "path": "/asset/info",
    "summary": "资产信息",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:150:GET:/asset/packages",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:150 handlers.ClientAsset.GetAvailablePackages",
    "owner": "personal",
    "method": "GET",
    "path": "/asset/packages",
    "summary": "资产可购套餐列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:158:GET:/asset/package-history",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:158 handlers.ClientAsset.GetPackageHistory",
    "owner": "personal",
    "method": "GET",
    "path": "/asset/package-history",
    "summary": "资产套餐历史",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:166:POST:/asset/refresh",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:166 handlers.ClientAsset.RefreshAsset",
    "owner": "personal",
    "method": "POST",
    "path": "/asset/refresh",
    "summary": "资产刷新",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.refresh_asset",
    "action_name": "资产刷新",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:174:GET:/wallet/detail",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:174 handlers.ClientWallet.GetWalletDetail",
    "owner": "personal",
    "method": "GET",
    "path": "/wallet/detail",
    "summary": "钱包详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:182:GET:/wallet/transactions",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:182 handlers.ClientWallet.GetWalletTransactions",
    "owner": "personal",
    "method": "GET",
    "path": "/wallet/transactions",
    "summary": "钱包流水列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:190:GET:/wallet/recharge-check",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:190 handlers.ClientWallet.GetRechargeCheck",
    "owner": "personal",
    "method": "GET",
    "path": "/wallet/recharge-check",
    "summary": "充值前校验",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:198:POST:/wallet/recharge",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:198 handlers.ClientWallet.CreateRecharge",
    "owner": "personal",
    "method": "POST",
    "path": "/wallet/recharge",
    "summary": "创建充值订单",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.create_recharge",
    "action_name": "创建充值订单",
    "category": "business",
    "risk": "high",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:206:GET:/wallet/recharges",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:206 handlers.ClientWallet.GetRechargeList",
    "owner": "personal",
    "method": "GET",
    "path": "/wallet/recharges",
    "summary": "充值记录列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:214:GET:/recharge-orders",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:214 handlers.ClientRechargeOrder.ListRechargeOrders",
    "owner": "personal",
    "method": "GET",
    "path": "/recharge-orders",
    "summary": "充值订单列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:222:GET:/recharge-orders/:id",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:222 handlers.ClientRechargeOrder.GetRechargeOrderDetail",
    "owner": "personal",
    "method": "GET",
    "path": "/recharge-orders/:id",
    "summary": "充值订单详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:230:POST:/orders/create",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:230 handlers.ClientOrder.CreateOrder",
    "owner": "personal",
    "method": "POST",
    "path": "/orders/create",
    "summary": "创建订单",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.create_order",
    "action_name": "创建订单",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:238:GET:/orders",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:238 handlers.ClientOrder.ListOrders",
    "owner": "personal",
    "method": "GET",
    "path": "/orders",
    "summary": "订单列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:246:GET:/orders/:id",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:246 handlers.ClientOrder.GetOrderDetail",
    "owner": "personal",
    "method": "GET",
    "path": "/orders/:id",
    "summary": "订单详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:254:POST:/orders/:id/pay",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:254 handlers.ClientOrder.PayOrder",
    "owner": "personal",
    "method": "POST",
    "path": "/orders/:id/pay",
    "summary": "订单支付",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.pay_order",
    "action_name": "订单支付",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:25:GET:/wechat/appid",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:25 handlers.ClientWechat.GetAppID",
    "owner": "personal",
    "method": "GET",
    "path": "/wechat/appid",
    "summary": "获取当前生效的公众号 AppID",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:262:GET:/exchange/pending",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:262 handlers.ClientExchange.GetPending",
    "owner": "personal",
    "method": "GET",
    "path": "/exchange/pending",
    "summary": "查询待处理换货单",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:270:POST:/exchange/:id/shipping-info",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:270 handlers.ClientExchange.SubmitShippingInfo",
    "owner": "personal",
    "method": "POST",
    "path": "/exchange/:id/shipping-info",
    "summary": "提交收货信息",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.submit_shipping_info",
    "action_name": "提交收货信息",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:278:GET:/realname/link",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:278 handlers.ClientRealname.GetRealnameLink",
    "owner": "personal",
    "method": "GET",
    "path": "/realname/link",
    "summary": "获取实名认证链接",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.get_realname_link",
    "action_name": "获取实名认证链接",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:286:GET:/device/cards",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:286 handlers.ClientDevice.GetDeviceCards",
    "owner": "personal",
    "method": "GET",
    "path": "/device/cards",
    "summary": "获取设备卡列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:294:POST:/device/reboot",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:294 handlers.ClientDevice.RebootDevice",
    "owner": "personal",
    "method": "POST",
    "path": "/device/reboot",
    "summary": "设备重启",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.reboot_device",
    "action_name": "设备重启",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:302:POST:/device/factory-reset",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:302 handlers.ClientDevice.FactoryResetDevice",
    "owner": "personal",
    "method": "POST",
    "path": "/device/factory-reset",
    "summary": "恢复出厂设置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.factory_reset_device",
    "action_name": "恢复出厂设置",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:310:POST:/device/wifi",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:310 handlers.ClientDevice.SetWiFi",
    "owner": "personal",
    "method": "POST",
    "path": "/device/wifi",
    "summary": "设备WiFi配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.set_wi_fi",
    "action_name": "设备WiFi配置",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:318:POST:/device/switch-card",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:318 handlers.ClientDevice.SwitchCard",
    "owner": "personal",
    "method": "POST",
    "path": "/device/switch-card",
    "summary": "设备切卡",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.switch_card",
    "action_name": "设备切卡",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:34:GET:/wechat/jssdk-config",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:34 handlers.ClientWechat.GetJSSDKConfig",
    "owner": "personal",
    "method": "GET",
    "path": "/wechat/jssdk-config",
    "summary": "获取微信 JSSDK 签名配置",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:43:POST:authBasePath+\"/verify-asset\"",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:43 handlers.ClientAuth.VerifyAsset",
    "owner": "personal",
    "method": "POST",
    "path": "authBasePath+\"/verify-asset\"",
    "summary": "资产验证",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal.go:51:POST:authBasePath+\"/wechat-login\"",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:51 handlers.ClientAuth.WechatLogin",
    "owner": "personal",
    "method": "POST",
    "path": "authBasePath+\"/wechat-login\"",
    "summary": "公众号登录",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.wechat_login",
    "action_name": "公众号登录",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:59:POST:authBasePath+\"/miniapp-login\"",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:59 handlers.ClientAuth.MiniappLogin",
    "owner": "personal",
    "method": "POST",
    "path": "authBasePath+\"/miniapp-login\"",
    "summary": "小程序登录",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.miniapp_login",
    "action_name": "小程序登录",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:67:POST:authBasePath+\"/send-code\"",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:67 handlers.ClientAuth.SendCode",
    "owner": "personal",
    "method": "POST",
    "path": "authBasePath+\"/send-code\"",
    "summary": "发送验证码",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.send_code",
    "action_name": "发送验证码",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:77:POST:authBasePath+\"/dev-login\"",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:77 handlers.ClientAuth.DevLogin",
    "owner": "personal",
    "method": "POST",
    "path": "authBasePath+\"/dev-login\"",
    "summary": "开发环境测试登录",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.dev_login",
    "action_name": "开发环境测试登录",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:91:POST:/bind-phone",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:91 handlers.ClientAuth.BindPhone",
    "owner": "personal",
    "method": "POST",
    "path": "/bind-phone",
    "summary": "绑定手机号",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.bind_phone",
    "action_name": "绑定手机号",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal.go:99:POST:/change-phone",
    "kind": "http",
    "code_entry": "internal/routes/personal.go:99 handlers.ClientAuth.ChangePhone",
    "owner": "personal",
    "method": "POST",
    "path": "/change-phone",
    "summary": "更换手机号",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal.change_phone",
    "action_name": "更换手机号",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "personal_customer/personal_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal_notification.go:16:GET:/unread-count",
    "kind": "http",
    "code_entry": "internal/routes/personal_notification.go:16 handler.UnreadCount",
    "owner": "personal_notification",
    "method": "GET",
    "path": "/unread-count",
    "summary": "查询个人客户通知未读数",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal_notification.go:24:GET:",
    "kind": "http",
    "code_entry": "internal/routes/personal_notification.go:24 handler.List",
    "owner": "personal_notification",
    "method": "GET",
    "summary": "查询个人客户通知列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/personal_notification.go:34:PUT:/read-all",
    "kind": "http",
    "code_entry": "internal/routes/personal_notification.go:34 handler.MarkAllRead",
    "owner": "personal_notification",
    "method": "PUT",
    "path": "/read-all",
    "summary": "全部标记个人客户通知已读",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal_notification.mark_all_read",
    "action_name": "全部标记个人客户通知已读",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal_notification",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/personal_notification.go:42:PUT:/:id/read",
    "kind": "http",
    "code_entry": "internal/routes/personal_notification.go:42 handler.MarkRead",
    "owner": "personal_notification",
    "method": "PUT",
    "path": "/:id/read",
    "summary": "标记个人客户单条通知已读",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "personal_notification.mark_read",
    "action_name": "标记个人客户单条通知已读",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal_notification",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "当前个人客户本人范围内可见",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_alert.go:17:POST:",
    "kind": "http",
    "code_entry": "internal/routes/polling_alert.go:17 handler.CreateRule",
    "owner": "polling_alert",
    "method": "POST",
    "summary": "创建轮询告警规则",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_alert.create_rule",
    "action_name": "创建轮询告警规则",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_alert",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_alert.go:25:GET:",
    "kind": "http",
    "code_entry": "internal/routes/polling_alert.go:25 handler.ListRules",
    "owner": "polling_alert",
    "method": "GET",
    "summary": "获取轮询告警规则列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_alert.go:33:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_alert.go:33 handler.GetRule",
    "owner": "polling_alert",
    "method": "GET",
    "path": "/:id",
    "summary": "获取轮询告警规则详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_alert.go:41:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_alert.go:41 handler.UpdateRule",
    "owner": "polling_alert",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新轮询告警规则",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_alert.update_rule",
    "action_name": "更新轮询告警规则",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_alert",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_alert.go:49:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_alert.go:49 handler.DeleteRule",
    "owner": "polling_alert",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除轮询告警规则",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_alert.delete_rule",
    "action_name": "删除轮询告警规则",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_alert",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_alert.go:59:GET:/polling-alert-history",
    "kind": "http",
    "code_entry": "internal/routes/polling_alert.go:59 handler.ListHistory",
    "owner": "polling_alert",
    "method": "GET",
    "path": "/polling-alert-history",
    "summary": "获取轮询告警历史",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:17:POST:",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:17 handler.CreateConfig",
    "owner": "polling_cleanup",
    "method": "POST",
    "summary": "创建数据清理配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_cleanup.create_config",
    "action_name": "创建数据清理配置",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_cleanup",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:25:GET:",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:25 handler.ListConfigs",
    "owner": "polling_cleanup",
    "method": "GET",
    "summary": "获取数据清理配置列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:33:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:33 handler.GetConfig",
    "owner": "polling_cleanup",
    "method": "GET",
    "path": "/:id",
    "summary": "获取数据清理配置详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:41:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:41 handler.UpdateConfig",
    "owner": "polling_cleanup",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新数据清理配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_cleanup.update_config",
    "action_name": "更新数据清理配置",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_cleanup",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:49:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:49 handler.DeleteConfig",
    "owner": "polling_cleanup",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除数据清理配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_cleanup.delete_config",
    "action_name": "删除数据清理配置",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_cleanup",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:58:GET:/data-cleanup-logs",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:58 handler.ListLogs",
    "owner": "polling_cleanup",
    "method": "GET",
    "path": "/data-cleanup-logs",
    "summary": "获取数据清理日志列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:67:GET:/data-cleanup/preview",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:67 handler.Preview",
    "owner": "polling_cleanup",
    "method": "GET",
    "path": "/data-cleanup/preview",
    "summary": "预览待清理数据",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:75:GET:/data-cleanup/progress",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:75 handler.GetProgress",
    "owner": "polling_cleanup",
    "method": "GET",
    "path": "/data-cleanup/progress",
    "summary": "获取数据清理进度",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_cleanup.go:83:POST:/data-cleanup/trigger",
    "kind": "http",
    "code_entry": "internal/routes/polling_cleanup.go:83 handler.TriggerCleanup",
    "owner": "polling_cleanup",
    "method": "POST",
    "path": "/data-cleanup/trigger",
    "summary": "手动触发数据清理",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_cleanup.trigger_cleanup",
    "action_name": "手动触发数据清理",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_cleanup",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_concurrency.go:16:GET:",
    "kind": "http",
    "code_entry": "internal/routes/polling_concurrency.go:16 handler.List",
    "owner": "polling_concurrency",
    "method": "GET",
    "summary": "获取轮询并发配置列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_concurrency.go:24:POST:/reset",
    "kind": "http",
    "code_entry": "internal/routes/polling_concurrency.go:24 handler.Reset",
    "owner": "polling_concurrency",
    "method": "POST",
    "path": "/reset",
    "summary": "重置轮询并发计数",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_concurrency.reset",
    "action_name": "重置轮询并发计数",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_concurrency",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_concurrency.go:32:GET:/:task_type",
    "kind": "http",
    "code_entry": "internal/routes/polling_concurrency.go:32 handler.Get",
    "owner": "polling_concurrency",
    "method": "GET",
    "path": "/:task_type",
    "summary": "获取指定任务类型的并发配置",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_concurrency.go:40:PUT:/:task_type",
    "kind": "http",
    "code_entry": "internal/routes/polling_concurrency.go:40 handler.Update",
    "owner": "polling_concurrency",
    "method": "PUT",
    "path": "/:task_type",
    "summary": "更新轮询并发配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_concurrency.update",
    "action_name": "更新轮询并发配置",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_concurrency",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_config.go:16:GET:",
    "kind": "http",
    "code_entry": "internal/routes/polling_config.go:16 handler.List",
    "owner": "polling_config",
    "method": "GET",
    "summary": "获取轮询配置列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_config.go:24:POST:",
    "kind": "http",
    "code_entry": "internal/routes/polling_config.go:24 handler.Create",
    "owner": "polling_config",
    "method": "POST",
    "summary": "创建轮询配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_config.create",
    "action_name": "创建轮询配置",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_config.go:32:GET:/enabled",
    "kind": "http",
    "code_entry": "internal/routes/polling_config.go:32 handler.ListEnabled",
    "owner": "polling_config",
    "method": "GET",
    "path": "/enabled",
    "summary": "获取所有启用的配置",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_config.go:40:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_config.go:40 handler.Get",
    "owner": "polling_config",
    "method": "GET",
    "path": "/:id",
    "summary": "获取轮询配置详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_config.go:48:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_config.go:48 handler.Update",
    "owner": "polling_config",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新轮询配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_config.update",
    "action_name": "更新轮询配置",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_config.go:56:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/polling_config.go:56 handler.Delete",
    "owner": "polling_config",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除轮询配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_config.delete",
    "action_name": "删除轮询配置",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_config.go:64:PUT:/:id/status",
    "kind": "http",
    "code_entry": "internal/routes/polling_config.go:64 handler.UpdateStatus",
    "owner": "polling_config",
    "method": "PUT",
    "path": "/:id/status",
    "summary": "更新轮询配置状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_config.update_status",
    "action_name": "更新轮询配置状态",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_manual_trigger.go:16:POST:/single",
    "kind": "http",
    "code_entry": "internal/routes/polling_manual_trigger.go:16 handler.TriggerSingle",
    "owner": "polling_manual_trigger",
    "method": "POST",
    "path": "/single",
    "summary": "单卡手动触发",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_manual_trigger.trigger_single",
    "action_name": "单卡手动触发",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_manual_trigger",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_manual_trigger.go:24:POST:/batch",
    "kind": "http",
    "code_entry": "internal/routes/polling_manual_trigger.go:24 handler.TriggerBatch",
    "owner": "polling_manual_trigger",
    "method": "POST",
    "path": "/batch",
    "summary": "批量手动触发",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_manual_trigger.trigger_batch",
    "action_name": "批量手动触发",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_manual_trigger",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_manual_trigger.go:32:POST:/by-condition",
    "kind": "http",
    "code_entry": "internal/routes/polling_manual_trigger.go:32 handler.TriggerByCondition",
    "owner": "polling_manual_trigger",
    "method": "POST",
    "path": "/by-condition",
    "summary": "条件筛选触发",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_manual_trigger.trigger_by_condition",
    "action_name": "条件筛选触发",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_manual_trigger",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_manual_trigger.go:40:GET:/status",
    "kind": "http",
    "code_entry": "internal/routes/polling_manual_trigger.go:40 handler.GetStatus",
    "owner": "polling_manual_trigger",
    "method": "GET",
    "path": "/status",
    "summary": "获取手动触发状态",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_manual_trigger.go:48:GET:/history",
    "kind": "http",
    "code_entry": "internal/routes/polling_manual_trigger.go:48 handler.ListHistory",
    "owner": "polling_manual_trigger",
    "method": "GET",
    "path": "/history",
    "summary": "获取手动触发历史",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_manual_trigger.go:56:POST:/cancel",
    "kind": "http",
    "code_entry": "internal/routes/polling_manual_trigger.go:56 handler.CancelTrigger",
    "owner": "polling_manual_trigger",
    "method": "POST",
    "path": "/cancel",
    "summary": "取消手动触发任务",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "polling_manual_trigger.cancel_trigger",
    "action_name": "取消手动触发任务",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_manual_trigger",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/polling_monitoring.go:16:GET:",
    "kind": "http",
    "code_entry": "internal/routes/polling_monitoring.go:16 handler.GetOverview",
    "owner": "polling_monitoring",
    "method": "GET",
    "summary": "获取轮询总览统计",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_monitoring.go:24:GET:/queues",
    "kind": "http",
    "code_entry": "internal/routes/polling_monitoring.go:24 handler.GetQueueStatuses",
    "owner": "polling_monitoring",
    "method": "GET",
    "path": "/queues",
    "summary": "获取轮询队列状态",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_monitoring.go:32:GET:/tasks",
    "kind": "http",
    "code_entry": "internal/routes/polling_monitoring.go:32 handler.GetTaskStatuses",
    "owner": "polling_monitoring",
    "method": "GET",
    "path": "/tasks",
    "summary": "获取轮询任务统计",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/polling_monitoring.go:40:GET:/init-progress",
    "kind": "http",
    "code_entry": "internal/routes/polling_monitoring.go:40 handler.GetInitProgress",
    "owner": "polling_monitoring",
    "method": "GET",
    "path": "/init-progress",
    "summary": "获取轮询初始化进度",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/refund.go:28:POST:",
    "kind": "http",
    "code_entry": "internal/routes/refund.go:28 handler.Create",
    "owner": "refund",
    "method": "POST",
    "summary": "创建退款申请",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "refund.create",
    "action_name": "创建退款申请",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/refund.go:36:GET:",
    "kind": "http",
    "code_entry": "internal/routes/refund.go:36 handler.List",
    "owner": "refund",
    "method": "GET",
    "summary": "退款申请列表",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/refund.go:44:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/refund.go:44 handler.GetByID",
    "owner": "refund",
    "method": "GET",
    "path": "/:id",
    "summary": "退款申请详情",
    "audit_event": "N/A",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/refund.go:52:POST:/:id/approve",
    "kind": "http",
    "code_entry": "internal/routes/refund.go:52 handler.Approve",
    "owner": "refund",
    "method": "POST",
    "path": "/:id/approve",
    "summary": "审批通过退款申请",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "refund.approve",
    "action_name": "审批通过退款申请",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/refund.go:60:POST:/:id/reject",
    "kind": "http",
    "code_entry": "internal/routes/refund.go:60 handler.Reject",
    "owner": "refund",
    "method": "POST",
    "path": "/:id/reject",
    "summary": "审批拒绝退款申请",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "refund.reject",
    "action_name": "审批拒绝退款申请",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/refund.go:68:POST:/:id/return",
    "kind": "http",
    "code_entry": "internal/routes/refund.go:68 handler.Return",
    "owner": "refund",
    "method": "POST",
    "path": "/:id/return",
    "summary": "退回退款申请",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "refund.return",
    "action_name": "退回退款申请",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/refund.go:76:POST:/:id/resubmit",
    "kind": "http",
    "code_entry": "internal/routes/refund.go:76 handler.Resubmit",
    "owner": "refund",
    "method": "POST",
    "path": "/:id/resubmit",
    "summary": "重新提交退款申请",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "refund.resubmit",
    "action_name": "重新提交退款申请",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:18:POST:",
    "kind": "http",
    "code_entry": "internal/routes/role.go:18 h.Create",
    "owner": "role",
    "method": "POST",
    "summary": "创建角色",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.create",
    "action_name": "创建角色",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:26:GET:",
    "kind": "http",
    "code_entry": "internal/routes/role.go:26 h.List",
    "owner": "role",
    "method": "GET",
    "summary": "角色列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/role.go:34:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/role.go:34 h.Get",
    "owner": "role",
    "method": "GET",
    "path": "/:id",
    "summary": "获取角色详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/role.go:42:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/role.go:42 h.Update",
    "owner": "role",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新角色",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.update",
    "action_name": "更新角色",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:50:PUT:/:id/status",
    "kind": "http",
    "code_entry": "internal/routes/role.go:50 h.UpdateStatus",
    "owner": "role",
    "method": "PUT",
    "path": "/:id/status",
    "summary": "更新角色状态",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.update_status",
    "action_name": "更新角色状态",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:58:PUT:/:id/default-credit",
    "kind": "http",
    "code_entry": "internal/routes/role.go:58 h.UpdateDefaultCredit",
    "owner": "role",
    "method": "PUT",
    "path": "/:id/default-credit",
    "summary": "更新客户角色的新建代理默认信用模板",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.update_default_credit",
    "action_name": "更新客户角色的新建代理默认信用模板",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:66:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/role.go:66 h.Delete",
    "owner": "role",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除角色",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.delete",
    "action_name": "删除角色",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:75:POST:/:id/permissions",
    "kind": "http",
    "code_entry": "internal/routes/role.go:75 h.AssignPermissions",
    "owner": "role",
    "method": "POST",
    "path": "/:id/permissions",
    "summary": "分配权限",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.assign_permissions",
    "action_name": "分配权限",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:83:GET:/:id/permissions",
    "kind": "http",
    "code_entry": "internal/routes/role.go:83 h.GetPermissions",
    "owner": "role",
    "method": "GET",
    "path": "/:id/permissions",
    "summary": "获取角色权限",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/role.go:91:DELETE:/:role_id/permissions/:perm_id",
    "kind": "http",
    "code_entry": "internal/routes/role.go:91 h.RemovePermission",
    "owner": "role",
    "method": "DELETE",
    "path": "/:role_id/permissions/:perm_id",
    "summary": "移除权限",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.remove_permission",
    "action_name": "移除权限",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/role.go:99:DELETE:/:role_id/permissions",
    "kind": "http",
    "code_entry": "internal/routes/role.go:99 h.BatchRemovePermissions",
    "owner": "role",
    "method": "DELETE",
    "path": "/:role_id/permissions",
    "summary": "批量移除权限",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "role.batch_remove_permissions",
    "action_name": "批量移除权限",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:108:POST:/:shop_id/roles",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:108 handler.AssignShopRoles",
    "owner": "shop",
    "method": "POST",
    "path": "/:shop_id/roles",
    "summary": "分配店铺默认角色",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.assign_shop_roles",
    "action_name": "分配店铺默认角色",
    "category": "business",
    "risk": "high",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:116:GET:/:shop_id/roles",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:116 handler.GetShopRoles",
    "owner": "shop",
    "method": "GET",
    "path": "/:shop_id/roles",
    "summary": "查询店铺默认角色",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:124:DELETE:/:shop_id/roles/:role_id",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:124 handler.DeleteShopRole",
    "owner": "shop",
    "method": "DELETE",
    "path": "/:shop_id/roles/:role_id",
    "summary": "删除店铺默认角色",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.delete_shop_role",
    "action_name": "删除店铺默认角色",
    "category": "business",
    "risk": "high",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:137:GET:/fund-summary",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:137 agentFundManagement",
    "owner": "shop",
    "method": "GET",
    "path": "/fund-summary",
    "summary": "代理商资金概况",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:146:GET:/:shop_id/withdrawal-requests",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:146 handler.ListWithdrawalRequests",
    "owner": "shop",
    "method": "GET",
    "path": "/:shop_id/withdrawal-requests",
    "summary": "代理商提现记录",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:154:GET:/:shop_id/commission-records",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:154 handler.ListCommissionRecords",
    "owner": "shop",
    "method": "GET",
    "path": "/:shop_id/commission-records",
    "summary": "代理商佣金明细",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:162:GET:/:shop_id/main-wallet/transactions",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:162 handler.ListMainWalletTransactions",
    "owner": "shop",
    "method": "GET",
    "path": "/:shop_id/main-wallet/transactions",
    "summary": "代理商预充值钱包流水",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:170:GET:/:shop_id/commission-stats",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:170 handler.GetCommissionStats",
    "owner": "shop",
    "method": "GET",
    "path": "/:shop_id/commission-stats",
    "summary": "代理商佣金统计",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:178:GET:/:shop_id/commission-daily-stats",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:178 handler.GetCommissionDailyStats",
    "owner": "shop",
    "method": "GET",
    "path": "/:shop_id/commission-daily-stats",
    "summary": "代理商每日佣金统计",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:186:POST:/:shop_id/withdrawal-requests",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:186 handler.CreateWithdrawal",
    "owner": "shop",
    "method": "POST",
    "path": "/:shop_id/withdrawal-requests",
    "summary": "发起提现申请",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.create_withdrawal",
    "action_name": "发起提现申请",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:18:GET:",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:18 coreShopManagement",
    "owner": "shop",
    "method": "GET",
    "summary": "店铺列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:197:POST:/:id/resolve",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:197 handler.ResolveCommissionRecord",
    "owner": "shop",
    "method": "POST",
    "path": "/:id/resolve",
    "summary": "修正待审佣金记录",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.resolve_commission_record",
    "action_name": "修正待审佣金记录",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:27:POST:",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:27 coreShopManagement",
    "owner": "shop",
    "method": "POST",
    "summary": "创建店铺",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.core_shop_management",
    "action_name": "创建店铺",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:36:GET:/business-owner-candidates",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:36 coreShopManagement",
    "owner": "shop",
    "method": "GET",
    "path": "/business-owner-candidates",
    "summary": "查询店铺业务员候选",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:45:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:45 coreShopManagement",
    "owner": "shop",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新店铺",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.core_shop_management",
    "action_name": "更新店铺",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:54:PUT:/:id/credit-limit",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:54 handler.UpdateCreditLimit",
    "owner": "shop",
    "method": "PUT",
    "path": "/:id/credit-limit",
    "summary": "调整既有店铺实际信用额度",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.update_credit_limit",
    "action_name": "调整既有店铺实际信用额度",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:63:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:63 coreShopManagement",
    "owner": "shop",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除店铺",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop.core_shop_management",
    "action_name": "删除店铺",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop.go:72:GET:/cascade",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:72 coreShopManagement",
    "owner": "shop",
    "method": "GET",
    "path": "/cascade",
    "summary": "店铺联级查询",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop.go:85:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/shop.go:85 coreShopManagement",
    "owner": "shop",
    "method": "GET",
    "path": "/:id",
    "summary": "查询店铺详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop_package_batch_allocation.go:15:POST:",
    "kind": "http",
    "code_entry": "internal/routes/shop_package_batch_allocation.go:15 handler.BatchAllocate",
    "owner": "shop_package_batch_allocation",
    "method": "POST",
    "summary": "批量分配套餐",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop_package_batch_allocation.batch_allocate",
    "action_name": "批量分配套餐",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_package_batch_allocation",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop_package_batch_allocation.go:23:PATCH:/shop-package-allocations/:id/expiry-base",
    "kind": "http",
    "code_entry": "internal/routes/shop_package_batch_allocation.go:23 handler.UpdateExpiryBase",
    "owner": "shop_package_batch_allocation",
    "method": "PATCH",
    "path": "/shop-package-allocations/:id/expiry-base",
    "summary": "修改套餐分配生效条件覆盖",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop_package_batch_allocation.update_expiry_base",
    "action_name": "修改套餐分配生效条件覆盖",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_package_batch_allocation",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop_package_batch_pricing.go:15:POST:",
    "kind": "http",
    "code_entry": "internal/routes/shop_package_batch_pricing.go:15 handler.BatchUpdatePricing",
    "owner": "shop_package_batch_pricing",
    "method": "POST",
    "summary": "批量调价",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop_package_batch_pricing.batch_update_pricing",
    "action_name": "批量调价",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_package_batch_pricing",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop_series_grant.go:15:GET:",
    "kind": "http",
    "code_entry": "internal/routes/shop_series_grant.go:15 handler.List",
    "owner": "shop_series_grant",
    "method": "GET",
    "summary": "查询代理系列授权列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop_series_grant.go:23:POST:",
    "kind": "http",
    "code_entry": "internal/routes/shop_series_grant.go:23 handler.Create",
    "owner": "shop_series_grant",
    "method": "POST",
    "summary": "创建代理系列授权",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop_series_grant.create",
    "action_name": "创建代理系列授权",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_series_grant",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop_series_grant.go:31:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/shop_series_grant.go:31 handler.Get",
    "owner": "shop_series_grant",
    "method": "GET",
    "path": "/:id",
    "summary": "查询代理系列授权详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/shop_series_grant.go:39:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/shop_series_grant.go:39 handler.Update",
    "owner": "shop_series_grant",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新代理系列授权",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop_series_grant.update",
    "action_name": "更新代理系列授权",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_series_grant",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop_series_grant.go:47:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/shop_series_grant.go:47 handler.Delete",
    "owner": "shop_series_grant",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除代理系列授权",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop_series_grant.delete",
    "action_name": "删除代理系列授权",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_series_grant",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/shop_series_grant.go:55:PUT:/:id/packages",
    "kind": "http",
    "code_entry": "internal/routes/shop_series_grant.go:55 handler.ManagePackages",
    "owner": "shop_series_grant",
    "method": "PUT",
    "path": "/:id/packages",
    "summary": "管理授权套餐（新增/更新/删除）",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "shop_series_grant.manage_packages",
    "action_name": "管理授权套餐（新增/更新/删除）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_series_grant",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/storage.go:15:POST:/batch-download-urls",
    "kind": "http",
    "code_entry": "internal/routes/storage.go:15 handler.GetBatchDownloadURLs",
    "owner": "storage",
    "method": "POST",
    "path": "/batch-download-urls",
    "summary": "批量获取文件下载预签名 URL",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "storage.get_batch_download_u_r_ls",
    "action_name": "批量获取文件下载预签名 URL",
    "category": "business",
    "risk": "normal",
    "primary_resource": "storage",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/storage.go:95:POST:/upload-url",
    "kind": "http",
    "code_entry": "internal/routes/storage.go:95 handler.GetUploadURL",
    "owner": "storage",
    "method": "POST",
    "path": "/upload-url",
    "summary": "获取文件上传预签名 URL",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "storage.get_upload_u_r_l",
    "action_name": "获取文件上传预签名 URL",
    "category": "business",
    "risk": "normal",
    "primary_resource": "storage",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/super_admin.go:15:POST:/operation-password",
    "kind": "http",
    "code_entry": "internal/routes/super_admin.go:15 handler.SetOperationPassword",
    "owner": "super_admin",
    "method": "POST",
    "path": "/operation-password",
    "summary": "设置/修改全局操作密码",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "super_admin.set_operation_password",
    "action_name": "设置/修改全局操作密码",
    "category": "business",
    "risk": "high",
    "primary_resource": "super_admin",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/super_admin.go:22:GET:/operation-password/status",
    "kind": "http",
    "code_entry": "internal/routes/super_admin.go:22 handler.GetOperationPasswordStatus",
    "owner": "super_admin",
    "method": "GET",
    "path": "/operation-password/status",
    "summary": "查询操作密码是否已设置",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/system_config.go:16:GET:",
    "kind": "http",
    "code_entry": "internal/routes/system_config.go:16 handler.List",
    "owner": "system_config",
    "method": "GET",
    "summary": "查询受控系统配置",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/system_config.go:24:PUT:/:key",
    "kind": "http",
    "code_entry": "internal/routes/system_config.go:24 handler.Update",
    "owner": "system_config",
    "method": "PUT",
    "path": "/:key",
    "summary": "更新受控系统配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "system_config.update",
    "action_name": "更新受控系统配置",
    "category": "business",
    "risk": "high",
    "primary_resource": "system_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wechat_config.go:26:GET:/active",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:26 handler.GetActive",
    "owner": "wechat_config",
    "method": "GET",
    "path": "/active",
    "summary": "获取当前生效的支付配置",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/wechat_config.go:34:GET:",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:34 handler.List",
    "owner": "wechat_config",
    "method": "GET",
    "summary": "获取支付配置列表",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/wechat_config.go:42:POST:",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:42 handler.Create",
    "owner": "wechat_config",
    "method": "POST",
    "summary": "创建支付配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wechat_config.create",
    "action_name": "创建支付配置",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wechat_config.go:50:GET:/:id",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:50 handler.Get",
    "owner": "wechat_config",
    "method": "GET",
    "path": "/:id",
    "summary": "获取支付配置详情",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/wechat_config.go:58:PUT:/:id",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:58 handler.Update",
    "owner": "wechat_config",
    "method": "PUT",
    "path": "/:id",
    "summary": "更新支付配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wechat_config.update",
    "action_name": "更新支付配置",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wechat_config.go:66:DELETE:/:id",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:66 handler.Delete",
    "owner": "wechat_config",
    "method": "DELETE",
    "path": "/:id",
    "summary": "删除支付配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wechat_config.delete",
    "action_name": "删除支付配置",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wechat_config.go:74:POST:/:id/activate",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:74 handler.Activate",
    "owner": "wechat_config",
    "method": "POST",
    "path": "/:id/activate",
    "summary": "激活支付配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wechat_config.activate",
    "action_name": "激活支付配置",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wechat_config.go:82:POST:/:id/deactivate",
    "kind": "http",
    "code_entry": "internal/routes/wechat_config.go:82 handler.Deactivate",
    "owner": "wechat_config",
    "method": "POST",
    "path": "/:id/deactivate",
    "summary": "停用支付配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wechat_config.deactivate",
    "action_name": "停用支付配置",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:24:POST:/applications",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:24 handler.Save",
    "owner": "wecom",
    "method": "POST",
    "path": "/applications",
    "summary": "创建或更新企业微信应用配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom.save",
    "action_name": "创建或更新企业微信应用配置",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:31:GET:/applications",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:31 handler.List",
    "owner": "wecom",
    "method": "GET",
    "path": "/applications",
    "summary": "查询企业微信应用配置",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom.list",
    "action_name": "查询企业微信应用配置",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:38:POST:/applications/:id/test",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:38 handler.Test",
    "owner": "wecom",
    "method": "POST",
    "path": "/applications/:id/test",
    "summary": "测试企业微信应用连接",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom.test",
    "action_name": "测试企业微信应用连接",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:45:PUT:/applications/:id/default-creator",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:45 handler.SaveDefaultCreator",
    "owner": "wecom",
    "method": "PUT",
    "path": "/applications/:id/default-creator",
    "summary": "保存企业微信应用默认审批发起人",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom.save_default_creator",
    "action_name": "保存企业微信应用默认审批发起人",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:52:POST:/applications/:id/members/sync",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:52 handler.SyncMembers",
    "owner": "wecom",
    "method": "POST",
    "path": "/applications/:id/members/sync",
    "summary": "同步企业微信应用可见成员",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom.sync_members",
    "action_name": "同步企业微信应用可见成员",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:59:GET:/applications/:id/members",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:59 handler.ListMembers",
    "owner": "wecom",
    "method": "GET",
    "path": "/applications/:id/members",
    "summary": "分页查询企业微信应用可见成员",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/wecom.go:66:POST:/applications/:id/templates/inspect",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:66 handler.InspectTemplate",
    "owner": "wecom",
    "method": "POST",
    "path": "/applications/:id/templates/inspect",
    "summary": "读取企业微信审批模板控件",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom.inspect_template",
    "action_name": "读取企业微信审批模板控件",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:73:GET:/scenes/:business_type/fields",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:73 handler.ListSceneFields",
    "owner": "wecom",
    "method": "GET",
    "path": "/scenes/:business_type/fields",
    "summary": "查询企业微信审批场景可映射字段",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/wecom.go:80:PUT:/scenes/:business_type",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:80 handler.SaveScene",
    "owner": "wecom",
    "method": "PUT",
    "path": "/scenes/:business_type",
    "summary": "保存并校验企业微信审批场景模板映射",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom.save_scene",
    "action_name": "保存并校验企业微信审批场景模板映射",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "http:internal/routes/wecom.go:87:GET:/scenes",
    "kind": "http",
    "code_entry": "internal/routes/wecom.go:87 handler.ListScenes",
    "owner": "wecom",
    "method": "GET",
    "path": "/scenes",
    "summary": "分页查询企业微信审批场景配置",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "登录账号快照/admin_api",
    "visibility": "按认证账号类型和现有数据权限可见；审计调查另按平台/主体投影隔离",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/wecom_callback.go:12:GET:/wecom/approval/:application_id",
    "kind": "http",
    "code_entry": "internal/routes/wecom_callback.go:12 handler.Verify",
    "owner": "wecom_callback",
    "method": "GET",
    "path": "/wecom/approval/:application_id",
    "summary": "验证企业微信审批回调地址",
    "audit_event": "N/A",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "actor_source": "external_system/callback",
    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
    "transaction": "N/A",
    "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口",
    "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值"
  },
  {
    "key": "http:internal/routes/wecom_callback.go:18:POST:/wecom/approval/:application_id",
    "kind": "http",
    "code_entry": "internal/routes/wecom_callback.go:18 handler.Receive",
    "owner": "wecom_callback",
    "method": "POST",
    "path": "/wecom/approval/:application_id",
    "summary": "接收企业微信审批状态变化回调",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识",
    "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A",
    "action_code": "wecom_callback.receive",
    "action_name": "接收企业微信审批状态变化回调",
    "category": "business",
    "risk": "normal",
    "primary_resource": "wecom_callback",
    "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展",
    "actor_source": "external_system/callback",
    "visibility": "外部回调入口；只记录内部完整事实，不直接向外部主体展示",
    "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical",
    "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限",
    "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用",
    "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口"
  },
  {
    "key": "integration_log:internal/handler/app/client_wallet_payment_audit.go:57:h.paymentIntegration.Start",
    "kind": "integration_log",
    "code_entry": "internal/handler/app/client_wallet_payment_audit.go:57 h.paymentIntegration.Start",
    "owner": "app",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/app/client_wallet_payment_audit.go:76:h.paymentIntegration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/app/client_wallet_payment_audit.go:76 h.paymentIntegration.Complete",
    "owner": "app",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/carrier_switch.go:76:repository.ClaimExpiredInboundPending",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/carrier_switch.go:76 repository.ClaimExpiredInboundPending",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cmcc_realname.go:125:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cmcc_realname.go:125 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cmcc_realname.go:133:h.integration.ClaimExpiredInboundPending",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cmcc_realname.go:133 h.integration.ClaimExpiredInboundPending",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cmcc_realname.go:142:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cmcc_realname.go:142 h.integration.Complete",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cmcc_realname.go:68:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cmcc_realname.go:68 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cmcc_realname.go:84:h.integration.ClaimExpiredInboundPending",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cmcc_realname.go:84 h.integration.ClaimExpiredInboundPending",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/ctcc_realname.go:158:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/ctcc_realname.go:158 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/ctcc_realname.go:181:h.integration.ClaimExpiredInboundPending",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/ctcc_realname.go:181 h.integration.ClaimExpiredInboundPending",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/ctcc_realname.go:185:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/ctcc_realname.go:185 h.integration.Complete",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/ctcc_realname.go:91:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/ctcc_realname.go:91 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname.go:124:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname.go:124 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname.go:148:h.integration.ClaimExpiredInboundPending",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname.go:148 h.integration.ClaimExpiredInboundPending",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname.go:157:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname.go:157 h.integration.Complete",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname.go:69:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname.go:69 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:101:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname_removal.go:101 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:123:h.integration.ClaimExpiredInboundPending",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname_removal.go:123 h.integration.ClaimExpiredInboundPending",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:127:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname_removal.go:127 h.integration.Complete",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/cucc_realname_removal.go:65:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/cucc_realname_removal.go:65 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/payment.go:238:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/payment.go:238 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/payment.go:306:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/payment.go:306 h.integration.Complete",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/payment.go:328:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/payment.go:328 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/payment.go:364:h.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/payment.go:364 h.integration.RecordInbound",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/payment.go:374:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/payment.go:374 h.integration.Complete",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/handler/callback/payment.go:385:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/handler/callback/payment.go:385 h.integration.Complete",
    "owner": "callback",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:174:r.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:174 r.integration.Complete",
    "owner": "cardobservation",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:207:r.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:207 r.integration.Complete",
    "owner": "cardobservation",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:220:r.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:220 r.integration.Start",
    "owner": "cardobservation",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/cardobservation/series_runner.go:530:r.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/cardobservation/series_runner.go:530 r.integration.Start",
    "owner": "cardobservation",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:107:a.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/alipay_wap.go:107 a.integration.Start",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:120:a.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/alipay_wap.go:120 a.integration.Complete",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:65:a.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/alipay_wap.go:65 a.integration.Complete",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/alipay_wap.go:81:a.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/alipay_wap.go:81 a.integration.Complete",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:173:a.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/wechat_web.go:173 a.integration.Start",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:186:a.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/wechat_web.go:186 a.integration.Complete",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:52:a.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/wechat_web.go:52 a.integration.Complete",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/payment/wechat_web.go:78:a.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/payment/wechat_web.go:78 a.integration.Complete",
    "owner": "payment",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:112:u.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:112 u.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:131:u.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:131 u.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:138:u.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:138 u.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_attachment_uploader.go:96:u.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_attachment_uploader.go:96 u.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_detail_client.go:126:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_detail_client.go:126 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_detail_client.go:57:c.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_detail_client.go:57 c.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_detail_client.go:92:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_detail_client.go:92 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_detail_task.go:118:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_detail_task.go:118 h.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_detail_task.go:82:h.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_detail_task.go:82 h.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_info_client.go:112:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_info_client.go:112 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_info_client.go:172:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_info_client.go:172 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_info_client.go:76:c.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_info_client.go:76 c.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:110:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:110 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:139:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:139 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:149:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:149 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:81:c.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:81 c.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/approval_submission_client.go:96:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/approval_submission_client.go:96 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/callback_service.go:90:s.integration.RecordInbound",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/callback_service.go:90 s.integration.RecordInbound",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:121:c.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/directory_client.go:121 c.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:266:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/directory_client.go:266 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:278:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/directory_client.go:278 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/directory_client.go:79:c.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/directory_client.go:79 c.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/template_client.go:233:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/template_client.go:233 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/template_client.go:58:c.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/template_client.go:58 c.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/template_client.go:87:c.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/template_client.go:87 c.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/token_provider.go:165:p.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/token_provider.go:165 p.integration.Start",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/token_provider.go:250:p.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/token_provider.go:250 p.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/infrastructure/wecom/token_provider.go:263:p.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/infrastructure/wecom/token_provider.go:263 p.integration.Complete",
    "owner": "wecom",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/client_order/payment_audit.go:52:s.paymentIntegration.Start",
    "kind": "integration_log",
    "code_entry": "internal/service/client_order/payment_audit.go:52 s.paymentIntegration.Start",
    "owner": "client_order",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/client_order/payment_audit.go:72:s.paymentIntegration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/service/client_order/payment_audit.go:72 s.paymentIntegration.Complete",
    "owner": "client_order",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/device/gateway_audit.go:109:s.gatewayIntegration.Start",
    "kind": "integration_log",
    "code_entry": "internal/service/device/gateway_audit.go:109 s.gatewayIntegration.Start",
    "owner": "device",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/device/gateway_audit.go:142:s.gatewayIntegration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/service/device/gateway_audit.go:142 s.gatewayIntegration.Complete",
    "owner": "device",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/iot_card/gateway_integration.go:38:s.speedTierIntegration.Start",
    "kind": "integration_log",
    "code_entry": "internal/service/iot_card/gateway_integration.go:38 s.speedTierIntegration.Start",
    "owner": "iot_card",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/iot_card/gateway_integration.go:71:s.speedTierIntegration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/service/iot_card/gateway_integration.go:71 s.speedTierIntegration.Complete",
    "owner": "iot_card",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/iot_card/speed_tier.go:45:s.speedTierIntegration.Start",
    "kind": "integration_log",
    "code_entry": "internal/service/iot_card/speed_tier.go:45 s.speedTierIntegration.Start",
    "owner": "iot_card",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/iot_card/speed_tier.go:81:s.speedTierIntegration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/service/iot_card/speed_tier.go:81 s.speedTierIntegration.Complete",
    "owner": "iot_card",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/iot_card/stop_resume_audit.go:151:s.integration.Start",
    "kind": "integration_log",
    "code_entry": "internal/service/iot_card/stop_resume_audit.go:151 s.integration.Start",
    "owner": "iot_card",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/iot_card/stop_resume_audit.go:184:s.integration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/service/iot_card/stop_resume_audit.go:184 s.integration.Complete",
    "owner": "iot_card",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/order/payment_audit.go:30:s.paymentIntegration.Start",
    "kind": "integration_log",
    "code_entry": "internal/service/order/payment_audit.go:30 s.paymentIntegration.Start",
    "owner": "order",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "integration_log:internal/service/order/payment_audit.go:53:s.paymentIntegration.Complete",
    "kind": "integration_log",
    "code_entry": "internal/service/order/payment_audit.go:53 s.paymentIntegration.Complete",
    "owner": "order",
    "summary": "记录外部交互尝试或终态",
    "audit_event": "N/A",
    "domain_ledger": "N/A：Integration Log 只记录外部交互事实，不替代内部业务表",
    "integration_log": "必须：保存实际请求、未发送裁决、入站回调或终态安全摘要",
    "outbox": "存在提交后可靠副作用时由业务用例另行登记；本调用点不替代 Outbox",
    "actor_source": "external_system 或发起外呼的真实 Application/Worker/Callback",
    "visibility": "仅平台内部调查完整可见；代理/企业不得读取外部交互细节",
    "transaction": "按外部尝试生命周期写入；内部状态变化另由业务事务记录 Audit Event",
    "failure_strategy": "保留真实 failed/unknown/not_sent 结果，不把记录失败伪装成业务成功",
    "sensitive_policy": "请求、响应和 metadata 写入前删除凭据，历史读取再次清理",
    "before_after_policy": "N/A：保存外部尝试结构化摘要和本地状态是否变化",
    "test_seam": "Integration Log 数据抽样 + 调用链 correlation/series/attempt 核对",
    "na_reason": "该入口只记录外部交互事实；只有改变内部业务事实时才由业务用例另写 Audit Event"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:340:constants.OutboxEventTypeApprovalSubmissionRequested",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:340 consumer",
    "owner": "constants._outbox_event_type_approval_submission_requested",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeApprovalSubmissionRequested",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:384:constants.OutboxEventTypeApprovalTerminalDecision",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:384 decisionConsumer",
    "owner": "constants._outbox_event_type_approval_terminal_decision",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeApprovalTerminalDecision",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:453:constants.OutboxEventTypeCardRealnameChanged",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:453 consumer",
    "owner": "constants._outbox_event_type_card_realname_changed",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardRealnameChanged",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:463:constants.OutboxEventTypeCardTrafficIncremented",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:463 trafficConsumer",
    "owner": "constants._outbox_event_type_card_traffic_incremented",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardTrafficIncremented",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:468:constants.OutboxEventTypeCardNetworkChanged",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:468 networkConsumer",
    "owner": "constants._outbox_event_type_card_network_changed",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardNetworkChanged",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:478:constants.OutboxEventTypeCardSeriesRequested",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:478 seriesConsumer",
    "owner": "constants._outbox_event_type_card_series_requested",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeCardSeriesRequested",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:488:constants.OutboxEventTypeAgentRechargePaymentConfirmed",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:488 agentRechargeConsumer",
    "owner": "constants._outbox_event_type_agent_recharge_payment_confirmed",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentRechargePaymentConfirmed",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:493:constants.OutboxEventTypeAgentMainWalletDebited",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:493 debitConsumer",
    "owner": "constants._outbox_event_type_agent_main_wallet_debited",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletDebited",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:498:constants.OutboxEventTypeAgentMainWalletReservationChanged",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:498 reservationConsumer",
    "owner": "constants._outbox_event_type_agent_main_wallet_reservation_changed",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletReservationChanged",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:503:constants.OutboxEventTypeAgentMainWalletCredited",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:503 creditConsumer",
    "owner": "constants._outbox_event_type_agent_main_wallet_credited",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletCredited",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:508:constants.OutboxEventTypeAgentMainWalletRefunded",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:508 refundConsumer",
    "owner": "constants._outbox_event_type_agent_main_wallet_refunded",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAgentMainWalletRefunded",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:521:constants.OutboxEventTypeAdminDirectNotification",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:521 consumer",
    "owner": "constants._outbox_event_type_admin_direct_notification",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAdminDirectNotification",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:525:constants.OutboxEventTypePersonalCustomerDirectNotification",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:525 consumer",
    "owner": "constants._outbox_event_type_personal_customer_direct_notification",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypePersonalCustomerDirectNotification",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "outbox_consumer:cmd/worker/main.go:529:constants.OutboxEventTypeAdminDynamicNotification",
    "kind": "outbox_consumer",
    "code_entry": "cmd/worker/main.go:529 consumer",
    "owner": "constants._outbox_event_type_admin_dynamic_notification",
    "summary": "注册 Outbox 消费者 constants.OutboxEventTypeAdminDynamicNotification",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "必须：消费已提交的可靠事件",
    "actor_source": "system_task/outbox_consumer",
    "visibility": "内部系统装配入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "注册失败阻止 Worker 启动；实际消费失败由 Outbox 重试，业务审计由消费者用例负责",
    "sensitive_policy": "注册入口不读取或记录事件载荷与安全凭据",
    "before_after_policy": "N/A：注册入口不修改业务事实",
    "test_seam": "静态扫描注册点、消费者实现和对应业务动作",
    "na_reason": "本入口只注册事件类型与消费者；实际业务事实和 Audit Event 由对应 Consumer/Application 完整用例负责"
  },
  {
    "key": "schedule:cmd/worker/main.go:696:constants.TaskTypeAgentRechargeRecovery",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:696",
    "owner": "agent_recharge_recovery",
    "summary": "按 @every 1m 调度 constants.TaskTypeAgentRechargeRecovery",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:706:constants.TaskTypeOrderExpire",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:706",
    "owner": "order_expire",
    "summary": "按 @every 1m 调度 constants.TaskTypeOrderExpire",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:713:constants.TaskTypeAlertCheck",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:713",
    "owner": "alert_check",
    "summary": "按 @every 1m 调度 constants.TaskTypeAlertCheck",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:720:constants.TaskTypeWeComApprovalRecovery",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:720",
    "owner": "we_com_approval_recovery",
    "summary": "按 @every 2m 调度 constants.TaskTypeWeComApprovalRecovery",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:729:constants.TaskTypeDataCleanup",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:729",
    "owner": "data_cleanup",
    "summary": "按 0 2 * * * 调度 constants.TaskTypeDataCleanup",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:736:constants.TaskTypeNotificationCleanup",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:736",
    "owner": "notification_cleanup",
    "summary": "按 15 2 * * * 调度 constants.TaskTypeNotificationCleanup",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:744:constants.TaskTypePackageExpiryReminder",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:744",
    "owner": "package_expiry_reminder",
    "summary": "按 CRON_TZ=Asia/Shanghai 0 3 * * * 调度 constants.TaskTypePackageExpiryReminder",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:753:constants.TaskTypeDailyTrafficFlush",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:753",
    "owner": "daily_traffic_flush",
    "summary": "按 0 2 * * * 调度 constants.TaskTypeDailyTrafficFlush",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:765:constants.TaskTypeAuditDailyArchive",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:765",
    "owner": "audit_daily_archive",
    "summary": "按 CRON_TZ=Asia/Shanghai 0 4 * * * 调度 constants.TaskTypeAuditDailyArchive",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:775:constants.TaskTypeIntegrationDailyArchive",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:775",
    "owner": "integration_daily_archive",
    "summary": "按 CRON_TZ=Asia/Shanghai 30 4 * * * 调度 constants.TaskTypeIntegrationDailyArchive",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:785:constants.TaskTypeIntegrationMonthlyFinalize",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:785",
    "owner": "integration_monthly_finalize",
    "summary": "按 CRON_TZ=Asia/Shanghai 0 5 1 * * 调度 constants.TaskTypeIntegrationMonthlyFinalize",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "schedule:cmd/worker/main.go:795:constants.TaskTypeAuditMonthlyRetention",
    "kind": "scheduled_job",
    "code_entry": "cmd/worker/main.go:795",
    "owner": "audit_monthly_retention",
    "summary": "按 CRON_TZ=Asia/Shanghai 0 6 1 * * 调度 constants.TaskTypeAuditMonthlyRetention",
    "audit_event": "N/A",
    "domain_ledger": "N/A",
    "integration_log": "N/A",
    "outbox": "N/A",
    "actor_source": "system_task/scheduled_job",
    "visibility": "内部系统入口，不直接对用户展示",
    "transaction": "N/A",
    "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责",
    "sensitive_policy": "调度日志仅记录任务类型与安全时间信息",
    "before_after_policy": "N/A：调度入口不修改业务事实",
    "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口",
    "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker"
  },
  {
    "key": "service:internal/service/account/service.go:102:Create",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:102 Create",
    "owner": "account",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.create",
    "action_name": "执行业务方法（Create）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:1085:CreateSystemAccount",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:1085 CreateSystemAccount",
    "owner": "account",
    "summary": "业务方法 CreateSystemAccount",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.create_system_account",
    "action_name": "执行业务方法（CreateSystemAccount）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:212:BindWeCom",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:212 BindWeCom",
    "owner": "account",
    "summary": "业务方法 BindWeCom",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.bind_we_com",
    "action_name": "执行业务方法（BindWeCom）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:284:Update",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:284 Update",
    "owner": "account",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.update",
    "action_name": "执行业务方法（Update）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:384:Delete",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:384 Delete",
    "owner": "account",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:484:AssignRoles",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:484 AssignRoles",
    "owner": "account",
    "summary": "业务方法 AssignRoles",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.assign_roles",
    "action_name": "执行业务方法（AssignRoles）",
    "category": "security",
    "risk": "high",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:553:RemoveRole",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:553 RemoveRole",
    "owner": "account",
    "summary": "业务方法 RemoveRole",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.remove_role",
    "action_name": "执行业务方法（RemoveRole）",
    "category": "security",
    "risk": "high",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:840:UpdatePassword",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:840 UpdatePassword",
    "owner": "account",
    "summary": "业务方法 UpdatePassword",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.update_password",
    "action_name": "执行业务方法（UpdatePassword）",
    "category": "security",
    "risk": "high",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/account/service.go:932:UpdateStatus",
    "kind": "service",
    "code_entry": "internal/service/account/service.go:932 UpdateStatus",
    "owner": "account",
    "summary": "业务方法 UpdateStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "account.update_status",
    "action_name": "执行业务方法（UpdateStatus）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "account",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/agent_open_api/service.go:218:ResumeCard",
    "kind": "service",
    "code_entry": "internal/service/agent_open_api/service.go:218 ResumeCard",
    "owner": "agent_open_api",
    "summary": "业务方法 ResumeCard",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agent_open_api.resume_card",
    "action_name": "执行业务方法（ResumeCard）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "agent_open_api",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/agent_open_api/service.go:348:CreateWalletPackageOrders",
    "kind": "service",
    "code_entry": "internal/service/agent_open_api/service.go:348 CreateWalletPackageOrders",
    "owner": "agent_open_api",
    "summary": "业务方法 CreateWalletPackageOrders",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agent_open_api.create_wallet_package_orders",
    "action_name": "执行业务方法（CreateWalletPackageOrders）",
    "category": "business",
    "risk": "high",
    "primary_resource": "agent_open_api",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/agent_open_api/service.go:558:ResetDevice",
    "kind": "service",
    "code_entry": "internal/service/agent_open_api/service.go:558 ResetDevice",
    "owner": "agent_open_api",
    "summary": "业务方法 ResetDevice",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agent_open_api.reset_device",
    "action_name": "执行业务方法（ResetDevice）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "agent_open_api",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/agent_recharge/service.go:260:HandlePaymentCallback",
    "kind": "service",
    "code_entry": "internal/service/agent_recharge/service.go:260 HandlePaymentCallback",
    "owner": "agent_recharge",
    "summary": "业务方法 HandlePaymentCallback",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agent_recharge.handle_payment_callback",
    "action_name": "执行业务方法（HandlePaymentCallback）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agent_recharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/agent_recharge/service.go:365:Reject",
    "kind": "service",
    "code_entry": "internal/service/agent_recharge/service.go:365 Reject",
    "owner": "agent_recharge",
    "summary": "业务方法 Reject",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agent_recharge.reject",
    "action_name": "执行业务方法（Reject）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agent_recharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/agent_recharge/service.go:93:Create",
    "kind": "service",
    "code_entry": "internal/service/agent_recharge/service.go:93 Create",
    "owner": "agent_recharge",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "agent_recharge.create",
    "action_name": "执行业务方法（Create）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agent_recharge",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/asset/lifecycle_service.go:35:DeactivateIotCard",
    "kind": "service",
    "code_entry": "internal/service/asset/lifecycle_service.go:35 DeactivateIotCard",
    "owner": "asset",
    "summary": "业务方法 DeactivateIotCard",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "asset.deactivate_iot_card",
    "action_name": "执行业务方法（DeactivateIotCard）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/asset/lifecycle_service.go:72:DeactivateDevice",
    "kind": "service",
    "code_entry": "internal/service/asset/lifecycle_service.go:72 DeactivateDevice",
    "owner": "asset",
    "summary": "业务方法 DeactivateDevice",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "asset.deactivate_device",
    "action_name": "执行业务方法（DeactivateDevice）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/asset/service.go:111:Resolve",
    "kind": "service",
    "code_entry": "internal/service/asset/service.go:111 Resolve",
    "owner": "asset",
    "summary": "业务方法 Resolve",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "asset.resolve",
    "action_name": "执行业务方法（Resolve）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/asset/service.go:612:Refresh",
    "kind": "service",
    "code_entry": "internal/service/asset/service.go:612 Refresh",
    "owner": "asset",
    "summary": "业务方法 Refresh",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "asset.refresh",
    "action_name": "执行业务方法（Refresh）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/asset/service.go:906:UpdatePackageExpiresAt",
    "kind": "service",
    "code_entry": "internal/service/asset/service.go:906 UpdatePackageExpiresAt",
    "owner": "asset",
    "summary": "业务方法 UpdatePackageExpiresAt",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "asset.update_package_expires_at",
    "action_name": "执行业务方法（UpdatePackageExpiresAt）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/asset/service.go:942:UpdatePackageUsage",
    "kind": "service",
    "code_entry": "internal/service/asset/service.go:942 UpdatePackageUsage",
    "owner": "asset",
    "summary": "业务方法 UpdatePackageUsage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "asset.update_package_usage",
    "action_name": "执行业务方法（UpdatePackageUsage）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "asset",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/asset_package_batch_order/service.go:50:Create",
    "kind": "service",
    "code_entry": "internal/service/asset_package_batch_order/service.go:50 Create",
    "owner": "asset_package_batch_order",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "asset_package_batch_order.create",
    "action_name": "执行业务方法（Create）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "asset_package_batch_order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/auth/service.go:168:Logout",
    "kind": "service",
    "code_entry": "internal/service/auth/service.go:168 Logout",
    "owner": "auth",
    "summary": "业务方法 Logout",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auth.logout",
    "action_name": "执行业务方法（Logout）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/auth/service.go:194:RefreshToken",
    "kind": "service",
    "code_entry": "internal/service/auth/service.go:194 RefreshToken",
    "owner": "auth",
    "summary": "业务方法 RefreshToken",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auth.refresh_token",
    "action_name": "执行业务方法（RefreshToken）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/auth/service.go:218:ChangePassword",
    "kind": "service",
    "code_entry": "internal/service/auth/service.go:218 ChangePassword",
    "owner": "auth",
    "summary": "业务方法 ChangePassword",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auth.change_password",
    "action_name": "执行业务方法（ChangePassword）",
    "category": "security",
    "risk": "high",
    "primary_resource": "auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/auth/service.go:60:Login",
    "kind": "service",
    "code_entry": "internal/service/auth/service.go:60 Login",
    "owner": "auth",
    "summary": "业务方法 Login",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "auth.login",
    "action_name": "执行业务方法（Login）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/carrier/service.go:139:Delete",
    "kind": "service",
    "code_entry": "internal/service/carrier/service.go:139 Delete",
    "owner": "carrier",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "carrier.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/carrier/service.go:202:UpdateStatus",
    "kind": "service",
    "code_entry": "internal/service/carrier/service.go:202 UpdateStatus",
    "owner": "carrier",
    "summary": "业务方法 UpdateStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "carrier.update_status",
    "action_name": "执行业务方法（UpdateStatus）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/carrier/service.go:30:Create",
    "kind": "service",
    "code_entry": "internal/service/carrier/service.go:30 Create",
    "owner": "carrier",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "carrier.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/carrier/service.go:89:Update",
    "kind": "service",
    "code_entry": "internal/service/carrier/service.go:89 Update",
    "owner": "carrier",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "carrier.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "carrier",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_auth/service.go:274:SendCode",
    "kind": "service",
    "code_entry": "internal/service/client_auth/service.go:274 SendCode",
    "owner": "client_auth",
    "summary": "业务方法 SendCode",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_auth.send_code",
    "action_name": "执行业务方法（SendCode）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "client_auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_auth/service.go:298:BindPhone",
    "kind": "service",
    "code_entry": "internal/service/client_auth/service.go:298 BindPhone",
    "owner": "client_auth",
    "summary": "业务方法 BindPhone",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_auth.bind_phone",
    "action_name": "执行业务方法（BindPhone）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "client_auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_auth/service.go:385:ChangePhone",
    "kind": "service",
    "code_entry": "internal/service/client_auth/service.go:385 ChangePhone",
    "owner": "client_auth",
    "summary": "业务方法 ChangePhone",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_auth.change_phone",
    "action_name": "执行业务方法（ChangePhone）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "client_auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_auth/service.go:528:Logout",
    "kind": "service",
    "code_entry": "internal/service/client_auth/service.go:528 Logout",
    "owner": "client_auth",
    "summary": "业务方法 Logout",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_auth.logout",
    "action_name": "执行业务方法（Logout）",
    "category": "security",
    "risk": "normal",
    "primary_resource": "client_auth",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_order/payment_provider.go:39:CreateJSAPIPayment",
    "kind": "service",
    "code_entry": "internal/service/client_order/payment_provider.go:39 CreateJSAPIPayment",
    "owner": "client_order",
    "summary": "业务方法 CreateJSAPIPayment",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_order.create_j_s_a_p_i_payment",
    "action_name": "执行业务方法（CreateJSAPIPayment）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "client_order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_order/payment_provider.go:53:CreateJSAPIPayment",
    "kind": "service",
    "code_entry": "internal/service/client_order/payment_provider.go:53 CreateJSAPIPayment",
    "owner": "client_order",
    "summary": "业务方法 CreateJSAPIPayment",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_order.create_j_s_a_p_i_payment",
    "action_name": "执行业务方法（CreateJSAPIPayment）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "client_order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_order/payment_provider.go:69:CreateJSAPIPayment",
    "kind": "service",
    "code_entry": "internal/service/client_order/payment_provider.go:69 CreateJSAPIPayment",
    "owner": "client_order",
    "summary": "业务方法 CreateJSAPIPayment",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_order.create_j_s_a_p_i_payment",
    "action_name": "执行业务方法（CreateJSAPIPayment）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "client_order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_order/service.go:1352:PayOrder",
    "kind": "service",
    "code_entry": "internal/service/client_order/service.go:1352 PayOrder",
    "owner": "client_order",
    "summary": "业务方法 PayOrder",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_order.pay_order",
    "action_name": "执行业务方法（PayOrder）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "client_order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/client_order/service.go:146:CreateOrder",
    "kind": "service",
    "code_entry": "internal/service/client_order/service.go:146 CreateOrder",
    "owner": "client_order",
    "summary": "业务方法 CreateOrder",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "client_order.create_order",
    "action_name": "执行业务方法（CreateOrder）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "client_order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_calculation/service.go:347:TriggerOneTimeCommissionForCard",
    "kind": "service",
    "code_entry": "internal/service/commission_calculation/service.go:347 TriggerOneTimeCommissionForCard",
    "owner": "commission_calculation",
    "summary": "业务方法 TriggerOneTimeCommissionForCard",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_calculation.trigger_one_time_commission_for_card",
    "action_name": "执行业务方法（TriggerOneTimeCommissionForCard）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_calculation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_calculation/service.go:426:TriggerOneTimeCommissionForDevice",
    "kind": "service",
    "code_entry": "internal/service/commission_calculation/service.go:426 TriggerOneTimeCommissionForDevice",
    "owner": "commission_calculation",
    "summary": "业务方法 TriggerOneTimeCommissionForDevice",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_calculation.trigger_one_time_commission_for_device",
    "action_name": "执行业务方法（TriggerOneTimeCommissionForDevice）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_calculation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_calculation/service.go:763:CreditCommission",
    "kind": "service",
    "code_entry": "internal/service/commission_calculation/service.go:763 CreditCommission",
    "owner": "commission_calculation",
    "summary": "业务方法 CreditCommission",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_calculation.credit_commission",
    "action_name": "执行业务方法（CreditCommission）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_calculation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_stats/service.go:37:UpdateStats",
    "kind": "service",
    "code_entry": "internal/service/commission_stats/service.go:37 UpdateStats",
    "owner": "commission_stats",
    "summary": "业务方法 UpdateStats",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_stats.update_stats",
    "action_name": "执行业务方法（UpdateStats）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_stats",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_stats/service.go:64:ArchiveCompletedPeriod",
    "kind": "service",
    "code_entry": "internal/service/commission_stats/service.go:64 ArchiveCompletedPeriod",
    "owner": "commission_stats",
    "summary": "业务方法 ArchiveCompletedPeriod",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_stats.archive_completed_period",
    "action_name": "执行业务方法（ArchiveCompletedPeriod）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_stats",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_withdrawal/service.go:152:Approve",
    "kind": "service",
    "code_entry": "internal/service/commission_withdrawal/service.go:152 Approve",
    "owner": "commission_withdrawal",
    "summary": "业务方法 Approve",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_withdrawal.approve",
    "action_name": "执行业务方法（Approve）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_withdrawal",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_withdrawal/service.go:272:Reject",
    "kind": "service",
    "code_entry": "internal/service/commission_withdrawal/service.go:272 Reject",
    "owner": "commission_withdrawal",
    "summary": "业务方法 Reject",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_withdrawal.reject",
    "action_name": "执行业务方法（Reject）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_withdrawal",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/commission_withdrawal_setting/service.go:35:Create",
    "kind": "service",
    "code_entry": "internal/service/commission_withdrawal_setting/service.go:35 Create",
    "owner": "commission_withdrawal_setting",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "commission_withdrawal_setting.create",
    "action_name": "执行业务方法（Create）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_withdrawal_setting",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/customer_binding/audit.go:152:UnbindByVirtualNo",
    "kind": "service",
    "code_entry": "internal/service/customer_binding/audit.go:152 UnbindByVirtualNo",
    "owner": "customer_binding",
    "summary": "业务方法 UnbindByVirtualNo",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "customer_binding.unbind_by_virtual_no",
    "action_name": "执行业务方法（UnbindByVirtualNo）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "customer_binding",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/customer_binding/service.go:220:Bind",
    "kind": "service",
    "code_entry": "internal/service/customer_binding/service.go:220 Bind",
    "owner": "customer_binding",
    "summary": "业务方法 Bind",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "customer_binding.bind",
    "action_name": "执行业务方法（Bind）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "customer_binding",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/customer_binding/service.go:354:Migrate",
    "kind": "service",
    "code_entry": "internal/service/customer_binding/service.go:354 Migrate",
    "owner": "customer_binding",
    "summary": "业务方法 Migrate",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "customer_binding.migrate",
    "action_name": "执行业务方法（Migrate）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "customer_binding",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/binding.go:186:UnbindCard",
    "kind": "service",
    "code_entry": "internal/service/device/binding.go:186 UnbindCard",
    "owner": "device",
    "summary": "业务方法 UnbindCard",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.unbind_card",
    "action_name": "执行业务方法（UnbindCard）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/binding.go:80:BindCard",
    "kind": "service",
    "code_entry": "internal/service/device/binding.go:80 BindCard",
    "owner": "device",
    "summary": "业务方法 BindCard",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.bind_card",
    "action_name": "执行业务方法（BindCard）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/realname_policy_batch.go:16:BatchUpdateRealnamePolicy",
    "kind": "service",
    "code_entry": "internal/service/device/realname_policy_batch.go:16 BatchUpdateRealnamePolicy",
    "owner": "device",
    "summary": "业务方法 BatchUpdateRealnamePolicy",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.batch_update_realname_policy",
    "action_name": "执行业务方法（BatchUpdateRealnamePolicy）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/service.go:1338:StopDevice",
    "kind": "service",
    "code_entry": "internal/service/device/service.go:1338 StopDevice",
    "owner": "device",
    "summary": "业务方法 StopDevice",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.stop_device",
    "action_name": "执行业务方法（StopDevice）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/service.go:1655:UpdateRealnamePolicy",
    "kind": "service",
    "code_entry": "internal/service/device/service.go:1655 UpdateRealnamePolicy",
    "owner": "device",
    "summary": "业务方法 UpdateRealnamePolicy",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.update_realname_policy",
    "action_name": "执行业务方法（UpdateRealnamePolicy）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/service.go:416:Delete",
    "kind": "service",
    "code_entry": "internal/service/device/service.go:416 Delete",
    "owner": "device",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/service.go:479:AllocateDevices",
    "kind": "service",
    "code_entry": "internal/service/device/service.go:479 AllocateDevices",
    "owner": "device",
    "summary": "业务方法 AllocateDevices",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.allocate_devices",
    "action_name": "执行业务方法（AllocateDevices）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/service.go:614:RecallDevices",
    "kind": "service",
    "code_entry": "internal/service/device/service.go:614 RecallDevices",
    "owner": "device",
    "summary": "业务方法 RecallDevices",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.recall_devices",
    "action_name": "执行业务方法（RecallDevices）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device/service.go:985:BatchSetSeriesBinding",
    "kind": "service",
    "code_entry": "internal/service/device/service.go:985 BatchSetSeriesBinding",
    "owner": "device",
    "summary": "业务方法 BatchSetSeriesBinding",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device.batch_set_series_binding",
    "action_name": "执行业务方法（BatchSetSeriesBinding）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device_import/service.go:109:CreateBatchAllocationTask",
    "kind": "service",
    "code_entry": "internal/service/device_import/service.go:109 CreateBatchAllocationTask",
    "owner": "device_import",
    "summary": "业务方法 CreateBatchAllocationTask",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device_import.create_batch_allocation_task",
    "action_name": "执行业务方法（CreateBatchAllocationTask）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device_import",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/device_import/service.go:50:CreateImportTask",
    "kind": "service",
    "code_entry": "internal/service/device_import/service.go:50 CreateImportTask",
    "owner": "device_import",
    "summary": "业务方法 CreateImportTask",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "device_import.create_import_task",
    "action_name": "执行业务方法（CreateImportTask）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device_import",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/email/service.go:32:SendWelcomeEmail",
    "kind": "service",
    "code_entry": "internal/service/email/service.go:32 SendWelcomeEmail",
    "owner": "email",
    "summary": "业务方法 SendWelcomeEmail",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "email.send_welcome_email",
    "action_name": "执行业务方法（SendWelcomeEmail）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "email",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/email/service.go:66:SendPasswordResetEmail",
    "kind": "service",
    "code_entry": "internal/service/email/service.go:66 SendPasswordResetEmail",
    "owner": "email",
    "summary": "业务方法 SendPasswordResetEmail",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "email.send_password_reset_email",
    "action_name": "执行业务方法（SendPasswordResetEmail）",
    "category": "business",
    "risk": "high",
    "primary_resource": "email",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/email/service.go:98:SendNotificationEmail",
    "kind": "service",
    "code_entry": "internal/service/email/service.go:98 SendNotificationEmail",
    "owner": "email",
    "summary": "业务方法 SendNotificationEmail",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "email.send_notification_email",
    "action_name": "执行业务方法（SendNotificationEmail）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "email",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise/service.go:182:Update",
    "kind": "service",
    "code_entry": "internal/service/enterprise/service.go:182 Update",
    "owner": "enterprise",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "enterprise",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise/service.go:243:UpdateStatus",
    "kind": "service",
    "code_entry": "internal/service/enterprise/service.go:243 UpdateStatus",
    "owner": "enterprise",
    "summary": "业务方法 UpdateStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise.update_status",
    "action_name": "执行业务方法（UpdateStatus）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "enterprise",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise/service.go:311:UpdatePassword",
    "kind": "service",
    "code_entry": "internal/service/enterprise/service.go:311 UpdatePassword",
    "owner": "enterprise",
    "summary": "业务方法 UpdatePassword",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise.update_password",
    "action_name": "执行业务方法（UpdatePassword）",
    "category": "business",
    "risk": "high",
    "primary_resource": "enterprise",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise/service.go:45:Create",
    "kind": "service",
    "code_entry": "internal/service/enterprise/service.go:45 Create",
    "owner": "enterprise",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "enterprise",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_card/authorization_service.go:154:RevokeAuthorizations",
    "kind": "service",
    "code_entry": "internal/service/enterprise_card/authorization_service.go:154 RevokeAuthorizations",
    "owner": "enterprise_card",
    "summary": "业务方法 RevokeAuthorizations",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_card.revoke_authorizations",
    "action_name": "执行业务方法（RevokeAuthorizations）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_card/authorization_service.go:409:UpdateRecordRemark",
    "kind": "service",
    "code_entry": "internal/service/enterprise_card/authorization_service.go:409 UpdateRecordRemark",
    "owner": "enterprise_card",
    "summary": "业务方法 UpdateRecordRemark",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_card.update_record_remark",
    "action_name": "执行业务方法（UpdateRecordRemark）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_card/authorization_service.go:54:BatchAuthorize",
    "kind": "service",
    "code_entry": "internal/service/enterprise_card/authorization_service.go:54 BatchAuthorize",
    "owner": "enterprise_card",
    "summary": "业务方法 BatchAuthorize",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_card.batch_authorize",
    "action_name": "执行业务方法（BatchAuthorize）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_card/service.go:207:AllocateCards",
    "kind": "service",
    "code_entry": "internal/service/enterprise_card/service.go:207 AllocateCards",
    "owner": "enterprise_card",
    "summary": "业务方法 AllocateCards",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_card.allocate_cards",
    "action_name": "执行业务方法（AllocateCards）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_card/service.go:344:RecallCards",
    "kind": "service",
    "code_entry": "internal/service/enterprise_card/service.go:344 RecallCards",
    "owner": "enterprise_card",
    "summary": "业务方法 RecallCards",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_card.recall_cards",
    "action_name": "执行业务方法（RecallCards）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_card/service.go:43:AllocateCardsPreview",
    "kind": "service",
    "code_entry": "internal/service/enterprise_card/service.go:43 AllocateCardsPreview",
    "owner": "enterprise_card",
    "summary": "业务方法 AllocateCardsPreview",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_card.allocate_cards_preview",
    "action_name": "执行业务方法（AllocateCardsPreview）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_card/service.go:661:ResumeCard",
    "kind": "service",
    "code_entry": "internal/service/enterprise_card/service.go:661 ResumeCard",
    "owner": "enterprise_card",
    "summary": "业务方法 ResumeCard",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_card.resume_card",
    "action_name": "执行业务方法（ResumeCard）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_device/service.go:407:RecallDevices",
    "kind": "service",
    "code_entry": "internal/service/enterprise_device/service.go:407 RecallDevices",
    "owner": "enterprise_device",
    "summary": "业务方法 RecallDevices",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_device.recall_devices",
    "action_name": "执行业务方法（RecallDevices）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/enterprise_device/service.go:56:AllocateDevices",
    "kind": "service",
    "code_entry": "internal/service/enterprise_device/service.go:56 AllocateDevices",
    "owner": "enterprise_device",
    "summary": "业务方法 AllocateDevices",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "enterprise_device.allocate_devices",
    "action_name": "执行业务方法（AllocateDevices）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "enterprise_device",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/exchange/service.go:269:Cancel",
    "kind": "service",
    "code_entry": "internal/service/exchange/service.go:269 Cancel",
    "owner": "exchange",
    "summary": "业务方法 Cancel",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "exchange.cancel",
    "action_name": "执行业务方法（Cancel）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/exchange/service.go:529:SubmitShippingInfo",
    "kind": "service",
    "code_entry": "internal/service/exchange/service.go:529 SubmitShippingInfo",
    "owner": "exchange",
    "summary": "业务方法 SubmitShippingInfo",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "exchange.submit_shipping_info",
    "action_name": "执行业务方法（SubmitShippingInfo）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/exchange/service.go:73:Create",
    "kind": "service",
    "code_entry": "internal/service/exchange/service.go:73 Create",
    "owner": "exchange",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "exchange.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "exchange",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/export_task/service.go:251:CancelTask",
    "kind": "service",
    "code_entry": "internal/service/export_task/service.go:251 CancelTask",
    "owner": "export_task",
    "summary": "业务方法 CancelTask",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "export_task.cancel_task",
    "action_name": "执行业务方法（CancelTask）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_task",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/export_task/service.go:58:CreateTask",
    "kind": "service",
    "code_entry": "internal/service/export_task/service.go:58 CreateTask",
    "owner": "export_task",
    "summary": "业务方法 CreateTask",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "export_task.create_task",
    "action_name": "执行业务方法（CreateTask）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_task",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/realname_policy_batch.go:16:BatchUpdateRealnamePolicy",
    "kind": "service",
    "code_entry": "internal/service/iot_card/realname_policy_batch.go:16 BatchUpdateRealnamePolicy",
    "owner": "iot_card",
    "summary": "业务方法 BatchUpdateRealnamePolicy",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.batch_update_realname_policy",
    "action_name": "执行业务方法（BatchUpdateRealnamePolicy）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1012:BatchSetSeriesBinding",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1012 BatchSetSeriesBinding",
    "owner": "iot_card",
    "summary": "业务方法 BatchSetSeriesBinding",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.batch_set_series_binding",
    "action_name": "执行业务方法（BatchSetSeriesBinding）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1373:RefreshCardDataByID",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1373 RefreshCardDataByID",
    "owner": "iot_card",
    "summary": "业务方法 RefreshCardDataByID",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.refresh_card_data_by_i_d",
    "action_name": "执行业务方法（RefreshCardDataByID）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1387:RefreshCardDataFromGateway",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1387 RefreshCardDataFromGateway",
    "owner": "iot_card",
    "summary": "业务方法 RefreshCardDataFromGateway",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.refresh_card_data_from_gateway",
    "action_name": "执行业务方法（RefreshCardDataFromGateway）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1692:UpdatePollingStatus",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1692 UpdatePollingStatus",
    "owner": "iot_card",
    "summary": "业务方法 UpdatePollingStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.update_polling_status",
    "action_name": "执行业务方法（UpdatePollingStatus）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1741:BatchUpdatePollingStatus",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1741 BatchUpdatePollingStatus",
    "owner": "iot_card",
    "summary": "业务方法 BatchUpdatePollingStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.batch_update_polling_status",
    "action_name": "执行业务方法（BatchUpdatePollingStatus）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1780:DeleteCard",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1780 DeleteCard",
    "owner": "iot_card",
    "summary": "业务方法 DeleteCard",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.delete_card",
    "action_name": "执行业务方法（DeleteCard）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1824:BatchDeleteCards",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1824 BatchDeleteCards",
    "owner": "iot_card",
    "summary": "业务方法 BatchDeleteCards",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.batch_delete_cards",
    "action_name": "执行业务方法（BatchDeleteCards）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:1866:UpdateRealnamePolicy",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:1866 UpdateRealnamePolicy",
    "owner": "iot_card",
    "summary": "业务方法 UpdateRealnamePolicy",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.update_realname_policy",
    "action_name": "执行业务方法（UpdateRealnamePolicy）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:514:AllocateCards",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:514 AllocateCards",
    "owner": "iot_card",
    "summary": "业务方法 AllocateCards",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.allocate_cards",
    "action_name": "执行业务方法（AllocateCards）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/service.go:666:RecallCards",
    "kind": "service",
    "code_entry": "internal/service/iot_card/service.go:666 RecallCards",
    "owner": "iot_card",
    "summary": "业务方法 RecallCards",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.recall_cards",
    "action_name": "执行业务方法（RecallCards）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/speed_tier.go:26:SetSpeedTier",
    "kind": "service",
    "code_entry": "internal/service/iot_card/speed_tier.go:26 SetSpeedTier",
    "owner": "iot_card",
    "summary": "业务方法 SetSpeedTier",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.set_speed_tier",
    "action_name": "执行业务方法（SetSpeedTier）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card/stop_resume_service.go:410:ResumeCardIfStopped",
    "kind": "service",
    "code_entry": "internal/service/iot_card/stop_resume_service.go:410 ResumeCardIfStopped",
    "owner": "iot_card",
    "summary": "业务方法 ResumeCardIfStopped",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card.resume_card_if_stopped",
    "action_name": "执行业务方法（ResumeCardIfStopped）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/iot_card_import/service.go:72:CreateImportTask",
    "kind": "service",
    "code_entry": "internal/service/iot_card_import/service.go:72 CreateImportTask",
    "owner": "iot_card_import",
    "summary": "业务方法 CreateImportTask",
    "audit_event": "必须",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "iot_card_import.create_import_task",
    "action_name": "执行业务方法（CreateImportTask）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card_import",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/operation_password/service.go:27:Set",
    "kind": "service",
    "code_entry": "internal/service/operation_password/service.go:27 Set",
    "owner": "operation_password",
    "summary": "业务方法 Set",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "operation_password.set",
    "action_name": "执行业务方法（Set）",
    "category": "business",
    "risk": "high",
    "primary_resource": "operation_password",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order/service.go:1240:CreatePendingOrder",
    "kind": "service",
    "code_entry": "internal/service/order/service.go:1240 CreatePendingOrder",
    "owner": "order",
    "summary": "业务方法 CreatePendingOrder",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order.create_pending_order",
    "action_name": "执行业务方法（CreatePendingOrder）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order/service.go:1438:Cancel",
    "kind": "service",
    "code_entry": "internal/service/order/service.go:1438 Cancel",
    "owner": "order",
    "summary": "业务方法 Cancel",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order.cancel",
    "action_name": "执行业务方法（Cancel）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order/service.go:1465:CancelExpiredOrders",
    "kind": "service",
    "code_entry": "internal/service/order/service.go:1465 CancelExpiredOrders",
    "owner": "order",
    "summary": "业务方法 CancelExpiredOrders",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order.cancel_expired_orders",
    "action_name": "执行业务方法（CancelExpiredOrders）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order/service.go:153:CreateAdminOrder",
    "kind": "service",
    "code_entry": "internal/service/order/service.go:153 CreateAdminOrder",
    "owner": "order",
    "summary": "业务方法 CreateAdminOrder",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order.create_admin_order",
    "action_name": "执行业务方法（CreateAdminOrder）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order/service.go:1913:HandlePaymentCallback",
    "kind": "service",
    "code_entry": "internal/service/order/service.go:1913 HandlePaymentCallback",
    "owner": "order",
    "summary": "业务方法 HandlePaymentCallback",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order.handle_payment_callback",
    "action_name": "执行业务方法（HandlePaymentCallback）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order/service.go:1989:HandlePaymentRecordCallback",
    "kind": "service",
    "code_entry": "internal/service/order/service.go:1989 HandlePaymentRecordCallback",
    "owner": "order",
    "summary": "业务方法 HandlePaymentRecordCallback",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order.handle_payment_record_callback",
    "action_name": "执行业务方法（HandlePaymentRecordCallback）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order/service.go:565:CreateH5Order",
    "kind": "service",
    "code_entry": "internal/service/order/service.go:565 CreateH5Order",
    "owner": "order",
    "summary": "业务方法 CreateH5Order",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order.create_h5_order",
    "action_name": "执行业务方法（CreateH5Order）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/order_package_invalidate/service.go:53:Create",
    "kind": "service",
    "code_entry": "internal/service/order_package_invalidate/service.go:53 Create",
    "owner": "order_package_invalidate",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "order_package_invalidate.create",
    "action_name": "执行业务方法（Create）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order_package_invalidate",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/activation_service.go:211:ActivateQueuedPackage",
    "kind": "service",
    "code_entry": "internal/service/package/activation_service.go:211 ActivateQueuedPackage",
    "owner": "package",
    "summary": "业务方法 ActivateQueuedPackage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.activate_queued_package",
    "action_name": "执行业务方法（ActivateQueuedPackage）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/activation_service.go:298:ActivateSpecificPackage",
    "kind": "service",
    "code_entry": "internal/service/package/activation_service.go:298 ActivateSpecificPackage",
    "owner": "package",
    "summary": "业务方法 ActivateSpecificPackage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.activate_specific_package",
    "action_name": "执行业务方法（ActivateSpecificPackage）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/activation_service.go:405:ActivateNextPendingMainPackage",
    "kind": "service",
    "code_entry": "internal/service/package/activation_service.go:405 ActivateNextPendingMainPackage",
    "owner": "package",
    "summary": "业务方法 ActivateNextPendingMainPackage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.activate_next_pending_main_package",
    "action_name": "执行业务方法（ActivateNextPendingMainPackage）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/activation_service.go:74:ActivateByRealname",
    "kind": "service",
    "code_entry": "internal/service/package/activation_service.go:74 ActivateByRealname",
    "owner": "package",
    "summary": "业务方法 ActivateByRealname",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.activate_by_realname",
    "action_name": "执行业务方法（ActivateByRealname）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/activation_service.go:774:InvalidatePackagesForRefund",
    "kind": "service",
    "code_entry": "internal/service/package/activation_service.go:774 InvalidatePackagesForRefund",
    "owner": "package",
    "summary": "业务方法 InvalidatePackagesForRefund",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.invalidate_packages_for_refund",
    "action_name": "执行业务方法（InvalidatePackagesForRefund）",
    "category": "business",
    "risk": "high",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/activation_service.go:871:InvalidateAllPackagesByAsset",
    "kind": "service",
    "code_entry": "internal/service/package/activation_service.go:871 InvalidateAllPackagesByAsset",
    "owner": "package",
    "summary": "业务方法 InvalidateAllPackagesByAsset",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.invalidate_all_packages_by_asset",
    "action_name": "执行业务方法（InvalidateAllPackagesByAsset）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/reset_service.go:134:ResetMonthlyUsage",
    "kind": "service",
    "code_entry": "internal/service/package/reset_service.go:134 ResetMonthlyUsage",
    "owner": "package",
    "summary": "业务方法 ResetMonthlyUsage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.reset_monthly_usage",
    "action_name": "执行业务方法（ResetMonthlyUsage）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/reset_service.go:296:ResetYearlyUsage",
    "kind": "service",
    "code_entry": "internal/service/package/reset_service.go:296 ResetYearlyUsage",
    "owner": "package",
    "summary": "业务方法 ResetYearlyUsage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.reset_yearly_usage",
    "action_name": "执行业务方法（ResetYearlyUsage）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/reset_service.go:52:ResetDailyUsage",
    "kind": "service",
    "code_entry": "internal/service/package/reset_service.go:52 ResetDailyUsage",
    "owner": "package",
    "summary": "业务方法 ResetDailyUsage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.reset_daily_usage",
    "action_name": "执行业务方法（ResetDailyUsage）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/service.go:208:Update",
    "kind": "service",
    "code_entry": "internal/service/package/service.go:208 Update",
    "owner": "package",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/service.go:342:Delete",
    "kind": "service",
    "code_entry": "internal/service/package/service.go:342 Delete",
    "owner": "package",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/service.go:44:Create",
    "kind": "service",
    "code_entry": "internal/service/package/service.go:44 Create",
    "owner": "package",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/service.go:478:UpdateStatus",
    "kind": "service",
    "code_entry": "internal/service/package/service.go:478 UpdateStatus",
    "owner": "package",
    "summary": "业务方法 UpdateStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.update_status",
    "action_name": "执行业务方法（UpdateStatus）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/service.go:514:UpdateShelfStatus",
    "kind": "service",
    "code_entry": "internal/service/package/service.go:514 UpdateShelfStatus",
    "owner": "package",
    "summary": "业务方法 UpdateShelfStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.update_shelf_status",
    "action_name": "执行业务方法（UpdateShelfStatus）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/service.go:559:UpdateRetailPrice",
    "kind": "service",
    "code_entry": "internal/service/package/service.go:559 UpdateRetailPrice",
    "owner": "package",
    "summary": "业务方法 UpdateRetailPrice",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.update_retail_price",
    "action_name": "执行业务方法（UpdateRetailPrice）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package/usage_service.go:78:DeductDataUsage",
    "kind": "service",
    "code_entry": "internal/service/package/usage_service.go:78 DeductDataUsage",
    "owner": "package",
    "summary": "业务方法 DeductDataUsage",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package.deduct_data_usage",
    "action_name": "执行业务方法（DeductDataUsage）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package_series/service.go:105:Update",
    "kind": "service",
    "code_entry": "internal/service/package_series/service.go:105 Update",
    "owner": "package_series",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package_series.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package_series/service.go:164:Delete",
    "kind": "service",
    "code_entry": "internal/service/package_series/service.go:164 Delete",
    "owner": "package_series",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package_series.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package_series/service.go:258:UpdateStatus",
    "kind": "service",
    "code_entry": "internal/service/package_series/service.go:258 UpdateStatus",
    "owner": "package_series",
    "summary": "业务方法 UpdateStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package_series.update_status",
    "action_name": "执行业务方法（UpdateStatus）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/package_series/service.go:38:Create",
    "kind": "service",
    "code_entry": "internal/service/package_series/service.go:38 Create",
    "owner": "package_series",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "package_series.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_series",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/permission/service.go:153:Update",
    "kind": "service",
    "code_entry": "internal/service/permission/service.go:153 Update",
    "owner": "permission",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "permission.update",
    "action_name": "执行业务方法（Update）",
    "category": "security",
    "risk": "high",
    "primary_resource": "permission",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/permission/service.go:247:Delete",
    "kind": "service",
    "code_entry": "internal/service/permission/service.go:247 Delete",
    "owner": "permission",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "permission.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "security",
    "risk": "high",
    "primary_resource": "permission",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/permission/service.go:65:Create",
    "kind": "service",
    "code_entry": "internal/service/permission/service.go:65 Create",
    "owner": "permission",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "permission.create",
    "action_name": "执行业务方法（Create）",
    "category": "security",
    "risk": "high",
    "primary_resource": "permission",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/personal_customer/service.go:45:UpdateProfile",
    "kind": "service",
    "code_entry": "internal/service/personal_customer/service.go:45 UpdateProfile",
    "owner": "personal_customer",
    "summary": "业务方法 UpdateProfile",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "personal_customer.update_profile",
    "action_name": "执行业务方法（UpdateProfile）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "personal_customer",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/alert_service.go:119:UpdateRule",
    "kind": "service",
    "code_entry": "internal/service/polling/alert_service.go:119 UpdateRule",
    "owner": "polling",
    "summary": "业务方法 UpdateRule",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.update_rule",
    "action_name": "执行业务方法（UpdateRule）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/alert_service.go:173:DeleteRule",
    "kind": "service",
    "code_entry": "internal/service/polling/alert_service.go:173 DeleteRule",
    "owner": "polling",
    "summary": "业务方法 DeleteRule",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.delete_rule",
    "action_name": "执行业务方法（DeleteRule）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/alert_service.go:57:CreateRule",
    "kind": "service",
    "code_entry": "internal/service/polling/alert_service.go:57 CreateRule",
    "owner": "polling",
    "summary": "业务方法 CreateRule",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.create_rule",
    "action_name": "执行业务方法（CreateRule）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/asset_polling_service.go:60:UpdatePollingStatus",
    "kind": "service",
    "code_entry": "internal/service/polling/asset_polling_service.go:60 UpdatePollingStatus",
    "owner": "polling",
    "summary": "业务方法 UpdatePollingStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.update_polling_status",
    "action_name": "执行业务方法（UpdatePollingStatus）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/cleanup_service.go:192:TriggerCleanup",
    "kind": "service",
    "code_entry": "internal/service/polling/cleanup_service.go:192 TriggerCleanup",
    "owner": "polling",
    "summary": "业务方法 TriggerCleanup",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.trigger_cleanup",
    "action_name": "执行业务方法（TriggerCleanup）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/cleanup_service.go:38:CreateConfig",
    "kind": "service",
    "code_entry": "internal/service/polling/cleanup_service.go:38 CreateConfig",
    "owner": "polling",
    "summary": "业务方法 CreateConfig",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.create_config",
    "action_name": "执行业务方法（CreateConfig）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/cleanup_service.go:67:UpdateConfig",
    "kind": "service",
    "code_entry": "internal/service/polling/cleanup_service.go:67 UpdateConfig",
    "owner": "polling",
    "summary": "业务方法 UpdateConfig",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.update_config",
    "action_name": "执行业务方法（UpdateConfig）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/cleanup_service.go:98:DeleteConfig",
    "kind": "service",
    "code_entry": "internal/service/polling/cleanup_service.go:98 DeleteConfig",
    "owner": "polling",
    "summary": "业务方法 DeleteConfig",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.delete_config",
    "action_name": "执行业务方法（DeleteConfig）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/concurrency_service.go:120:UpdateMaxConcurrency",
    "kind": "service",
    "code_entry": "internal/service/polling/concurrency_service.go:120 UpdateMaxConcurrency",
    "owner": "polling",
    "summary": "业务方法 UpdateMaxConcurrency",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.update_max_concurrency",
    "action_name": "执行业务方法（UpdateMaxConcurrency）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/concurrency_service.go:167:ResetConcurrency",
    "kind": "service",
    "code_entry": "internal/service/polling/concurrency_service.go:167 ResetConcurrency",
    "owner": "polling",
    "summary": "业务方法 ResetConcurrency",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.reset_concurrency",
    "action_name": "执行业务方法（ResetConcurrency）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/concurrency_service.go:255:SyncConfigToRedis",
    "kind": "service",
    "code_entry": "internal/service/polling/concurrency_service.go:255 SyncConfigToRedis",
    "owner": "polling",
    "summary": "业务方法 SyncConfigToRedis",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.sync_config_to_redis",
    "action_name": "执行业务方法（SyncConfigToRedis）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/config_service.go:133:Update",
    "kind": "service",
    "code_entry": "internal/service/polling/config_service.go:133 Update",
    "owner": "polling",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.update",
    "action_name": "执行业务方法（Update）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/config_service.go:226:Delete",
    "kind": "service",
    "code_entry": "internal/service/polling/config_service.go:226 Delete",
    "owner": "polling",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/config_service.go:310:UpdateStatus",
    "kind": "service",
    "code_entry": "internal/service/polling/config_service.go:310 UpdateStatus",
    "owner": "polling",
    "summary": "业务方法 UpdateStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.update_status",
    "action_name": "执行业务方法（UpdateStatus）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/config_service.go:51:Create",
    "kind": "service",
    "code_entry": "internal/service/polling/config_service.go:51 Create",
    "owner": "polling",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.create",
    "action_name": "执行业务方法（Create）",
    "category": "asset",
    "risk": "high",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/manual_trigger_service.go:175:TriggerBatch",
    "kind": "service",
    "code_entry": "internal/service/polling/manual_trigger_service.go:175 TriggerBatch",
    "owner": "polling",
    "summary": "业务方法 TriggerBatch",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.trigger_batch",
    "action_name": "执行业务方法（TriggerBatch）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/manual_trigger_service.go:315:TriggerByCondition",
    "kind": "service",
    "code_entry": "internal/service/polling/manual_trigger_service.go:315 TriggerByCondition",
    "owner": "polling",
    "summary": "业务方法 TriggerByCondition",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.trigger_by_condition",
    "action_name": "执行业务方法（TriggerByCondition）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/manual_trigger_service.go:452:CancelTrigger",
    "kind": "service",
    "code_entry": "internal/service/polling/manual_trigger_service.go:452 CancelTrigger",
    "owner": "polling",
    "summary": "业务方法 CancelTrigger",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.cancel_trigger",
    "action_name": "执行业务方法（CancelTrigger）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/polling/manual_trigger_service.go:52:TriggerSingle",
    "kind": "service",
    "code_entry": "internal/service/polling/manual_trigger_service.go:52 TriggerSingle",
    "owner": "polling",
    "summary": "业务方法 TriggerSingle",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "polling.trigger_single",
    "action_name": "执行业务方法（TriggerSingle）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/recharge_order/service.go:72:HandlePaymentCallback",
    "kind": "service",
    "code_entry": "internal/service/recharge_order/service.go:72 HandlePaymentCallback",
    "owner": "recharge_order",
    "summary": "业务方法 HandlePaymentCallback",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "recharge_order.handle_payment_callback",
    "action_name": "执行业务方法（HandlePaymentCallback）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "recharge_order",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/refund/approval_decision.go:19:Handle",
    "kind": "service",
    "code_entry": "internal/service/refund/approval_decision.go:19 Handle",
    "owner": "refund",
    "summary": "业务方法 Handle",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "refund.handle",
    "action_name": "执行业务方法（Handle）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/refund/service.go:115:Create",
    "kind": "service",
    "code_entry": "internal/service/refund/service.go:115 Create",
    "owner": "refund",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "refund.create",
    "action_name": "执行业务方法（Create）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/refund/service.go:258:Approve",
    "kind": "service",
    "code_entry": "internal/service/refund/service.go:258 Approve",
    "owner": "refund",
    "summary": "业务方法 Approve",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "refund.approve",
    "action_name": "执行业务方法（Approve）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/refund/service.go:588:Reject",
    "kind": "service",
    "code_entry": "internal/service/refund/service.go:588 Reject",
    "owner": "refund",
    "summary": "业务方法 Reject",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "refund.reject",
    "action_name": "执行业务方法（Reject）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "refund",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/role/service.go:114:Update",
    "kind": "service",
    "code_entry": "internal/service/role/service.go:114 Update",
    "owner": "role",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.update",
    "action_name": "执行业务方法（Update）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/role/service.go:173:Delete",
    "kind": "service",
    "code_entry": "internal/service/role/service.go:173 Delete",
    "owner": "role",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/role/service.go:255:AssignPermissions",
    "kind": "service",
    "code_entry": "internal/service/role/service.go:255 AssignPermissions",
    "owner": "role",
    "summary": "业务方法 AssignPermissions",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.assign_permissions",
    "action_name": "执行业务方法（AssignPermissions）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/role/service.go:383:RemovePermission",
    "kind": "service",
    "code_entry": "internal/service/role/service.go:383 RemovePermission",
    "owner": "role",
    "summary": "业务方法 RemovePermission",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.remove_permission",
    "action_name": "执行业务方法（RemovePermission）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/role/service.go:436:BatchRemovePermissions",
    "kind": "service",
    "code_entry": "internal/service/role/service.go:436 BatchRemovePermissions",
    "owner": "role",
    "summary": "业务方法 BatchRemovePermissions",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.batch_remove_permissions",
    "action_name": "执行业务方法（BatchRemovePermissions）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/role/service.go:495:UpdateStatus",
    "kind": "service",
    "code_entry": "internal/service/role/service.go:495 UpdateStatus",
    "owner": "role",
    "summary": "业务方法 UpdateStatus",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.update_status",
    "action_name": "执行业务方法（UpdateStatus）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/role/service.go:54:Create",
    "kind": "service",
    "code_entry": "internal/service/role/service.go:54 Create",
    "owner": "role",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "role.create",
    "action_name": "执行业务方法（Create）",
    "category": "security",
    "risk": "high",
    "primary_resource": "role",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop/service.go:104:Disable",
    "kind": "service",
    "code_entry": "internal/service/shop/service.go:104 Disable",
    "owner": "shop",
    "summary": "业务方法 Disable",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.disable",
    "action_name": "执行业务方法（Disable）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop/service.go:125:Enable",
    "kind": "service",
    "code_entry": "internal/service/shop/service.go:125 Enable",
    "owner": "shop",
    "summary": "业务方法 Enable",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.enable",
    "action_name": "执行业务方法（Enable）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop/service.go:300:Delete",
    "kind": "service",
    "code_entry": "internal/service/shop/service.go:300 Delete",
    "owner": "shop",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop/service.go:50:Update",
    "kind": "service",
    "code_entry": "internal/service/shop/service.go:50 Update",
    "owner": "shop",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop/shop_role.go:19:AssignRolesToShop",
    "kind": "service",
    "code_entry": "internal/service/shop/shop_role.go:19 AssignRolesToShop",
    "owner": "shop",
    "summary": "业务方法 AssignRolesToShop",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.assign_roles_to_shop",
    "action_name": "执行业务方法（AssignRolesToShop）",
    "category": "business",
    "risk": "high",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop/shop_role.go:95:DeleteShopRole",
    "kind": "service",
    "code_entry": "internal/service/shop/shop_role.go:95 DeleteShopRole",
    "owner": "shop",
    "summary": "业务方法 DeleteShopRole",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop.delete_shop_role",
    "action_name": "执行业务方法（DeleteShopRole）",
    "category": "business",
    "risk": "high",
    "primary_resource": "shop",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_commission/service.go:412:CreateWithdrawalRequest",
    "kind": "service",
    "code_entry": "internal/service/shop_commission/service.go:412 CreateWithdrawalRequest",
    "owner": "shop_commission",
    "summary": "业务方法 CreateWithdrawalRequest",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_commission.create_withdrawal_request",
    "action_name": "执行业务方法（CreateWithdrawalRequest）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "shop_commission",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_commission/service.go:627:ResolveCommissionRecord",
    "kind": "service",
    "code_entry": "internal/service/shop_commission/service.go:627 ResolveCommissionRecord",
    "owner": "shop_commission",
    "summary": "业务方法 ResolveCommissionRecord",
    "audit_event": "必须",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_commission.resolve_commission_record",
    "action_name": "执行业务方法（ResolveCommissionRecord）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "shop_commission",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_package_batch_allocation/service.go:47:UpdateExpiryBase",
    "kind": "service",
    "code_entry": "internal/service/shop_package_batch_allocation/service.go:47 UpdateExpiryBase",
    "owner": "shop_package_batch_allocation",
    "summary": "业务方法 UpdateExpiryBase",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_package_batch_allocation.update_expiry_base",
    "action_name": "执行业务方法（UpdateExpiryBase）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_package_batch_allocation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_package_batch_allocation/service.go:97:BatchAllocate",
    "kind": "service",
    "code_entry": "internal/service/shop_package_batch_allocation/service.go:97 BatchAllocate",
    "owner": "shop_package_batch_allocation",
    "summary": "业务方法 BatchAllocate",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_package_batch_allocation.batch_allocate",
    "action_name": "执行业务方法（BatchAllocate）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_package_batch_allocation",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_package_batch_pricing/service.go:44:BatchUpdatePricing",
    "kind": "service",
    "code_entry": "internal/service/shop_package_batch_pricing/service.go:44 BatchUpdatePricing",
    "owner": "shop_package_batch_pricing",
    "summary": "业务方法 BatchUpdatePricing",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_package_batch_pricing.batch_update_pricing",
    "action_name": "执行业务方法（BatchUpdatePricing）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_package_batch_pricing",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_series_grant/service.go:306:Create",
    "kind": "service",
    "code_entry": "internal/service/shop_series_grant/service.go:306 Create",
    "owner": "shop_series_grant",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_series_grant.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_series_grant",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_series_grant/service.go:657:Update",
    "kind": "service",
    "code_entry": "internal/service/shop_series_grant/service.go:657 Update",
    "owner": "shop_series_grant",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_series_grant.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_series_grant",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/shop_series_grant/service.go:932:Delete",
    "kind": "service",
    "code_entry": "internal/service/shop_series_grant/service.go:932 Delete",
    "owner": "shop_series_grant",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "shop_series_grant.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "shop_series_grant",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/verification/service.go:36:SendCode",
    "kind": "service",
    "code_entry": "internal/service/verification/service.go:36 SendCode",
    "owner": "verification",
    "summary": "业务方法 SendCode",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "verification.send_code",
    "action_name": "执行业务方法（SendCode）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "verification",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/wechat_config/service.go:191:Update",
    "kind": "service",
    "code_entry": "internal/service/wechat_config/service.go:191 Update",
    "owner": "wechat_config",
    "summary": "业务方法 Update",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wechat_config.update",
    "action_name": "执行业务方法（Update）",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/wechat_config/service.go:280:Delete",
    "kind": "service",
    "code_entry": "internal/service/wechat_config/service.go:280 Delete",
    "owner": "wechat_config",
    "summary": "业务方法 Delete",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wechat_config.delete",
    "action_name": "执行业务方法（Delete）",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/wechat_config/service.go:332:Activate",
    "kind": "service",
    "code_entry": "internal/service/wechat_config/service.go:332 Activate",
    "owner": "wechat_config",
    "summary": "业务方法 Activate",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wechat_config.activate",
    "action_name": "执行业务方法（Activate）",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/wechat_config/service.go:379:Deactivate",
    "kind": "service",
    "code_entry": "internal/service/wechat_config/service.go:379 Deactivate",
    "owner": "wechat_config",
    "summary": "业务方法 Deactivate",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wechat_config.deactivate",
    "action_name": "执行业务方法（Deactivate）",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "service:internal/service/wechat_config/service.go:67:Create",
    "kind": "service",
    "code_entry": "internal/service/wechat_config/service.go:67 Create",
    "owner": "wechat_config",
    "summary": "业务方法 Create",
    "audit_event": "必须",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A",
    "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A",
    "action_code": "wechat_config.create",
    "action_name": "执行业务方法（Create）",
    "category": "business",
    "risk": "high",
    "primary_resource": "wechat_config",
    "affected_resource": "完整用例直接修改或引用的资源",
    "actor_source": "由调用入口传入操作者与来源快照",
    "visibility": "由完整用例决定平台完整视图、主体安全投影或 internal_only",
    "transaction": "关键成功事件与业务事实同一 GORM 事务",
    "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical",
    "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品",
    "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影",
    "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用静态检查与数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:152:constants.TaskTypeOutboxDeliver",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:152 outboxHandler.Handle",
    "owner": "outbox_deliver",
    "summary": "处理异步任务 constants.TaskTypeOutboxDeliver",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "outbox_deliver.handle",
    "action_name": "处理异步任务（constants.TaskTypeOutboxDeliver）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "outbox_deliver",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:418:constants.TaskTypeWeComApprovalSync",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:418 detailHandler.Handle",
    "owner": "we_com_approval_sync",
    "summary": "处理异步任务 constants.TaskTypeWeComApprovalSync",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "we_com_approval_sync.handle",
    "action_name": "处理异步任务（constants.TaskTypeWeComApprovalSync）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "we_com_approval_sync",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:419:constants.TaskTypeWeComApprovalRecovery",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:419 recoveryHandler.Handle",
    "owner": "we_com_approval_recovery",
    "summary": "处理异步任务 constants.TaskTypeWeComApprovalRecovery",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "we_com_approval_recovery.handle",
    "action_name": "处理异步任务（constants.TaskTypeWeComApprovalRecovery）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "we_com_approval_recovery",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:440:constants.TaskTypeAgentRechargeRecovery",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:440 handler.Handle",
    "owner": "agent_recharge_recovery",
    "summary": "处理异步任务 constants.TaskTypeAgentRechargeRecovery",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "agent_recharge_recovery.handle",
    "action_name": "处理异步任务（constants.TaskTypeAgentRechargeRecovery）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "agent_recharge_recovery",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:812:constants.TaskTypeAuditDailyArchive",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:812 task.NewAuditDailyArchiveHandler.Handle",
    "owner": "audit_daily_archive",
    "summary": "处理异步任务 constants.TaskTypeAuditDailyArchive",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "audit_daily_archive.handle",
    "action_name": "处理异步任务（constants.TaskTypeAuditDailyArchive）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "audit_daily_archive",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:814:constants.TaskTypeIntegrationDailyArchive",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:814 integrationHandler.HandleDaily",
    "owner": "integration_daily_archive",
    "summary": "处理异步任务 constants.TaskTypeIntegrationDailyArchive",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "integration_daily_archive.handle_daily",
    "action_name": "处理异步任务（constants.TaskTypeIntegrationDailyArchive）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "integration_daily_archive",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:815:constants.TaskTypeIntegrationMonthlyFinalize",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:815 integrationHandler.HandleMonthlyFinalize",
    "owner": "integration_monthly_finalize",
    "summary": "处理异步任务 constants.TaskTypeIntegrationMonthlyFinalize",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "integration_monthly_finalize.handle_monthly_finalize",
    "action_name": "处理异步任务（constants.TaskTypeIntegrationMonthlyFinalize）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "integration_monthly_finalize",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:816:constants.TaskTypeAuditMonthlyRetention",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:816 task.NewAuditMonthlyRetentionHandler.Handle",
    "owner": "audit_monthly_retention",
    "summary": "处理异步任务 constants.TaskTypeAuditMonthlyRetention",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "audit_monthly_retention.handle",
    "action_name": "处理异步任务（constants.TaskTypeAuditMonthlyRetention）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "audit_monthly_retention",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:827:constants.TaskTypeAuditDailyArchive",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:827 task.NewAuditDailyArchiveHandler.Handle",
    "owner": "audit_daily_archive",
    "summary": "处理异步任务 constants.TaskTypeAuditDailyArchive",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "audit_daily_archive.handle",
    "action_name": "处理异步任务（constants.TaskTypeAuditDailyArchive）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "audit_daily_archive",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:829:constants.TaskTypeIntegrationDailyArchive",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:829 integrationHandler.HandleDaily",
    "owner": "integration_daily_archive",
    "summary": "处理异步任务 constants.TaskTypeIntegrationDailyArchive",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "integration_daily_archive.handle_daily",
    "action_name": "处理异步任务（constants.TaskTypeIntegrationDailyArchive）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "integration_daily_archive",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:830:constants.TaskTypeIntegrationMonthlyFinalize",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:830 integrationHandler.HandleMonthlyFinalize",
    "owner": "integration_monthly_finalize",
    "summary": "处理异步任务 constants.TaskTypeIntegrationMonthlyFinalize",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "integration_monthly_finalize.handle_monthly_finalize",
    "action_name": "处理异步任务（constants.TaskTypeIntegrationMonthlyFinalize）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "integration_monthly_finalize",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:cmd/worker/main.go:831:constants.TaskTypeAuditMonthlyRetention",
    "kind": "worker",
    "code_entry": "cmd/worker/main.go:831 task.NewAuditMonthlyRetentionHandler.Handle",
    "owner": "audit_monthly_retention",
    "summary": "处理异步任务 constants.TaskTypeAuditMonthlyRetention",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "audit_monthly_retention.handle",
    "action_name": "处理异步任务（constants.TaskTypeAuditMonthlyRetention）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "audit_monthly_retention",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:114:constants.TaskTypeIotCardImport",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:114 iotCardImportHandler.HandleIotCardImport",
    "owner": "iot_card_import",
    "summary": "处理异步任务 constants.TaskTypeIotCardImport",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "iot_card_import.handle_iot_card_import",
    "action_name": "处理异步任务（constants.TaskTypeIotCardImport）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "iot_card_import",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:127:constants.TaskTypeOrderPackageInvalidate",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:127 orderPkgHandler.Handle",
    "owner": "order_package_invalidate",
    "summary": "处理异步任务 constants.TaskTypeOrderPackageInvalidate",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "order_package_invalidate.handle",
    "action_name": "处理异步任务（constants.TaskTypeOrderPackageInvalidate）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order_package_invalidate",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:140:constants.TaskTypeAssetPackageBatchOrder",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:140 handler.Handle",
    "owner": "asset_package_batch_order",
    "summary": "处理异步任务 constants.TaskTypeAssetPackageBatchOrder",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "asset_package_batch_order.handle",
    "action_name": "处理异步任务（constants.TaskTypeAssetPackageBatchOrder）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "asset_package_batch_order",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:160:constants.TaskTypeDeviceImport",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:160 deviceImportHandler.HandleDeviceImport",
    "owner": "device_import",
    "summary": "处理异步任务 constants.TaskTypeDeviceImport",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "device_import.handle_device_import",
    "action_name": "处理异步任务（constants.TaskTypeDeviceImport）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "device_import",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:194:constants.TaskTypeExportDispatch",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:194 dispatchHandler.HandleExportDispatch",
    "owner": "export_dispatch",
    "summary": "处理异步任务 constants.TaskTypeExportDispatch",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "export_dispatch.handle_export_dispatch",
    "action_name": "处理异步任务（constants.TaskTypeExportDispatch）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_dispatch",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:197:constants.TaskTypeExportShard",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:197 shardHandler.HandleExportShard",
    "owner": "export_shard",
    "summary": "处理异步任务 constants.TaskTypeExportShard",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "export_shard.handle_export_shard",
    "action_name": "处理异步任务（constants.TaskTypeExportShard）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_shard",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:200:constants.TaskTypeExportFinalize",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:200 finalizeHandler.HandleExportFinalize",
    "owner": "export_finalize",
    "summary": "处理异步任务 constants.TaskTypeExportFinalize",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "业务任务及明细表是批量结果权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "export_finalize.handle_export_finalize",
    "action_name": "处理异步任务（constants.TaskTypeExportFinalize）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "export_finalize",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:224:constants.TaskTypeCommissionStatsUpdate",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:224 updateHandler.HandleCommissionStatsUpdate",
    "owner": "commission_stats_update",
    "summary": "处理异步任务 constants.TaskTypeCommissionStatsUpdate",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "commission_stats_update.handle_commission_stats_update",
    "action_name": "处理异步任务（constants.TaskTypeCommissionStatsUpdate）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_stats_update",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:227:constants.TaskTypeCommissionStatsSync",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:227 syncHandler.HandleCommissionStatsSync",
    "owner": "commission_stats_sync",
    "summary": "处理异步任务 constants.TaskTypeCommissionStatsSync",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "commission_stats_sync.handle_commission_stats_sync",
    "action_name": "处理异步任务（constants.TaskTypeCommissionStatsSync）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_stats_sync",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:230:constants.TaskTypeCommissionStatsArchive",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:230 archiveHandler.HandleCommissionStatsArchive",
    "owner": "commission_stats_archive",
    "summary": "处理异步任务 constants.TaskTypeCommissionStatsArchive",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "commission_stats_archive.handle_commission_stats_archive",
    "action_name": "处理异步任务（constants.TaskTypeCommissionStatsArchive）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission_stats_archive",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:240:constants.TaskTypeCommission",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:240 commissionCalculationHandler.HandleCommissionCalculation",
    "owner": "commission",
    "summary": "处理异步任务 constants.TaskTypeCommission",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "commission.handle_commission_calculation",
    "action_name": "处理异步任务（constants.TaskTypeCommission）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "commission",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:261:constants.TaskTypePollingRealname",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:261 realnameHandler.Handle",
    "owner": "polling_realname",
    "summary": "处理异步任务 constants.TaskTypePollingRealname",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "必须：每次实际请求或未发送裁决均记录",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "polling_realname.handle",
    "action_name": "处理异步任务（constants.TaskTypePollingRealname）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_realname",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:262:constants.TaskTypePollingCarddata",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:262 carddataHandler.Handle",
    "owner": "polling_carddata",
    "summary": "处理异步任务 constants.TaskTypePollingCarddata",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "必须：每次实际请求或未发送裁决均记录",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "polling_carddata.handle",
    "action_name": "处理异步任务（constants.TaskTypePollingCarddata）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_carddata",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:263:constants.TaskTypePollingPackage",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:263 packageHandler.Handle",
    "owner": "polling_package",
    "summary": "处理异步任务 constants.TaskTypePollingPackage",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "必须：每次实际请求或未发送裁决均记录",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "polling_package.handle",
    "action_name": "处理异步任务（constants.TaskTypePollingPackage）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_package",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:264:constants.TaskTypePollingProtect",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:264 protectHandler.Handle",
    "owner": "polling_protect",
    "summary": "处理异步任务 constants.TaskTypePollingProtect",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "必须：每次实际请求或未发送裁决均记录",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "polling_protect.handle",
    "action_name": "处理异步任务（constants.TaskTypePollingProtect）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_protect",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:265:constants.TaskTypePollingCardStatus",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:265 cardStatusHandler.Handle",
    "owner": "polling_card_status",
    "summary": "处理异步任务 constants.TaskTypePollingCardStatus",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "必须：每次实际请求或未发送裁决均记录",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "polling_card_status.handle",
    "action_name": "处理异步任务（constants.TaskTypePollingCardStatus）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "polling_card_status",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:279:constants.TaskTypePackageFirstActivation",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:279 packageActivationHandler.HandlePackageFirstActivation",
    "owner": "package_first_activation",
    "summary": "处理异步任务 constants.TaskTypePackageFirstActivation",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "package_first_activation.handle_package_first_activation",
    "action_name": "处理异步任务（constants.TaskTypePackageFirstActivation）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_first_activation",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:282:constants.TaskTypePackageQueueActivation",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:282 packageActivationHandler.HandlePackageQueueActivation",
    "owner": "package_queue_activation",
    "summary": "处理异步任务 constants.TaskTypePackageQueueActivation",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "package_queue_activation.handle_package_queue_activation",
    "action_name": "处理异步任务（constants.TaskTypePackageQueueActivation）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_queue_activation",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:288:constants.TaskTypeOrderExpire",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:288 orderExpireHandler.HandleOrderExpire",
    "owner": "order_expire",
    "summary": "处理异步任务 constants.TaskTypeOrderExpire",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "order_expire.handle_order_expire",
    "action_name": "处理异步任务（constants.TaskTypeOrderExpire）",
    "category": "finance",
    "risk": "normal",
    "primary_resource": "order_expire",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:294:constants.TaskTypeAlertCheck",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:294 alertCheckHandler.HandleAlertCheck",
    "owner": "alert_check",
    "summary": "处理异步任务 constants.TaskTypeAlertCheck",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "alert_check.handle_alert_check",
    "action_name": "处理异步任务（constants.TaskTypeAlertCheck）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "alert_check",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:300:constants.TaskTypeDataCleanup",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:300 dataCleanupHandler.HandleDataCleanup",
    "owner": "data_cleanup",
    "summary": "处理异步任务 constants.TaskTypeDataCleanup",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "data_cleanup.handle_data_cleanup",
    "action_name": "处理异步任务（constants.TaskTypeDataCleanup）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "data_cleanup",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:307:constants.TaskTypeNotificationCleanup",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:307 cleanupHandler.Handle",
    "owner": "notification_cleanup",
    "summary": "处理异步任务 constants.TaskTypeNotificationCleanup",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "notification_cleanup.handle",
    "action_name": "处理异步任务（constants.TaskTypeNotificationCleanup）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "notification_cleanup",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:316:constants.TaskTypePackageExpiryReminder",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:316 handler.Handle",
    "owner": "package_expiry_reminder",
    "summary": "处理异步任务 constants.TaskTypePackageExpiryReminder",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "package_expiry_reminder.handle",
    "action_name": "处理异步任务（constants.TaskTypePackageExpiryReminder）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "package_expiry_reminder",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:335:constants.TaskTypeAutoPurchaseAfterRecharge",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:335 autoPurchaseHandler.ProcessTask",
    "owner": "auto_purchase_after_recharge",
    "summary": "处理异步任务 constants.TaskTypeAutoPurchaseAfterRecharge",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "auto_purchase_after_recharge.process_task",
    "action_name": "处理异步任务（constants.TaskTypeAutoPurchaseAfterRecharge）",
    "category": "finance",
    "risk": "high",
    "primary_resource": "auto_purchase_after_recharge",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:342:constants.TaskTypeDailyTrafficFlush",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:342 dailyTrafficFlushHandler.HandleDailyTrafficFlush",
    "owner": "daily_traffic_flush",
    "summary": "处理异步任务 constants.TaskTypeDailyTrafficFlush",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "daily_traffic_flush.handle_daily_traffic_flush",
    "action_name": "处理异步任务（constants.TaskTypeDailyTrafficFlush）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "daily_traffic_flush",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:70:constants.TaskTypeEmailSend",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:70 emailHandler.HandleEmailSend",
    "owner": "email_send",
    "summary": "处理异步任务 constants.TaskTypeEmailSend",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "email_send.handle_email_send",
    "action_name": "处理异步任务（constants.TaskTypeEmailSend）",
    "category": "business",
    "risk": "normal",
    "primary_resource": "email_send",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  },
  {
    "key": "worker:pkg/queue/handler.go:97:constants.TaskTypeCardObservationSeries",
    "kind": "worker",
    "code_entry": "pkg/queue/handler.go:97 handler.Handle",
    "owner": "card_observation_series",
    "summary": "处理异步任务 constants.TaskTypeCardObservationSeries",
    "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定",
    "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型",
    "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A",
    "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等",
    "action_code": "card_observation_series.handle",
    "action_name": "处理异步任务（constants.TaskTypeCardObservationSeries）",
    "category": "asset",
    "risk": "normal",
    "primary_resource": "card_observation_series",
    "affected_resource": "任务载荷定位的直接业务资源",
    "actor_source": "system_task/asynq",
    "visibility": "内部系统入口；外部主体只读取对应业务安全投影",
    "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交",
    "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计",
    "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL",
    "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log",
    "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费幂等数据核对；覆盖门禁静态比对本入口"
  }
]