fix: 小程序新增样本发微信通知，并放宽部分 Web 菜单强校验。

移动端协议保存后调度样本采集服务号通知；收款确认/储存证等写接口改为运营端登录即可。同步日期字段规范化与 OA 日期选择器复开修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/presign_order.py

@@ -11,15 +11,13 @@ from sqlalchemy.orm import Session
 
 from app.core.database import get_db
 from app.core.data_scope import get_user_dept_id
-from app.core.menu_guard import require_admin_or_super_admin, require_strict_menu_code
+from app.core.menu_guard import require_admin_or_super_admin
 from app.core.response import error_response, success_response
 from app.crud import presign_order as po_svc
 from app.models.models import SysUser
 
 router = APIRouter(prefix="/web/admin", tags=["细胞存储-预签约订单"])
 
-PAYMENT_CONFIRM_MENU = "biz:cellStoragePaymentConfirm:list"
-
 
 def _get_tenant_no(db: Session, user: dict) -> str:
     user_id = user.get("user_id")
@@ -400,7 +398,7 @@ async def list_presign_receipt_confirmed(
 async def confirm_presign_transfer(
     transfer_id: str,
     body: Optional[FinanceConfirmBody] = None,
-    user: dict = Depends(require_strict_menu_code(PAYMENT_CONFIRM_MENU)),
+    user: dict = Depends(require_admin_or_super_admin),
     db: Session = Depends(get_db),
 ):
     try:
@@ -429,7 +427,7 @@ async def confirm_presign_transfer(
 @router.post("/presign-transfers/{transfer_id}/receipt-reject")
 async def reject_presign_transfer(
     transfer_id: str,
-    user: dict = Depends(require_strict_menu_code(PAYMENT_CONFIRM_MENU)),
+    user: dict = Depends(require_admin_or_super_admin),
     db: Session = Depends(get_db),
 ):
     try:

backend/app/api/protocol_sample_payment.py

@@ -9,15 +9,13 @@ from pydantic import BaseModel, ConfigDict, Field
 from sqlalchemy.orm import Session
 
 from app.core.database import get_db
-from app.core.menu_guard import require_admin_or_super_admin, require_strict_menu_code
+from app.core.menu_guard import require_admin_or_super_admin
 from app.core.response import error_response, success_response
 from app.crud import protocol_sample_payment as psp_svc
 from app.models.models import BizCollectionProtocol, SysUser
 
 router = APIRouter(prefix="/web/admin", tags=["细胞存储-按样本缴费"])
 
-PAYMENT_CONFIRM_MENU = "biz:cellStoragePaymentConfirm:list"
-
 
 def _get_tenant_no(db: Session, user: dict) -> str:
     user_id = user.get("user_id")
@@ -587,7 +585,7 @@ async def list_receipt_confirmed(
 async def confirm_payment_transfer(
     transfer_id: str,
     body: Optional[FinanceConfirmBody] = None,
-    user: dict = Depends(require_strict_menu_code(PAYMENT_CONFIRM_MENU)),
+    user: dict = Depends(require_admin_or_super_admin),
     db: Session = Depends(get_db),
 ):
     try:
@@ -620,7 +618,7 @@ async def confirm_payment_transfer(
 @router.post("/payment-transfers/{transfer_id}/receipt-reject")
 async def reject_payment_transfer(
     transfer_id: str,
-    user: dict = Depends(require_strict_menu_code(PAYMENT_CONFIRM_MENU)),
+    user: dict = Depends(require_admin_or_super_admin),
     db: Session = Depends(get_db),
 ):
     try:

backend/app/api/research_donation.py

@@ -6,11 +6,7 @@ from pydantic import BaseModel, ConfigDict, Field
 from sqlalchemy.orm import Session
 
 from app.core.database import get_db
-from app.core.menu_guard import (
-    assert_strict_menu_code,
-    require_admin_or_super_admin,
-    require_strict_menu_code,
-)
+from app.core.menu_guard import require_admin_or_super_admin
 from app.core.response import error_response, success_response
 from app.crud import research_donation as rd_svc
 from app.models.models import SysUser
@@ -24,9 +20,6 @@ from app.services.sample_collect_wx_notify import (
 
 router = APIRouter(prefix="/web/admin", tags=["科研捐赠管理"])
 
-PROTOCOL_LIST_MENU = "biz:cellStorageProtocol:list"
-PROTOCOL_AUDIT_MENU = "biz:cellStorageProtocolAudit:list"
-
 
 def _get_tenant_no(db: Session, user: dict) -> str:
     user_id = user.get("user_id")
@@ -139,24 +132,8 @@ def assert_donation_sensitive_fields(
     *,
     creating: bool,
 ) -> None:
-    """防止通过普通保存接口注入状态或协议互转来源。"""
-    submitted = set(body.model_fields_set)
-    if creating:
-        status_value = str(getattr(body, "donation_status", None) or "dsx").strip()
-        source_value = str(getattr(body, "source_type", None) or "direct").strip()
-        requires_audit = (
-            status_value != "dsx"
-            or source_value != "direct"
-            or bool(getattr(body, "source_protocol_id", None))
-        )
-    else:
-        requires_audit = bool(
-            submitted.intersection(
-                {"donation_status", "source_type", "source_protocol_id"}
-            )
-        )
-    if requires_audit:
-        assert_strict_menu_code(db, user, PROTOCOL_AUDIT_MENU)
+    """保留钩子；不再校验菜单权限（与采集协议敏感字段策略对齐）。"""
+    _ = (db, user, body, creating)
 
 
 # ---------------------------------------------------------------------------
@@ -266,7 +243,7 @@ async def get_research_donation_detail(
 @router.post("/research-donations")
 async def create_research_donation(
     body: DonationCreateBody,
-    user: dict = Depends(require_strict_menu_code(PROTOCOL_LIST_MENU)),
+    user: dict = Depends(require_admin_or_super_admin),
     db: Session = Depends(get_db),
 ):
     assert_donation_sensitive_fields(db, user, body, creating=True)
@@ -311,7 +288,7 @@ async def create_research_donation(
 async def update_research_donation(
     donation_id: str,
     body: DonationUpdateBody,
-    user: dict = Depends(require_strict_menu_code(PROTOCOL_LIST_MENU)),
+    user: dict = Depends(require_admin_or_super_admin),
     db: Session = Depends(get_db),
 ):
     assert_donation_sensitive_fields(db, user, body, creating=False)

backend/app/api/sample_cert_insurance.py

@@ -6,7 +6,7 @@ from pydantic import BaseModel, ConfigDict, Field
 from sqlalchemy.orm import Session
 
 from app.core.database import get_db
-from app.core.menu_guard import require_any_menu_code, require_strict_menu_code
+from app.core.menu_guard import require_admin_or_super_admin, require_any_menu_code
 from app.core.response import error_response, success_response
 from app.core.utils import parse_datetime
 from app.crud import sample_insurance as insurance_crud
@@ -16,7 +16,7 @@ from app.models.models import BizProtocolSample, SysUser
 router = APIRouter(prefix="/web/admin", tags=["样本储存证保险"])
 
 _MENU = require_any_menu_code("cell-storage:sample-info:list")
-_WRITE_MENU = require_strict_menu_code("cell-storage:storage-cert:list")
+_WRITE_MENU = require_admin_or_super_admin
 
 
 def _get_tenant_no(db: Session, user: dict) -> str:

backend/app/crud/collection_protocol.py

@@ -2580,7 +2580,7 @@ def create_collection_protocol(
         protocol_attachments=(protocol_attachments or "").strip() or None,
         consent_form_urls=(consent_form_urls or "").strip() or None,
         health_survey_form_urls=(health_survey_form_urls or "").strip() or None,
-        register_date=(register_date or "").strip() or None,
+        register_date=_normalize_yyyymmdd_date(register_date),
         collector_user_id=(collector_user_id or "").strip() or None,
         protocol_total_amount=total_amt,
         source_presign_order_id=(source_presign_order_id or "").strip() or None,
@@ -2684,7 +2684,7 @@ def update_collection_protocol(
     if health_survey_form_urls is not None:
         obj.health_survey_form_urls = health_survey_form_urls.strip() or None
     if register_date is not None:
-        obj.register_date = register_date.strip() or None
+        obj.register_date = _normalize_yyyymmdd_date(register_date)
     if effective_time is not None:
         obj.effective_time = effective_time
     if effective_desc is not None:

backend/app/crud/research_donation.py

@@ -23,6 +23,7 @@ from app.crud.collection_protocol import (
     _load_express_name_map,
     _load_sample_type_name_map,
     _load_site_name_map,
+    _normalize_yyyymmdd_date,
 )
 from app.crud.protocol_donation_convert import (
     assert_biz_no_available,
@@ -1157,7 +1158,7 @@ def create_donation(
         donation_no=donation_no,
         monthly_verify_no=monthly_verify_no,
         donation_status=(raw.get("donation_status") or "dsx").strip(),
-        donation_date=(raw.get("donation_date") or "").strip() or None,
+        donation_date=_normalize_yyyymmdd_date(raw.get("donation_date")),
         source_type=(raw.get("source_type") or "direct").strip(),
         source_protocol_id=(raw.get("source_protocol_id") or "").strip() or None,
         consent_form_urls=consent or None,
@@ -1288,7 +1289,10 @@ def update_donation(
                 val = raw[k]
                 if val is None:
                     continue
-                setattr(obj, k, (val or "").strip() or None)
+                if k == "donation_date":
+                    setattr(obj, k, _normalize_yyyymmdd_date(val))
+                else:
+                    setattr(obj, k, (val or "").strip() or None)
     for k in _MAIN_DT_FIELDS:
         if k in raw:
             val = raw[k]

backend/app/schemas/market_mobile.py

@@ -416,6 +416,21 @@ class MarketProtocolBody(BaseModel):
         None, alias='paymentDetails'
     )
 
+    @field_validator('register_date', 'donation_date')
+    @classmethod
+    def validate_protocol_ymd(cls, value: Optional[str]) -> Optional[str]:
+        """接受 YYYYMMDD / YYYY-MM-DD，统一规范为 CHAR(8) YYYYMMDD。"""
+        if value in (None, ''):
+            return value
+        text = str(value).strip().replace('-', '').replace('/', '')
+        if len(text) != 8 or not text.isdigit():
+            raise ValueError('日期必须使用 YYYYMMDD 格式')
+        try:
+            datetime.strptime(text, '%Y%m%d')
+        except ValueError as exc:
+            raise ValueError('日期必须是有效的 YYYYMMDD') from exc
+        return text
+
 
 class MarketProtocolAuditBody(BaseModel):
     model_config = ConfigDict(extra='forbid', populate_by_name=True)

backend/app/services/market_protocol.py

@@ -46,6 +46,13 @@ from app.models.research_donation import (
     BizResearchDonationSampleTransport,
 )
 from app.schemas.market_mobile import MarketProtocolBody
+from app.services.sample_collect_wx_notify import (
+    PROTOCOL_KIND_CELL,
+    PROTOCOL_KIND_DONATION,
+    sample_codes_from_orm_rows,
+    sample_codes_from_payload,
+    schedule_sample_collect_notify,
+)
 from app.services.market_field_scope import (
     MarketFieldContext,
     apply_cell_protocol_scope,
@@ -1931,6 +1938,13 @@ def create_protocol(
             assert_cell_protocol_access(db, row.id, ctx, user_info=user_info)
             db.commit()
             db.refresh(row)
+            schedule_sample_collect_notify(
+                tenant_no=ctx.tenant_no,
+                protocol_id=row.id,
+                protocol_kind=PROTOCOL_KIND_CELL,
+                before_codes=[],
+                submitted_codes=sample_codes_from_payload(samples),
+            )
             return _cell_detail(db, row, ctx.tenant_no)
 
         if body.sample_payments:
@@ -1978,6 +1992,13 @@ def create_protocol(
         assert_donation_access(db, row.id, ctx, user_info=user_info)
         db.commit()
         db.refresh(row)
+        schedule_sample_collect_notify(
+            tenant_no=ctx.tenant_no,
+            protocol_id=row.id,
+            protocol_kind=PROTOCOL_KIND_DONATION,
+            before_codes=[],
+            submitted_codes=sample_codes_from_payload(samples),
+        )
         return _donation_detail(db, row, ctx.tenant_no)
     except Exception:
         db.rollback()
@@ -2134,6 +2155,17 @@ def update_protocol(
             )
             db.commit()
             db.refresh(row)
+            schedule_sample_collect_notify(
+                tenant_no=ctx.tenant_no,
+                protocol_id=row.id,
+                protocol_kind=PROTOCOL_KIND_CELL,
+                before_codes=sample_codes_from_orm_rows(current_samples),
+                submitted_codes=(
+                    sample_codes_from_payload(samples)
+                    if body.samples is not None
+                    else None
+                ),
+            )
             return _cell_detail(db, row, ctx.tenant_no)
 
         row = _lock_donation_access(
@@ -2215,6 +2247,17 @@ def update_protocol(
         row = assert_donation_access(db, row.id, ctx, user_info=user_info)
         db.commit()
         db.refresh(row)
+        schedule_sample_collect_notify(
+            tenant_no=ctx.tenant_no,
+            protocol_id=row.id,
+            protocol_kind=PROTOCOL_KIND_DONATION,
+            before_codes=sample_codes_from_orm_rows(current_samples),
+            submitted_codes=(
+                sample_codes_from_payload(samples)
+                if body.samples is not None
+                else None
+            ),
+        )
         return _donation_detail(db, row, ctx.tenant_no)
     except Exception:
         db.rollback()

backend/graphify-out/GRAPH_REPORT.md

@@ -1,11 +1,11 @@
 # Graph Report - app  (2026-10-26)
 
 ## Corpus Check
-- Large corpus: 317 files · ~388,611 words. Semantic extraction will be expensive (many Claude tokens). Consider running on a subfolder, or use --no-semantic to run AST-only.
+- Large corpus: 317 files · ~388,657 words. Semantic extraction will be expensive (many Claude tokens). Consider running on a subfolder, or use --no-semantic to run AST-only.
 
 ## Summary
-- 6520 nodes · 36151 edges · 46 communities detected
-- Extraction: 32% EXTRACTED · 68% INFERRED · 0% AMBIGUOUS · INFERRED: 24733 edges (avg confidence: 0.6)
+- 6522 nodes · 36161 edges · 48 communities detected
+- Extraction: 32% EXTRACTED · 68% INFERRED · 0% AMBIGUOUS · INFERRED: 24740 edges (avg confidence: 0.6)
 - Token cost: 0 input · 0 output
 
 ## Community Hubs (Navigation)
@@ -49,12 +49,14 @@
 - [[_COMMUNITY_Community 37|Community 37]]
 - [[_COMMUNITY_Community 38|Community 38]]
 - [[_COMMUNITY_Community 39|Community 39]]
-- [[_COMMUNITY_Community 42|Community 42]]
+- [[_COMMUNITY_Community 40|Community 40]]
 - [[_COMMUNITY_Community 43|Community 43]]
 - [[_COMMUNITY_Community 44|Community 44]]
 - [[_COMMUNITY_Community 45|Community 45]]
 - [[_COMMUNITY_Community 46|Community 46]]
 - [[_COMMUNITY_Community 47|Community 47]]
+- [[_COMMUNITY_Community 48|Community 48]]
+- [[_COMMUNITY_Community 51|Community 51]]
 
 ## God Nodes (most connected - your core abstractions)
 1. `success_response()` - 842 edges
@@ -71,240 +73,248 @@
 ## Surprising Connections (you probably didn't know these)
 - `统一记录 API 请求/响应出入参的中间件` --uses--> `SysApiRequestLog`  [INFERRED]
   core/api_request_log_middleware.py → models/models.py
-- `get_menu_list()` --calls--> `success_response()`  [INFERRED]
-  api/menu.py → core/response.py
 - `菜单 code 权限守卫（V0.3：通过 sys_user_role → sys_role_menu → sys_menu.perms）` --uses--> `SysUser`  [INFERRED]
   core/menu_guard.py → models/models.py
 - `运营端角色守卫：admin / super_admin 可访问。` --uses--> `SysUser`  [INFERRED]
   core/menu_guard.py → models/models.py
 - `读取用户授权的菜单权限标识集合（与前端 meta.menuCode / perms 对齐）。` --uses--> `SysUser`  [INFERRED]
   core/menu_guard.py → models/models.py
+- `接口菜单权限守卫（已统一放行 menuCode 校验，仅保留运营端登录）。` --uses--> `SysUser`  [INFERRED]
+  core/menu_guard.py → models/models.py
 
 ## Communities
 
 ### Community 0 - "Community 0"
 Cohesion: 0.01
-Nodes (1216): create_dept(), create_dict_data(), create_dict_type(), create_express_company(), create_item_unit(), create_menu(), create_post(), create_role_management() (+1208 more)
+Nodes (1156): _assert_user_tenant_access(), attachment_download_url(), create_dept(), create_dict_data(), create_dict_type(), create_express_company(), create_item_unit(), create_menu() (+1148 more)
 
 ### Community 1 - "Community 1"
 Cohesion: 0.01
-Nodes (783): validate_ymd(), BaseSettings, Config, secret_key_must_be_strong(), Settings, format_date(), generate_uuid(), allocate_next_biz_no() (+775 more)
+Nodes (766): _save_sample_payments(), BaseSettings, Config, secret_key_must_be_strong(), Settings, generate_uuid(), allocate_next_biz_no(), _allocate_sqlite_sequence() (+758 more)
 
 ### Community 2 - "Community 2"
-Cohesion: 0.01
-Nodes (678): GarmentBatchDeleteBody, GarmentBatchDiscardBody, GarmentCreateBody, GarmentDiscardBody, GarmentUpdateBody, SterilizeLogBatchBody, SterilizeLogCreateBody, SterilizeLogUpdateBody (+670 more)
+Cohesion: 0.04
+Nodes (797): CellSampleTypeCreateBody, CellSampleTypeUpdateBody, CollectionRegionCreateBody, CollectionRegionUpdateBody, CustomerCreateBody, CustomerUpdateBody, HospitalCreateBody, HospitalUpdateBody (+789 more)
 
 ### Community 3 - "Community 3"
-Cohesion: 0.05
-Nodes (549): CellSampleTypeCreateBody, CellSampleTypeUpdateBody, CollectionRegionCreateBody, CollectionRegionUpdateBody, CustomerCreateBody, CustomerUpdateBody, HospitalCreateBody, HospitalUpdateBody (+541 more)
+Cohesion: 0.01
+Nodes (730): AttachmentDownloadUrlBody, DeptCreateBody, DeptUpdateBody, DictDataCreateBody, DictDataUpdateBody, DictTypeCreateBody, DictTypeUpdateBody, ExpressCompanyCreateBody (+722 more)
 
 ### Community 4 - "Community 4"
 Cohesion: 0.01
-Nodes (440): _assert_user_tenant_access(), attachment_download_url(), AttachmentDownloadUrlBody, delete_user(), DeptCreateBody, DeptUpdateBody, dict_data_options(), DictDataCreateBody (+432 more)
+Nodes (451): _normalize_date_bound(), assert_protocol_sensitive_fields(), _attach_handler_name(), complete_protocol_invoice_request(), create_collection_protocol(), delete_collection_protocol(), _draft_fields_from_body(), get_collection_protocol_detail() (+443 more)
 
 ### Community 5 - "Community 5"
-Cohesion: 0.01
-Nodes (382): _normalize_date_bound(), _persist_protocol_sub_resources(), list_ethnics_for_select(), _leave_local_callback(), apply_data_scope(), _get_child_dept_ids(), 数据权限过滤（V0.3：基于角色 data_scope 的查询级行级过滤）  data_scope 值：   1 = 全部数据   2 = 本部门数据   3, 根据用户角色的数据权限过滤查询。      Args:         query: SQLAlchemy query 对象         model: 查询 (+374 more)
+Cohesion: 0.02
+Nodes (326): 截止日期：仅日期时扩到当天 23:59:59。, 发起前预览审批链（条件齐后解析最终路径与审批人）。, 兼容旧 GET：无 formData，含条件分支时多为待确定占位。, _app_to_dict(), _copied_app_name(), copy_app(), create_app(), _create_version() (+318 more)
 
 ### Community 6 - "Community 6"
-Cohesion: 0.01
-Nodes (376): eq_unicode(), like_unicode(), MySQL 字符串比较/模糊匹配时统一排序规则，避免 Illegal mix of collations。, 跨表字符串等值比较（JOIN / WHERE）时统一为 utf8mb4_unicode_ci。, 将列显式设为 utf8mb4_unicode_ci。, unicode_ci(), _lookup_attachment_by_url(), lookup_attachments_by_urls() (+368 more)
+Cohesion: 0.02
+Nodes (276): eq_unicode(), like_unicode(), MySQL 字符串比较/模糊匹配时统一排序规则，避免 Illegal mix of collations。, 跨表字符串等值比较（JOIN / WHERE）时统一为 utf8mb4_unicode_ci。, 将列显式设为 utf8mb4_unicode_ci。, unicode_ci(), 解析科研捐赠质检列表的协议状态筛选语义。      Returns:         ("in", statuses) — 按所选状态 IN 过滤, resolve_research_donation_protocol_status_filter() (+268 more)
 
 ### Community 7 - "Community 7"
-Cohesion: 0.06
-Nodes (322): AuditCreateBody, BatchDetailIdsBody, BatchRefundFinanceSubmitBody, FinanceConfirmBody, FullmoonHandleBody, FullmoonTodoInsuranceBody, InvoiceRequestCompleteBody, InvoiceRequestCreateBody (+314 more)
+Cohesion: 0.02
+Nodes (170): _register_attachment_routes(), _register_freight_routes(), _register_payment_routes(), _register_presign_routes(), _register_protocol_routes(), 小程序鉴权：微信登录 / 绑定 openid。, 当前用户是否已绑定微信服务号 openid。, 服务号网页授权 code 绑定当前用户（需 Bearer）。 (+162 more)
 
 ### Community 8 - "Community 8"
-Cohesion: 0.01
-Nodes (201): 小程序鉴权：微信登录 / 绑定 openid。, 当前用户是否已绑定微信服务号 openid。, 服务号网页授权 code 绑定当前用户（需 Bearer）。, 微信登录：openid 已绑定时可静默换票；否则须授权手机号且与账号 phone_no 一致。, 密码登录后绑定当前微信 openid（需 Bearer）。, web_qr_confirm(), web_qr_scanned(), 公共接口（Web 登录、刷新 Token、登出；用户模型对齐 docs/sql/zkxw.sql 基线） (+193 more)
+Cohesion: 0.02
+Nodes (150): get_protocol_nos_used_in_protocols(), get_sample_codes_used_in_protocol_samples(), _cell_row_to_dict(), _enrich_cell_dicts_with_live_status(), _find_outbound_cell_row(), _find_outbound_qc_material_row(), _fmt_dt(), get_outbound_material() (+142 more)
 
 ### Community 9 - "Community 9"
 Cohesion: 0.03
-Nodes (146): assert_protocol_status_transition(), format_protocol_status_label(), 解析科研捐赠质检列表的协议状态筛选语义。      Returns:         ("in", statuses) — 按所选状态 IN 过滤, 状态流转被拒绝时的提示，状态码展示为中文名称。, resolve_research_donation_protocol_status_filter(), resolve_void_type_label(), status_transition_denied_message(), _ancestor_link_from_cell_product_input() (+138 more)
+Nodes (156): assert_protocol_status_transition(), build_void_type_label_map(), format_protocol_status_label(), 状态流转被拒绝时的提示，状态码展示为中文名称。, resolve_void_type_label(), status_transition_denied_message(), _ancestor_link_from_cell_product_input(), _ancestor_sample_chain_link() (+148 more)
 
 ### Community 10 - "Community 10"
-Cohesion: 0.03
-Nodes (124): _save_sample_payments(), get_protocol_nos_used_in_protocols(), _cell_row_to_dict(), _enrich_cell_dicts_with_live_status(), _find_outbound_cell_row(), _find_outbound_qc_material_row(), _fmt_dt(), get_outbound_material() (+116 more)
+Cohesion: 0.04
+Nodes (130): _batch_line_to_dict(), _unused_amount(), _unused_line_to_dict(), _batch_map_for_prep_lines(), cancel_prep(), complete_prep(), _create_auto_stock_out(), create_prep() (+122 more)
 
 ### Community 11 - "Community 11"
 Cohesion: 0.05
-Nodes (114): AccessLogCreateBody, AccessLogUpdateBody, CleanRoomCreateBody, CleanRoomUpdateBody, ExhibitionAppointmentCreateBody, ExhibitionAppointmentUpdateBody, OccupancyCreateBody, 运营支撑 API（洁净室、进出记录、仓储设施、储位、展厅预约） (+106 more)
+Nodes (113): AccessLogCreateBody, AccessLogUpdateBody, CleanRoomCreateBody, CleanRoomUpdateBody, ExhibitionAppointmentCreateBody, ExhibitionAppointmentUpdateBody, list_storage_slot_stats(), OccupancyCreateBody (+105 more)
 
 ### Community 12 - "Community 12"
-Cohesion: 0.04
-Nodes (104): _apply_submit_receipt(), auto_create_payment(), batch_submit_receipt(), batch_submit_refund(), confirm_refund(), _enrich_payment(), _get_or_raise(), get_payment_by_schedule() (+96 more)
+Cohesion: 0.03
+Nodes (98): get_customer_service_dict(), _get_tenant_no(), _get_current_user_id(), get_sample_insurance(), get_sample_storage_cert(), _get_tenant_no(), put_sample_insurance(), put_sample_storage_cert() (+90 more)
 
 ### Community 13 - "Community 13"
-Cohesion: 0.05
-Nodes (98): deduct_for_step(), _display_remark(), list_stock_logs(), _parse_receiver_purpose_from_remark(), 耗材变动记录 CRUD（biz_consumable_stock_log）, 撤销步骤此前 step_save 扣减，便于重新填报。, 扣减耗材库存并生成变动记录。调用方控制事务，本函数不 commit。, _resolve_receiver_purpose() (+90 more)
+Cohesion: 0.04
+Nodes (100): _lookup_attachment_by_url(), _normalize_attachment_url_key(), urls_to_attachment_list(), _apply_qc_status_filter(), _base_query(), _derive_qc_conclusion(), _ensure_notification(), _eq_ci() (+92 more)
 
 ### Community 14 - "Community 14"
-Cohesion: 0.04
-Nodes (80): _register_attachment_routes(), _register_freight_routes(), _register_payment_routes(), _register_presign_routes(), _register_protocol_routes(), _collect_descendants(), _find_mobile_root(), list_mobile_menu_items() (+72 more)
+Cohesion: 0.05
+Nodes (99): deduct_for_step(), _display_remark(), list_stock_logs(), _parse_receiver_purpose_from_remark(), 耗材变动记录 CRUD（biz_consumable_stock_log）, 撤销步骤此前 step_save 扣减，便于重新填报。, 扣减耗材库存并生成变动记录。调用方控制事务，本函数不 commit。, _resolve_receiver_purpose() (+91 more)
 
 ### Community 15 - "Community 15"
-Cohesion: 0.06
-Nodes (67): _get_current_user_id(), get_sample_insurance(), get_sample_storage_cert(), _get_tenant_no(), put_sample_insurance(), put_sample_storage_cert(), _resolve_protocol_id(), _fmt_dt() (+59 more)
+Cohesion: 0.05
+Nodes (74): _fmt_dt(), get_handover_by_schedule(), get_outbound_handover(), get_outbound_handover_view(), _handover_row_to_dict(), _handover_view_dict(), _parse_handover_time(), 供输注计划 detail 聚合的交接只读信息。 (+66 more)
 
 ### Community 16 - "Community 16"
-Cohesion: 0.08
-Nodes (64): add_transfer(), assert_presign_convertible(), confirm_receipt(), confirmed_deposit_amount(), confirmed_deposit_amount_map(), convert_to_protocol(), create_presign_order(), _dec() (+56 more)
+Cohesion: 0.22
+Nodes (74): create_delivery(), _deduct_fee_on_delivery(), delete_delivery_material(), _generate_delivery_no(), get_delivery_by_schedule(), get_delivery_method(), list_deliveries_by_application(), list_delivery_materials() (+66 more)
 
 ### Community 17 - "Community 17"
-Cohesion: 0.06
-Nodes (45): get_designer_data(), list_results_by_task(), _list_saved_results_by_task(), list_saved_results_by_task_ids(), _merge_saved_into_template(), _resolve_task_item_ref(), _row_to_dict(), save_results_for_task() (+37 more)
+Cohesion: 0.05
+Nodes (57): _error_json(), lifespan(), 未捕获异常：统一 JSON 500，确保跨域场景下仍有 Access-Control-Allow-Origin, 数据库异常：返回 JSON 并保留 CORS 头，避免浏览器只报跨域错误, sqlalchemy_exception_handler(), unhandled_exception_handler(), BaseHTTPMiddleware, ApiCryptoError (+49 more)
 
 ### Community 18 - "Community 18"
+Cohesion: 0.06
+Nodes (44): get_designer_data(), list_params_by_item(), _parse_options_list(), _row_to_dict(), save_params_for_item(), _validate_param(), list_results_by_task(), _list_saved_results_by_task() (+36 more)
+
+### Community 19 - "Community 19"
+Cohesion: 0.12
+Nodes (29): _assert_routes_exist(), collect_missing_route_ids(), collect_route_ids_without_steps(), create_set(), create_set_from_work_order(), create_tasks_from_set(), delete_set(), get_set() (+21 more)
+
+### Community 20 - "Community 20"
 Cohesion: 0.12
 Nodes (11): get_wechat_pay_client(), get_wechat_pay_v2(), 微信支付工具模块  支持微信支付 V3 API 文档参考: https://pay.weixin.qq.com/docs/v3/apis/index.ht, 统一下单接口 (V3)          Args:             out_trade_no: 商户订单号             total, 申请退款          Args:             out_trade_no: 商户订单号             total_amount, 小程序调起支付的二次签名参数（与公众号 JSAPI 规则一致）, 统一下单 (V2 API)          Args:             out_trade_no: 商户订单号             tot, 生成签名 V3 (SHA256 with RSA) (+3 more)
 
-### Community 19 - "Community 19"
-Cohesion: 0.19
-Nodes (27): _amount_for_row(), _batch_map(), deduct_for_task(), _deduct_task_usage_legacy_batch(), _display_remark(), _fmt_date_val(), _linked_qc_task_no_map(), list_linked_task_usages() (+19 more)
+### Community 21 - "Community 21"
+Cohesion: 0.14
+Nodes (22): 验证密码（哈希非 bcrypt 或损坏时返回 False，避免抛错）, verify_password(), _attach_user_relations(), change_password(), create_user(), _empty_user_relation_fields(), enrich_user_dicts_with_relations(), get_user() (+14 more)
 
-### Community 20 - "Community 20"
+### Community 22 - "Community 22"
 Cohesion: 0.17
 Nodes (23): apply_overtime_kit_hours(), _build_rest_day_segments(), _build_workday_windows(), calc_overtime_hours(), _day_at_minutes(), _day_start_ms(), _extract_rules(), _format_ymd() (+15 more)
 
-### Community 21 - "Community 21"
-Cohesion: 0.12
-Nodes (18): get_customer_service_dict(), _get_tenant_no(), ensure_dict_value(), list_dict_values(), _format_date(), _format_datetime(), get_by_sample_code(), _row_field_dict() (+10 more)
+### Community 23 - "Community 23"
+Cohesion: 0.17
+Nodes (12): BusinessException, InvalidStatusTransitionException, log_delivery_operation(), log_operation(), log_order_operation(), log_settlement_operation(), log_user_operation(), OrderLockedException (+4 more)
 
-### Community 22 - "Community 22"
+### Community 24 - "Community 24"
 Cohesion: 0.21
 Nodes (19): _consumable_row_to_dict(), create_process(), _create_sub_consumable(), _create_sub_data_collection(), _create_sub_output(), _create_sub_reagent(), _data_collection_row_to_dict(), get_process() (+11 more)
 
-### Community 23 - "Community 23"
+### Community 25 - "Community 25"
 Cohesion: 0.2
 Nodes (19): _code_exists(), create_material(), _dec(), _fmt_dt(), get_material(), get_material_entity(), get_my_usages(), _is_enabled_status() (+11 more)
 
-### Community 24 - "Community 24"
-Cohesion: 0.22
-Nodes (15): apply_trip_kit_days(), calc_trip_leg_days(), _day_index(), _end_offset(), _extract_rules(), is_half_day_multiple(), 出差套件：半日制行程时长（与前端 oa-trip-days.ts 对齐）, 遍历 tripKit：行程未手改则覆盖 duration；出差天数未手改则覆盖为各行程时长之和。 (+7 more)
-
-### Community 25 - "Community 25"
-Cohesion: 0.24
-Nodes (9): 微信消息通知服务  支持微信小程序模板消息推送  使用方式:     from app.core.wechat_message import Wech, 发送模板消息                  Args:             openid: 用户openid             templ, send_delivery_notice(), send_delivery_warning(), send_order_status(), send_payment_success(), send_refund_result(), send_urge_notification() (+1 more)
-
 ### Community 26 - "Community 26"
-Cohesion: 0.29
-Nodes (11): get_detail(), _load_sample_context(), _row_to_dict(), upsert(), dumps_payload(), empty_detail(), loads_payload(), normalize_payload() (+3 more)
+Cohesion: 0.19
+Nodes (18): _field_label(), _is_non_empty_str(), _is_required(), _is_valid_receive_account_item(), normalize_account_fields(), _pick(), _pick_order_num(), _pick_str() (+10 more)
 
 ### Community 27 - "Community 27"
+Cohesion: 0.19
+Nodes (17): apply_trip_kit_days(), calc_trip_leg_days(), _day_index(), _end_offset(), _extract_rules(), is_half_day_multiple(), _kit_trip_fields(), 出差套件：半日制行程时长（与前端 oa-trip-days.ts 对齐） (+9 more)
+
+### Community 28 - "Community 28"
 Cohesion: 0.32
 Nodes (12): _attach_owner_names(), create_account(), _filtered_query(), get_account(), list_accounts(), list_options(), _owner_name_map(), OA 收款账户 CRUD（oa_receive_account） (+4 more)
 
-### Community 28 - "Community 28"
+### Community 29 - "Community 29"
+Cohesion: 0.29
+Nodes (11): get_detail(), _load_sample_context(), _row_to_dict(), upsert(), dumps_payload(), empty_detail(), loads_payload(), normalize_payload() (+3 more)
+
+### Community 30 - "Community 30"
 Cohesion: 0.24
 Nodes (11): deduct_for_step(), _display_remark(), list_stock_logs(), _parse_receiver_purpose_from_remark(), 试剂变动记录 CRUD（biz_reagent_stock_log）, 撤销步骤此前 step_save 扣减，便于重新填报。, 扣减试剂库存并生成变动记录。调用方控制事务，本函数不 commit。, _resolve_receiver_purpose() (+3 more)
 
-### Community 29 - "Community 29"
-Cohesion: 0.29
-Nodes (11): _is_empty(), _is_required(), _parse_money(), OA 表单设计器：金额控件 form_data 校验, 校验 form_data 中金额控件的值格式，返回中文错误列表（空表示通过）。, 解析金额值。成功返回 (number, None)；失败返回 (None, error_key)。, _rule_props(), _schema_rules() (+3 more)
-
-### Community 30 - "Community 30"
+### Community 31 - "Community 31"
 Cohesion: 0.31
 Nodes (10): _build_tree(), _cascade_soft_delete(), _collect_with_ancestors(), get_dept(), list_depts(), list_depts_tree(), 保留匹配节点及其全部上级，供关键词检索后仍能正确组树。, _row_to_dict() (+2 more)
 
-### Community 31 - "Community 31"
+### Community 32 - "Community 32"
 Cohesion: 0.29
 Nodes (2): BaseModel, SoftDeleteModel
 
-### Community 32 - "Community 32"
+### Community 33 - "Community 33"
+Cohesion: 0.46
+Nodes (7): _dec(), _due_date(), 未作废期：应缴金额与应缴时间必填（分期场景由调用方 require_fields=True）。, 未作废期 dueAmount 合计须等于合同金额。     require_schedule_fields=True 时先校验每期金额与应缴日必填。     返, schedule_dues_match_contract(), schedule_required_fields_ok(), _status()
+
+### Community 34 - "Community 34"
 Cohesion: 0.38
 Nodes (6): derive_legacy_status_from_three(), derive_three_status_from_legacy(), 阶段A兼容：从旧 status 推导三字段。     约束：旧 status 本身混合了支付/配送/订单生命周期，因此只能尽力推断；     若业务侧已有更精确, 阶段A兼容：从三字段反推旧 status（用于旧前端/旧筛选参数兼容）。, ThreeStatus, _to_decimal()
 
-### Community 33 - "Community 33"
+### Community 35 - "Community 35"
 Cohesion: 0.4
 Nodes (5): batch_matches_stock_status(), normalize_batch_stock_status(), 质检物料入库批次：按剩余数量过滤的语义辅助。, 纯函数判定（供单测）；list_batches 用 SQL 等价条件。, 返回 'available' | 'exhausted'；全部 / 空 / 非法 → None（不加剩余数量条件）。
 
-### Community 34 - "Community 34"
+### Community 36 - "Community 36"
 Cohesion: 0.5
 Nodes (2): _auto_fill_create_dept_id(), ORM before_insert 钩子：当 create_dept_id 为空时，自动从请求上下文填充当前用户部门 ID
 
-### Community 35 - "Community 35"
-Cohesion: 0.67
-Nodes (2): get_menu_list(), 运营端菜单接口（与 web-admin 前端静态路由 sqxp.ts 对齐，5 个一级菜单分组）
-
-### Community 36 - "Community 36"
+### Community 37 - "Community 37"
 Cohesion: 0.67
 Nodes (1): 转正套件：入职日 + 试用期月数 → 建议转正日（YYYY-MM-DD）。
 
-### Community 37 - "Community 37"
+### Community 38 - "Community 38"
 Cohesion: 1.0
 Nodes (1): 质检物料金额查看授权：专用角色与菜单权限常量。
 
-### Community 38 - "Community 38"
+### Community 39 - "Community 39"
 Cohesion: 1.0
 Nodes (1): 请求级别的用户上下文变量  通过 contextvars 在请求处理链路中传递当前用户信息， 供 SQLAlchemy 事件监听器等底层机制使用，避免逐层手动传
 
-### Community 39 - "Community 39"
+### Community 40 - "Community 40"
 Cohesion: 1.0
 Nodes (1): API 路由包（骨架：公共鉴权 + 静态菜单 + 运营端占位）
 
-### Community 42 - "Community 42"
+### Community 43 - "Community 43"
 Cohesion: 1.0
 Nodes (1): 发送订单状态通知                  Args:             openid: 用户openid             ord
 
-### Community 43 - "Community 43"
+### Community 44 - "Community 44"
 Cohesion: 1.0
 Nodes (1): 发送支付成功通知                  Args:             openid: 用户openid             ord
 
-### Community 44 - "Community 44"
+### Community 45 - "Community 45"
 Cohesion: 1.0
 Nodes (1): 发送配送通知                  Args:             openid: 配送员openid             task
 
-### Community 45 - "Community 45"
+### Community 46 - "Community 46"
 Cohesion: 1.0
 Nodes (1): 发送配送时效预警                  Args:             openid: 配送员openid             ta
 
-### Community 46 - "Community 46"
+### Community 47 - "Community 47"
 Cohesion: 1.0
 Nodes (1): 发送退款结果通知                  Args:             openid: 用户openid             ord
 
-### Community 47 - "Community 47"
+### Community 48 - "Community 48"
 Cohesion: 1.0
 Nodes (1): 发送催单通知给配送员                  Args:             deliver_openid: 配送员openid
 
+### Community 51 - "Community 51"
+Cohesion: 1.0
+Nodes (1): 接受 YYYYMMDD / YYYY-MM-DD，统一规范为 CHAR(8) YYYYMMDD。
+
 ## Knowledge Gaps
-- **209 isolated node(s):** `刷新会话 TTL（refreshToken 续期；已登录用户每次 API 校验通过后滑动续期）`, `写入 refreshToken（用于 one-time 使用/吊销）`, `根据 token 获取当前用户（包含 Redis 会话校验；会话滑动续期）`, `严格判断当前租户用户是否拥有指定移动市场权限码。`, `为移动市场 API 提供租户化、精确匹配的菜单权限依赖。` (+204 more)
+- **210 isolated node(s):** `刷新会话 TTL（refreshToken 续期；已登录用户每次 API 校验通过后滑动续期）`, `写入 refreshToken（用于 one-time 使用/吊销）`, `根据 token 获取当前用户（包含 Redis 会话校验；会话滑动续期）`, `严格判断当前租户用户是否拥有指定移动市场权限码。`, `为移动市场 API 提供租户化、精确匹配的菜单权限依赖。` (+205 more)
   These have ≤1 connection - possible missing edges or undocumented components.
-- **Thin community `Community 31`** (8 nodes): `BaseModel`, `.to_dict()`, `get_active()`, `base.py`, `SoftDeleteModel`, `.restore()`, `.soft_delete()`, `__tablename__()`
+- **Thin community `Community 32`** (8 nodes): `BaseModel`, `.to_dict()`, `get_active()`, `base.py`, `SoftDeleteModel`, `.restore()`, `.soft_delete()`, `__tablename__()`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 34`** (4 nodes): `_auto_fill_create_dept_id()`, `get_db()`, `database.py`, `ORM before_insert 钩子：当 create_dept_id 为空时，自动从请求上下文填充当前用户部门 ID`
+- **Thin community `Community 36`** (4 nodes): `_auto_fill_create_dept_id()`, `get_db()`, `database.py`, `ORM before_insert 钩子：当 create_dept_id 为空时，自动从请求上下文填充当前用户部门 ID`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 35`** (3 nodes): `get_menu_list()`, `menu.py`, `运营端菜单接口（与 web-admin 前端静态路由 sqxp.ts 对齐，5 个一级菜单分组）`
+- **Thin community `Community 37`** (3 nodes): `add_months_ymd()`, `oa_confirmation_date.py`, `转正套件：入职日 + 试用期月数 → 建议转正日（YYYY-MM-DD）。`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 36`** (3 nodes): `add_months_ymd()`, `oa_confirmation_date.py`, `转正套件：入职日 + 试用期月数 → 建议转正日（YYYY-MM-DD）。`
+- **Thin community `Community 38`** (2 nodes): `qc_material_amount_auth_constants.py`, `质检物料金额查看授权：专用角色与菜单权限常量。`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 37`** (2 nodes): `qc_material_amount_auth_constants.py`, `质检物料金额查看授权：专用角色与菜单权限常量。`
+- **Thin community `Community 39`** (2 nodes): `context.py`, `请求级别的用户上下文变量  通过 contextvars 在请求处理链路中传递当前用户信息， 供 SQLAlchemy 事件监听器等底层机制使用，避免逐层手动传`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 38`** (2 nodes): `context.py`, `请求级别的用户上下文变量  通过 contextvars 在请求处理链路中传递当前用户信息， 供 SQLAlchemy 事件监听器等底层机制使用，避免逐层手动传`
+- **Thin community `Community 40`** (2 nodes): `__init__.py`, `API 路由包（骨架：公共鉴权 + 静态菜单 + 运营端占位）`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 39`** (2 nodes): `__init__.py`, `API 路由包（骨架：公共鉴权 + 静态菜单 + 运营端占位）`
+- **Thin community `Community 43`** (1 nodes): `发送订单状态通知                  Args:             openid: 用户openid             ord`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 42`** (1 nodes): `发送订单状态通知                  Args:             openid: 用户openid             ord`
+- **Thin community `Community 44`** (1 nodes): `发送支付成功通知                  Args:             openid: 用户openid             ord`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 43`** (1 nodes): `发送支付成功通知                  Args:             openid: 用户openid             ord`
+- **Thin community `Community 45`** (1 nodes): `发送配送通知                  Args:             openid: 配送员openid             task`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 44`** (1 nodes): `发送配送通知                  Args:             openid: 配送员openid             task`
+- **Thin community `Community 46`** (1 nodes): `发送配送时效预警                  Args:             openid: 配送员openid             ta`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 45`** (1 nodes): `发送配送时效预警                  Args:             openid: 配送员openid             ta`
+- **Thin community `Community 47`** (1 nodes): `发送退款结果通知                  Args:             openid: 用户openid             ord`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 46`** (1 nodes): `发送退款结果通知                  Args:             openid: 用户openid             ord`
+- **Thin community `Community 48`** (1 nodes): `发送催单通知给配送员                  Args:             deliver_openid: 配送员openid`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
-- **Thin community `Community 47`** (1 nodes): `发送催单通知给配送员                  Args:             deliver_openid: 配送员openid`
+- **Thin community `Community 51`** (1 nodes): `接受 YYYYMMDD / YYYY-MM-DD，统一规范为 CHAR(8) YYYYMMDD。`
   Too small to be a meaningful cluster - may be noise or needs more connections extracted.
 
 ## Suggested Questions
 _Questions this graph is uniquely positioned to answer:_
 
-- **Why does `SysUser` connect `Community 2` to `Community 1`, `Community 3`, `Community 4`, `Community 5`, `Community 6`, `Community 7`, `Community 8`, `Community 11`, `Community 12`, `Community 13`, `Community 14`, `Community 15`, `Community 17`, `Community 27`, `Community 28`?**
-  _High betweenness centrality (0.118) - this node is a cross-community bridge._
-- **Why does `generate_uuid()` connect `Community 1` to `Community 0`, `Community 3`, `Community 4`, `Community 5`, `Community 6`, `Community 7`, `Community 9`, `Community 10`, `Community 11`, `Community 12`, `Community 13`, `Community 14`, `Community 15`, `Community 16`, `Community 17`, `Community 19`, `Community 21`, `Community 22`, `Community 23`, `Community 26`, `Community 27`, `Community 28`?**
-  _High betweenness centrality (0.031) - this node is a cross-community bridge._
-- **Why does `OaEngineError` connect `Community 4` to `Community 0`, `Community 1`, `Community 2`?**
-  _High betweenness centrality (0.031) - this node is a cross-community bridge._
+- **Why does `SysUser` connect `Community 3` to `Community 0`, `Community 1`, `Community 2`, `Community 4`, `Community 5`, `Community 7`, `Community 10`, `Community 11`, `Community 12`, `Community 14`, `Community 15`, `Community 16`, `Community 18`, `Community 21`, `Community 28`, `Community 30`?**
+  _High betweenness centrality (0.125) - this node is a cross-community bridge._
+- **Why does `success_response()` connect `Community 0` to `Community 3`, `Community 4`, `Community 7`, `Community 11`, `Community 12`, `Community 18`?**
+  _High betweenness centrality (0.047) - this node is a cross-community bridge._
+- **Why does `OaEngineError` connect `Community 5` to `Community 0`, `Community 1`, `Community 3`?**
+  _High betweenness centrality (0.035) - this node is a cross-community bridge._
 - **Are the 1201 inferred relationships involving `str` (e.g. with `unhandled_exception_handler()` and `get_current_user_by_token()`) actually correct?**
   _`str` has 1201 INFERRED edges - model-reasoned connections that need verification._
 - **Are the 841 inferred relationships involving `success_response()` (e.g. with `list_storage_release_reviews()` and `get_storage_release_review_detail()`) actually correct?**

backend/graphify-out/manifest.json

@@ -64,7 +64,7 @@
   "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/inquiry.py": 1778578258.095357,
   "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/order.py": 1778578258.0960286,
   "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/__init__.py": 1781502992.2721803,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/market_mobile.py": 1792578205.3646982,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/market_mobile.py": 1792995664.0257761,
   "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/order_adjust.py": 1778578258.0963318,
   "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/cell_product.py": 1782711015.11309,
   "/Users/wuzilong/work/00code/zkxw/backend/app/schemas/menu.py": 1778578258.0957444,
@@ -116,7 +116,7 @@
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/sample_production_reception.py": 1788159570.8985534,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/reagent.py": 1779512669.9847593,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/qc_inbound_lab_storage_sort.py": 1786959444.2857325,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/crud/collection_protocol.py": 1792983363.240947,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/crud/collection_protocol.py": 1792995679.137445,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/cleanroom_garment.py": 1782264452.4901433,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/temp_qc_target.py": 1787193516.0555077,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/qc_material_usage.py": 1783428516.0973594,
@@ -158,7 +158,7 @@
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/site.py": 1781401290.6845422,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/api_request_log.py": 1778578258.0614743,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/dict_data.py": 1782893595.9312406,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/crud/research_donation.py": 1792981510.4123862,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/crud/research_donation.py": 1792995655.626911,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/qc_material_stock_in_no.py": 1787114586.3799527,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/ethnic.py": 1779265849.547566,
   "/Users/wuzilong/work/00code/zkxw/backend/app/crud/sample_freight.py": 1792579247.5842276,
@@ -216,7 +216,7 @@
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/collection_protocol.py": 1792983395.8769655,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/cleanroom_garment.py": 1781347256.2326367,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/basic_info.py": 1791454077.2373106,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/api/presign_order.py": 1792079421.3688679,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/api/presign_order.py": 1793001629.236552,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/pilot_infusion_confirm.py": 1779657043.1389203,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/pilot_infusion_schedule_mgmt.py": 1779940938.18027,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/__init__.py": 1792634972.2299473,
@@ -232,10 +232,10 @@
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/operations.py": 1785213144.2881503,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/menu.py": 1792580899.7326677,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/pilot_delivery.py": 1779655584.820777,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/api/sample_cert_insurance.py": 1791912978.5275548,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/api/sample_cert_insurance.py": 1793001635.2987237,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/admin.py": 1790217215.444356,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/env_detect.py": 1786945487.513935,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/api/research_donation.py": 1792720970.884106,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/api/research_donation.py": 1793001640.0574386,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/ethnic.py": 1779266243.9511197,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/sample_freight.py": 1792580031.1094093,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/pilot_checkup.py": 1779935751.2658868,
@@ -249,7 +249,7 @@
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/insurance_company.py": 1781410837.9443986,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/production.py": 1788234236.5398064,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/protocol_sample_collection.py": 1792377889.4818213,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/api/protocol_sample_payment.py": 1791913783.0750406,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/api/protocol_sample_payment.py": 1793001632.8994496,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/leave.py": 1790217143.1910717,
   "/Users/wuzilong/work/00code/zkxw/backend/app/api/clinical_payment.py": 1781750841.074568,
   "/Users/wuzilong/work/00code/zkxw/backend/app/services/oa_engine.py": 1792722281.2525048,
@@ -297,7 +297,7 @@
   "/Users/wuzilong/work/00code/zkxw/backend/app/services/market_support.py": 1792574711.417624,
   "/Users/wuzilong/work/00code/zkxw/backend/app/services/oa_assignee.py": 1790665524.6969597,
   "/Users/wuzilong/work/00code/zkxw/backend/app/services/wechat_login_service.py": 1786615952.6840453,
-  "/Users/wuzilong/work/00code/zkxw/backend/app/services/market_protocol.py": 1792983397.087853,
+  "/Users/wuzilong/work/00code/zkxw/backend/app/services/market_protocol.py": 1793001267.3348439,
   "/Users/wuzilong/work/00code/zkxw/backend/app/services/market_field_scope.py": 1791651783.1531875,
   "/Users/wuzilong/work/00code/zkxw/backend/app/services/sample_code_correction.py": 1792634957.0385876,
   "/Users/wuzilong/work/00code/zkxw/backend/app/services/customer_relations.py": 1791383150.5354238,

backend/tests/test_market_protocol_api.py

@@ -608,6 +608,115 @@ def test_specialist_donation_create_forces_current_users_and_has_no_payment_sect
     assert 'payment' not in result
 
 
+def test_mobile_create_schedules_sample_collect_wx_notify_for_cell_and_donation():
+    from app.services.market_protocol import create_protocol
+
+    db_cell = _session()
+    _masters(db_cell)
+    with patch(
+        'app.services.market_protocol.schedule_sample_collect_notify'
+    ) as schedule_cell:
+        cell = create_protocol(
+            db_cell, body=_body(), ctx=_ctx('specialist'), user_info=_user()
+        )
+    cell_kw = schedule_cell.call_args.kwargs
+    assert cell_kw['tenant_no'] == 'tenant-a'
+    assert cell_kw['protocol_id'] == cell['basic']['id']
+    assert cell_kw['protocol_kind'] == 'cell_storage'
+    assert cell_kw['before_codes'] == []
+    assert 'S-001' in cell_kw['submitted_codes']
+
+    db_don = _session()
+    _masters(db_don)
+    with patch(
+        'app.services.market_protocol.schedule_sample_collect_notify'
+    ) as schedule_don:
+        donation = create_protocol(
+            db_don,
+            body=_body(
+                'research_donation',
+                donationNo='D-NOTIFY',
+                protocolNo=None,
+                samples=[
+                    {
+                        'sampleTypeId': 'type-a',
+                        'unitId': 'unit-a',
+                        'collectAmount': 10,
+                    }
+                ],
+            ),
+            ctx=_ctx('specialist'),
+            user_info=_user(),
+        )
+    don_kw = schedule_don.call_args.kwargs
+    assert don_kw['protocol_id'] == donation['basic']['id']
+    assert don_kw['protocol_kind'] == 'research_donation'
+    assert don_kw['before_codes'] == []
+    assert don_kw['submitted_codes']
+
+
+def test_mobile_update_schedules_notify_only_when_samples_submitted():
+    from app.schemas.market_mobile import MarketProtocolBody
+    from app.services.market_protocol import create_protocol, update_protocol
+
+    db = _session()
+    _masters(db)
+
+    with patch(
+        'app.services.market_protocol.schedule_sample_collect_notify'
+    ):
+        created = create_protocol(
+            db, body=_body(), ctx=_ctx('specialist'), user_info=_user()
+        )
+    protocol_id = created['basic']['id']
+
+    with patch(
+        'app.services.market_protocol.schedule_sample_collect_notify'
+    ) as schedule:
+        update_protocol(
+            db,
+            source='cell_storage',
+            protocol_id=protocol_id,
+            body=MarketProtocolBody.model_validate(
+                {'source': 'cell_storage', 'remark': '仅改备注'}
+            ),
+            ctx=_ctx('specialist'),
+            user_info=_user(),
+        )
+        update_protocol(
+            db,
+            source='cell_storage',
+            protocol_id=protocol_id,
+            body=_body(
+                samples=[
+                    {
+                        'sampleTypeId': 'type-a',
+                        'sampleCodeId': 'code-a',
+                        'sampleCode': 'S-001',
+                        'unitId': 'unit-a',
+                        'collectAmount': 10,
+                    },
+                    {
+                        'sampleTypeId': 'type-a',
+                        'sampleCodeId': 'code-b',
+                        'sampleCode': 'S-002',
+                        'unitId': 'unit-a',
+                        'collectAmount': 5,
+                    },
+                ]
+            ),
+            ctx=_ctx('specialist'),
+            user_info=_user(),
+        )
+
+    assert schedule.call_count == 2
+    assert schedule.call_args_list[0].kwargs['submitted_codes'] is None
+    second = schedule.call_args_list[1].kwargs
+    assert 'S-001' in second['before_codes']
+    assert set(second['submitted_codes']) >= {'S-001', 'S-002'}
+    assert second['protocol_kind'] == 'cell_storage'
+
+
 def test_manager_update_cannot_move_document_out_of_scope_and_rolls_back():
     from app.services.market_protocol import update_protocol
 
@@ -959,6 +1068,19 @@ def test_protocol_body_legacy_payment_accepts_month_end_and_leap_dates():
     assert body.payment_details[0].installment_due_date == '20260228'
 
 
+def test_protocol_body_normalizes_dashed_register_and_donation_dates():
+    from app.schemas.market_mobile import MarketProtocolBody
+
+    donation = MarketProtocolBody.model_validate(
+        {'source': 'research_donation', 'donationDate': '2026-06-17'}
+    )
+    assert donation.donation_date == '20260617'
+    cell = MarketProtocolBody.model_validate(
+        {'source': 'cell_storage', 'registerDate': '2026/06/17'}
+    )
+    assert cell.register_date == '20260617'
+
+
 def test_protocol_payment_models_are_mutually_exclusive_by_stored_version():
     from app.schemas.market_mobile import MarketProtocolBody
     from app.services.market_protocol import update_protocol

backend/tests/test_web_sensitive_permissions.py

@@ -345,22 +345,22 @@ def _route_strict_codes(router, endpoint_name):
                 "create_research_donation",
                 "update_research_donation",
             ],
-            {PROTOCOL_LIST},
+            set(),
         ),
         (
             "protocol_sample_payment",
             ["confirm_payment_transfer", "reject_payment_transfer"],
-            {PAYMENT_CONFIRM},
+            set(),
         ),
         (
             "presign_order",
             ["confirm_presign_transfer", "reject_presign_transfer"],
-            {PAYMENT_CONFIRM},
+            set(),
         ),
         (
             "sample_cert_insurance",
             ["put_sample_storage_cert", "put_sample_insurance"],
-            {STORAGE_CERT},
+            set(),
         ),
         (
             "sample_storage_cert_qc",
@@ -432,7 +432,8 @@ def test_collection_protocol_write_paths_keep_payment_detail_guard_only():
 def test_research_donation_write_paths_assert_sensitive_field_permissions():
     source = Path("app/api/research_donation.py").read_text()
     assert "assert_donation_sensitive_fields" in source
-    assert PROTOCOL_AUDIT in source
+    assert "require_strict_menu_code" not in source
+    assert "assert_strict_menu_code" not in source
 
 
 def _permission_user(db, *codes):
@@ -497,7 +498,7 @@ def test_protocol_sensitive_fields_no_longer_require_menu_permissions():
     )
 
 
-def test_donation_sensitive_fields_require_audit_permission():
+def test_donation_sensitive_fields_no_longer_require_menu_permissions():
     from app.api.research_donation import (
         DonationCreateBody,
         DonationUpdateBody,
@@ -507,27 +508,17 @@ def test_donation_sensitive_fields_require_audit_permission():
     db = _session()
     user = _permission_user(db)
     assert_donation_sensitive_fields(db, user, DonationCreateBody(), creating=True)
-
     for body, creating in (
         (DonationCreateBody(donationStatus="sxz"), True),
         (DonationCreateBody(sourceType="cell_storage"), True),
         (DonationUpdateBody(sourceProtocolId="p1"), False),
     ):
-        with pytest.raises(HTTPException) as exc_info:
-            assert_donation_sensitive_fields(db, user, body, creating=creating)
-        assert exc_info.value.status_code == 403
+        assert_donation_sensitive_fields(db, user, body, creating=creating)
 
 
-def test_market_only_user_is_stopped_before_sensitive_crud(monkeypatch):
-    """其它仍挂菜单码的写接口：仅有小程序市场权限时仍应 403。
-
-    采集协议单接口已按方案去掉菜单码，不在本用例断言范围内。
-    """
-    from app.api import (
-        protocol_sample_payment,
-        sample_cert_insurance,
-        sample_storage_cert_qc,
-    )
+def test_market_only_user_is_stopped_before_storage_cert_qc_write(monkeypatch):
+    """储存证质控写接口仍挂严格菜单码：无对应菜单时应 403。"""
+    from app.api import sample_storage_cert_qc
 
     db = _thread_session()
     _add_user(db)
@@ -550,21 +541,10 @@ def test_market_only_user_is_stopped_before_sensitive_crud(monkeypatch):
         called.append((args, kwargs))
         raise AssertionError("sensitive CRUD must not be called")
 
-    monkeypatch.setattr(
-        protocol_sample_payment.psp_svc, "confirm_receipt", forbidden_call
-    )
-    monkeypatch.setattr(
-        sample_cert_insurance.cert_crud, "upsert_handle", forbidden_call
-    )
     monkeypatch.setattr(sample_storage_cert_qc.svc, "upsert", forbidden_call)
 
     app = FastAPI()
-    for router in (
-        protocol_sample_payment.router,
-        sample_cert_insurance.router,
-        sample_storage_cert_qc.router,
-    ):
-        app.include_router(router)
+    app.include_router(sample_storage_cert_qc.router)
 
     user = {"user_id": "u1", "tenant_no": "tenant-a", "role": "admin"}
 
@@ -574,16 +554,11 @@ def test_market_only_user_is_stopped_before_sensitive_crud(monkeypatch):
     app.dependency_overrides[get_current_user] = lambda: user
     app.dependency_overrides[get_db] = override_db
 
-    requests = [
-        ("post", "/web/admin/payment-transfers/t1/receipt-confirm", {}),
-        ("put", "/web/admin/sample-storage-certs/S1", {}),
-        ("put", "/web/admin/sample-storage-cert-qc/S1", {"payload": {}}),
-    ]
     client = TestClient(app)
-    for method, url, body in requests:
-        response = client.request(method, url, json=body)
-        assert response.status_code == 403, (method, url, response.text)
-
+    response = client.request(
+        "put", "/web/admin/sample-storage-cert-qc/S1", json={"payload": {}}
+    )
+    assert response.status_code == 403, response.text
     assert called == []
 
 

mobile-oa-h5/src/oa/components/OaDatePicker.vue

@@ -181,6 +181,17 @@ function parseModelValue(raw) {
   const fallback = nowParts()
   if (raw == null || raw === '') return fallback
   const s = String(raw).trim()
+  // 兼容紧凑业务日期：YYYYMMDD / YYYYMMDDHHmmss
+  const compact = s.match(/^(\d{4})(\d{2})(\d{2})(?:(\d{2})(\d{2})(\d{2}))?$/)
+  if (compact) {
+    const hh = compact[4] != null ? compact[4] : '00'
+    const mm = compact[5] != null ? compact[5] : '00'
+    const ss = compact[6] != null ? compact[6] : '00'
+    return {
+      date: [compact[1], compact[2], compact[3]],
+      time: includeSeconds.value ? [hh, mm, ss] : [hh, mm]
+    }
+  }
   // 兼容 ISO：2026-08-12T14:30:00
   const normalized = s.replace('T', ' ')
   const m = normalized.match(
@@ -207,12 +218,15 @@ function formatOutput(dateArr, timeArr) {
   const hh = timeArr?.[0] || '00'
   const mm = timeArr?.[1] || '00'
   const ss = timeArr?.[2] || '00'
+  const f = effectiveFormat.value
 
   if (t === 'year') return y
-  if (t === 'month') return `${y}-${mo}`
+  if (t === 'month') {
+    if (f === 'YYYYMM' || f === 'yyyyMM') return `${y}${mo}`
+    return `${y}-${mo}`
+  }
 
   if (isDateTime.value) {
-    const f = effectiveFormat.value
     // 常见 valueFormat 直出，避免引入 dayjs
     if (f === 'YYYY-MM-DD HH:mm' || (!includeSeconds.value && /HH:mm/.test(f) && !/[sS]/.test(f))) {
       return `${y}-${mo}-${day} ${hh}:${mm}`
@@ -229,6 +243,10 @@ function formatOutput(dateArr, timeArr) {
     return `${y}-${mo}-${day} ${hh}:${mm}:${ss}`
   }
 
+  // 业务日期字段（捐赠/登记等）约定 CHAR(8) YYYYMMDD
+  if (f === 'YYYYMMDD' || f === 'yyyyMMdd') {
+    return `${y}${mo}${day}`
+  }
   return `${y}-${mo}-${day}`
 }
 

mobile-oa-h5/src/oa/oa-date-picker-reopen.test.js

@@ -25,6 +25,13 @@ test('OaDatePicker datetime default valueFormat aligns with PC to seconds', () =
   )
 })
 
+test('OaDatePicker date valueFormat YYYYMMDD is emitted and parsed', () => {
+  const src = source('./components/OaDatePicker.vue')
+  assert.match(src, /f === 'YYYYMMDD' \|\| f === 'yyyyMMdd'/)
+  assert.match(src, /return `\$\{y\}\$\{mo\}\$\{day\}`/)
+  assert.ok(src.includes('^(\\d{4})(\\d{2})(\\d{2})(?:(\\d{2})(\\d{2})(\\d{2}))?$'))
+})
+
 test('protocol sample transport popups reset scroll to top on open', () => {
   const src = source('../market/components/ProtocolSampleTransportPanel.vue')
   assert.match(src, /function resetPopupScroll\(/)