更新

gengxin
2026-08-24 16:56:37 +08:00 · 2026-08-22 10:50:20 +08:00 · 2026-08-22 10:49:34 +08:00 · 2026-08-22 10:46:13 +08:00 · 2026-08-22 08:51:35 +08:00 · 2026-08-20 18:01:36 +08:00
570 changed files with 34213 additions and 4679 deletions
@@ -1,33 +1,34 @@
-# Build and Release Folders
-bin-debug/
-bin-release/
-[Oo]bj/
-[Bb]in/
-
-# Other files and folders
-.settings/
-
-# Executables
-*.swf
-*.air
-*.ipa
-*.apk
-
-# Project files, i.e. `.project`, `.actionScriptProperties` and `.flexProperties`
-# should NOT be excluded as they contain compiler settings and other important
-# information for Eclipse / Flash Builder.
-
-/.idea
-/.codex-tasks
-/.trellis
-/.claude
-/.agent
-/.shared
-/.cursor
-/.codex
-/.agents
-/server/.spool
-/server/.claude
-/.spool
-TUICallKit-Vue3/.env
-/.codegraph
+# Build and Release Folders
+bin-debug/
+bin-release/
+[Oo]bj/
+[Bb]in/
+
+# Other files and folders
+.settings/
+
+# Executables
+*.swf
+*.air
+*.ipa
+*.apk
+
+# Project files, i.e. `.project`, `.actionScriptProperties` and `.flexProperties`
+# should NOT be excluded as they contain compiler settings and other important
+# information for Eclipse / Flash Builder.
+# 测试临时目录
+app/.test-tmp-stream/
+/.idea
+/.codex-tasks
+/.trellis
+/.claude
+/.agent
+/.shared
+/.cursor
+/.codex
+/.agents
+/server/.spool
+/server/.claude
+/.spool
+TUICallKit-Vue3/.env
+/.codegraph
@@ -0,0 +1,90 @@
+# 2026-08-20 — 医生工作站 AI 问诊对话框布局优化
+
+## 改动
+- 文件: `app/src/doctor_workstation/ui/dialogs/ai_consult.py`
+- 模块: `AiConsultDialog` 右侧「智能分析」卡片 + 问诊对话卡片密度优化
+- 新增 helpers: `_InsightItem`, `_split_insight_segments`, `_split_numbered_list`, `_split_plain_paragraph`, `_split_label_or_sentence`, `_escape_html`
+- `_set_insights` 改成将稠密段落拆成 lead / list / plain 三类, 每类单独 QLabel 显示
+- CSS 新增 `AiConsultInsightMarker` / `AiConsultInsightText` / `AiConsultInsightPlaceholder`
+- 卡片 padding `10,8,10,8` → `14,12,14,14`; 卡间距 `8` → `10`
+- 聊天气泡垂直 margin `4` → `6`, chat_layout spacing `10` → `12`
+
+## 拆分策略
+- 文本以 `1./2、/3)/4）` 起头 → 视为完整编号列表
+- 文本中嵌入 `…：1.…2.…` → 拆出序言 + 编号列表
+- 短中文标签 `XX：YY` 开头 → 视为 lead, 标签部分加粗
+- 其余按 `。/；/;/` 分句 → 单独成行
+
+## 测试
+- 现有 `tests/test_ai_consult_ui.py` 通过 `widget.objectName() == "AiConsultRecordTitle"` 校验标题仍在, 未受影响
+- 暂未运行 UI 测试 (开发环境未装 PySide6); 解析逻辑单独脚本验证通过
+
+## 注意
+- PySide6 QSS 对 `QLabel` 的 `line-height` 支持有限; 主要靠 item 间距 `8px` 与 `padding:1px 0` 提供节奏
+- 如果后续接入 `AiConsultInsightText` 还嫌密集, 可再调 `body_host.setSpacing`
+
+---
+
+# 接诊台 AI 智能分析详情对话框 (`ReceptionAiAnalysisDialog`) 优化
+用户截图(`clipboard-2026-08-20T08-42-40`...)反馈: 「问诊详情 → AI 智能分析」卡片里的诊断建议 / 风险评估 / 治疗建议三段文字太稠密, 不利于阅读。
+
+## 关键差异
+这次的目标文件和上次不同 — 用户截图里出现 "诊断建议 / 风险评估 / 治疗建议" 标题, 而 `ai_consult.py` 用的是 "血糖控制评估 / 并发症风险评估 / 用药合理性评估"。实际是 `app/src/doctor_workstation/ui/pages/reception.py` 中的 `_ReceptionAiAnalysisDialog` 类。
+
+## 改动
+- 文件: `app/src/doctor_workstation/ui/pages/reception.py`
+- 新增 helpers (与 ai_consult.py 类似但导出名加 `_ai_` 前缀):
+  - `_ai_split_into_segments` / `_ai_split_numbered_list` / `_ai_split_plain_paragraph`
+  - `_ai_segments_to_html` / `_ai_narrative_structured_html`
+  - `_ai_split_label_or_sentence` / `_ai_escape_html`
+  - 正则: `_AI_INSIGHT_LIST_RE`, `_AI_INSIGHT_LIST_LOOKAHEAD_RE`, `_AI_INSIGHT_LABEL_RE`
+- `add_text_section` 闭包内多挂一个 RichText `_structured_labels[name]` 标签 (`.setObjectName(name + "Structured")`, `property="dialogAiStructured"`)
+- 原 PlainText `value_label` 仍存在 (`hide()` + `setMaximumHeight(0)`) 用于兼容既有 findChild 测试
+- `_render_model` 同步刷新两个结构化标签; 空 HTML 时回退显示原 label 文本
+- 风险评估 FlowLayout spacing `7×7` → `9×9`
+- `body_layout.setSpacing` `12` → `14`
+- 卡片 contentsMargins `14,13,16,15` → `16,14,18,16`
+- QSS: `dialogAiBody` 加 `line-height: 1.85`, 新增 `dialogAiStructured` 选择器 (line-height 175%); 风险 pill `min-height` `28` → `30`, padding `4 10` → `5 12`, font 12 → 12.5, border-radius `7` → `8`
+
+## 兼容约束
+- `tests/test_reception_parity_ui.py` 严格校验:
+  - `findChild(QLabel, "ReceptionAiAnalysisDialogDiagnosisText")` 必须能找到
+  - `.text()` 必须等于 `_ai_narrative_text` 归一化结果
+  - `.textFormat() == Qt.TextFormat.PlainText`
+- 因此 PlainText 标签必须原样保留, 仅做 `.hide()` + `setMaximumHeight(0)` (避免 QSS `>` 子选择器不被 Qt 支持)
+
+## 验证
+- `py_compile` 通过, 无 `SyntaxWarning`
+- 单独脚本跑过 4 组样本文本 (稠密段落 / 嵌入式编号列表 / 短句 / 纯编号列表), 拆分结果符合预期
+- 未在本机跑 UI 测试 (缺 PySide6)
+
+---
+
+# 患者列表 AI 分析: 发送完整患者资料给 AI
+
+用户需求: 患者列表 AI 分析时, 每日血糖报告、舌苔、AI 报告、视频录制回放的文字对话都要发给 AI。
+
+## 改动
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py`
+  - `_load_workspace` 新增 `list_call_records` section (视频问诊记录, 含 `transcript_text`)
+  - 模块级纯函数 (无 Qt 依赖, 便于测试):
+    - `AI_CONTEXT_MAX_CHARS=320`, `AI_PROMPT_LIMIT=500`, `AI_CONTEXT_SEPARATOR="\n\n— 医生提问 —\n"`
+    - `_truncate_for_context` / `_patient_context_blood_sugar` / `_patient_context_tongue` / `_patient_context_reports` / `_patient_context_prescriptions` / `_patient_context_videos` / `build_patient_ai_context` / `_compose_ai_prompt`
+  - `build_patient_ai_context` 返回 `(text, labels)`, 按 每日血糖→舌苔/脉象→视频问诊文字→历史AI报告→处方记录 顺序装入 320 字预算的信封
+  - `_patient_context_videos` 按 `diagnosis_id` 过滤归属 (`_exact_positive_id`), 只取最近一条有文字的
+  - `_compose_ai_prompt` 本地强制 500 字上限: 上下文 + "— 医生提问 —" + 问题, 超长时截断问题加 `…` (服务端 `tcm.diagnosis/aiAssistant` prompt 上限 500)
+  - `_ChatBubble.attach_extra()` 支持气泡下方挂载控件
+  - `_render_patient_context`: 聊天区系统气泡 "AI 已加载本诊单上下文(N 项…)", `_attach_context_detail` 挂 "查看本次发送给 AI 的资料全文" 展开按钮 (QSS: `AiConsultContextToggle`/`AiConsultContextReveal`)
+  - `_ask` 用 `_compose_ai_prompt(text, self._patient_ai_context)` 组装后传给 `_AiStreamWorker`; 医生气泡仍显示原始问题
+  - `open_for` / `_clear_chat` 重置 `_patient_ai_context*` 三个状态, 防止跨患者残留
+
+## 测试
+- `app/tests/test_ai_consult_ui.py` 新增 5 个测试 (总 15 个全通过):
+  纯函数: 全 section 信封+视频按诊单过滤 / 仅基本病历返回空 / 长问题截断≤500
+  UI: 上下文气泡+展开按钮+视频记录计数 / `_ask` 注入上下文 (FakeWorker 捕获 prompt, monkeypatch `QThreadPool`)
+- `app/scripts/check_ai_context.py`: AST 提取纯函数的冒烟脚本 (无需 Qt)
+- `tests/test_ai_consult_workspace_ui.py` 18 个测试无回归
+
+## 环境要点 (重要)
+- **PySide6 + pytest 在 `app/.venv` 里可用**: 用 `D:/web/zyt/app/.venv/Scripts/python.exe -m pytest` 跑 UI 测试 (QT_QPA_PLATFORM=offscreen)。之前"本机缺 PySide6"的结论只对系统 Python 成立。
+- 测试 FakeWorker 需实现 `signals.event/error/finished.connect()` 和 `cancel()` (closeEvent 会调 cancel)
@@ -230,27 +230,27 @@ export function wecomPromotionDeleteLink(params: { id: number }) {
    return request.post({ url: '/firstvisit.wecomPromotion/deleteLink', params })
 }

-export type WecomPromotionCustomerChatStatus = '' | 'messaged' | 'silent' | 'unknown'
-
-export interface WecomPromotionCustomerStatsParams {
-    page_no: number
-    page_size: number
-    promotion_link_id?: number
-    userid?: string
-    chat_status?: 0 | 1 | 2
-}
-
-export interface WecomPromotionCustomerStatsSummary {
+export type WecomPromotionCustomerChatStatus = '' | 'messaged' | 'silent' | 'unknown'
+
+export interface WecomPromotionCustomerStatsParams {
+    page_no: number
+    page_size: number
+    promotion_link_id?: number
+    userid?: string
+    chat_status?: 0 | 1 | 2
+}
+export interface WecomPromotionCustomerStatsSummary {
    customer_count: number
    messaged_customer_count: number
    message_customer_rate: number
-    received_message_count: number
-    message_count_known_count: number
-}
-
-export interface WecomPromotionCustomerStatRow {
-    id?: number
-    external_userid_masked?: string
+    received_message_count: number
+    message_count_known_count: number
+}
+
+export interface WecomPromotionCustomerStatRow {
+    id?: number
+    userid?: string
+    external_userid_masked?: string
    customer_id_masked?: string
    customer_name_masked?: string
    link_id?: number | string
@@ -260,21 +260,21 @@ export interface WecomPromotionCustomerStatRow {
    department_name?: string
    dept_name?: string
    has_messaged?: boolean | number
-    chat_status?: 0 | 1 | 2
-    message_count_known?: boolean | number
-    received_message_count?: number
-    last_synced_at?: string
-    last_message_at?: string
-}
+    chat_status?: 0 | 1 | 2
+    message_count_known?: boolean | number
+    received_message_count?: number
+    last_synced_at?: string
+    last_message_at?: string
+}

 export interface WecomPromotionCustomerStatsResult {
    summary?: Partial<WecomPromotionCustomerStatsSummary>
    lists?: WecomPromotionCustomerStatRow[]
    total?: number
    link_options?: Array<{ id: number | string; name: string }>
-    member_options?: Array<{ id: number; name: string; department_name?: string; dept_name?: string }>
-    meta?: { last_synced_at?: string }
-}
+    member_options?: Array<{ id: number; userid?: string; name: string; department_name?: string; dept_name?: string }>
+    meta?: { last_synced_at?: string }
+}

 /** 获客客户消息统计：服务端继续按当前角色和部门数据范围收窄。 */
 export function wecomPromotionCustomerStats(params: WecomPromotionCustomerStatsParams) {
@@ -0,0 +1,35 @@
+import request from '@/utils/request'
+
+export type DesktopPackageType = 'archive' | 'inno_setup'
+
+export type DesktopPackage = {
+    url: string
+    sha256: string
+    size: number
+    filename: string
+    type: DesktopPackageType
+}
+
+export type DesktopWorkstationConfig = {
+    enabled: number
+    latest_version: string
+    min_version: string
+    force_update: number
+    title: string
+    notes: string
+    packages: {
+        windows_x64: DesktopPackage
+        macos_arm64: DesktopPackage
+        macos_x64: DesktopPackage
+    }
+}
+
+export function getDesktopWorkstationConfig() {
+    return request.get({
+        url: '/setting.desktop_workstation/getConfig'
+    }) as Promise<DesktopWorkstationConfig>
+}
+
+export function setDesktopWorkstationConfig(params: DesktopWorkstationConfig) {
+    return request.post({ url: '/setting.desktop_workstation/setConfig', params })
+}
@@ -331,9 +331,8 @@ function onSelectionChange(rows: Record<string, unknown>[]) {
    selectedRows.value = rows
 }

-/** 与诊单预约弹窗一致：这些字典 name 需填「自媒体补充」 */
+/** 与诊单预约弹窗一致：自媒体4H/4Q 无需补充，仅以下字典 name 需填「自媒体补充」 */
 const CHANNEL_NAMES_REQUIRING_SELF_MEDIA_DETAIL = new Set([
-    '自媒体4H',
    '自媒体3Q',
    '自媒体3H',
    '自媒体2H',
@@ -81,10 +81,10 @@
                        <el-option
                            v-for="item in group.channels"
                            :key="item.code"
-                            :label="item.name"
+                            :label="item.search_label || item.name"
                            :value="item.code"
                        >
-                            <span class="channel-option">
+                            <span class="channel-option" :class="{ 'is-group': item.kind === 'group' }">
                                <span>{{ item.name }}</span>
                                <span>{{ item.customer_count }} 人</span>
                            </span>
@@ -96,47 +96,56 @@
        </section>

        <section class="metric-grid" aria-label="综合转化指标">
-            <article v-for="metric in metricCards" :key="metric.key" class="metric-card">
+            <article v-for="metric in visibleMetricCards" :key="metric.key" class="metric-card">
                <span>{{ metric.label }}</span>
-                <strong>{{ formatMetric(metric.key, metric.type) }}</strong>
+                <strong class="metric-value">
+                    {{ formatMetric(metric.key, metric.type) }}
+                    <em
+                        v-if="metric.key === 'add_fans_count' && hasDeletedFans(dashboard.summary.deleted_fans_count)"
+                        class="deleted-fans-marker"
+                        title="加粉总数中已删除"
+                    >
+                        （-{{ formatNumber(dashboard.summary.deleted_fans_count) }}）
+                    </em>
+                </strong>
                <small>{{ metric.hint }}</small>
            </article>
        </section>

-        <section v-if="showRankings" class="ranking-grid">
-            <article class="panel ranking-panel">
-                <div class="panel-heading">
-                    <div>
-                        <h2>{{ rankingSubject }}订单量占比排名</h2>
-                        <p>按{{ rankingSubject }}归属统计，排除取消、拒收及退款</p>
-                    </div>
-                    <span>单位：单</span>
-                </div>
-                <div v-if="dashboard.rankings.orders.length" class="bar-list">
-                    <div v-for="(item, index) in dashboard.rankings.orders" :key="`order-${item.id}`" class="bar-row">
-                        <span class="bar-name" :title="item.name"><b>{{ index + 1 }}</b>{{ item.name }}</span>
-                        <div class="bar-track"><i class="is-teal" :style="{ width: barWidth(item.value, totalOrderValue) }" /></div>
-                        <strong><span>{{ formatNumber(item.value) }} 单</span><small>{{ formatShare(item.value, totalOrderValue) }}</small></strong>
-                    </div>
-                </div>
-                <el-empty v-else :image-size="54" description="当前范围暂无订单数据" />
+        <section v-if="showRankings" class="ranking-grid">
+            <article class="panel ranking-panel">
+                <div class="panel-heading">
+                    <div>
+                        <h2>{{ rankingSubject }}订单量占比排名</h2>
+                        <p>按{{ rankingSubject }}归属统计，排除取消、拒收及退款</p>
+                    </div>
+                    <span>单位：单</span>
+                </div>
+                <div v-if="dashboard.rankings.orders.length" class="bar-list">
+                    <div v-for="(item, index) in dashboard.rankings.orders" :key="`order-${item.id}`" class="bar-row">
+                        <span class="bar-name" :title="item.name"><b>{{ index + 1 }}</b>{{ item.name }}</span>
+                        <div class="bar-track"><i class="is-teal" :style="{ width: barWidth(item.value, totalOrderValue) }" /></div>
+                        <strong><span>{{ formatNumber(item.value) }} 单</span><small>{{ formatShare(item.value, totalOrderValue) }}</small></strong>
+                    </div>
+                </div>
+                <el-empty v-else :image-size="54" description="当前范围暂无订单数据" />
            </article>

            <article class="panel ranking-panel">
-                <div class="panel-heading">
-                    <div>
-                        <h2>{{ rankingSubject }}金额占比排名</h2>
-                        <p>按{{ rankingSubject }}归属统计，仅含未取消、未拒收且未退款的有效金额</p>
-                    </div>
-                    <span>单位：元</span>
-                </div>
-                <div v-if="dashboard.rankings.amounts.length" class="bar-list">
-                    <div v-for="(item, index) in dashboard.rankings.amounts" :key="`amount-${item.id}`" class="bar-row">
-                        <span class="bar-name" :title="item.name"><b>{{ index + 1 }}</b>{{ item.name }}</span>
-                        <div class="bar-track"><i class="is-blue" :style="{ width: barWidth(item.value, totalAmountValue) }" /></div>
-                        <strong><span>{{ formatMoney(item.value) }}</span><small>{{ formatShare(item.value, totalAmountValue) }}</small></strong>
-                    </div>
-                </div>
+                <div class="panel-heading">
+                    <div>
+                        <h2>{{ rankingSubject }}金额占比排名</h2>
+                        <p>按{{ rankingSubject }}归属统计，仅含未取消、未拒收且未退款的有效金额</p>
+                    </div>
+                    <span>单位：元</span>
+                </div>
+                <div v-if="dashboard.rankings.amounts.length" class="bar-list">
+                    <div v-for="(item, index) in dashboard.rankings.amounts" :key="`amount-${item.id}`" class="bar-row">
+                        <span class="bar-name" :title="item.name"><b>{{ index + 1 }}</b>{{ item.name }}</span>
+                        <div class="bar-track"><i class="is-blue" :style="{ width: barWidth(item.value, totalAmountValue) }" /></div>
+                        <strong><span>{{ formatMoney(item.value) }}</span><small>{{ formatShare(item.value, totalAmountValue) }}</small></strong>
+                    </div>
+                </div>
                <el-empty v-else :image-size="54" description="当前范围暂无金额数据" />
            </article>
        </section>
@@ -145,7 +154,7 @@
            <div class="panel-heading panel-heading--table">
                <div>
                    <h2>明细数据列表</h2>
-                    <p>展开部门可查看人员明细；加粉=总进线=区间有效加粉（按员工+客户去重，须会话同意，剔除已删客户、继承客户、扫一扫/搜手机号/名片分享添加及区间前已加过的重加）；挂号=已支付且实收低于 10 元的订单，预约=有效预约记录；开口率=开口/加粉，挂号率=挂号/加粉，面诊率=面诊/挂号（看挂号后流失），预约率=面诊/预约（看预约后未面诊），面诊接诊率=接诊诊单/面诊，接诊率=接诊诊单/总进线</p>
+                    <p>展开部门可查看人员明细；加粉=总进线=区间新增加粉（按员工+客户去重，包含区间内添加后已删客户，剔除继承客户、扫一扫/搜手机号/名片分享添加及区间前已加过的重加），（-N）表示加粉总数中已删除；挂号=已支付且实收低于 10 元的订单，预约=有效预约记录；开口率=开口/加粉，挂号率=挂号/加粉，面诊率=面诊/挂号（看挂号后流失），预约率=面诊/预约（看预约后未面诊），面诊接诊率=接诊诊单/面诊，接诊率=接诊诊单/总进线</p>
                </div>
                <span>{{ dashboard.rows.length }} 个顶层节点</span>
            </div>
@@ -156,7 +165,7 @@
                default-expand-all
                class="detail-table"
            >
-                <el-table-column prop="name" label="部门 / 人员" min-width="220" fixed="left">
+                <el-table-column prop="name" label="部门 / 人员" min-width="220" fixed="left">
                    <template #default="{ row }">
                        <strong :class="{ 'is-parent': Array.isArray(row.children) && row.children.length, 'is-member': row.type === 'member' }">
                            {{ row.name }}
@@ -178,34 +187,47 @@
                        </el-tag>
                    </template>
                </el-table-column>
-                <el-table-column prop="add_fans_count" label="加粉" min-width="72" align="right" />
-                <el-table-column prop="total_open_count" label="开口" min-width="72" align="right" />
-                <el-table-column prop="paid_appointment_count" label="挂号" min-width="72" align="right" />
-                <el-table-column prop="appointment_total_count" label="预约" min-width="72" align="right" />
-                <el-table-column prop="interview_count" label="面诊" min-width="72" align="right" />
-                <el-table-column prop="completed_order_count" label="接诊诊单" min-width="88" align="right" />
-                <el-table-column label="接诊金额" min-width="104" align="right">
+                <el-table-column prop="add_fans_count" label="加粉" min-width="92" align="right">
+                    <template #default="{ row }">
+                        <span class="fan-count-value">
+                            {{ formatNumber(row.add_fans_count) }}
+                            <em
+                                v-if="hasDeletedFans(row.deleted_fans_count)"
+                                class="deleted-fans-marker"
+                                title="加粉总数中已删除"
+                            >
+                                （-{{ formatNumber(row.deleted_fans_count) }}）
+                            </em>
+                        </span>
+                    </template>
+                </el-table-column>
+                <el-table-column prop="total_open_count" label="开口" min-width="72" align="right" />
+                <el-table-column prop="paid_appointment_count" label="挂号" min-width="72" align="right" />
+                <el-table-column prop="appointment_total_count" label="预约" min-width="72" align="right" />
+                <el-table-column prop="interview_count" label="面诊" min-width="72" align="right" />
+                <el-table-column prop="completed_order_count" label="接诊诊单" min-width="88" align="right" />
+                <el-table-column label="接诊金额" min-width="104" align="right">
                    <template #default="{ row }">{{ formatMoney(row.completed_order_amount) }}</template>
                </el-table-column>
-                <el-table-column label="开口率" min-width="82" align="right">
+                <el-table-column label="开口率" min-width="82" align="right">
                    <template #default="{ row }">{{ formatPercent(row.total_open_rate) }}</template>
                </el-table-column>
-                <el-table-column label="挂号率" min-width="82" align="right">
+                <el-table-column label="挂号率" min-width="82" align="right">
                    <template #default="{ row }">{{ formatPercent(row.paid_appointment_rate) }}</template>
                </el-table-column>
-                <el-table-column label="面诊率" min-width="82" align="right">
+                <el-table-column label="面诊率" min-width="82" align="right">
                    <template #default="{ row }">{{ formatPercent(row.interview_paid_rate) }}</template>
                </el-table-column>
-                <el-table-column label="预约率" min-width="82" align="right">
+                <el-table-column label="预约率" min-width="82" align="right">
                    <template #default="{ row }">{{ formatPercent(row.interview_rate) }}</template>
                </el-table-column>
-                <el-table-column label="面诊接诊率" min-width="100" align="right">
+                <el-table-column label="面诊接诊率" min-width="100" align="right">
                    <template #default="{ row }">{{ formatPercent(row.interview_receive_rate) }}</template>
                </el-table-column>
-                <el-table-column label="接诊率" min-width="82" align="right">
+                <el-table-column label="接诊率" min-width="82" align="right">
                    <template #default="{ row }">{{ formatPercent(row.receive_rate) }}</template>
                </el-table-column>
-                <el-table-column label="ROI" min-width="72" align="right">
+                <el-table-column v-if="canViewFinance" label="ROI" min-width="72" align="right">
                    <template #default="{ row }">{{ formatRatio(row.roi) }}</template>
                </el-table-column>
                <template #empty><el-empty description="当前权限范围内暂无转化数据" /></template>
@@ -287,13 +309,18 @@ type MediaChannelOption = {
    tag_id?: string
    group_name?: string
    customer_count?: number
+    kind?: 'channel' | 'group'
+    search_label?: string
 }

+const FINANCE_METRIC_KEYS = new Set(['account_cost', 'roi'])
+
 const emptyDashboard = () => ({
    meta: {
-        time_type: 'today', time_label: '今日', start_date: '', end_date: '', generated_at: '',
-        scope_value: 4, scope_label: '', selected_dept_name: '', selected_assistant_name: '',
-        selected_media_channel_code: '', selected_media_channel_name: '', open_count_source: '', ranking_kind: 'hidden'
+        time_type: 'today', time_label: '今日', start_date: '', end_date: '', generated_at: '',
+        scope_value: 4, scope_label: '', selected_dept_name: '', selected_assistant_name: '',
+        selected_media_channel_code: '', selected_media_channel_name: '', open_count_source: '', ranking_kind: 'hidden',
+        can_view_finance: false
    },
    filters: {
        departments: [] as any[],
@@ -330,7 +357,7 @@ const timeOptions = [
    { label: '自定义', value: 'custom' }
 ]
 const metricCards: Array<{ key: string; label: string; type: MetricType; hint: string }> = [
-    { key: 'add_fans_count', label: '加粉数', type: 'count', hint: '区间有效加粉：去重，须会话同意，剔除已删客户、继承客户、扫一扫/搜手机号/名片分享添加及区间前已加过的重加' },
+    { key: 'add_fans_count', label: '加粉数', type: 'count', hint: '区间新增加粉（含已删除）；（-N）为其中已删除' },
    { key: 'total_open_count', label: '开口数', type: 'count', hint: '来源于个人业绩录入' },
    { key: 'interview_count', label: '面诊', type: 'count', hint: '已完成预约' },
    { key: 'completed_order_count', label: '接诊诊单', type: 'count', hint: '业务订单，按创建人归属并过滤无效单' },
@@ -347,30 +374,58 @@ const scopeDescription = computed(() => {
    if (dashboard.meta.selected_media_channel_name) parts.push(`渠道：${dashboard.meta.selected_media_channel_name}`)
    return parts.join(' · ')
 })
+const canViewFinance = computed(() => Boolean(dashboard.meta.can_view_finance))
+const visibleMetricCards = computed(() =>
+    canViewFinance.value
+        ? metricCards
+        : metricCards.filter((card) => !FINANCE_METRIC_KEYS.has(card.key))
+)
 const mediaChannelGroups = computed(() => {
-    const groups = new Map<string, {
+    const groups: Array<{
        group_name: string
        customer_count: number
        channels: MediaChannelOption[]
-    }>()
+    }> = []
+    const indexByName = new Map<string, number>()
+
    for (const channel of dashboard.filters.media_channels) {
-        const groupName = channel.group_name || ''
-        if (!groups.has(groupName)) {
-            groups.set(groupName, { group_name: groupName, customer_count: 0, channels: [] })
+        if (channel.kind === 'group') continue
+        const groupName = String(channel.group_name || '').trim()
+        let groupIndex = indexByName.get(groupName)
+        if (groupIndex === undefined) {
+            groupIndex = groups.length
+            indexByName.set(groupName, groupIndex)
+            groups.push({ group_name: groupName, customer_count: 0, channels: [] })
        }
-        const group = groups.get(groupName)!
-        group.channels.push(channel)
+        const group = groups[groupIndex]
+        const searchLabel = groupName !== '' && !channel.name.includes(groupName)
+            ? `${channel.name} ${groupName}`
+            : ''
+        group.channels.push(searchLabel === '' ? channel : { ...channel, search_label: searchLabel })
        group.customer_count = Math.max(group.customer_count, Number(channel.customer_count || 0))
    }
-    return Array.from(groups.values())
+
+    for (const group of groups) {
+        if (group.group_name === '') continue
+        const hasSameNameLeaf = group.channels.some((item) => item.name === group.group_name)
+        if (group.channels.length < 2 && hasSameNameLeaf) continue
+        group.channels.unshift({
+            code: `group:${group.group_name}`,
+            name: `${group.group_name}（全部）`,
+            group_name: group.group_name,
+            customer_count: group.customer_count,
+            kind: 'group'
+        })
+    }
+    return groups
 })
-const rankingKind = computed(() => dashboard.meta.ranking_kind || (
-    Number(dashboard.meta.scope_value) === 4 ? 'hidden' : Number(dashboard.meta.scope_value) === 3 ? 'member' : 'group'
-))
-const showRankings = computed(() => rankingKind.value !== 'hidden')
-const rankingSubject = computed(() => rankingKind.value === 'member' ? '组内成员' : '小组')
-const totalOrderValue = computed(() => dashboard.rankings.orders.reduce((total, item) => total + Number(item.value || 0), 0))
-const totalAmountValue = computed(() => dashboard.rankings.amounts.reduce((total, item) => total + Number(item.value || 0), 0))
+const rankingKind = computed(() => dashboard.meta.ranking_kind || (
+    Number(dashboard.meta.scope_value) === 4 ? 'hidden' : Number(dashboard.meta.scope_value) === 3 ? 'member' : 'group'
+))
+const showRankings = computed(() => rankingKind.value !== 'hidden')
+const rankingSubject = computed(() => rankingKind.value === 'member' ? '组内成员' : '小组')
+const totalOrderValue = computed(() => dashboard.rankings.orders.reduce((total, item) => total + Number(item.value || 0), 0))
+const totalAmountValue = computed(() => dashboard.rankings.amounts.reduce((total, item) => total + Number(item.value || 0), 0))
 const targetChartOption = computed(() => ({
    animationDuration: 450,
    color: ['#0f9185', '#2f78df'],
@@ -448,18 +503,22 @@ function formatNumber(value: any) {
    return Math.round(Number(value || 0)).toLocaleString('zh-CN')
 }

+function hasDeletedFans(value: any) {
+    return Math.round(Number(value || 0)) > 0
+}
+
 function formatMoney(value: any) {
    return `¥${Number(value || 0).toLocaleString('zh-CN', { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`
 }

-function formatPercent(value: any) {
-    return `${Number(value || 0).toFixed(1)}%`
-}
-
-function formatShare(value: any, total: number) {
-    if (total <= 0) return '0.0%'
-    return `${(Number(value || 0) / total * 100).toFixed(1)}%`
-}
+function formatPercent(value: any) {
+    return `${Number(value || 0).toFixed(1)}%`
+}
+
+function formatShare(value: any, total: number) {
+    if (total <= 0) return '0.0%'
+    return `${(Number(value || 0) / total * 100).toFixed(1)}%`
+}

 function nullablePercent(value: any) {
    return value === null || value === undefined ? '未设置' : formatPercent(value)
@@ -474,11 +533,11 @@ function compactNumber(value: number) {
    return String(Math.round(value))
 }

-function barWidth(value: any, total: number) {
-    const numericValue = Number(value || 0)
-    if (total <= 0 || numericValue <= 0) return '0%'
-    return `${Math.max(4, Math.min(100, numericValue / total * 100))}%`
-}
+function barWidth(value: any, total: number) {
+    const numericValue = Number(value || 0)
+    if (total <= 0 || numericValue <= 0) return '0%'
+    return `${Math.max(4, Math.min(100, numericValue / total * 100))}%`
+}

 function progressValue(value: any) {
    return Math.max(0, Math.min(100, Number(value || 0)))
@@ -488,29 +547,29 @@ onMounted(loadDashboard)
 </script>

 <style scoped lang="scss">
-.conversion-page {
-    display: grid;
-    gap: 14px;
-    width: 100%;
-    max-width: 100%;
-    min-width: 0;
-    min-height: 640px;
-    padding: 16px;
-    overflow-x: hidden;
-    box-sizing: border-box;
-    color: #172033;
-    background: #f4f6f8;
-}
+.conversion-page {
+    display: grid;
+    gap: 14px;
+    width: 100%;
+    max-width: 100%;
+    min-width: 0;
+    min-height: 640px;
+    padding: 16px;
+    overflow-x: hidden;
+    box-sizing: border-box;
+    color: #172033;
+    background: #f4f6f8;
+}

 .page-heading,
 .filter-strip,
 .panel,
-.metric-card {
-    min-width: 0;
-    box-sizing: border-box;
-    border: 1px solid #dfe5ec;
-    background: #fff;
-}
+.metric-card {
+    min-width: 0;
+    box-sizing: border-box;
+    border: 1px solid #dfe5ec;
+    background: #fff;
+}

 .page-heading {
    display: flex;
@@ -553,7 +612,7 @@ onMounted(loadDashboard)
 .date-range-picker { width: 260px; }
 .employee-select { width: 190px; }
 .dept-select { width: 220px; }
-.channel-select { width: 180px; }
+.channel-select { width: 220px; }
 .channel-option {
    display: flex;
    align-items: center;
@@ -565,6 +624,11 @@ onMounted(loadDashboard)
        color: #98a2b3;
        font-size: 12px;
    }
+
+    &.is-group span:first-child {
+        font-weight: 650;
+        color: #172033;
+    }
 }

 .metric-grid {
@@ -583,8 +647,28 @@ onMounted(loadDashboard)
    small { color: #a0a9b6; font-size: 11px; }
 }

+.metric-value,
+.fan-count-value {
+    display: inline-flex;
+    align-items: baseline;
+    justify-content: flex-end;
+    gap: 3px;
+    font-variant-numeric: tabular-nums;
+    white-space: nowrap;
+}
+
+.metric-value { display: flex; justify-content: flex-start; }
+.deleted-fans-marker {
+    color: #c65f26;
+    font-size: .58em;
+    font-style: normal;
+    font-weight: 650;
+}
+
+.fan-count-value .deleted-fans-marker { font-size: 11px; }
+
 .ranking-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 14px; }
-.panel { min-width: 0; max-width: 100%; padding: 16px; border-radius: 10px; box-sizing: border-box; }
+.panel { min-width: 0; max-width: 100%; padding: 16px; border-radius: 10px; box-sizing: border-box; }

 .panel-heading {
    display: flex;
@@ -598,26 +682,26 @@ onMounted(loadDashboard)
    > span { color: #929dac; font-size: 11px; white-space: nowrap; }
 }

-.bar-list { display: grid; gap: 13px; max-height: 340px; overflow-y: auto; padding-right: 4px; }
-.bar-row { display: grid; grid-template-columns: 130px minmax(80px, 1fr) 116px; align-items: center; gap: 10px; }
-.bar-name { overflow: hidden; color: #66748a; font-size: 12px; text-overflow: ellipsis; white-space: nowrap; }
-.bar-name b { display: inline-block; width: 20px; margin-right: 7px; color: #98a2b3; font-size: 11px; font-weight: 650; text-align: center; }
-.bar-row > strong { display: flex; align-items: baseline; justify-content: flex-end; gap: 7px; text-align: right; font-size: 12px; font-variant-numeric: tabular-nums; }
-.bar-row > strong small { color: #8a95a5; font-size: 10px; font-weight: 500; }
+.bar-list { display: grid; gap: 13px; max-height: 340px; overflow-y: auto; padding-right: 4px; }
+.bar-row { display: grid; grid-template-columns: 130px minmax(80px, 1fr) 116px; align-items: center; gap: 10px; }
+.bar-name { overflow: hidden; color: #66748a; font-size: 12px; text-overflow: ellipsis; white-space: nowrap; }
+.bar-name b { display: inline-block; width: 20px; margin-right: 7px; color: #98a2b3; font-size: 11px; font-weight: 650; text-align: center; }
+.bar-row > strong { display: flex; align-items: baseline; justify-content: flex-end; gap: 7px; text-align: right; font-size: 12px; font-variant-numeric: tabular-nums; }
+.bar-row > strong small { color: #8a95a5; font-size: 10px; font-weight: 500; }
 .bar-track { height: 18px; overflow: hidden; border-radius: 5px; background: #edf1f5; }
 .bar-track i { display: block; height: 100%; border-radius: 5px; transition: width .35s ease; }
 .bar-track i.is-teal { background: #15998d; }
 .bar-track i.is-blue { background: #307bdf; }

-.detail-panel { padding-bottom: 10px; overflow: hidden; }
-.detail-table {
-    width: 100%;
-    max-width: 100%;
-    min-width: 0;
-
-    :deep(.el-table__inner-wrapper),
-    :deep(.el-scrollbar) { max-width: 100%; }
-    :deep(th.el-table__cell) { color: #66748a; background: #f7f9fb; font-size: 12px; }
+.detail-panel { padding-bottom: 10px; overflow: hidden; }
+.detail-table {
+    width: 100%;
+    max-width: 100%;
+    min-width: 0;
+
+    :deep(.el-table__inner-wrapper),
+    :deep(.el-scrollbar) { max-width: 100%; }
+    :deep(th.el-table__cell) { color: #66748a; background: #f7f9fb; font-size: 12px; }
    :deep(td.el-table__cell) { color: #273347; font-size: 12px; }
    :deep(.el-table__row--level-0 > td.el-table__cell) { background: #edf7f5; font-weight: 650; }
    strong.is-parent { color: #172033; font-weight: 700; }
@@ -658,7 +742,7 @@ onMounted(loadDashboard)
    .metric-grid, .ranking-grid { grid-template-columns: 1fr; }
    .filter-item, .filter-item--time { width: 100%; align-items: flex-start; flex-direction: column; }
    .employee-select, .dept-select, .channel-select { width: 100%; }
-    .bar-row { grid-template-columns: 100px minmax(70px, 1fr) 96px; }
+    .bar-row { grid-template-columns: 100px minmax(70px, 1fr) 96px; }
    .target-summary { grid-template-columns: 1fr; }
 }
 </style>
@@ -187,11 +187,11 @@
                    <div>
                        <h2>获客客户消息统计</h2>
                        <p>统计当前权限范围内由获客助手链接添加的客户，以及客户向承接成员发送消息的情况。</p>
-                    </div>
-                    <div class="customer-heading-actions">
-                        <span v-if="customerStats.meta.last_synced_at" class="update-time">最近同步 {{ customerStats.meta.last_synced_at }}</span>
-                        <el-button type="primary" :icon="Refresh" :loading="syncingCustomers" @click="syncCustomers">同步客户</el-button>
-                    </div>
+                    </div>
+                    <div class="customer-heading-actions">
+                        <span v-if="customerStats.meta.last_synced_at" class="update-time">最近同步 {{ customerStats.meta.last_synced_at }}</span>
+                        <el-button type="primary" :icon="Refresh" :loading="syncingCustomers" @click="syncCustomers">同步客户</el-button>
+                    </div>
                </div>

                <section class="customer-metric-grid" aria-label="获客客户消息汇总">
@@ -207,11 +207,11 @@
                        <span class="metric-icon is-green"><el-icon><DataAnalysis /></el-icon></span>
                        <div><small>消息客户率</small><strong>{{ formatCustomerRate(customerStats.summary.message_customer_rate) }}</strong><p>已发消息客户占获客客户比例</p></div>
                    </article>
-                    <article class="customer-metric-card">
-                        <span class="metric-icon is-orange"><el-icon><Connection /></el-icon></span>
-                        <div><small>累计接收消息数</small><strong>{{ formatNumber(customerStats.summary.received_message_count) }}</strong><p>已精确统计 {{ formatNumber(customerStats.summary.message_count_known_count) }} 位客户</p></div>
-                    </article>
-                </section>
+                    <article class="customer-metric-card">
+                        <span class="metric-icon is-orange"><el-icon><Connection /></el-icon></span>
+                        <div><small>累计接收消息数</small><strong>{{ formatNumber(customerStats.summary.received_message_count) }}</strong><p>已精确统计 {{ formatNumber(customerStats.summary.message_count_known_count) }} 位客户</p></div>
+                    </article>
+                </section>

                <el-alert
                    v-if="!overview.config.callback_ready"
@@ -220,18 +220,18 @@
                    show-icon
                    :closable="false"
                    title="消息次数回调尚未配置完成"
-                    description="请在企业微信获客助手的 API 接入场景中配置本页“应用配置”展示的消息回调地址，并在服务器配置 contact_callback_token 与 contact_callback_aes_key。未完成前只能同步客户及聊天状态，无法得到精确接收消息次数。"
-                />
-
-                <el-alert
-                    class="chatkey-alert"
-                    type="info"
-                    show-icon
-                    :closable="false"
-                    title="消息统计依赖企业微信 ChatKey"
-                    description="ChatKey 仅在事件产生后的 30 分钟内有效。服务端收到企业微信回调后会立即拉取会话详情；手动同步用于刷新客户清单，无法补取已过期的会话消息。"
+                    description="复用企业微信自建应用现有的“API 接收消息”地址即可，无需新增第二个回调；请确保该地址为 QywxExternalContactCallback/notify，且服务器 Token、AESKey 与企微后台一致。未完成前无法得到精确接收消息次数。"
                />

+                <el-alert
+                    class="chatkey-alert"
+                    type="info"
+                    show-icon
+                    :closable="false"
+                    title="获客助手通过事件与 ChatKey 返回收消息次数"
+                    description="本功能复用现有回调并按事件类型处理 customer_acquisition，不会占用第二个回调。客户首次发消息会推送 customer_start_chat；累计第 3、5、10 次时推送 message_from_customer，服务端需在 30 分钟内用 ChatKey 查询成员、客户、获客链接和累计收消息次数。"
+                />
+
                <div class="customer-filter-bar">
                    <el-form :model="customerFilters" inline label-position="top">
                        <el-form-item label="来源链接">
@@ -244,13 +244,13 @@
                                <el-option v-for="option in customerMemberOptions" :key="option.userid || String(option.id)" :label="memberFilterLabel(option)" :value="option.userid || String(option.id)" />
                            </el-select>
                        </el-form-item>
-                        <el-form-item label="聊天状态">
+                        <el-form-item label="聊天状态">
                            <el-select v-model="customerFilters.chat_status" clearable placeholder="全部状态">
                                <el-option label="已发过消息" value="messaged" />
                                <el-option label="未发过消息" value="silent" />
                                <el-option label="状态未知" value="unknown" />
-                            </el-select>
-                        </el-form-item>
+                            </el-select>
+                        </el-form-item>
                        <el-form-item class="filter-actions">
                            <el-button type="primary" :icon="Search" :loading="customerStatsLoading" @click="applyCustomerFilters">查询</el-button>
                            <el-button @click="resetCustomerFilters">重置</el-button>
@@ -269,23 +269,26 @@
                            <div class="member-cell"><strong>{{ customerLinkName(row) }}</strong><small>{{ customerLinkId(row) }}</small></div>
                        </template>
                    </el-table-column>
-                    <el-table-column label="承接成员 / 部门" min-width="175">
-                        <template #default="{ row }">
-                            <div class="member-cell"><strong>{{ row.member_name || row.owner_name || '未匹配成员' }}</strong><small>{{ row.department_name || row.dept_name || '未分部门' }}</small></div>
-                        </template>
-                    </el-table-column>
-                    <el-table-column label="是否发过消息" width="125" align="center">
+                    <el-table-column label="承接成员 / 部门" min-width="175">
+                        <template #default="{ row }">
+                            <div class="member-cell">
+                                <strong>{{ row.member_name || row.owner_name || '未匹配成员' }}</strong>
+                                <small>{{ row.department_name || row.dept_name || '未分部门' }} · {{ row.userid || '未绑定企微账号' }}</small>
+                            </div>
+                        </template>
+                    </el-table-column>
+                    <el-table-column label="客户开口" width="110" align="center">
                        <template #default="{ row }">
                            <span class="message-state" :class="`is-${customerChatState(row)}`">{{ customerChatStateLabel(row) }}</span>
                        </template>
                    </el-table-column>
-                    <el-table-column label="接收消息数" width="120" align="right">
-                        <template #default="{ row }"><strong class="message-count" :class="{ muted: !customerMessageCountKnown(row) }">{{ customerMessageCountLabel(row) }}</strong></template>
-                    </el-table-column>
+                    <el-table-column label="累计消息" width="100" align="right">
+                        <template #default="{ row }"><strong class="message-count" :class="{ muted: !customerMessageCountKnown(row) }">{{ customerMessageCountLabel(row) }}</strong></template>
+                    </el-table-column>
                    <el-table-column label="最近同步时间" min-width="165">
                        <template #default="{ row }">{{ formatCustomerTime(row.last_synced_at || row.last_sync_time || row.synced_at || row.sync_time) }}</template>
                    </el-table-column>
-                    <el-table-column label="最近消息时间" min-width="165">
+                    <el-table-column label="最近收消息事件" min-width="165">
                        <template #default="{ row }"><span :class="{ muted: !customerLastMessageTime(row) }">{{ formatCustomerTime(customerLastMessageTime(row)) }}</span></template>
                    </el-table-column>
                    <template #empty><el-empty :image-size="72" description="当前筛选范围暂无获客客户数据" /></template>
@@ -429,7 +432,7 @@ import {
    wecomPromotionSyncRemoteLinks,
    wecomPromotionToggleLink
 } from '@/api/first_visit'
-import type { WecomPromotionCustomerChatStatus } from '@/api/first_visit'
+import type { WecomPromotionCustomerChatStatus } from '@/api/first_visit'

 import WecomFloatingWidgetBuilder from './components/WecomFloatingWidgetBuilder.vue'

@@ -458,19 +461,19 @@ const linkForm = reactive({ id: 0, pool_id: 0, name: '', group_name: '默认分
 const customerStatsLoading = ref(false)
 const customerStatsLoaded = ref(false)
 const syncingCustomers = ref(false)
-const customerFilters = reactive<{
-    link_id: number | string
-    userid: string
-    chat_status: WecomPromotionCustomerChatStatus
-}>({ link_id: '', userid: '', chat_status: '' })
-const customerPager = reactive({ page_no: 1, page_size: 20, total: 0 })
-const customerStats = reactive({
-    summary: { customer_count: 0, messaged_customer_count: 0, message_customer_rate: 0, received_message_count: 0, message_count_known_count: 0 },
+const customerFilters = reactive<{
+    link_id: number | string
+    userid: string
+    chat_status: WecomPromotionCustomerChatStatus
+}>({ link_id: '', userid: '', chat_status: '' })
+const customerPager = reactive({ page_no: 1, page_size: 20, total: 0 })
+const customerStats = reactive({
+    summary: { customer_count: 0, messaged_customer_count: 0, message_customer_rate: 0, received_message_count: 0, message_count_known_count: 0 },
    rows: [] as any[],
    link_options: [] as Array<{ id: number | string; name: string }>,
    member_options: [] as Array<{ id: number; userid?: string; name: string; department_name?: string; dept_name?: string }>,
-    meta: { last_synced_at: '' }
-})
+    meta: { last_synced_at: '' }
+})

 const selectedPool = computed(() => overview.pools.find((item: any) => Number(item.id) === selectedPoolId.value))
 const selectedLinks = computed(() => overview.links.filter((item: any) => Number(item.pool_id) === selectedPoolId.value))
@@ -630,10 +633,10 @@ async function loadCustomerStats() {
            page_no: customerPager.page_no,
            page_size: customerPager.page_size,
            promotion_link_id: customerFilters.link_id ? Number(customerFilters.link_id) : undefined,
-            userid: customerFilters.userid || undefined,
-            chat_status: customerFilters.chat_status === ''
-                ? undefined
-                : (customerFilters.chat_status === 'messaged' ? 1 : (customerFilters.chat_status === 'unknown' ? 2 : 0))
+            userid: customerFilters.userid || undefined,
+            chat_status: customerFilters.chat_status === ''
+                ? undefined
+                : (customerFilters.chat_status === 'messaged' ? 1 : (customerFilters.chat_status === 'unknown' ? 2 : 0))
        })
        const summary = result?.summary || result?.stats || {}
        const customerCount = numberFrom(summary, ['customer_count', 'total_customers', 'customer_total', 'total'])
@@ -643,9 +646,9 @@ async function loadCustomerStats() {
        Object.assign(customerStats.summary, {
            customer_count: customerCount,
            messaged_customer_count: messagedCount,
-            message_customer_rate: hasRate ? numberFrom(summary, rateKeys) : (customerCount ? messagedCount / customerCount * 100 : 0),
-            received_message_count: numberFrom(summary, ['received_message_count', 'recv_msg_cnt', 'recv_msg_count', 'total_recv_msg_cnt', 'message_count']),
-            message_count_known_count: numberFrom(summary, ['message_count_known_count', 'exact_message_customer_count'])
+            message_customer_rate: hasRate ? numberFrom(summary, rateKeys) : (customerCount ? messagedCount / customerCount * 100 : 0),
+            received_message_count: numberFrom(summary, ['received_message_count', 'recv_msg_cnt', 'recv_msg_count', 'total_recv_msg_cnt', 'message_count']),
+            message_count_known_count: numberFrom(summary, ['message_count_known_count', 'exact_message_customer_count'])
        })
        customerStats.rows = Array.isArray(result?.lists)
            ? result.lists
@@ -661,9 +664,9 @@ async function loadCustomerStats() {
            return Number(current || 0) > Number(latest || 0) ? current : latest
        }, '')
        const syncedAt = result?.meta?.last_synced_at || result?.last_synced_at || latestSyncTime || customerStats.meta.last_synced_at || ''
-        Object.assign(customerStats.meta, result?.meta || {}, {
-            last_synced_at: syncedAt ? formatCustomerTime(syncedAt) : ''
-        })
+        Object.assign(customerStats.meta, result?.meta || {}, {
+            last_synced_at: syncedAt ? formatCustomerTime(syncedAt) : ''
+        })
        customerStatsLoaded.value = true
    } catch (error: any) {
        ElMessage.error(error?.message || '获客客户统计加载失败')
@@ -677,8 +680,8 @@ function applyCustomerFilters() {
    loadCustomerStats()
 }

-function resetCustomerFilters() {
-    Object.assign(customerFilters, { link_id: '', userid: '', chat_status: '' })
+function resetCustomerFilters() {
+    Object.assign(customerFilters, { link_id: '', userid: '', chat_status: '' })
    customerPager.page_no = 1
    loadCustomerStats()
 }
@@ -821,10 +824,11 @@ function remoteMemberLabel(row: any) {
    return row.is_official ? '未返回成员范围' : '手工配置'
 }

-function memberFilterLabel(member: any) {
-    const department = member.department_name || member.dept_name || ''
-    return department ? `${member.name} · ${department}` : member.name
-}
+function memberFilterLabel(member: any) {
+    const department = member.department_name || member.dept_name || ''
+    const userid = member.userid ? ` · ${member.userid}` : ''
+    return department ? `${member.name} · ${department}${userid}` : `${member.name}${userid}`
+}

 function customerIdentifier(row: any) {
    const masked = row.external_userid_masked || row.customer_id_masked || row.customer_masked || row.customer_name_masked
@@ -879,16 +883,16 @@ function customerChatStateLabel(row: any) {
    return state === 'messaged' ? '已发消息' : (state === 'unknown' ? '状态未知' : '未发消息')
 }

-function customerMessageCountLabel(row: any) {
-    if (customerMessageCountKnown(row)) return formatNumber(customerMessageCount(row))
-    const state = customerChatState(row)
-    if (state === 'silent') return '0'
-    return state === 'unknown' ? '未知' : '待回调'
-}
-
-function customerLastMessageTime(row: any) {
-    return row.last_message_at || row.last_chat_time || row.last_message_time || row.last_msg_time || row.event_time || ''
-}
+function customerMessageCountLabel(row: any) {
+    if (customerMessageCountKnown(row)) return formatNumber(customerMessageCount(row))
+    const state = customerChatState(row)
+    if (state === 'silent') return '0'
+    return state === 'unknown' ? '未知' : '待回调'
+}
+
+function customerLastMessageTime(row: any) {
+    return row.last_message_at || row.last_chat_time || row.last_message_time || row.last_msg_time || row.event_time || ''
+}

 function formatCustomerTime(value: unknown) {
    if (value === undefined || value === null || value === '' || value === 0 || value === '0') return '-'
@@ -998,7 +1002,7 @@ h1, h2, h3, p { margin: 0; }
 .chatkey-alert { margin-top: 14px; }.chatkey-alert :deep(.el-alert__title) { font-size: 12px; }.chatkey-alert :deep(.el-alert__description) { line-height: 1.6; }
 .customer-filter-bar { margin-top: 14px; padding: 12px 14px 0; border: 1px solid var(--line); border-radius: 9px; background: #f8fafb; }
 .customer-filter-bar :deep(.el-form-item) { margin-right: 12px; margin-bottom: 12px; }.customer-filter-bar :deep(.el-form-item__label) { height: 22px; padding: 0; color: #67768a; font-size: 11px; line-height: 22px; }.customer-filter-bar .el-select { width: 220px; }.customer-filter-bar .filter-actions { align-self: flex-end; margin-right: 0; }
-.customer-table { margin-top: 14px; --el-table-header-bg-color: #f7f9fb; }.customer-table :deep(th.el-table__cell) { color: #67768a; font-weight: 500; }.customer-identifier { color: #53657a; font-family: ui-monospace, SFMono-Regular, Consolas, monospace; font-size: 11px; }.message-state { display: inline-flex; align-items: center; min-height: 24px; padding: 0 9px; border-radius: 12px; font-size: 10px; }.message-state.is-messaged { color: #16895f; background: #eaf8ef; }.message-state.is-silent { color: #788696; background: #eef2f5; }.message-state.is-unknown { color: #a66a1f; background: #fff3df; }.message-count { color: #253348; font-variant-numeric: tabular-nums; }
+.customer-table { margin-top: 14px; --el-table-header-bg-color: #f7f9fb; }.customer-table :deep(th.el-table__cell) { color: #67768a; font-weight: 500; }.customer-identifier { color: #53657a; font-family: ui-monospace, SFMono-Regular, Consolas, monospace; font-size: 11px; }.message-state { display: inline-flex; align-items: center; min-height: 24px; padding: 0 9px; border-radius: 12px; font-size: 10px; }.message-state.is-messaged { color: #16895f; background: #eaf8ef; }.message-state.is-silent { color: #788696; background: #eef2f5; }.message-state.is-unknown { color: #a66a1f; background: #fff3df; }.message-count { color: #253348; font-variant-numeric: tabular-nums; }
 .customer-pagination { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-top: 14px; color: #8491a2; font-size: 11px; }
 .configuration-panel { margin-bottom: 16px; padding: 16px; border: 1px solid; border-radius: 10px; }.configuration-panel.is-ready { border-color: #cce8e3; background: #f5fbfa; }.configuration-panel.is-pending { border-color: #f0d8b6; background: #fffaf2; }
 .configuration-state { display: flex; align-items: center; gap: 12px; }.configuration-state > span { display: grid; width: 36px; height: 36px; place-items: center; border-radius: 9px; color: #fff; background: var(--teal); font-size: 18px; }.is-pending .configuration-state > span { background: #e69a43; }.configuration-state strong { font-size: 14px; }.configuration-state p { margin-top: 4px; color: #718094; font-size: 11px; }
@@ -215,6 +215,7 @@ const PAGE_SIZE = 15
 interface QueueRow {
    id: number
    patient_id: number
+    source_patient_id?: number
    patient_name: string
    patient_phone?: string
    diagnosis_id?: number
@@ -436,19 +437,25 @@ const handleSearch = async () => {
 }

 const handleCall = async (row: QueueRow) => {
-    if (!row.patient_id) {
+    const sourcePatientId = Number(row.source_patient_id || 0)
+    const diagnosisId = Number(row.diagnosis_id || 0)
+    if (!sourcePatientId) {
        feedback.msgWarning('患者信息不完整')
        return
    }
+    if (!diagnosisId) {
+        feedback.msgWarning('预约信息不完整，无法发起聊天')
+        return
+    }
    try {
        const res = await getCallSignature({
-            patient_id: row.patient_id,
-            diagnosis_id: row.diagnosis_id || row.id
+            patient_id: sourcePatientId,
+            diagnosis_id: diagnosisId
        })
        chatDialogRef.value?.open({
-            patientId: row.patient_id,
+            patientId: sourcePatientId,
            patientName: row.patient_name,
-            diagnosisId: row.diagnosis_id || row.id,
+            diagnosisId,
            signatureData: res
        })
    } catch (error: any) {
@@ -0,0 +1,349 @@
+<template>
+    <div class="desktop-workstation">
+        <el-form
+            ref="formRef"
+            class="ls-form"
+            :model="formData"
+            :rules="rules"
+            label-width="140px"
+            scroll-to-error
+        >
+            <el-card shadow="never" class="!border-none">
+                <el-alert type="info" :closable="false" show-icon class="mb-5">
+                    <template #title>医生工作站升级包</template>
+                    <div class="leading-6">
+                        桌面端启动后会检测本页发布的版本。请上传或填写与
+                        <code>一键打包</code>
+                        产物一致的安装包，并填入打包目录中的 SHA-256。Windows 推荐使用
+                        Setup.exe，用户点击“立即更新”后会自动安装并重启；macOS 继续使用 ZIP。
+                        安装包通常超过 200MB，优先传到对象存储 / CDN 后粘贴地址。
+                    </div>
+                </el-alert>
+                <div class="text-xl font-medium mb-[20px]">升级策略</div>
+                <el-form-item label="自动检测" prop="enabled">
+                    <div>
+                        <el-switch
+                            v-model="formData.enabled"
+                            :active-value="1"
+                            :inactive-value="0"
+                        />
+                        <span class="ml-2">{{ formData.enabled ? '开启' : '关闭' }}</span>
+                        <div class="form-tips">关闭后，桌面端不会提示或强制升级。</div>
+                    </div>
+                </el-form-item>
+                <el-form-item label="最新版本号" prop="latest_version">
+                    <div class="w-80">
+                        <el-input
+                            v-model.trim="formData.latest_version"
+                            placeholder="须与 pyproject.toml / 客户端版本一致，例如 0.2.0"
+                            maxlength="20"
+                        />
+                    </div>
+                </el-form-item>
+                <el-form-item label="强制升级" prop="force_update">
+                    <div>
+                        <el-switch
+                            v-model="formData.force_update"
+                            :active-value="1"
+                            :inactive-value="0"
+                        />
+                        <span class="ml-2">{{ formData.force_update ? '开启' : '关闭' }}</span>
+                        <div class="form-tips">
+                            开启后，低于最新版本且已配置对应平台安装包的客户端必须升级后才能继续使用。
+                        </div>
+                    </div>
+                </el-form-item>
+                <el-form-item label="最低可用版本" prop="min_version">
+                    <div class="w-80">
+                        <el-input
+                            v-model.trim="formData.min_version"
+                            placeholder="可选，例如 0.1.0；低于该版本也会强制升级"
+                            maxlength="20"
+                        />
+                    </div>
+                </el-form-item>
+                <el-form-item label="更新标题" prop="title">
+                    <div class="w-[480px]">
+                        <el-input
+                            v-model.trim="formData.title"
+                            placeholder="例如：医生工作站 0.2.0"
+                            maxlength="80"
+                            show-word-limit
+                        />
+                    </div>
+                </el-form-item>
+                <el-form-item label="更新说明" prop="notes">
+                    <div class="w-[640px]">
+                        <el-input
+                            v-model="formData.notes"
+                            type="textarea"
+                            :rows="6"
+                            maxlength="4000"
+                            show-word-limit
+                            placeholder="医生端弹窗中展示的更新说明"
+                        />
+                    </div>
+                </el-form-item>
+            </el-card>
+
+            <el-card
+                v-for="item in platforms"
+                :key="item.key"
+                shadow="never"
+                class="!border-none mt-4"
+            >
+                <div class="text-xl font-medium mb-[20px]">{{ item.label }}</div>
+                <el-form-item label="安装包类型">
+                    <el-select v-model="formData.packages[item.key].type" class="w-80">
+                        <el-option label="便携压缩包（ZIP）" value="archive" />
+                        <el-option
+                            v-if="item.key === 'windows_x64'"
+                            label="Windows 安装程序（Inno Setup EXE）"
+                            value="inno_setup"
+                        />
+                    </el-select>
+                    <div class="form-tips ml-3">
+                        {{
+                            formData.packages[item.key].type === 'inno_setup'
+                                ? '推荐：退出客户端后静默安装，必要时显示 Windows 权限确认。'
+                                : '兼容旧版客户端的 ZIP 覆盖更新。'
+                        }}
+                    </div>
+                </el-form-item>
+                <el-form-item label="安装包地址">
+                    <div class="w-[640px]">
+                        <el-input
+                            v-model.trim="formData.packages[item.key].url"
+                            :placeholder="
+                                formData.packages[item.key].type === 'inno_setup'
+                                    ? 'https://.../DoctorWorkstation-Setup-....exe'
+                                    : 'https://...zip 或站内 uploads/file/... 路径'
+                            "
+                        />
+                    </div>
+                </el-form-item>
+                <el-form-item label="上传安装包">
+                    <div>
+                        <upload
+                            type="file"
+                            :limit="1"
+                            :multiple="false"
+                            :show-progress="true"
+                            :data="{ cid: 0 }"
+                            @success="(response: any) => handleUploadSuccess(item.key, response)"
+                            @change="(file: any) => handleUploadFile(item.key, file)"
+                        >
+                            <el-button type="primary" plain>选择安装包并上传</el-button>
+                        </upload>
+                        <div class="form-tips">
+                            仅建议上传较小的包。大文件请先传到对象存储，再把地址和 SHA-256
+                            填到上方。Windows 自动安装程序必须使用 HTTPS 地址并开启证书校验。
+                        </div>
+                    </div>
+                </el-form-item>
+                <el-form-item label="SHA-256">
+                    <div class="w-[640px]">
+                        <el-input
+                            v-model.trim="formData.packages[item.key].sha256"
+                            placeholder="64 位十六进制，来自 SHA256SUMS.txt 或打包生成的 .sha256"
+                        />
+                    </div>
+                </el-form-item>
+                <el-form-item label="文件名">
+                    <div class="w-[480px]">
+                        <el-input
+                            v-model.trim="formData.packages[item.key].filename"
+                            :placeholder="
+                                formData.packages[item.key].type === 'inno_setup'
+                                    ? 'DoctorWorkstation-Setup-Windows-x64-0.2.0.exe'
+                                    : 'DoctorWorkstation-Windows-x64-0.2.0.zip'
+                            "
+                        />
+                    </div>
+                </el-form-item>
+                <el-form-item label="文件大小">
+                    <div class="flex items-center gap-3">
+                        <el-input
+                            v-model.number="formData.packages[item.key].size"
+                            class="w-48"
+                            placeholder="字节"
+                        />
+                        <span class="text-tx-secondary text-sm">{{
+                            formatSize(formData.packages[item.key].size)
+                        }}</span>
+                    </div>
+                </el-form-item>
+            </el-card>
+        </el-form>
+        <footer-btns v-perms="['setting.desktop_workstation/setConfig']">
+            <el-button type="primary" @click="handleSubmit">保存</el-button>
+        </footer-btns>
+    </div>
+</template>
+
+<script lang="ts" setup name="desktopWorkstation">
+import type { FormInstance } from 'element-plus'
+
+import {
+    getDesktopWorkstationConfig,
+    setDesktopWorkstationConfig,
+    type DesktopPackage,
+    type DesktopPackageType
+} from '@/api/setting/desktop_workstation'
+import Upload from '@/components/upload/index.vue'
+import feedback from '@/utils/feedback'
+
+type PlatformKey = 'windows_x64' | 'macos_arm64' | 'macos_x64'
+
+const emptyPackage = (type: DesktopPackageType = 'archive'): DesktopPackage => ({
+    url: '',
+    sha256: '',
+    size: 0,
+    filename: '',
+    type
+})
+
+const formRef = shallowRef<FormInstance>()
+const formData = reactive({
+    enabled: 1,
+    latest_version: '',
+    min_version: '',
+    force_update: 0,
+    title: '',
+    notes: '',
+    packages: {
+        windows_x64: emptyPackage('inno_setup'),
+        macos_arm64: emptyPackage(),
+        macos_x64: emptyPackage()
+    }
+})
+
+const platforms: { key: PlatformKey; label: string }[] = [
+    { key: 'windows_x64', label: 'Windows 64 位安装包' },
+    { key: 'macos_arm64', label: 'macOS Apple 芯片安装包' },
+    { key: 'macos_x64', label: 'macOS Intel 安装包' }
+]
+
+const rules = {
+    latest_version: [
+        {
+            validator: (_rule: unknown, value: string, callback: (error?: Error) => void) => {
+                if (formData.enabled === 1 && !String(value || '').trim()) {
+                    callback(new Error('启用自动检测时请填写最新版本号'))
+                    return
+                }
+                if (value && !/^\d+(?:\.\d+){0,3}$/.test(value.trim())) {
+                    callback(new Error('版本号须为 x.y.z 数字格式'))
+                    return
+                }
+                callback()
+            },
+            trigger: ['blur', 'change']
+        }
+    ],
+    min_version: [
+        {
+            validator: (_rule: unknown, value: string, callback: (error?: Error) => void) => {
+                if (value && !/^\d+(?:\.\d+){0,3}$/.test(value.trim())) {
+                    callback(new Error('版本号须为 x.y.z 数字格式'))
+                    return
+                }
+                callback()
+            },
+            trigger: ['blur']
+        }
+    ]
+}
+
+const formatSize = (size: number) => {
+    const bytes = Number(size) || 0
+    if (bytes <= 0) return '未填写'
+    if (bytes < 1024) return `${bytes} B`
+    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
+    if (bytes < 1024 * 1024 * 1024) return `${(bytes / 1024 / 1024).toFixed(1)} MB`
+    return `${(bytes / 1024 / 1024 / 1024).toFixed(2)} GB`
+}
+
+const assignPackage = (key: PlatformKey, row: Partial<DesktopPackage> | undefined) => {
+    const current = formData.packages[key]
+    current.url = String(row?.url || '')
+    current.sha256 = String(row?.sha256 || '')
+    current.size = Number(row?.size || 0)
+    current.filename = String(row?.filename || '')
+    current.type =
+        row?.type === 'inno_setup' || (key === 'windows_x64' && !row?.url && !row?.filename)
+            ? 'inno_setup'
+            : 'archive'
+}
+
+const getData = async () => {
+    const data = await getDesktopWorkstationConfig()
+    formData.enabled = Number(data.enabled ?? 0) ? 1 : 0
+    formData.latest_version = data.latest_version || ''
+    formData.min_version = data.min_version || ''
+    formData.force_update = Number(data.force_update ?? 0) ? 1 : 0
+    formData.title = data.title || ''
+    formData.notes = data.notes || ''
+    assignPackage('windows_x64', data.packages?.windows_x64)
+    assignPackage('macos_arm64', data.packages?.macos_arm64)
+    assignPackage('macos_x64', data.packages?.macos_x64)
+}
+
+const sha256File = async (file: File) => {
+    const buffer = await file.arrayBuffer()
+    const digest = await crypto.subtle.digest('SHA-256', buffer)
+    return Array.from(new Uint8Array(digest))
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('')
+}
+
+const handleUploadFile = async (key: PlatformKey, file: any) => {
+    const raw = file?.raw as File | undefined
+    if (!raw) return
+    formData.packages[key].filename = raw.name || formData.packages[key].filename
+    formData.packages[key].size = Number(raw.size || 0)
+    if (key === 'windows_x64' && raw.name?.toLowerCase().endsWith('.exe')) {
+        formData.packages[key].type = 'inno_setup'
+    } else if (raw.name?.toLowerCase().endsWith('.zip')) {
+        formData.packages[key].type = 'archive'
+    }
+    try {
+        formData.packages[key].sha256 = await sha256File(raw)
+    } catch (error) {
+        console.warn(error)
+        feedback.msgWarning('浏览器计算 SHA-256 失败，请手动填写校验值')
+    }
+}
+
+const handleUploadSuccess = (key: PlatformKey, response: any) => {
+    const payload = response?.data || {}
+    if (payload.uri) {
+        formData.packages[key].url = payload.uri
+    } else if (payload.url) {
+        formData.packages[key].url = payload.url
+    }
+    if (payload.name && !formData.packages[key].filename) {
+        formData.packages[key].filename = payload.name
+    }
+}
+
+const handleSubmit = async () => {
+    await formRef.value?.validate()
+    await setDesktopWorkstationConfig({
+        enabled: formData.enabled,
+        latest_version: formData.latest_version,
+        min_version: formData.min_version,
+        force_update: formData.force_update,
+        title: formData.title,
+        notes: formData.notes,
+        packages: {
+            windows_x64: { ...formData.packages.windows_x64 },
+            macos_arm64: { ...formData.packages.macos_arm64 },
+            macos_x64: { ...formData.packages.macos_x64 }
+        }
+    })
+    await getData()
+}
+
+getData()
+</script>
@@ -996,34 +996,34 @@ const handleEdit = (row: any) => {
 }

 // 聊天
-const handleChat = async (row: any) => {
-    if (!row.patient_id) {
-        feedback.msgWarning('患者信息不完整')
-        return
-    }
-    
-    // 检查是否有诊单ID
-    if (!row.diagnosis_id && !row.id) {
-        feedback.msgWarning('预约信息不完整，无法发起聊天')
-        return
-    }
-    
-    try {
-        // 获取聊天签名信息
-        const res = await getCallSignature({ 
-            patient_id: row.patient_id,
-            diagnosis_id: row.diagnosis_id || row.id
-        })
-        
-        console.log('获取聊天签名成功:', res)
-        
-        // 直接打开聊天对话框，传入必要的参数
-        chatDialogRef.value?.open({
-            patientId: row.patient_id,
-            patientName: row.patient_name,
-            diagnosisId: row.diagnosis_id || row.id,
-            signatureData: res // 传入签名数据
-        })
+const handleChat = async (row: any) => {
+    const sourcePatientId = Number(row.source_patient_id || 0)
+    const diagnosisId = Number(row.diagnosis_id || 0)
+    if (!sourcePatientId) {
+        feedback.msgWarning('患者信息不完整')
+        return
+    }
+    if (!diagnosisId) {
+        feedback.msgWarning('预约信息不完整，无法发起聊天')
+        return
+    }
+
+    try {
+        // 获取聊天签名信息
+        const res = await getCallSignature({
+            patient_id: sourcePatientId,
+            diagnosis_id: diagnosisId
+        })
+
+        console.log('获取聊天签名成功:', res)
+
+        // 直接打开聊天对话框，传入必要的参数
+        chatDialogRef.value?.open({
+            patientId: sourcePatientId,
+            patientName: row.patient_name,
+            diagnosisId,
+            signatureData: res // 传入签名数据
+        })
    } catch (error: any) {
        console.error('获取聊天签名失败:', error)
        feedback.msgError(error.message || '获取聊天签名失败')
@@ -642,22 +642,28 @@ const handleEdit = (row: any) => {
    }
    editRef.value?.open('edit', row.patient_id)
 }
-const handleChat = async (row: any) => {
-    if (!row.patient_id) {
-        feedback.msgWarning('患者信息不完整')
-        return
-    }
-    try {
-        const res = await getCallSignature({
-            patient_id: row.patient_id,
-            diagnosis_id: row.diagnosis_id || row.id
-        })
-        chatDialogRef.value?.open({
-            patientId: row.patient_id,
-            patientName: row.patient_name,
-            diagnosisId: row.diagnosis_id || row.id,
-            signatureData: res
-        })
+const handleChat = async (row: any) => {
+    const sourcePatientId = Number(row.source_patient_id || 0)
+    const diagnosisId = Number(row.diagnosis_id || 0)
+    if (!sourcePatientId) {
+        feedback.msgWarning('患者信息不完整')
+        return
+    }
+    if (!diagnosisId) {
+        feedback.msgWarning('预约信息不完整，无法发起聊天')
+        return
+    }
+    try {
+        const res = await getCallSignature({
+            patient_id: sourcePatientId,
+            diagnosis_id: diagnosisId
+        })
+        chatDialogRef.value?.open({
+            patientId: sourcePatientId,
+            patientName: row.patient_name,
+            diagnosisId,
+            signatureData: res
+        })
    } catch (e: any) {
        feedback.msgError(e?.msg || e?.message || '获取通话签名失败')
    }
@@ -262,9 +262,8 @@ const form = reactive({
  channel_source_detail: '' as string
 })

-/** 仅这些渠道字典 name 需填「自媒体补充」（与后台字典名称完全一致） */
+/** 自媒体4H/4Q 无需补充；仅这些渠道字典 name 需填「自媒体补充」（与后台字典名称完全一致） */
 const CHANNEL_NAMES_REQUIRING_SELF_MEDIA_DETAIL = new Set([
-  '自媒体4H',
  '自媒体3Q',
  '自媒体3H',
  '自媒体2H',
@@ -1,6 +1,8 @@
 .env
 .venv/
 .venv-build/
+.venv-win7-check/
+.build-tools/
 .uv-cache/
 .uv-python/
 __pycache__/
@@ -6,12 +6,13 @@ set "POWERSHELL_EXE=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
 "%POWERSHELL_EXE%" -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%PROJECT_ROOT%scripts\package_windows.ps1" %*
 set "RESULT=%ERRORLEVEL%"

-if "%RESULT%"=="0" (
+if "%RESULT%"=="0" if /I "%~1"=="-ValidateOnly" (
    echo.
-    echo Package ready in: %PROJECT_ROOT%dist
-    if /I not "%~1"=="-ValidateOnly" (
-        start "" "%SystemRoot%\explorer.exe" "%PROJECT_ROOT%dist"
-    )
+    echo Validation complete. No installer was generated.
+) else if "%RESULT%"=="0" (
+    echo.
+    echo Installer and portable package ready in: %PROJECT_ROOT%dist
+    start "" "%SystemRoot%\explorer.exe" "%PROJECT_ROOT%dist"
 ) else (
    echo.
    echo DoctorWorkstation packaging failed. Exit code: %RESULT%
@@ -9,16 +9,18 @@
 Windows 直接在项目根目录双击：

 - `一键运行_医生工作站.bat`：优先启动现有成品；没有成品时自动使用 `uv` 准备源码环境并运行。
- `一键打包_医生工作站.bat`：自动同步锁定的 Python/Node 依赖，检查冻结 QtWebEngine/QtMultimedia 文件，执行应用与媒体离屏冒烟验证，最后生成 `dist/DoctorWorkstation-Windows-x64-<版本>.zip` 和 SHA-256 文件。
+- `一键打包_医生工作站.bat`：自动同步锁定的 Python/Node 依赖，检查冻结 QtWebEngine/QtMultimedia 文件，执行应用与媒体离屏冒烟验证，最后生成 `dist/DoctorWorkstation-Setup-Windows-x64-<版本>.exe` 安装包、便携 ZIP 和 SHA-256 文件。首次使用会自动下载固定版本的 Inno Setup，并校验下载文件的 SHA-256 与数字签名。

 英文稳定别名分别是 `Run_DoctorWorkstation.bat` 和 `Build_DoctorWorkstation.bat`。分发 ZIP 解压后，可直接双击其中的 `Start_DoctorWorkstation.bat`。

+发布新版本时，可在管理后台的“医生工作站升级包”中为 Windows 选择 `Inno Setup EXE`，填入一键打包生成的 Setup 地址、SHA-256、文件大小和文件名。客户端启动时自动检测；发现新版本后，用户点击“立即更新”即可完成下载、校验、退出、静默安装和自动重启。生产地址必须使用 HTTPS 并开启证书校验，正式 Setup 还应配置组织的 Authenticode 代码签名。
+
 macOS 在 Finder 中双击：

 - `一键运行.command`：优先打开现有 `DoctorWorkstation.app`，否则自动准备源码环境并运行。
 - `一键打包.command`：构建、QtWebEngine/QtMultimedia 文件门禁、签名检查和两项冻结冒烟验证后，生成 `.app`、可分发 ZIP 及 SHA-256 文件。

-Windows 打包机需预先安装 `uv` 与 Node.js 20+；脚本会自动处理项目虚拟环境和锁定依赖。首次打包需要联网下载依赖，之后会复用本机缓存。macOS 发布源码中的根 `.command` 与操作型 `scripts/*.sh` 必须以 Git mode `100755` 跟踪；源码压缩包在传输中丢失权限时，可在项目目录执行一次 `chmod +x *.command scripts/*.sh`。若 Gatekeeper 拦截未签名内部测试版，请使用右键“打开”。
+Windows 打包机需预先安装 `uv` 与 Node.js 20+；脚本会自动处理项目虚拟环境、锁定依赖和安装器编译器。首次打包需要联网下载依赖，之后会复用本机缓存。当前 Python 3.11+/PySide6/Qt 6 成品的真实最低系统是 Windows 10 1809；Qt 6 不支持 Windows 7，不能只降低安装器版本门槛来伪装兼容。Windows 7 SP1 必须另行维护 Python 3.8.10 + PySide2/Qt 5.15 的遗留构建，并在干净 Win7 虚拟机完成视频、媒体、安装、升级和卸载验收。macOS 发布源码中的根 `.command` 与操作型 `scripts/*.sh` 必须以 Git mode `100755` 跟踪；源码压缩包在传输中丢失权限时，可在项目目录执行一次 `chmod +x *.command scripts/*.sh`。若 Gatekeeper 拦截未签名内部测试版，请使用右键“打开”。

 ## 已实现范围

@@ -0,0 +1,39 @@
+# AiConsultDialog 诊单工作区最终验收
+
+日期：2026-08-18  
+范围：诊单 `501`；复用 `tests/test_ai_consult_workspace_ui.py` 的 `WorkspaceRepository` 与即时异步执行方式；只读验收，未修改业务源码或测试。
+
+## 结论
+
+内容、控件数量、安全过滤与横向几何均通过。四个页签均有非空中文内容，没有出现 `['...']`、`{'...'}` 等 Python 集合 repr。默认窗口 `1280 × 820` 和最小窗口 `1080 × 680` 下，四页签横向滚动最大值均为 `0`，内容宽度等于视口宽度，未发现后代控件越界。
+
+存在 1 类状态提示问题：测试仓储故意返回外诊单数据时，检查检验页和健康档案页已正确过滤这些数据，但把“已拒绝 1 条归属其他诊单的数据”呈现为红色 `error` 状态并显示“重新加载”。有效内容仍完整可见，安全边界也生效；建议后续改成 warning/info 提示，避免被误解为数据加载失败。
+
+## 截图
+
+- `01_case_records.png`：病历资料
+- `02_exam_tests.png`：检查检验
+- `03_prescriptions.png`：处方记录
+- `04_health_profile.png`：健康档案
+
+截图均为 `1280 × 820`，按真实应用启动路径调用全局主题，字体为 `Microsoft YaHei UI`。
+
+## 内容与控件核验
+
+| 页签 | 核验结果 |
+| --- | --- |
+| 病历资料 | 文本 969 字符；`AiConsultCaseGrid` 1 个；中文集合已人类可读化；Python repr 标记 0 个。 |
+| 检查检验 | 文本 173 字符；时间线 1 个；舌苔缩略图 1 个；附件按钮 3 个，其中 PDF 报告 2 个；安全 HTTP(S) 按钮可用，本地 `file:` 附件按钮禁用。 |
+| 处方记录 | 文本 316 字符；处方卡 3 张；详情按钮 3 个；处方 ID 为 `5011 / 5012 / 5013`。 |
+| 健康档案 | 文本 443 字符；患者信息网格 1 个；本诊单健康概览 1 个；血糖/血压、饮食、运动三类跟踪记录均存在；手机号和身份证号已脱敏。 |
+
+## 几何
+
+- `1280 × 820`：记录面板约 `876 × 586`；有纵向滚动条时视口/内容宽度均为 `824`，检查检验页为 `834`；所有页签 `hbar maximum = 0`、后代越界量 `0`。
+- `1080 × 680`：记录面板 `676 × 446`；有纵向滚动条时视口/内容宽度均为 `624`，检查检验页为 `634`；所有页签 `hbar maximum = 0`、后代越界量 `0`。
+- 长内容通过纵向滚动呈现：病历、处方、健康档案的默认窗口纵向最大值分别为 `1064 / 215 / 455`；未发现横向裁切。
+
+## Smoke
+
+执行：`uv run --offline pytest -q tests/test_ai_consult_workspace_ui.py`  
+结果：`11 passed`。仅有 pytest 缓存目录无写权限警告，不影响测试结果。
@@ -8,6 +8,21 @@ Both build scripts launch the frozen executable twice. `--media-smoke-test` is h

 Run the build on the target operating system. PyInstaller cannot cross-build Windows and macOS artifacts.

+## Brand assets
+
+The approved source artwork is kept byte-for-byte at `resources/branding/brand-master.png`.
+`app-icon.png`, the multi-size Windows `app-icon.ico`, the macOS `app-icon.icns`,
+the login-page `brand-lockup.png`, and the video companion favicon are deterministic
+derivatives of that master. Regenerate them after replacing the approved master:
+
+```powershell
+uv run --no-project --with pillow==11.3.0 python scripts/generate_brand_assets.py
+```
+
+The full lockup is reserved for large brand placements. Window, taskbar, shortcut,
+installer, uninstaller, Dock, and browser icons use the text-free pictorial mark so
+the identity remains legible at 16–64 pixels.
+
 ## Windows

 ```powershell
@@ -16,7 +31,15 @@ Run the build on the target operating system. PyInstaller cannot cross-build Win

 The default interpreter is `.venv-build\Scripts\python.exe`; override it with `-Python C:\path\to\python.exe`.

-For the one-click release ZIP and SHA-256 manifest, run `Build_DoctorWorkstation.bat`. It prepares locked dependencies, invokes the build/file/smoke gates, and archives only after all gates pass.
+For the one-click Windows installer, portable ZIP, and SHA-256 manifest, run `Build_DoctorWorkstation.bat` (or double-click `一键打包_医生工作站.bat`). It prepares locked dependencies, invokes the build/file/smoke gates, then compiles `DoctorWorkstation-Setup-Windows-x64-<version>.exe` with a pinned Inno Setup compiler. The compiler is downloaded from the official release on first use and accepted only after both its pinned SHA-256 and Authenticode signer pass validation. The portable ZIP is retained as a secondary artifact.
+
+The current Python 3.11+/PySide6/Qt 6 runtime requires Windows 10 version 1809 or newer, so the installer declares `MinVersion=10.0.17763`. Do not lower that installer value to claim Windows 7 compatibility: Qt 6 does not support Windows 7. A real Windows 7 SP1 build requires a separately maintained legacy runtime (Python 3.8.10, PySide2/Qt 5.15, and a compatible freezer), plus clean Windows 7 SP1 VM validation for QtWebEngine, multimedia, installation, upgrade, and uninstall behavior.
+
+After packaging, `scripts/smoke_windows_installer.ps1` silently installs the newest Setup artifact for the current user into an isolated temporary directory, runs the installed executable's smoke gate, silently uninstalls it, and verifies that the executable was removed. It intentionally retains only its small logs and isolated user-data directory under `%TEMP%` for diagnosis.
+
+To publish an automatic Windows update, open **System settings → Doctor workstation update** in the admin site and select `Windows installer (Inno Setup EXE)`. Upload the generated `DoctorWorkstation-Setup-Windows-x64-<version>.exe` (or use an HTTPS CDN URL), then copy its SHA-256, byte size, and filename from the packaging output. New clients download and verify the installer, close themselves, run Inno Setup silently, and restart only after the installer succeeds. Existing ZIP metadata remains supported for older releases.
+
+Automatic installer execution requires an HTTPS download with certificate verification (loopback development URLs are the only exception). Production Setup artifacts should also be Authenticode-signed before publication; the current local build can create an unsigned installer when no organization signing certificate is configured.

 ## macOS

@@ -20,6 +20,8 @@ SOURCE_ROOT = PROJECT_ROOT / "src"
 ENTRY_POINT = SOURCE_ROOT / "doctor_workstation" / "__main__.py"
 VIDEO_DIST = PROJECT_ROOT / "video_companion" / "dist"
 RESOURCES = PROJECT_ROOT / "resources"
+WINDOWS_ICON = RESOURCES / "branding" / "app-icon.ico"
+MACOS_ICON = RESOURCES / "branding" / "app-icon.icns"
 ENTITLEMENTS = PROJECT_ROOT / "packaging" / "macos" / "entitlements.plist"
 VERSION_FILE = PROJECT_ROOT / "packaging" / "windows" / "version_info.txt"
 MEDIA_SMOKE_HOOK = PROJECT_ROOT / "packaging" / "runtime_media_smoke.py"
@@ -30,6 +32,10 @@ if not (VIDEO_DIST / "index.html").is_file():
    raise SystemExit("Build video_companion before running PyInstaller")
 if not MEDIA_SMOKE_HOOK.is_file():
    raise SystemExit(f"Frozen multimedia smoke hook is missing: {MEDIA_SMOKE_HOOK}")
+if sys.platform == "win32" and not WINDOWS_ICON.is_file():
+    raise SystemExit(f"Windows application icon is missing: {WINDOWS_ICON}")
+if sys.platform == "darwin" and not MACOS_ICON.is_file():
+    raise SystemExit(f"macOS application icon is missing: {MACOS_ICON}")

 # Some Windows developer tools add an unrelated OpenSSL installation to PATH.
 # PyInstaller's dependency scanner would then pair Python's ``_ssl.pyd`` with
@@ -98,6 +104,7 @@ exe = EXE(
    disable_windowed_traceback=False,
    argv_emulation=False,
    target_arch=None,
+    icon=str(WINDOWS_ICON) if sys.platform == "win32" else None,
    codesign_identity=os.environ.get("MACOS_CODESIGN_IDENTITY") if is_macos else None,
    entitlements_file=str(ENTITLEMENTS) if is_macos else None,
    version=str(VERSION_FILE) if sys.platform == "win32" else None,
@@ -116,7 +123,7 @@ if is_macos:
    app = BUNDLE(
        collection,
        name="DoctorWorkstation.app",
-        icon=None,
+        icon=str(MACOS_ICON),
        bundle_identifier="com.zyt.doctor-workstation",
        info_plist={
            "CFBundleDisplayName": "甄养堂医生工作站",
@@ -0,0 +1,66 @@
+#ifndef AppVersion
+  #error AppVersion must be provided by scripts/package_windows.ps1
+#endif
+#ifndef SourceDir
+  #error SourceDir must be provided by scripts/package_windows.ps1
+#endif
+#ifndef OutputDir
+  #error OutputDir must be provided by scripts/package_windows.ps1
+#endif
+#ifndef SetupBaseName
+  #error SetupBaseName must be provided by scripts/package_windows.ps1
+#endif
+#ifndef ChineseMessagesFile
+  #error ChineseMessagesFile must be provided by scripts/package_windows.ps1
+#endif
+#ifndef AppIconFile
+  #error AppIconFile must be provided by scripts/package_windows.ps1
+#endif
+
+#define AppName "甄养堂医生工作站"
+#define AppPublisher "ZYT"
+#define AppExecutableName "DoctorWorkstation.exe"
+#define AppIdValue "{{07D97DE8-3DF5-492D-AB2A-BE58FC1A040D}"
+
+[Setup]
+AppId={#AppIdValue}
+AppName={#AppName}
+AppVersion={#AppVersion}
+AppVerName={#AppName} {#AppVersion}
+AppPublisher={#AppPublisher}
+DefaultDirName={autopf}\ZYT\DoctorWorkstation
+DefaultGroupName={#AppName}
+DisableProgramGroupPage=yes
+OutputDir={#OutputDir}
+OutputBaseFilename={#SetupBaseName}
+SetupIconFile={#AppIconFile}
+Compression=lzma2/max
+SolidCompression=yes
+WizardStyle=modern
+PrivilegesRequired=admin
+PrivilegesRequiredOverridesAllowed=dialog commandline
+UsePreviousAppDir=yes
+UsePreviousPrivileges=yes
+ArchitecturesAllowed=x64compatible
+ArchitecturesInstallIn64BitMode=x64compatible
+MinVersion=10.0.17763
+UninstallDisplayIcon={app}\{#AppExecutableName},0
+CloseApplications=yes
+RestartApplications=no
+SetupLogging=yes
+
+[Languages]
+Name: "chinesesimplified"; MessagesFile: "{#ChineseMessagesFile}"
+
+[Tasks]
+Name: "desktopicon"; Description: "创建桌面快捷方式"; GroupDescription: "附加快捷方式："; Flags: unchecked
+
+[Files]
+Source: "{#SourceDir}\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
+
+[Icons]
+Name: "{autoprograms}\{#AppName}"; Filename: "{app}\{#AppExecutableName}"; WorkingDir: "{app}"; IconFilename: "{app}\{#AppExecutableName}"; IconIndex: 0
+Name: "{autodesktop}\{#AppName}"; Filename: "{app}\{#AppExecutableName}"; WorkingDir: "{app}"; IconFilename: "{app}\{#AppExecutableName}"; IconIndex: 0; Tasks: desktopicon
+
+[Run]
+Filename: "{app}\{#AppExecutableName}"; Description: "启动 {#AppName}"; WorkingDir: "{app}"; Flags: nowait postinstall skipifsilent
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"

 [project]
 name = "zhenyang-doctor-workstation"
-version = "0.1.0"
+version = "1.0.0"
 description = "Cross-platform doctor consultation workstation for Windows and macOS"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -0,0 +1,173 @@
+# app AI 入口与患者上下文绑定审计（2026-08-21）
+
+## 1. 范围与结论
+
+本次只读审计覆盖当前工作树中的 `app/src/doctor_workstation`，重点追踪所有 AI 对话、结构化分析、诊断报告、患者纵向报告和处方库 AI 解释入口，向下核对到 `DoctorRepository` / `RemoteDoctorRepository` 的实际 HTTP 请求。为判断“服务端全量上下文”是否真实存在，额外只读核对了相应 `server/app/adminapi` 实现；没有修改生产代码或测试。
+
+结论：
+
+1. **没有发现生产环境下只携带 `prompt`、不携带任何资源 ID 的 HTTP 请求，也没有发现桌面端直连 OpenAI、千问、Dify 或携带 provider key/base URL 的路径。** 所有患者相关生成请求至少携带 `diagnosis_id`（线上字段名 `id`）或 `patient_id`；处方库解释携带 `template_id`（线上字段名 `id`）。
+2. **ID 绑定总体正确，但强度不一致。** 患者级报告链路对当前选择、请求和响应中的 `patient_id` 做了最严格的精确校验；AI 完整对话工作区也会用服务端诊单详情反查 `diagnosis_id`/`patient_id` 并过滤错归属数据。诊单报告和诊单结构化分析主要依赖“请求关联 + 服务端授权/DataScope”，桌面端不能从响应再次核对 `diagnosis_id`。
+3. **并非所有患者 AI 入口都走服务端“患者纵向全量上下文”。** 只有 `patientAiReports` / `generatePatientAiReport` 是服务端按 `patient_id` 聚合历次诊单、医生备注、跟踪、血糖、饮食、运动、IM/微信、通话和转写的纵向链路。`aiAssistant(Stream)`、`aiAnalysis`、诊单 `generateAiReports` 都是按单个 `diagnosis_id` 构造诊单表字段摘要。
+4. **存在明确的本地拼 prompt 路径。** `AiConsultDialog` 从多个桌面端请求结果中摘取最多 320 字的血糖、舌脉、视频转写、历史 AI 摘要、处方标题，拼到医生问题前，再受 500 字总限制截断。工作区未完成或加载失败时仍可发送，此时退化为“`diagnosis_id` + 原始问题”。该请求仍会进入第一方服务端并由服务端补入单诊单摘要，因此不是无权限的裸模型调用；但它不满足“患者上下文只能由服务端统一、全量组装”的要求。
+
+## 2. 入口清单
+
+| # | 可见入口 | 入口代码 | 最终 repository 方法 | 绑定键 | 上下文结论 |
+|---|---|---|---|---|---|
+| 1 | 主壳全局“AI 助手” | `ui/shell.py:1551-1565` → 全局患者诊单选择器 `ui/dialogs/ai_consult_picker.py:390-421` | `list_ai_patient_options` 后进入 `stream_diagnosis_ai` / `analyze_diagnosis_ai` | 选择器独立保存 `diagnosis_id`、`source_patient_id`，不允许 patient ID 回退为 diagnosis ID（`ai_consult_picker.py:72-119`） | 诊单级服务端摘要 + 桌面端局部上下文 |
+| 2 | “问诊列表/预约”工具栏“AI 分析” | `ui/pages/appointments.py:1578-1598` | 同上 | `diagnosis_id`；展示用 `patient_id` 只取 `source_patient_id` | 同上；存在旧字段兼容回退风险，见缺口 G3 |
+| 3 | “问诊列表/诊单”行操作“AI 分析” | `ui/pages/consultations.py:2980-3002` | 同上 | `diagnosis_id` 取 `diagnosis_id/id`，`patient_id` 取 `source_patient_id/patient_id` | 同上 |
+| 4 | “我的患者”行操作/按钮“AI 分析” | `ui/pages/patients.py:2706-2708,2732-2759` | 同上 | 明确禁止从 `patient_id` 回退为诊单；诊单取 `diagnosis_id/id` | 同上 |
+| 5 | 接诊台“AI 分析”对话工作区 | `ui/pages/reception.py:8650-8668` | 同上 | 从已加载详情的选择上下文取 `diagnosis_id`、`patient_id` | 同上；发送前不要求本地上下文已完成 |
+| 6 | 接诊台 AI 问诊助手快捷问题/输入框 | `ui/pages/reception.py:8620-8648` → `DiagnosisAiAssistantDialog` | `analyze_diagnosis_ai` | 仅 `diagnosis_id` + `prompt` + `task`；无 `patient_id` | 服务端单诊单摘要；无桌面端患者纵向上下文 |
+| 7 | 接诊台“AI 智能分析”自动加载、模型切换、重试、重新分析 | `ui/pages/reception.py:5265-6142,6954-6991` | 优先 `list_patient_ai_reports` / `generate_patient_ai_report`；权限/能力不足时回退 `get_diagnosis_ai_analysis` | 优先链路只传 `patient_id`；回退链路只传 `diagnosis_id` | 优先链路是服务端患者纵向全量；回退链路是单诊单摘要 |
+| 8 | 接诊台“AI 报告” | `ui/pages/reception.py:8680-8721` | `list_diagnosis_ai_reports` / `generate_diagnosis_ai_reports` / `edit_diagnosis_ai_report` | `diagnosis_id` | 服务端单诊单报告，不是患者纵向报告 |
+| 9 | 预约页“AI 报告” | `ui/pages/appointments.py:1559-1576` | 同上 | 页面先把解析出的诊单号覆盖写入 payload 的 `id` 和 `diagnosis_id` | 服务端单诊单报告 |
+| 10 | 诊单详情内“AI 报告” | `ui/dialogs/diagnosis.py:1897-1912` | 同上 | 当前详情的 `_diagnosis_id` 同时写入 `id`、`diagnosis_id` | 服务端单诊单报告 |
+| 11 | 处方库“AI解释” | `ui/pages/prescription_library.py:734-740` | `list_prescription_template_ai_reports` / `generate_prescription_template_ai_reports` / `edit_prescription_template_ai_report` | `template_id`，线上字段 `id` | 非患者入口；服务端只分析模板药材组合 |
+| 12 | AI 分析历史详情弹窗 | `ui/pages/reception.py:6140-6153` | 不发请求 | 使用已校验缓存 | 纯展示，无新增上下文风险 |
+
+补充：AI 对话中“开个处方”等明确指令会被 `_handle_local_action` 拦截，重新读取当前诊单详情并打开处方编辑器，不会发 AI 请求（`ui/dialogs/ai_consult.py:4881-4935`）。
+
+## 3. Repository 请求矩阵
+
+生产实现集中在 `services/repository.py`，`services/remote_repository.py` 只是兼容导出；未发现其他 AI HTTP 实现。
+
+| Repository 方法 | HTTP | 请求体/查询 | 患者标识 | 本地校验 |
+|---|---|---|---|---|
+| `list_ai_patient_options` | GET `tcm.diagnosis/aiPatientOptions` | `page_no,page_size,keyword` | 返回独立 `diagnosis_id`、`source_patient_id` | DTO 清洗；入口再分离两种 ID（`repository.py:2029-2044`） |
+| `list_prescription_template_ai_reports` | GET `tcm.prescriptionLibrary/aiReports` | `id=template_id` | 不适用 | repository 未显式正数校验（`repository.py:1267-1277`） |
+| `generate_prescription_template_ai_reports` | POST `tcm.prescriptionLibrary/generateAiReports` | `id=template_id` | 不适用 | 同上（`repository.py:1279-1289`） |
+| `edit_prescription_template_ai_report` | POST `tcm.prescriptionLibrary/editAiReport` | `id,report_id,content` | 不适用 | 同上（`repository.py:1291-1307`） |
+| `list_diagnosis_ai_reports` | GET `tcm.diagnosis/aiReports` | `id=diagnosis_id` | `diagnosis_id` | repository 未显式正数校验（`repository.py:1309-1319`） |
+| `generate_diagnosis_ai_reports` | POST `tcm.diagnosis/generateAiReports` | `id=diagnosis_id` | `diagnosis_id` | repository 未显式正数校验（`repository.py:1321-1331`） |
+| `edit_diagnosis_ai_report` | POST `tcm.diagnosis/editAiReport` | `id,report_id,content` | `diagnosis_id` | repository 未显式正数校验（`repository.py:1333-1349`） |
+| `analyze_diagnosis_ai` | POST `tcm.diagnosis/aiAssistant` | `id, prompt, task` | `diagnosis_id` | 要求正数诊单、非空且 ≤500 字问题、任务白名单（`repository.py:1351-1371,2803-2823`） |
+| `stream_diagnosis_ai` | SSE POST `tcm.diagnosis/aiAssistantStream` | `id, prompt, task` | `diagnosis_id` | 同上；首个 delta 前失败时最多回退一次非流式助手（`repository.py:1373-1428`） |
+| `get_diagnosis_ai_analysis` | POST `tcm.diagnosis/aiAnalysis` | `id,model` | `diagnosis_id` | 正数诊单、模型白名单（`repository.py:1430-1450`） |
+| `list_patient_ai_reports` | GET `tcm.diagnosis/patientAiReports` | `patient_id` | `patient_id` | 正数患者 ID（`repository.py:1452-1464`） |
+| `generate_patient_ai_report` | POST `tcm.diagnosis/generatePatientAiReport` | `patient_id,model` | `patient_id` | 正数患者 ID、模型白名单（`repository.py:1466-1488`） |
+
+安全边界：助手请求体只有 `id/prompt/task`，结构化分析只有 `id/model`，患者报告只有 `patient_id/model`；未携带 `key/api_key/base_url/provider/model` 等上游配置（模型键仅出现在固定白名单分析/报告接口）。
+
+## 4. ID 绑定与归属校验
+
+### 4.1 AI 完整对话工作区
+
+- `present_ai_consult` 拒绝非正数 `diagnosis_id`（`ai_consult.py:5353-5378`）。
+- 打开后先按该诊单请求只读详情，再从详情中解析权威 `patient_id`。如果详情返回的诊单 ID 不完全等于当前诊单，整个详情及关联备注、处方、跟踪资料被过滤；如果入口传入的 patient ID 与详情不一致，停止患者报告请求（`ai_consult.py:3703-3802,3833-3907`）。
+- IM 消息、备注、处方要求每行明确携带当前 `diagnosis_id`；跟踪记录也必须声明当前诊单归属（`ai_consult.py:1514-1543,3866-3907`）。
+- 患者报告响应会递归检查所有已声明的 `patient_id`（`ai_consult.py:1546-1564,3769-3781`）。
+- 每次发送最终都把当前 `self.diagnosis_id` 交给 `_AiStreamWorker`（`ai_consult.py:5171-5230`）。因此即使本地患者上下文为空，也不是 prompt-only 请求。
+
+### 4.2 接诊台患者级报告
+
+这是 app 中最强的绑定实现：
+
+- 请求前同时锁定 generation、appointment 和当前选择的 `patient_id`（`reception.py:5062-5073,5265-5352`）。
+- GET 响应要求顶层和每条 report 的 `patient_id` 都是精确正数且等于请求值；POST 还要求 `generated_report.id` 为正数、`model_key` 与请求一致（`reception.py:1865-1993`）。
+- A→B、A→B→A、迟到响应、旧 GET 覆盖新 POST 等并发情况都有单飞、取消和 mutation epoch 保护（`reception.py:5135-5164,5376-5452,5503-5731`）。
+- 该接口按患者聚合，因此请求不带单一 `diagnosis_id` 是正确契约，不是遗漏。服务端会记录全部来源诊单集合和最新诊单 ID。
+
+### 4.3 接诊台诊单级回退分析
+
+- 只有在患者报告权限/方法/患者 ID 条件不满足时才走 `get_diagnosis_ai_analysis`（`reception.py:5788-5853`）。
+- 请求前后都校验 generation、appointment、当前选择的 diagnosis，且响应模型必须与请求模型相同（`reception.py:5049-5060,5855-6028`）。
+- 响应契约没有返回 `diagnosis_id`，因此桌面端只能依赖异步请求关联，无法做响应所有者复核。
+
+### 4.4 报告弹窗
+
+`PrescriptionAiReportDialog` 通过 `AiReportKind` 把诊单、模板分别路由到正确 repository 方法，生成和读取只使用实体 ID（`prescription_ai.py:453-510,780-828,909-929`）。但 `_apply_reports` 直接接受报告数组和 capabilities，不核对响应中的 `diagnosis_id`/`prescription_id`（`prescription_ai.py:856-891`）；该层完全信任服务端返回与请求 ID 对应。
+
+## 5. 上下文路径判定
+
+### 5.1 真正的服务端患者纵向全量路径
+
+接诊台优先使用患者级报告。服务端 `PatientAiReportLogic` 明确按 `patient_id` 查询当前数据域内的全部有效诊单，并聚合诊单、doctor notes、tracking notes、blood、diet、exercise、IM、微信、通话和 transcript segments（`server/app/adminapi/logic/tcm/PatientAiReportLogic.php:17-22,254-297,335-395`）。生成请求只接受 `patient_id` 和固定模型，完整来源快照留在服务端（同文件 `126-218`）。
+
+### 5.2 诊单级服务端上下文
+
+`aiAssistant(Stream)`、`aiAnalysis`、诊单报告都先按 `diagnosis_id` 做权限和 DataScope 校验，再由服务端构建脱敏病例摘要；不是裸 prompt 调模型（`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:320-378,470-515,551-590`）。但是其 `buildCaseContext` 只整理当前诊单表中的生命体征和 `CASE_FIELDS`，不会查询 doctor notes、tracking、血糖历史、饮食、运动、IM/微信、通话/转写等关联表（同文件 `211-253,881-953`）。因此它是“单诊单完整字段”，不是患者纵向全量。
+
+### 5.3 桌面端本地拼 prompt
+
+`AiConsultDialog` 的本地 envelope 明确存在：
+
+- 上限 320 字，来源只有每日血糖摘要、舌苔/脉象、第一条视频转写、历史 AI 报告摘要和最多三条处方标题（`ai_consult.py:2687-2694,2703-2898`）。
+- envelope 与医生问题拼成最多 500 字的 `prompt`，超限时优先保留上下文、截断医生问题（`ai_consult.py:2901-2928`）。
+- 工作区加载失败时 UI 明示“可先根据已有信息提问”，此时 `_patient_ai_context` 可能为空（`ai_consult.py:3810-3831`）；`_compose_ai_prompt` 在上下文为空时直接返回问题（`ai_consult.py:2915-2919`）。
+- 每次发送仍携带当前 `diagnosis_id`，并由服务端再次加入单诊单摘要（`ai_consult.py:5171-5230`）。
+
+判定：这不是绕过第一方服务端或无 ID 调用，但**确实绕过了“由服务端作为唯一来源统一组装患者纵向上下文”的架构要求**。本地 envelope 是不完整、截断且可能暂时为空的第二套上下文实现；它还把本可用于医生问题的 500 字预算占掉。
+
+### 5.4 仅原始问题的 UI 路径
+
+接诊台轻量 `DiagnosisAiAssistantDialog` 直接发送 `diagnosis_id + prompt + task`，不拼患者报告或桌面工作区上下文（`prescription_ai.py:1427-1454`）。这是“仅原始问题 + diagnosis ID”，不是“仅 prompt”。其安全性依赖服务端按 diagnosis ID 补入单诊单摘要；如果产品要求患者纵向资料，则该路径不达标。
+
+## 6. 缺口与风险
+
+### G1 — 高：患者对话上下文存在第二套桌面端拼装，且不是全量
+
+AI 完整对话把最多 320 字的局部资料拼入问题；快速发送、加载失败或最小病历时可退化为空。本地实现与服务端 `DiagnosisAiLogic::buildCaseContext` 并存，两者字段、更新时机和截断规则不同，容易产生遗漏或矛盾。若目标是“每次患者发消息均由服务端使用完整、权威上下文”，当前实现不满足。
+
+建议：服务端提供唯一的 diagnosis/patient-scoped assistant context 聚合器；桌面只发送 `diagnosis_id`（必要时另传经验证的 `patient_id`）和原始医生问题。返回可审计的 `context_version/source_summary/source_diagnosis_ids`，UI 展示服务端声明而不是展示客户端自拼文本。
+
+### G2 — 中高：轻量助手和诊单级分析/报告不是患者纵向全量
+
+轻量助手、诊单分析、诊单报告都正确绑定 `diagnosis_id`，也经过服务端授权；但上下文只来自单个诊单字段。接诊台有患者报告权限时会优先使用真正的患者纵向报告，缺少该权限时则回退为单诊单分析。产品若把这些入口统称为“患者分析”，应显式区分“本诊单分析”与“患者纵向分析”，或统一到患者级聚合服务。
+
+### G3 — 中：预约页仍把 `patient_id` 当作诊单 ID 的兼容回退
+
+`appointments.py:382-394` 在缺少显式 `diagnosis_id` 时把 `patient_id` 作为 diagnosis ID，同时真正患者 ID 只接受 `source_patient_id`。这符合旧 admin 预约行的历史语义，但与规范化 DTO 中 `patient_id` 表示真实患者的常见语义冲突。如果未来接口只返回真实 `patient_id` 而漏掉 `diagnosis_id`，可能把患者 ID 当诊单 ID 发给 AI；若数值恰好命中另一个可访问诊单，仅靠正数/权限校验无法识别语义错绑。
+
+建议：AI 入口必须要求显式 `diagnosis_id`；旧接口兼容应在 repository DTO 适配层一次性完成，并用契约版本或独立字段证明，不要在 UI 回退。
+
+### G4 — 中：诊单/处方库 AI 报告弹窗不校验响应所有者
+
+患者级报告会严格核对响应中的 `patient_id`，AI 工作区也过滤错诊单数据；但通用报告弹窗直接接收 reports。服务端当前会返回 `diagnosis_id`/`prescription_id`，桌面端应拒绝缺失或不匹配的所有者，并在生成、编辑后同样校验，避免代理缓存、服务端回归或测试替身把 A 的报告显示在 B 上。
+
+### G5 — 低：部分报告 repository 方法缺少一致的正数 ID 前置校验
+
+助手、结构化分析、患者报告均在 repository 层验证正数 ID；诊单/处方库报告的 list/generate/edit 没有同级校验。UI 通常会拦截无 ID，因此当前主要是防御一致性和未来非 UI 调用风险。
+
+## 7. 现有测试覆盖与缺口
+
+### 已覆盖
+
+- `test_ai_patient_options_repository.py`：专用选择器 endpoint、分页、脱敏 DTO、diagnosis/patient ID 分离。
+- `test_ai_consult_picker_ui.py`：选择器不自动选中、搜索/迟到响应、接受后才打开、最小脱敏 seed。
+- `test_ai_consult_workspace_ui.py`：四个资料页均使用选中诊单；seed 不可替换权威 patient ID；错详情/错 patient report/无 owner 的备注、处方、IM、tracking 均 fail closed；A/B 迟到结果隔离。
+- `test_ai_consult_ui.py`：四个页面入口传递 501/301；完整对话流式顺序、取消；本地上下文的来源过滤、320/500 字截断和拼接；处方本地动作重新核对当前诊单。
+- `test_patient_ai_report_desktop.py`：patient-only HTTP 契约、精确顶层/行 patient ID 校验、POST 新快照校验、权限组合、A/B/A 单飞与旧 GET/新 POST 并发保护。
+- `test_prescription_ai_ui.py`：诊单/处方库报告方法路由、权限、生成/编辑；轻量助手精确发送 `diagnosis_id/prompt/task`。
+- `test_repository_parity.py`：所有 AI endpoint 和 DTO、无 provider 配置、SSE 正常化与单次回退、诊单分析模型白名单。
+- `test_reception_parity_ui.py`：诊单分析自动加载、Qwen→OpenAI 顺序、迟到结果丢弃、详情失败停止 AI、患者报告完成态和权限回退。
+- `test_api_client.py`：SSE 请求体、事件顺序、HTTP 行为。
+
+本次执行：
+
+```text
+211 collected tests across the 9 files above
+211 passed
+```
+
+命令使用 `PYTHONDONTWRITEBYTECODE=1` 和 `-p no:cacheprovider`，未写入生产代码或测试。
+
+### 未覆盖/覆盖不足
+
+1. 没有测试“工作区仍在加载时立即发送”或“工作区失败后发送”时，断言请求退化为原始问题并验证产品是否允许。
+2. 当前测试 `test_ask_prepends_patient_context_to_the_ai_prompt` 固化了本地拼 prompt 行为；没有相反的架构契约测试，确保患者上下文只能由服务端组装。
+3. 没有诊单/处方库报告响应 `diagnosis_id`/`prescription_id` 缺失或错配时 fail closed 的测试。
+4. 没有预约行“缺少 diagnosis_id、但 patient_id 是真实患者 ID”时拒绝打开 AI 的测试；现有测试只覆盖显式 501/301 分离。
+5. 诊单级 `aiAnalysis`/assistant 响应本身不返回 `diagnosis_id`，因此目前无法写真正的响应归属断言；只能测试异步请求关联。
+6. app 测试证明请求 ID 和 UI 并发安全，但没有端到端断言服务器实际采用了患者纵向 source summary。该契约目前只在 server 侧测试/实现中可见。
+
+## 8. 建议验收标准
+
+1. 所有患者对话接口只接受 `diagnosis_id`/`patient_id` + 原始用户问题/任务，不接受桌面端病例 envelope。
+2. 服务端返回 `context_scope`（`diagnosis` 或 `patient_longitudinal`）、`context_version`、`source_diagnosis_ids`、`source_summary`；桌面展示该信息并验证 owner。
+3. “患者纵向分析”必须传 `patient_id`，服务端按 DataScope 聚合；“本诊单分析”必须显式标注，并只传 `diagnosis_id`。
+4. 所有 AI response DTO 都回显 owner；app 对 owner 缺失、类型不精确、错配统一 fail closed。
+5. 预约、诊单、患者三种 ID 在 DTO 层分离；UI 禁止 `patient_id -> diagnosis_id` 语义回退。
+6. 新增上述六项测试缺口，并保留现有迟到响应、A/B/A 和单飞测试。
@@ -0,0 +1,49 @@
+# AI 全量患者上下文与处方闭环（2026-08-21）
+
+## 范围
+
+本次改造覆盖 `app` 医生工作台实际调用的患者级 AI 入口：AI 问诊助手（普通与流式）、AI 智能分析、诊断报告生成、患者纵向报告，以及新增的 AI 处方草稿。客户端不再自行拼装或截断患者资料，统一由服务端在完成诊单权限校验后聚合。
+
+## 全量上下文覆盖矩阵
+
+| 必须资料 | 权威数据源 | 发给 AI 的内容 |
+| --- | --- | --- |
+| 当前信息、现病史、病例/病历 | `tcm_diagnosis`（同一稳定患者全部未删除诊单） | 结构化字段与完整纵向记录 |
+| 医生备注 | `tcm_doctor_note` | 备注正文、分类、时间及附件 |
+| 舌苔/舌象 | `tcm_doctor_note.tongue_images` 等附件字段 | 文字描述与原图文件 |
+| 报告信息 | 医生备注、诊单等记录中的报告附件 | 元数据与报告原文件 |
+| 每日视频面诊文字 | `tcm_call_record`、`tcm_call_transcript_segment` | 完整转写文本；有录像地址时同时发送视频文件 |
+| 日常记录 | `tcm_blood_record`、`patient_diet_record`、`patient_exercise_record` | 血糖/血压/用药、饮食、运动等完整明细 |
+| 聊天与随访 | IM/微信消息与关联随访记录 | 可用的完整文本和附件 |
+| 正式处方与记录病历 | `tcm_prescription` | 处方药味、剂量、用法、处方病历、审核状态 |
+
+聚合结果不再使用客户端 320/500 字符截断，也不再只取当前诊单。超长纵向报告仍可分段送入模型，但不会在分段前丢弃资料。图片、文档、音频和视频通过上游文件参数发送；无法读取的附件要求模型明确说明，不能臆测其内容。
+
+## AI 处方闭环
+
+1. 医生在 AI 问诊助手选择“AI 生成处方”。
+2. 服务端使用同一份全量纵向上下文生成严格 JSON 处方草稿。
+3. 客户端只接受诊断、药味剂量、用法、辨证与风险说明；患者身份、诊单、预约、医生身份不得由模型覆盖。
+4. 草稿必须进入现有处方编辑器，由医生复核并签名。
+5. 保存后始终进入 `audit_status = 0` 的待审核状态，沿用现有审核发布流程；AI 不能伪造签名或绕过审核直接生效。
+
+## 权限与数据完整性
+
+- 服务端先按“我的患者”权限校验入口诊单，再按稳定患者 ID 聚合同一患者历史。
+- 处方新增时再次校验诊单归属，并由服务端回填患者、预约、医生和病例字段，忽略客户端对权威身份字段的伪造。
+- 处方编辑仅允许创建者，诊单关联不可被改写。
+- 关键处方写接口在菜单配置缺失时不再默认放行。
+- 含文档/音视频的请求不会静默降级为不带附件的文本请求。
+
+## 验证结果
+
+- 桌面端 AI/处方相关回归：244 passed。
+- 桌面端重点 AI/仓储/处方回归：116 passed。
+- 服务端 AI 上下文、权限、流式、快照、处方、安全与配置契约测试：通过。
+- 所有本次涉及的 PHP 与 Python 文件语法检查：通过。
+
+## 部署验收
+
+- 配置可接收文件输入的 Dify 工作流，并确保模型/工作流能够读取所需附件类型。
+- 使用包含舌象、报告、转写、日常记录和历史处方的真实患者，检查 Dify 调用日志中的文本上下文和 `files`。
+- 让 AI 生成处方，确认医生签名不可省略、保存后为待审核、患者身份不能被请求参数篡改。
@@ -0,0 +1,241 @@
+# AI 对话/报告直接开方链路审计（2026-08-21）
+
+## 结论
+
+**当前不能从 AI 的回答或 AI 报告“一键形成并提交处方”。** 当前工作树实现的是另一条链路：医生在 AI 对话框输入一条明确的本地命令（如“开个处方”），桌面端不请求 AI，而是重新核对诊单/患者后打开通用处方编辑器；医生仍需人工填写药材、剂量、用法和手写签名，点击确认后才调用真实创建接口，服务端保存为 `audit_status = 0` 的待审核处方。
+
+因此应区分三种能力：
+
+| 能力 | 当前状态 | 判断 |
+|---|---|---|
+| AI 输出诊断/风险/用药建议文本 | 已有 | 助手返回 `answer` 文本；结构化分析仅有诊断建议、风险和治疗建议 |
+| 从 AI 对话入口手工新建并提交待审核处方 | 部分可用 | 输入特定命令可打开编辑器，人工完成后调用 `tcm.prescription/add` |
+| 把 AI 生成的药味、剂量、用法直接转换成处方草稿/一键提交 | 不存在 | 无处方草稿 schema、无 AI 结果到编辑器的字段映射、无“采用为处方”按钮，也无服务端 AI 开方接口 |
+| AI 直接生成已审核/生效处方 | 不存在，且不应建设成无人工复核链路 | 创建接口强制待审核；审核由独立权限和角色控制 |
+
+## 审计范围与验证
+
+- 审计当前工作树中的桌面端 Python/PySide6、repository/API、PHP controller/logic/validate、权限及数据绑定。
+- 未修改生产代码或测试，只新增本报告。
+- 已运行：`uv run pytest tests/test_ai_consult_ui.py tests/test_prescription_ui.py -q`，67 项通过。
+- 已运行：`DiagnosisAiAssistantContractTest.php`、`DiagnosisAiAssistantStreamContractTest.php`、`DiagnosisWorkspaceRowAuthorizationTest.php`，均通过。
+- 仓库根目录没有 AGENTS.md 声明的 `.trellis/workflow.md` 和 `.trellis/spec/`，故无法应用缺失的 Trellis 分层规范；本报告按现有实现和测试取证。
+
+## 端到端链路
+
+### 1. AI 返回结构：只能给建议，不能形成处方 DTO
+
+服务端病例助手的返回契约只有 `answer/model_key/model_label/model_name/task`，其中 `answer` 是清洗后的纯文本；没有 `herbs`、`medicine_id`、`dosage`、`usage_*` 或可执行 action。证据：
+
+- `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:276-307`：助手调用上游并交给 `formatAssistantResult()`。
+- `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:419-437`：最终响应只有 `answer` 和模型/任务元数据。
+- `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:64-104`：`prescription_review` 仅定义为“分析处方/用药并提示复核重点”，不是生成处方。
+- `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:1084-1106`：提示词要求“简洁、分点的专业回答”和执业医师复核，没有处方 JSON schema。
+
+另一路结构化 `aiAnalysis` 也只能返回 `diagnosis_advice`、`risk_assessment`、`treatment_advice`：
+
+- `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:1035-1069`：模型被要求输出的唯一 JSON schema 不包含处方字段。
+- `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:1281-1352`：解析器严格只接受上述三类业务字段。
+
+桌面端流式处理也只拼接 `delta.text` 并渲染答案，不解析处方动作或草稿：
+
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:5243-5282`：`start/delta/done` 只更新文本和模型标签。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:5284-5289`：流式片段直接拼成 `_stream_text`。
+
+### 2. 桌面 AI UI：有“命令开编辑器”，没有“AI 结果转处方”
+
+AI 入口和患者选择已接通：
+
+- `app/src/doctor_workstation/ui/shell.py:1103-1122,1551-1565`：有全局“AI 助手/开始对话”入口，并先进入患者诊单选择器。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult_picker.py:57-119`：选择对象分别保存 `diagnosis_id` 与 `source_patient_id`，不会把诊单主键误当患者主键，只保留掩码手机号。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult_picker.py:274-298,390-419`：通过专用 repository 拉取权限范围内诊单，再携带诊单/患者上下文打开 AI 工作区。
+
+所谓“开方”实际是本地意图拦截：
+
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:2931-2967`：仅识别不超过 24 字的明确命令；带“怎么/是否/建议/分析/复核/审核”等词时不会触发。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:5171-5179`：本地动作发生在 `_compose_ai_prompt()` 和 AI worker 之前，命中后直接返回，不会调用模型。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:4881-4919`：本地检查 `tcm.diagnosis/chufang` 或 `tcm.diagnosis/kaifang`，再开始诊单核对。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:4921-5001`：重新读取只读诊单详情，严格比对诊单 ID 和当前会话患者 ID。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:5003-5044`：仅从权威诊单构造患者/诊断种子，没有从 AI 答案提取药材。
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:5055-5105`：打开通用 `PrescriptionEditorDialog`；只有对话框返回 Accepted 后才调用 `create_prescription`。
+
+这意味着：
+
+- 输入“怎么开方更合理”会得到 AI 文本建议，但该回答没有“采用为处方”入口。
+- 输入“开个处方”不会让 AI 开方，只会打开人工编辑器。
+- 即便在命令里写药名和剂量，当前代码也不会解析或带入编辑器。
+- UI 没有可发现的“开方”快捷按钮；现有快捷指令都是病情总结、用药建议、检查建议等（`app/src/doctor_workstation/ui/dialogs/ai_consult.py:762-783,3189-3215`）。
+
+### 3. 人工编辑与提交：接口已复用，但仍是完整人工处方流程
+
+通用处方编辑器可复用程度较高：
+
+- `app/src/doctor_workstation/ui/dialogs/prescription.py:2652-2765`：完整新增/编辑处方表单。
+- `app/src/doctor_workstation/ui/dialogs/prescription.py:2910-3007`：患者、诊断、诊单提示等表单字段。
+- `app/src/doctor_workstation/ui/dialogs/prescription.py:3015-3042`：可从处方库或文本导入药材；这不是 AI 回答映射。
+- `app/src/doctor_workstation/ui/dialogs/prescription.py:3205-3227`：医师姓名和手写签名是必填 UI。
+- `app/src/doctor_workstation/ui/dialogs/prescription.py:3770-3831`：提交前校验患者、临床诊断、医师、手写签名、至少一味药材、药材主数据选择和正剂量。
+
+repository/API 已接真实端点：
+
+- `app/src/doctor_workstation/services/repository.py:1563-1572`：`create_prescription()` POST `tcm.prescription/add`。
+- `app/src/doctor_workstation/services/repository.py:1574-1593`：`update_prescription()` POST `tcm.prescription/edit`。
+- `app/src/doctor_workstation/services/repository.py:1643-1649`：按诊单刷新 `tcm.prescription/listByDiagnosis`。
+- `app/src/doctor_workstation/services/repository.py:3249-3279`：repository 只做浅层 DTO 规范化，不承担患者/诊单一致性校验。
+
+### 4. 服务端创建与审核：创建即待审，不等于审核通过
+
+服务端创建流程已有一些正确的安全边界：
+
+- `server/app/adminapi/controller/tcm/PrescriptionController.php:27-35`：控制器忽略客户端 `creator_id`，以当前 `$adminId` 调用创建逻辑。
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:220-245`：限制同诊单、同开方人、同日只能有一张未作废处方。
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:268-278`：要求药材数组并通过药材主数据解析。
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:332-340`：忽略客户端审核状态，强制 `audit_status = 0`，创建人与诊单医助由服务端写入。
+
+“提交审核”只是保存一条待审核记录；AI 链路不会调用审核接口。真正审核是独立动作：
+
+- `server/app/adminapi/controller/tcm/PrescriptionController.php:102-129`：审核需另行调用 `audit`。
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:55-73,796-840`：审核还需允许角色、对象可见性和待审状态；通过后才变为 `audit_status = 1`。
+
+## 主要缺口与风险
+
+### P1 / 高：创建接口没有诊单写权限和行级数据域校验
+
+`PrescriptionLogic::add()` 在有 `diagnosis_id` 时只做 `Diagnosis::find()` 存在性检查，没有复用 `DiagnosisLogic::canManageDiagnosis()` 或 `canViewReadonlyDiagnosis()`，controller 也没有传入 `$adminInfo`：
+
+- `server/app/adminapi/controller/tcm/PrescriptionController.php:27-35`
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:251-266`
+- 可复用的写权限入口已经存在于 `server/app/adminapi/logic/tcm/DiagnosisLogic.php:4458-4468`。
+
+桌面 AI 流程虽然会先走只读详情并做客户端 ID 比对，但这不是服务端写操作授权。调用者只要能到达 `tcm.prescription/add`，就可能对一个仅知道 ID、但不在其可管理范围内的诊单创建处方。医疗数据完整性和越权写入风险都应由服务端兜底。
+
+**建议：** `add()` 接收 `$adminInfo`，在任何读取患者/预约信息和写入前调用 `DiagnosisLogic::canManageDiagnosis($diagnosisId, $adminId, $adminInfo)`；不存在和越权统一报错，避免枚举。AI 页面可继续保留客户端核对作为 UX 防误操作，但不能代替服务端鉴权。
+
+### P1 / 高：诊单、预约、患者和患者快照没有权威一致性校验
+
+创建逻辑只验证诊单存在，随后直接信任客户端提交的 `appointment_id`、`patient_id`、`patient_name`、`phone` 和病例快照：
+
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:251-260`：只查诊单是否存在。
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:291-315`：诊单、预约、患者 ID 和患者快照直接来自 `$params`。
+- `server/database/migrations/create_tcm_prescription.sql:5-7,27-31`：三个关系字段只有普通索引，没有外键约束。
+
+因此直接 API 请求可构造“诊单 A + 预约 B + 患者 C + 姓名 D”的处方。即便 UI 正常使用，也存在下一项实际丢字段问题。
+
+**建议：** 创建时仅接受 `diagnosis_id` 和处方临床字段；由服务端基于授权诊单解析并写入 `appointment_id/patient_id/patient_name/phone/gender/age`，对病例快照使用服务端当前诊单生成。若必须允许修正患者打印信息，应走现有独立 `patchPatient` 权限和审计链路。
+
+### P1 / 高：桌面处方编辑器会丢失 `patient_id` 和 `phone`
+
+AI 入口的种子包含患者 ID 和电话：
+
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:5021-5030`
+
+但 `PrescriptionEditorDialog.payload()` 的保留字段没有 `patient_id`、`appointment_id`、`phone`、`case_record`，表单输出也没有这些字段：
+
+- `app/src/doctor_workstation/ui/dialogs/prescription.py:3692-3758`
+- 领域模型 `Prescription` 本身也没有 `patient_id` 字段：`app/src/doctor_workstation/core/models.py:577-588`。
+
+AI 流程在确认后只强制补回 `diagnosis_id`、`appointment_id` 和 `case_record`，没有补回 `patient_id` 或 `phone`：
+
+- `app/src/doctor_workstation/ui/dialogs/ai_consult.py:5078-5093`
+
+服务端对缺失值使用 `patient_id = 0`、`phone = ''`：
+
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:300-307`
+
+所以从 AI 对话新建的处方虽然能按 `diagnosis_id` 找到，但患者 ID/手机号快照会为空。诊单详情里的既有手工开方流程采用同样的 payload 回填方式，也有同类问题（`app/src/doctor_workstation/ui/dialogs/diagnosis.py:3085-3104,3117-3127`）。
+
+现有 AI UI 测试只断言强制回填了诊单、预约和病例快照，没有断言 `patient_id/phone`：`app/tests/test_ai_consult_ui.py:293-305`。
+
+**建议：** 短期在编辑器 DTO 中不可编辑地保留 `patient_id/phone/appointment_id/case_record` 并补测试；最终仍应由服务端从诊单权威派生，避免信任客户端快照。
+
+### P1 / 高：编辑接口允许关系漂移，且共享处方的对象级编辑边界过宽
+
+服务端编辑时允许客户端提供新的 `diagnosis_id`，但没有验证新诊单存在、调用者能管理新诊单，也不会同步/校验 `patient_id`、`appointment_id` 和 `phone`：
+
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:388-425`：新诊单 ID 用于唯一性检查，但没有授权/存在性检查。
+- `server/app/adminapi/logic/tcm/PrescriptionLogic.php:438-485`：保存新 `diagnosis_id`，患者 ID、预约 ID、电话和病例快照不在更新集合中。
+
+同时对象级编辑规则是“创建者或 `is_shared = 1`”，即任何能到达编辑端点的用户都可编辑共享处方：`server/app/adminapi/logic/tcm/PrescriptionLogic.php:408-412`。这会让处方既可能被重新绑定到其他诊单，又可能保留旧患者关系字段。
+
+**建议：** 编辑禁止修改关系字段；若确需迁移，使用专用、强审计接口并同时校验新诊单写权限和重建全部患者快照。共享应只扩大读取范围，不应自动扩大编辑权。
+
+### P1 / 高（部署相关）：桌面权限码与真实 API 路由没有统一的服务端别名契约
+
+AI UI 以 `tcm.diagnosis/chufang` 或 `tcm.diagnosis/kaifang` 判断可开方（`app/src/doctor_workstation/ui/dialogs/ai_consult.py:4891-4901`），独立已开处方页则使用 `cf.prescription/add|edit`（`app/src/doctor_workstation/ui/pages/prescriptions.py:558-565,676-683`），但 repository 最终调用的是 `tcm.prescription/add|edit`。
+
+`AuthMiddleware` 的通用规则是：如果真实路由不在全量菜单 URI 中就直接放行；若已注册则要求真实路由或显式别名：
+
+- `server/app/adminapi/http/middleware/AuthMiddleware.php:70-92`
+- 现有别名仅为“处方库列表导入”覆盖多套权限，不包含 `tcm.prescription/add|edit` 的开方别名：`server/app/adminapi/http/middleware/AuthMiddleware.php:169-202`。
+
+本仓库没有找到为 `tcm.prescription/add|edit` 注册并分配权限的版本化 SQL，故实际安全性依赖部署数据库里是否已有旧菜单记录：
+
+- 若未注册，middleware 的第 77-82 行会 fail-open。
+- 若注册但未分配真实路由，拥有 `chufang/kaifang/cf.prescription/add` 的桌面用户可能被 403。
+
+**建议：** 选择一套 canonical 权限，版本化注册真实路由，并在 middleware 对兼容码做双向、可测试的精确别名；未知业务写路由应 fail-closed，而不是因为未注册就绕过鉴权。
+
+### P2 / 中：AI “开方命令”不可发现，且会丢弃命令中的处方内容
+
+界面没有开方快捷按钮或“采用为处方”CTA；只有文本意图正则。命中后清空输入并进入本地编辑流程（`app/src/doctor_workstation/ui/dialogs/ai_consult.py:4881-4889`），未保存原命令里的药味、剂量或 AI 建议。用户容易误解为 AI 已生成处方，实际看到的是诊单预填的空药材表单。
+
+**建议：** AI 答案与本地命令分离。提供明确的“生成处方草稿”与“采用草稿”按钮，展示字段来源、缺失项和风险提示；任何药材/剂量进入正式表单前都需医生逐项确认。
+
+### P2 / 中：医师显示名和签名缺少服务端身份约束
+
+编辑器预填当前用户姓名，但姓名仍可编辑，签名由客户端 data URL 提交（`app/src/doctor_workstation/ui/dialogs/prescription.py:3205-3227,3349-3355,3740-3741`）；服务端虽然强制 `creator_id = $adminId`，却直接保存客户端 `doctor_name/doctor_signature`（`server/app/adminapi/logic/tcm/PrescriptionLogic.php:327-339`）。待审核机制降低了风险，但不能防止错误/冒用的签名快照进入系统。
+
+**建议：** 医师显示名由 authenticated profile 派生；签名使用账号绑定的签名资产或至少保存签名来源、哈希、提交人、时间和确认事件，不接受 AI 生成签名。
+
+### P2 / 中：删除、作废的对象级服务端授权也不完整
+
+虽不是 AI 新建的主路径，但同一处方生命周期中：
+
+- `delete()` 未接收当前管理员，也没有创建者/共享/可见性检查：`server/app/adminapi/logic/tcm/PrescriptionLogic.php:636-675`。
+- `void()` 接收管理员仅用于记录作废人，没有对象级授权：`server/app/adminapi/logic/tcm/PrescriptionLogic.php:1137-1178`。
+
+如果路由权限配置漂移或范围过宽，可能修改他人处方。建议所有写操作统一通过同一个处方对象授权策略。
+
+## 可直接复用的接口和组件
+
+| 层 | 可复用能力 | 证据 / 用途 |
+|---|---|---|
+| AI 患者选择 | `list_ai_patient_options` / `tcm.diagnosis/aiPatientOptions` | `app/src/doctor_workstation/services/repository.py:2029-2044`；用于只暴露数据域内、脱敏的诊单目标 |
+| 诊单权威读取 | `get_diagnosis_detail(..., readonly=True)` / `readonlyDetail` | `app/src/doctor_workstation/services/repository.py:2046-2060`；服务端在 `server/app/adminapi/logic/tcm/DiagnosisLogic.php:4362-4412` 做行级只读授权 |
+| AI 问答 | `stream_diagnosis_ai` / `aiAssistantStream` | `app/src/doctor_workstation/services/repository.py:1373-1405`；适合继续提供解释，不应直接作为可执行处方 DTO |
+| 人工处方编辑 | `PrescriptionEditorDialog` | 已有主数据药材选择、剂量、用法、签名和本地校验，可作为 AI 草稿的人工复核容器 |
+| 药材主数据 | `doctor.medicine/lists` + `RemoteMedicineComboBox` | `app/src/doctor_workstation/ui/dialogs/prescription.py:1425-1536`；AI 草稿必须解析为有效 `medicine_id` |
+| 处方提交 | `create_prescription` / `tcm.prescription/add` | 可复用，但应先补服务端诊单写授权和权威关系派生 |
+| 处方刷新 | `list_prescriptions_by_diagnosis` | 创建成功后已能按当前诊单刷新并过滤归属 |
+| 服务端药材校验 | `normalizeHerbIdentities()` | `server/app/adminapi/logic/tcm/PrescriptionLogic.php:165-175`；AI 草稿落表前必须复用 |
+| 服务端重复控制 | `assertUniquePrescriptionPerDiagnosisDay()` | `server/app/adminapi/logic/tcm/PrescriptionLogic.php:220-245` |
+| 诊单写授权 | `DiagnosisLogic::canManageDiagnosis()` | `server/app/adminapi/logic/tcm/DiagnosisLogic.php:4458-4468`；应接入处方 add/edit |
+| 审核 | `PrescriptionLogic::audit()` | 保留独立人工审核，不与 AI 生成合并 |
+
+## 推荐目标链路
+
+不建议把“AI 可以直接给患者开方”实现为模型静默调用创建接口。更安全且可交付的目标是“AI 生成结构化草稿，医生确认并签名，服务端权威绑定，进入独立审核”。
+
+1. 新增只读草稿能力：AI 返回 `prescription_draft`，至少包含 `clinical_diagnosis`、主/辅方药材（`medicine_id/name/dosage/formula_type`）、剂数、用法、禁忌、生成依据、缺失信息和风险警示；不得包含可自行决定的患者/诊单/医生身份字段。
+2. 服务端严格解析草稿：使用药材主数据解析、剂量范围、重复药名、特殊人群/相互作用规则；无法解析的草稿只作为文本展示。
+3. UI 显示“采用为处方草稿”，而不是“直接提交”；逐字段标记“AI 建议/诊单原值/医生修改”，打开现有 `PrescriptionEditorDialog`。
+4. 医生必须人工复核、补齐必填项并手写/绑定签名；确认页明确显示“将创建待审核处方”。
+5. 创建接口仅接收授权 `diagnosis_id` 和临床处方字段；患者、预约、医生身份、病例快照全部由服务端权威派生，并在事务内校验诊单写权限与唯一性。
+6. 审核继续使用独立角色/权限；AI 生成标记、模型、prompt 版本、草稿哈希、采用人和修改差异写审计日志。
+
+## 建议补充的最小测试集
+
+1. AI `done` 事件的合法/非法 `prescription_draft` schema、超量药材、无 `medicine_id`、负剂量和重复药名。
+2. “AI 建议 → 采用草稿 → 人工修改 → 签名 → 创建待审”端到端桌面测试。
+3. AI 创建 payload 必须包含当前诊单，并由服务端返回的处方断言 `diagnosis_id/appointment_id/patient_id` 一致。
+4. 任意其他诊单 ID、跨数据域诊单、错配预约/患者 ID 的创建请求必须失败。
+5. 编辑请求尝试修改 `diagnosis_id/patient_id/appointment_id` 必须失败。
+6. 只有读取权限、只有 AI 权限、只有 `cf.prescription/add`、只有 `chufang/kaifang` 的权限矩阵测试，并覆盖 middleware 菜单已注册/未注册两种状态。
+7. 创建后必须仍为待审核；没有审核权限的创建者不能把处方变为已通过。
+8. 共享处方仅扩大读取范围，非创建者不能编辑、删除或作废。
+
+## 最终判断
+
+- **问：目前能否从 AI 对话/报告一键形成并提交处方？答：不能。**
+- **问：能否在 AI 对话窗口里用一句“开方”命令进入处方流程，并在人工填写/签名后创建待审核处方？答：当前工作树可以。**
+- **问：这条半自动链路是否已达到可安全上线的端到端闭环？答：尚未。** 服务端诊单写授权、患者/预约权威绑定、权限 canonical 化和患者字段丢失问题应先修复；之后再建设“AI 结构化草稿 → 医生确认 → 待审核”的链路。
@@ -0,0 +1,176 @@
+# Server AI/LLM 患者上下文与接口安全审计
+
+审计日期：2026-08-21  
+审计范围：`server/app`、`server/config` 及与真实请求拼装直接相关的 `app/src/doctor_workstation`。  
+方法：只读静态审计；未连接生产数据库、未请求任何模型服务、未修改生产代码或测试。行号以本次工作区内容为准。
+
+## 1. 结论
+
+当前不存在一套被所有患者 AI 入口复用的统一上下文。实际有三套相互独立的患者上下文：
+
+1. `DiagnosisAiLogic`：诊单 AI 助手、诊单智能分析、诊单 AI 报告共用 `buildCaseContext()`，但它只基于**当前一张诊单详情**，并不聚合医生备注文字、跟踪记录、视频转写、聊天、已开处方或处方病历快照。证据：`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:349`、`:492`、`:564` 均调用 `buildCaseContext()`；该方法仅遍历诊单及附件数量，见 `:875-947`。
+2. `PatientAiReportLogic`：患者纵向 AI 报告明确与 `DiagnosisAiLogic` 独立，见 `server/app/adminapi/logic/tcm/PatientAiReportLogic.php:18-22`。它覆盖历次诊单、备注、日常记录、聊天及视频转写，是当前最完整的一套，但**仍不读取 `tcm_prescription` 已开处方、药味和 `case_record`**。
+3. `DailyDietAiLogic`：患者端饮食建议另建一套上下文，只含姓名、性别、年龄和近 30 天血糖统计/近 7 条明细，见 `server/app/api/logic/tcm/DailyDietAiLogic.php:279-339`。
+
+此外，桌面端给诊单 AI 助手补上下文时存在两个确定的契约错误：跟踪接口返回 `blood_records`，客户端却读取 `blood_sugar`；处方接口返回 `Prescription` 数据类，客户端只接受 `Mapping`。因此界面声称附带的“每日血糖/处方记录”在真实远端数据形态下会缺失。证据见第 4 节。
+
+最高优先级安全问题是 `AiChatService` 在阻塞与流式请求中都关闭 TLS 证书和主机名校验，会让患者姓名、血糖及问题内容面临中间人窃取或篡改风险：`server/app/common/service/AiChatService.php:48-59`、`:144-160`。
+
+## 2. AI/LLM 入口清单
+
+| 入口 | 是否调用 LLM | 上下文构造 | 备注 |
+|---|---:|---|---|
+| `tcm.diagnosis/aiAssistant`、`aiAssistantStream` | 是 | `DiagnosisAiLogic::buildCaseContext()` + 客户端把额外资料塞入 `prompt` | 控制器入口：`server/app/adminapi/controller/tcm/DiagnosisController.php:913-1020`；阻塞/流式最终都用同一 prepared context：`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:316-397` |
+| `tcm.diagnosis/aiAnalysis` | 是 | `DiagnosisAiLogic::buildCaseContext()` | `server/app/adminapi/controller/tcm/DiagnosisController.php:1034-1047`；`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:481-516` |
+| `tcm.diagnosis/generateAiReports` | 是，每次固定生成 qwen/openai 两份 | `DiagnosisAiLogic::buildCaseContext()` | `server/app/adminapi/controller/tcm/DiagnosisController.php:1087-1098`；`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:553-618` |
+| `patientAiReports` | 否，只读历史 | 不组装上游请求 | `server/app/adminapi/controller/tcm/DiagnosisController.php:1052-1064` |
+| `generatePatientAiReport` | 是 | `PatientAiReportLogic::buildSourceSnapshot()` | `server/app/adminapi/controller/tcm/DiagnosisController.php:1069-1082`；全量聚合见 `server/app/adminapi/logic/tcm/PatientAiReportLogic.php:335-398` |
+| `aiReports`、`editAiReport`、`aiPatientOptions` | 否，只读/编辑/选择 | 不调用模型 | 控制器见 `server/app/adminapi/controller/tcm/DiagnosisController.php:879-926`、`:1104-1115` |
+| `dailyDietAiRecommend`、`dailyDietAiAsk` 及两条 Stream | 是 | `DailyDietAiLogic::buildPatientContext()` | `server/app/api/controller/TcmController.php:900-979`；上下文见 `server/app/api/logic/tcm/DailyDietAiLogic.php:279-339` |
+| 处方库 `generateAiReports` | 是，但不是患者入口 | 处方库名称、类型、最多 80 味有效药材 | `server/app/adminapi/logic/tcm/PrescriptionLibraryAiLogic.php:145-222`、`:400-426`；不应强行复用患者上下文 |
+| `DailyBloodCareAiLogic` | 当前不可达 | 计划复用 DailyDiet | 全仓只有类自身引用，没有控制器/路由；且调用不存在的公开方法 `DailyDietAiLogic::getPatientContext()`，见 `server/app/api/logic/tcm/DailyBloodCareAiLogic.php:161-176`，实际方法是私有 `buildPatientContext()`：`server/app/api/logic/tcm/DailyDietAiLogic.php:279` |
+
+全仓 PHP 搜索只发现两种上游客户端：`DifyChatService` 和 `AiChatService`。其调用者分别是 `DiagnosisAiLogic`、`PatientAiReportLogic`、`PrescriptionLibraryAiLogic`，以及 `DailyDietAiLogic`、未接线的 `DailyBloodCareAiLogic`。
+
+## 3. “患者发给 AI”时各类资料的真实覆盖
+
+符号：✅ 文字进入上游；△ 只有部分字段/数量元数据/依赖客户端；❌ 未进入。
+
+| 资料类型 | 诊单 AI 助手/分析/诊单报告 | 患者纵向 AI 报告 | 患者端饮食 AI |
+|---|---|---|---|
+| 患者基本信息 | △ 性别、年龄、身高、体重、婚姻等；服务端不主动发送姓名/电话/身份证 | ✅ 最新诊单基本信息；上游发送前 `_id`、`_name` 等键脱敏 | △ 姓名、性别、年龄；姓名被直接发送 |
+| 当前/现病信息 | △ 当前诊单的症状、既往史、当前用药、舌脉、治则等；仓库字段漂移导致实际 `prescription`、`doctor_advice` 漏掉 | ✅ 所有授权诊单的广泛字段，包含诊单上的 `prescription`、`doctor_advice` | ❌ 除血糖外不含症状、当前用药、过敏、肝肾风险、医嘱等 |
+| 每日视频面诊转写 | ❌ 服务端不查；桌面端最多把一条转写塞入 320 字上下文 | ✅ 所有授权诊单通话及转写段，段落可重建 transcript | ❌ |
+| 病例与记录病历 | △ 当前诊单字段；不含处方 `case_record` | △ 历次诊单完整，但不含已开处方的 `case_record` | ❌ |
+| 医生备注/跟踪备注 | ❌ 只聚合备注里的图片，不聚合备注文字 | ✅ 全部医生备注和跟踪备注 | ❌ |
+| 舌苔/舌象 | △ 舌苔/舌象文字 + 图片数量；不读取图片内容 | △ 文字 + 附件数量元数据；明确禁止声称做视觉识别 | ❌ |
+| 检查报告 | △ 只发送附件数量和“未提供附件内容” | △ 只发送附件数量元数据，无 OCR/报告正文 | ❌ |
+| 日常记录 | ❌ 服务端不查；桌面端本想补血糖但字段名错误，饮食/运动也未拼入 | ✅ 血糖血压、饮食、运动全量 | △ 近 30 天血糖统计、近 7 条逐日明细；不含饮食/运动记录 |
+| 既往处方 | ❌ `tcm_diagnosis.prescription` 被字段白名单漏掉；不查 `tcm_prescription`；桌面端又因类型判断漏掉远端处方 | △ 有历次诊单的自由文本 `prescription`，但没有正式 `tcm_prescription`、药味、服法、`case_record` | ❌ |
+| IM/企微聊天 | ❌ | ✅ 腾讯 IM 与企微聊天全量 | ❌ |
+
+### 3.1 诊单 AI 共用的是“窄上下文”
+
+`DiagnosisAiLogic::CASE_FIELDS` 定义于 `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:210-252`。它会加入血压、空腹血糖、身高体重、舌象/报告附件数量，再遍历白名单字段，见 `:875-923`。`DiagnosisLogic::detail()` 本身只从医生备注聚合舌象与报告图片，未加载备注 `content`，见 `server/app/adminapi/logic/tcm/DiagnosisLogic.php:274-352` 与 `server/app/adminapi/logic/doctor/DoctorNoteLogic.php:140-164`。
+
+字段白名单存在明确漂移：仓库诊单表包含 `prescription` 和 `doctor_advice`，见 `server/sql/tcm_diagnosis.sql:13-21`；新增/编辑验证器也使用这两个名称，见 `server/app/adminapi/validate/tcm/DiagnosisValidate.php:111`。但 AI 白名单只找 `prescription_opinion`、`prescription_advice`，没有 `prescription`、`doctor_advice`，见 `server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:244-251`。相反，白名单中的 `chief_complaint`、`present_illness` 等名称在本仓库 SQL 定义中未找到，应以生产表 `SHOW COLUMNS` 再核实；无论如何，这已说明上下文与真实字段没有单一契约。
+
+舌象和检查报告只有数量元数据：`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:905-916` 明确写入“未提供附件内容”。医生备注实际保存 `content`、`tongue_images`、`report_files`，见 `server/app/adminapi/logic/doctor/DoctorNoteLogic.php:12-68`，但诊单 AI 没有读取 `content`。
+
+### 3.2 患者纵向报告覆盖广，但漏正式处方
+
+纵向报告先按 `patient_id` 和 `MyPatientLogic` 数据域查出全部有效诊单，不设日期或条数上限：`server/app/adminapi/logic/tcm/PatientAiReportLogic.php:254-296`。随后按这些诊单 ID 全量查询：
+
+- 医生备注、跟踪备注、血糖血压、饮食、运动：`server/app/adminapi/logic/tcm/PatientAiReportLogic.php:342-366`；
+- 腾讯 IM、企微聊天、视频通话：`:367-380`；
+- 视频转写段：`:382-392`，并在 `:450-472` 重建每次通话的 `transcript_text`；
+- 汇总对象确实包含 `doctor_notes`、`tracking_notes`、三类 daily records、两类 chat records 和 `video_calls`：`:495-520`。
+
+但 `buildSourceSnapshot()` 完全没有查询 `tcm_prescription`。正式处方模型把 `herbs`、`case_record`、`aux_usage` 声明为 JSON 字段：`server/app/common/model/tcm/Prescription.php:14-21`；`case_record` 又是明确的“详细病历（诊单快照 JSON）”：`server/database/migrations/2026_03_19_add_prescription_case_record.sql:2`。已有按诊单、逐条可见性过滤的安全入口可复用：`server/app/adminapi/logic/tcm/PrescriptionLogic.php:937-963`。
+
+上游脱敏总体正确：患者纵向报告会把 ID、`*_id`、`*_name`、账户标识替换为脱敏占位，并把附件 URL 替换成数量，见 `server/app/adminapi/logic/tcm/PatientAiReportLogic.php:820-848`；手机号、身份证、邮箱、URL 正则见 `:851-860`。提示词也明确禁止对附件和视频画面作视觉推断，只能使用文字、转写和元数据，见 `:739-744`。
+
+### 3.3 患者端饮食 AI 的上下文过窄且发送姓名
+
+`DailyDietAiLogic` 查询近 30 天血糖、不限显式行数，筛近 7 天后只取 7 条明细，见 `server/app/api/logic/tcm/DailyDietAiLogic.php:291-326`。返回上下文只有 `patient_name`、`age`、`gender_text`、血糖明细和 7/30 天统计，见 `:328-337`。推荐与问答提示词都将患者姓名直接发往模型：`:508-519`、`:560-569`、`:706-712`、`:795-803`。
+
+对于会给出个体化饮食建议的糖尿病入口，未纳入诊单中的当前用药、过敏、肾脏/肝脏状况、医生医嘱、现有饮食/运动记录和正式处方，可能使建议与真实禁忌或治疗方案冲突。
+
+## 4. 桌面端实际问答链路的两个确定缺口
+
+诊单 AI 助手不是只用服务端诊单摘要。桌面端先把额外资料拼成最多 320 字的“患者综合资料”，再与医生问题合成最多 500 字的 `prompt`：`app/src/doctor_workstation/ui/dialogs/ai_consult.py:2682-2694`、`:2835-2928`。服务端把整个 `prompt` 当作 `<USER_QUESTION>`，同时另放自己构造的 `<CASE_DATA>`：`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:1052-1078`。真实流式请求体只有 `id`、`prompt`、`task`：`app/src/doctor_workstation/services/repository.py:1373-1391`。
+
+确定缺口如下：
+
+1. **每日血糖字段名不一致。** 客户端先读取 `tracking["blood_sugar"]`，再找 `entries|records|items`：`app/src/doctor_workstation/ui/dialogs/ai_consult.py:2710-2742`。但服务端跟踪接口返回的是 `blood_records`、`diet_records`、`exercise_records`：`server/app/adminapi/logic/tcm/DiagnosisLogic.php:4473-4502`；仓库层原样返回：`app/src/doctor_workstation/services/repository.py:2170-2191`。结果是逐日血糖不会进入 prompt，通常只剩诊单上的一次空腹血糖。
+2. **远端处方对象类型不一致。** 客户端只处理 `Mapping`，否则 `continue`：`app/src/doctor_workstation/ui/dialogs/ai_consult.py:2789-2806`。远端仓库却把列表解析为 `Prescription` 数据类：`app/src/doctor_workstation/services/repository.py:1643-1649`；该类定义于 `app/src/doctor_workstation/core/models.py:577-620`。结果是正式环境返回的处方不会进入 prompt。当前脚本 `app/scripts/check_ai_context.py:252-267` 用字典模拟处方，无法覆盖此契约错误。
+
+另有三个设计缺口：
+
+- 工作区已加载医生备注 `notes`，见 `app/src/doctor_workstation/ui/dialogs/ai_consult.py:3782-3801`，但调用 `build_patient_ai_context()` 时没有 notes 参数，见 `:3928-3951`。
+- 上下文顺序固定为血糖、舌脉、视频、历史 AI 报告、处方，并共享 320 字预算，见 `:2855-2898`；后面的处方更容易被预算耗尽，没有逐段保底或截断清单。
+- “历史AI报告”会作为新一轮模型输入，见 `:2769-2786`，存在把旧模型推断当作新证据反复强化的来源污染；应至少明确标记为模型生成内容并默认不作为临床事实。
+
+## 5. 鉴权与接口安全
+
+### 5.1 已有的有效控制
+
+- 管理端经过登录、权限认证等中间件：`server/app/adminapi/config/route.php:15-27`。诊单 AI 逻辑又独立校验精确权限和 `MyPatientLogic::canAccessDiagnosis()`，再读详情：`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:842-869`；权限匹配是精确小写 URI 白名单：`:744-755`。
+- 患者纵向报告同时要求查看权限和生成权限，见 `server/app/adminapi/logic/tcm/PatientAiReportLogic.php:126-149`，并通过 `MyPatientLogic::applyScope()` 限定医生/医助/部门数据域，且对不存在和越权返回同一错误，见 `:254-296`。
+- 患者端饮食四个入口不在 `notNeedLogin` 中：`server/app/api/controller/TcmController.php:36-42`；每个入口在调用 AI 前执行 `ensurePatientOwnsDiagnosis()`，通过当前用户的 `diagnosis_view_records` 验证归属：`:495-525`、`:904-977`。
+- `aiAnalysis`、患者报告读/生成使用严格字段白名单，拒绝客户端传 provider、BASE_URL、凭据和自由来源正文：`server/app/adminapi/validate/tcm/DiagnosisValidate.php:196-213`、`:269-327`。AI 助手 task 受枚举限制，prompt 最长 500：`:27-53`。
+- `DifyChatService` 只允许 qwen/openai profile、超时 1–300 秒，且启用 TLS 校验：`server/app/common/service/DifyChatService.php:13-50`、`:305-307`、`:329-343`、`:422-440`。它也不会把供应商原始错误正文和密钥回传给控制器。
+
+### 5.2 缺口与风险等级
+
+#### P0：患者端 AI 上游关闭 TLS 校验
+
+`AiChatService` 阻塞和流式路径均设置 `CURLOPT_SSL_VERIFYPEER=false`、`CURLOPT_SSL_VERIFYHOST=false`：`server/app/common/service/AiChatService.php:48-59`、`:144-160`。该服务承载姓名、血糖和自由问题，风险为患者隐私泄露、模型响应被篡改以及服务端密钥被中间人获取。
+
+最小修复：两处改为 `true`/`2`；对 `base_url` 做与 `DifyChatService::isValidBaseUrl()` 同等级校验；生产只允许 HTTPS。若企业内网使用私有 CA，应配置 CA bundle，不能关闭校验。
+
+#### P1：上下文不统一且诊单助手缺失关键临床资料
+
+诊单助手、分析和诊单报告虽然内部共用一份 builder，但这份 builder 没有患者级聚合能力；纵向报告和饮食 AI 又各自维护字段。这会造成同一患者在三个入口得到基于不同事实集的答案。
+
+最小修复：新增服务端只读 `PatientAiContextBuilder`，先接收已鉴权的 diagnosis/patient scope，再用 profile 决定范围：
+
+- `assistant`：当前诊单 + 最近 30/90 天日常记录 + 最近 N 条医生/跟踪备注 + 最近 N 次已完成视频转写 + 最近 N 张可见正式处方；
+- `diagnosis_report`：当前诊单的完整字段、备注、处方及附件元数据；
+- `longitudinal_report`：现有全病程分片策略，但补正式处方和来源清单；
+- `daily_diet`：只取饮食决策所需的最小临床子集，避免姓名。
+
+所有 profile 应返回 `source_manifest`、每类记录数量、时间窗和 `truncated_sections`，使 UI 与审计日志能准确说明模型看到了什么。
+
+#### P1：患者纵向报告无限查询/无限调用成本
+
+诊单查询和九类来源查询均未设置日期或行数上限：`server/app/adminapi/logic/tcm/PatientAiReportLogic.php:270-283`、`:342-392`。代码会按 120,000 字节切片、逐片调用模型，再最多做 8 轮归并，确保不静默截断：`:44-51`、`:630-729`。完整性设计是优点，但攻击者或异常大患者记录可触发大量数据库内存和模型请求，当前 AI 路径也未发现用户级/患者级频率限制或并发去重。
+
+最小修复：在查询层分页/游标读取；设置总来源字节、最大 chunk 数和最大上游调用数；生成任务使用 `(patient_id, model, source_hash)` 幂等锁；按管理员/患者限流。达到上限时返回显式“资料过多，需要缩小时间范围”，不可仍标记 `snapshot_complete=true`。
+
+#### P1：原始患者快照落库，保留范围过大
+
+上游发送前会脱敏，但落库的 `source_snapshot` 是脱敏前的 `$sourceJson`：快照先在 `server/app/adminapi/logic/tcm/PatientAiReportLogic.php:163-166` 构造，脱敏只在 `generateUpstreamReport()` 的 `:638-640` 执行，而原始 JSON 在 `:203-225` 直接写入 `source_snapshot`。它包含姓名、内部 ID、聊天/转写正文和附件 URL。历史接口有意识地不读取这个大字段，见 `:1012-1025`，但数据库静态泄露与过度保留风险仍存在。
+
+最小修复：若无需法律审计复现，仅存脱敏快照 + 哈希 + source manifest；若必须保存原文，则字段级加密、独立访问权限、明确 TTL/删除策略，并记录谁读取过原始快照。
+
+#### P1：患者端饮食 AI 暴露不必要姓名且临床约束不足
+
+姓名对 GI 推荐没有必要，但当前四套 prompt 均发送姓名，证据见第 3.3 节。与此同时，可能直接影响饮食安全的过敏、肾病/肾功能、当前用药和医生医嘱未进入模型。
+
+最小修复：删除 `patient_name`；加入最小化的风险字段并设置“若过敏/肝肾/用药信息缺失，不给个体化禁忌结论”；将问答文本放进明确的不可信数据边界，防止把用户问题中的指令当系统指令。
+
+#### P2：上游 URL/响应大小与中间件防线仍可加强
+
+- `DifyChatService` 的 URL 校验允许 `http` 和任意主机/IP：`server/app/common/service/DifyChatService.php:287-303`。虽然 URL 只来自服务端配置，不是请求参数，因此不是直接请求型 SSRF，但生产误配会把患者资料发往明文或非批准主机。建议 HTTPS-only + 域名 allowlist；若确有内网模型，使用独立显式配置开关并拒绝重定向到私网/环回地址。
+- 两个上游客户端都没有在传输阶段设置响应体最大字节数。`DifyChatService` 阻塞请求先整段 `RETURNTRANSFER`：`:329-354`，解析器的 32/64 KiB 限制发生在收完之后；流式路径也持续累积内容。建议在 write callback 中按字节中止，并区分“响应过大”错误。
+- `AuthMiddleware` 对不在全局菜单 URI 集合中的路由直接放行：`server/app/adminapi/http/middleware/AuthMiddleware.php:73-83`。当前诊单/患者 AI 逻辑自带权限校验，故没有形成直接越权；但新 AI 路由若忘记逻辑层校验会失守。最小修复是对 `/ai*` 或配置的敏感控制器 fail-closed，并保留逻辑层二次校验。
+
+#### P2：未接线的 DailyBloodCare 代码会在接线后立即失败
+
+`DailyBloodCareAiLogic` 调用不存在的 `DailyDietAiLogic::getPatientContext()`，且自身没有患者归属校验。当前无路由所以不构成线上入口；未来若启用，应先改为共享的公开 context builder，并在控制器进入逻辑前复用 `ensurePatientOwnsDiagnosis()`。不要只修方法名后直接暴露。
+
+## 6. 字段、时间范围和条数限制清单
+
+| 路径 | 当前限制 | 审计判断 |
+|---|---|---|
+| 诊单 AI 助手 | task 枚举；医生 prompt 500 字；上下文字段逐项最多 800 字 | 输入边界明确，但 500 字中还混入客户端上下文，医生问题会被截短；字段截断无 manifest。证据：`server/app/adminapi/validate/tcm/DiagnosisValidate.php:49-53`、`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:1653-1661` |
+| 诊单 AI 分析 | case 最多 16,000 字，响应最多 32,768 bytes，建议字段/风险条数均有限 | 输出校验较好；仍只看当前诊单且截断不告知模型/UI。证据：`server/app/adminapi/logic/tcm/DiagnosisAiLogic.php:21-58`、`:1025-1048` |
+| 患者纵向报告 | 数据库查询全历史、无行数上限；每片 120,000 bytes；综合 180,000 bytes；最多 8 轮归并；响应 65,536 bytes | 不静默漏源，但数据库内存、延迟和费用无硬上限。证据：`server/app/adminapi/logic/tcm/PatientAiReportLogic.php:36-51`、`:630-729` |
+| 患者端饮食推荐 | 血糖 30 天；近 7 天最多 7 条明细；问答 80 字；缓存推荐 1 天、问答 1 小时 | 时间窗合理，但 `refresh=1` 可反复绕过推荐缓存，未见限流；30 天查询无显式行数 cap。证据：`server/app/api/logic/tcm/DailyDietAiLogic.php:28-109`、`:291-326` |
+| 处方库 AI | 最多 80 味有效药材；待生成列表最多 500 条 | 属于非患者入口，边界基本清晰。证据：`server/app/adminapi/logic/tcm/PrescriptionLibraryAiLogic.php:83-120`、`:604-625` |
+| Dify 上游 | profile 仅 qwen/openai；timeout 1–300 秒 | 正向控制；缺传输级响应大小上限与生产域名 allowlist。证据：`server/app/common/service/DifyChatService.php:16-20`、`:305-307` |
+
+## 7. 建议的最小修复顺序
+
+1. **当天可改**：恢复 `AiChatService` TLS 校验；饮食 prompt 去掉患者姓名；为上游响应设置硬字节上限。
+2. **第一批契约修复**：桌面端读取 `blood_records`；处方 helper 同时支持 `Prescription` 对象；把 notes 显式加入或由服务端统一拼装；补覆盖真实远端类型/字段名的测试。
+3. **服务端临床完整性**：给 `DiagnosisAiLogic::CASE_FIELDS` 补真实 `prescription`、`doctor_advice`；接入最近医生/跟踪备注、视频转写、日常记录和经 `canViewPrescription()` 过滤的正式处方；不要把附件 URL 当内容，若有 OCR 则以独立、带来源的文本字段加入。
+4. **统一 builder**：让 DiagnosisAi、PatientAiReport、DailyDiet 复用同一数据访问/脱敏/来源清单层，只在 profile 的时间窗和字段最小化上不同。
+5. **资源与审计**：患者报告增加查询/调用/总字节上限、幂等锁和限流；调整原始 `source_snapshot` 的加密与保留策略；所有结果返回上下文版本、来源数量和截断信息。
+
+## 8. 最终判断
+
+目前“诊单 AI 助手会自动拿到患者完整资料”的说法不成立。服务端只自动拿当前诊单摘要；桌面端确实尝试补视频、血糖、处方等，但 320 字预算及两个契约错误使其远达不到完整上下文。患者纵向 AI 报告是唯一真正覆盖视频转写、备注、聊天和日常记录的入口，却没有正式处方/处方病历，并且全历史、无限行的实现带来显著资源与隐私保留风险。
+
+建议把“统一上下文”定义为**统一的数据访问、鉴权、脱敏、来源清单和截断协议**，而不是要求所有入口发送同样多的数据。饮食问答应最小化；纵向报告可更完整；诊单助手应在可控时间窗内补齐临床关键项。这样才能同时解决答案一致性、隐私最小化和成本边界。
@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="真阳医生工作台">
-  <rect width="64" height="64" rx="16" fill="#123F3A"/>
-  <path d="M29 14h6a3 3 0 0 1 3 3v10h9a3 3 0 0 1 3 3v5a3 3 0 0 1-3 3h-9v9a3 3 0 0 1-3 3h-6a3 3 0 0 1-3-3v-9h-9a3 3 0 0 1-3-3v-5a3 3 0 0 1 3-3h9V17a3 3 0 0 1 3-3Z" fill="#F6F4EE"/>
-  <path d="M42 16c-1 8-5 13-12 15 2-7 6-12 12-15Z" fill="#79B9A4"/>
-</svg>
@@ -4,6 +4,7 @@ set -euo pipefail
 project_root="$(cd "$(dirname "$0")/.." && pwd)"
 python_bin="${PYINSTALLER_PYTHON:-$project_root/.venv-build/bin/python}"
 companion_root="$project_root/video_companion"
+macos_icon="$project_root/resources/branding/app-icon.icns"

 if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "The macOS bundle must be built on macOS." >&2
@@ -13,6 +14,10 @@ if [[ ! -x "$python_bin" ]]; then
  echo "Build Python was not found: $python_bin" >&2
  exit 2
 fi
+if [[ ! -f "$macos_icon" ]]; then
+  echo "macOS application icon was not found: $macos_icon" >&2
+  exit 2
+fi

 if [[ "${SKIP_FRONTEND_INSTALL:-0}" != "1" ]]; then
  npm ci --prefix "$companion_root" --no-audit --no-fund
@@ -8,6 +8,7 @@ $ErrorActionPreference = "Stop"
 $ProjectRoot = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
 $CompanionRoot = Join-Path $ProjectRoot "video_companion"
 $Spec = Join-Path $ProjectRoot "packaging\doctor_workstation.spec"
+$WindowsIcon = Join-Path $ProjectRoot "resources\branding\app-icon.ico"

 function Invoke-FrozenGate {
    param(
@@ -153,6 +154,9 @@ if (-not [System.IO.Path]::IsPathRooted($Python)) {
 if (-not (Test-Path -LiteralPath $Python -PathType Leaf)) {
    throw "Build Python was not found: $Python"
 }
+if (-not (Test-Path -LiteralPath $WindowsIcon -PathType Leaf)) {
+    throw "Windows application icon was not found: $WindowsIcon"
+}

 $Npm = (Get-Command npm.cmd -ErrorAction Stop).Source
 Push-Location $ProjectRoot
@@ -0,0 +1,315 @@
+"""Smoke test for the AI context builder helpers in ai_consult.py.
+
+This avoids importing PySide6-bound modules by extracting only the pure
+helper functions we want to verify.
+"""
+
+from __future__ import annotations
+
+import ast
+import os
+import sys
+
+
+AI_CONSULT_PATH = os.path.join(
+    os.path.dirname(__file__), "..", "src", "doctor_workstation", "ui", "dialogs",
+    "ai_consult.py",
+)
+
+
+def _make_helpers() -> dict[str, object]:
+    """Pull the pure helpers out of ai_consult.py without importing PySide6."""
+
+    with open(AI_CONSULT_PATH, encoding="utf-8") as stream:
+        source = stream.read()
+    tree = ast.parse(source)
+    wanted_names = {
+        "AI_CONTEXT_MAX_CHARS",
+        "AI_PROMPT_LIMIT",
+        "AI_CONTEXT_SEPARATOR",
+        "_truncate_for_context",
+        "_patient_context_blood_sugar",
+        "_patient_context_tongue",
+        "_patient_context_reports",
+        "_patient_context_prescriptions",
+        "_patient_context_videos",
+        "build_patient_ai_context",
+        "_compose_ai_prompt",
+    }
+    selected: list[ast.stmt] = []
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef) and node.name in wanted_names:
+            selected.append(node)
+            continue
+        if isinstance(node, ast.Assign):
+            for target in node.targets:
+                if isinstance(target, ast.Name) and target.id in wanted_names:
+                    selected.append(node)
+                    break
+
+    namespace: dict[str, object] = {}
+
+    def _as_mapping(value: object) -> dict[str, object]:
+        if isinstance(value, dict):
+            return dict(value)
+        raw = getattr(value, "raw", None)
+        return dict(raw) if isinstance(raw, dict) else {}
+
+    def first_value(value: object, *keys: str, default: object = None) -> object:
+        """Return the first present, non-empty value from ``keys``.
+
+        Mirrors ``widgets.first_value``:
+        ``first_value(mapping, "k1", "k2", default=...)``.
+        """
+
+        for key in keys:
+            if not isinstance(value, dict):
+                break
+            if key in value and value[key] not in (None, "", "—"):
+                return value[key]
+        return default
+
+    def get_value(source: object, key: str, default: object = None) -> object:
+        if isinstance(source, dict) and key in source:
+            return source[key]
+        return default
+
+    def _human_value(value: object, *, empty: str = "未记录") -> str:
+        if value in (None, "", "—"):
+            return empty
+        if isinstance(value, str):
+            return value.strip() or empty
+        if isinstance(value, bool):
+            return "是" if value else "否"
+        if isinstance(value, dict):
+            parts = []
+            for key, nested in value.items():
+                rendered = _human_value(nested, empty="")
+                if rendered:
+                    parts.append(f"{key}：{rendered}")
+            return "；".join(parts) or empty
+        if isinstance(value, list):
+            parts = [_human_value(item, empty="") for item in value]
+            return "、".join(part for part in parts if part) or empty
+        return str(value).strip() or empty
+
+    def display_text(value: object, *, default: str = "") -> str:
+        if value in (None, "", "—"):
+            return default
+        return str(value).strip() or default
+
+    def _exact_positive_id(value: object, expected: int) -> bool:
+        if value in (None, ""):
+            return False
+        try:
+            return int(value) == expected
+        except (TypeError, ValueError):
+            return False
+
+    # Provide fallback names for ``collections.abc`` symbols referenced by
+    # the helpers without forcing the real module imports on this stub box.
+    import collections.abc as _abc
+    Sequence = _abc.Sequence  # type: ignore[attr-defined]
+    Mapping = _abc.Mapping  # type: ignore[attr-defined]
+    Any = object  # type: ignore[assignment]
+
+    namespace.update(
+        {
+            "_as_mapping": _as_mapping,
+            "first_value": first_value,
+            "get_value": get_value,
+            "_human_value": _human_value,
+            "display_text": display_text,
+            "_exact_positive_id": _exact_positive_id,
+            "Sequence": Sequence,
+            "Mapping": Mapping,
+            "Any": Any,
+        }
+    )
+
+    module_ast = ast.Module(body=selected, type_ignores=[])
+    ast.fix_missing_locations(module_ast)
+    exec(compile(module_ast, AI_CONSULT_PATH, "exec"), namespace)
+    return namespace
+
+
+def main() -> None:
+    helpers = _make_helpers()
+    AI_CONTEXT_MAX_CHARS = helpers["AI_CONTEXT_MAX_CHARS"]
+    AI_PROMPT_LIMIT = helpers["AI_PROMPT_LIMIT"]
+    _truncate_for_context = helpers["_truncate_for_context"]
+    _patient_context_blood_sugar = helpers["_patient_context_blood_sugar"]
+    _patient_context_tongue = helpers["_patient_context_tongue"]
+    _patient_context_reports = helpers["_patient_context_reports"]
+    _patient_context_videos = helpers["_patient_context_videos"]
+    build_patient_ai_context = helpers["build_patient_ai_context"]
+    _compose_ai_prompt = helpers["_compose_ai_prompt"]
+
+    def fail(message: str) -> None:
+        raise AssertionError(message)
+
+    def assertEqual(actual: object, expected: object, message: str) -> None:
+        if actual != expected:
+            fail(f"{message}: expected {expected!r}, got {actual!r}")
+
+    def assertContains(container: object, needle: str, message: str) -> None:
+        if not isinstance(container, str) or needle not in container:
+            fail(f"{message}: {needle!r} missing in output")
+
+    # 1. _truncate_for_context
+    short = _truncate_for_context("hello", max_chars=10)
+    assertEqual(short, "hello", "short text should pass through unchanged")
+
+    long_text = _truncate_for_context(
+        "诊断：血糖偏高，建议调整饮食结构，配合运动每周三次以上。",
+        max_chars=12,
+    )
+    assertContains(long_text, "…", "long text should end with ellipsis")
+    assertEqual(len(long_text), 12, "truncated text should respect max_chars")
+
+    # 2. _patient_context_tongue
+    tongue = _patient_context_tongue(
+        {
+            "diagnosis": {
+                "tongue": "舌红苔黄腻",
+                "tongue_coating": "黄腻",
+                "pulse": "弦滑",
+                "tongue_images": ["url1", "url2", "url3"],
+            }
+        }
+    )
+    assertContains(tongue, "舌红苔黄腻", "tongue text missing")
+    assertContains(tongue, "弦滑", "pulse text missing")
+    assertContains(tongue, "舌苔图片 3 张", "tongue image count missing")
+
+    # 3. _patient_context_blood_sugar
+    blood_sugar = _patient_context_blood_sugar(
+        {"diagnosis": {"fasting_blood_sugar": "7.8"}},
+        {
+            "blood_sugar": {
+                "entries": [
+                    {"date": "2026-08-15", "value": "6.2", "period": "空腹"},
+                    {"date": "2026-08-14", "value": "9.1", "period": "餐后"},
+                ]
+            }
+        },
+    )
+    assertContains(blood_sugar, "7.8", "fasting reading missing")
+    assertContains(blood_sugar, "每日血糖", "tracking summary missing")
+
+    # 4. _patient_context_videos: filters by current diagnosis id.
+    videos = _patient_context_videos(
+        [
+            {
+                "diagnosis_id": 99,
+                "transcript_text": "其他诊单",
+                "start_time_text": "今天",
+            },
+            {
+                "diagnosis_id": 501,
+                "transcript_text": "医生：请问您最近睡眠如何；患者：经常失眠。",
+                "start_time_text": "2026-08-15 10:30",
+            },
+        ],
+        diagnosis_id=501,
+    )
+    assertContains(videos, "医生", "transcript text missing")
+    assertContains(videos, "2026-08-15", "transcript timestamp missing")
+
+    # 5. _patient_context_reports
+    reports = _patient_context_reports(
+        {
+            "summary": "近期血糖偏高",
+            "diagnosis_advice": "建议控制饮食",
+            "risk_assessment": ["心血管风险升高", "肾功负担加重"],
+        }
+    )
+    assertContains(reports, "既往AI摘要", "summary missing")
+    assertContains(reports, "诊断建议", "advice missing")
+    assertContains(reports, "心血管风险", "risk bullet missing")
+
+    # 6. build_patient_ai_context: full envelope assembly.
+    detail = {
+        "diagnosis": {
+            "tongue": "舌淡苔白",
+            "pulse": "细弱",
+            "fasting_blood_sugar": "8.0",
+        },
+        "tongue_images": ["a", "b"],
+    }
+    tracking = {
+        "blood_sugar": {
+            "entries": [
+                {"date": "2026-08-19", "value": "6.1", "period": "空腹"},
+            ]
+        }
+    }
+    analysis = {
+        "summary": "控制尚可",
+        "diagnosis_advice": "调整饮食",
+        "risk_assessment": ["肾功"],
+    }
+    prescriptions = [
+        {"prescription_name": "六味地黄丸", "prescription_remark": "调理方"},
+    ]
+    call_records = [
+        {
+            "diagnosis_id": 501,
+            "transcript_text": "对话内容：患者表述近期乏力。",
+            "start_time_text": "2026-08-18 14:00",
+        }
+    ]
+    context_text, present = build_patient_ai_context(
+        detail=detail,
+        tracking=tracking,
+        analysis=analysis,
+        prescriptions=prescriptions,
+        call_records=call_records,
+        diagnosis_id=501,
+    )
+    for label in (
+        "每日血糖",
+        "舌苔/脉象",
+        "视频问诊文字",
+        "历史AI报告",
+        "处方记录",
+    ):
+        assertContains(context_text, label, f"section {label} missing in envelope")
+        if label not in present:
+            fail(f"label {label} not in present labels")
+    if len(context_text) > AI_CONTEXT_MAX_CHARS + 12:
+        fail(f"context exceeds {AI_CONTEXT_MAX_CHARS} chars: {len(context_text)}")
+
+    # 7. _compose_ai_prompt: short answer stays untouched.
+    short_prompt = _compose_ai_prompt("血糖如何？", context_text)
+    assertContains(short_prompt, context_text, "short prompt loses context")
+    assertContains(short_prompt, "血糖如何？", "short prompt loses question")
+    if len(short_prompt) > AI_PROMPT_LIMIT:
+        fail("short prompt exceeds limit")
+
+    # 8. Long answer is truncated with ellipsis.
+    long_question = (
+        "请结合患者既往糖尿病史、家族史以及服用的多种药物，给出一份详尽的"
+        "个性化治疗方案，并解释每一步的理由，最终输出一份结构化报告，"
+        "包括风险评估、用药合理性、并发症筛查和分级随访计划。"
+    ) * 6
+    long_prompt = _compose_ai_prompt(long_question, context_text)
+    if len(long_prompt) > AI_PROMPT_LIMIT:
+        fail(f"long prompt exceeds limit: {len(long_prompt)}")
+    if context_text not in long_prompt:
+        fail("long prompt loses context")
+    assertContains(long_prompt, "…", "long prompt should end with ellipsis")
+
+    # 9. Empty context returns bare question.
+    bare = _compose_ai_prompt("血糖？", "")
+    assertEqual(bare, "血糖？", "empty context should drop the envelope entirely")
+
+    # 10. Empty question returns empty string.
+    empty = _compose_ai_prompt("", context_text)
+    assertEqual(empty, "", "empty question returns empty string")
+
+    print("OK: all AI context helper assertions passed")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,102 @@
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = "Stop"
+$ProjectRoot = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+$ToolVersion = "6.7.3"
+$ToolRoot = Join-Path $ProjectRoot ".build-tools\inno-setup-$ToolVersion"
+$Compiler = Join-Path $ToolRoot "ISCC.exe"
+$DownloadRoot = Join-Path $ProjectRoot ".build-tools\downloads"
+$Installer = Join-Path $DownloadRoot "innosetup-$ToolVersion.exe"
+$InstallerUrl = (
+    "https://github.com/jrsoftware/issrc/releases/download/" +
+    "is-6_7_3/innosetup-$ToolVersion.exe"
+)
+$InstallerSha256 = "9C73C3BAE7ED48D44112A0F48E66742C00090BDB5BEF71D9D3C056C66E97B732"
+$LanguageRoot = Join-Path $ProjectRoot ".build-tools\inno-languages"
+$ChineseMessages = Join-Path $LanguageRoot "ChineseSimplified.isl"
+$ChineseMessagesUrl = (
+    "https://raw.githubusercontent.com/jrsoftware/issrc/" +
+    "6ef32198ef1f7b7b375cd4b6b90896c2a58eb4c2/Files/Languages/ChineseSimplified.isl"
+)
+$ChineseMessagesSha256 = "E0B0B350E2245F3C5E65586DFE43D574F6E7F06F2261149ABA284954B3FC9A8D"
+
+function Test-Compiler {
+    param([Parameter(Mandatory = $true)][string]$Candidate)
+
+    if (-not (Test-Path -LiteralPath $Candidate -PathType Leaf)) {
+        return $false
+    }
+    $ReleaseNotes = Join-Path (Split-Path -Parent $Candidate) "whatsnew.htm"
+    if (-not (Test-Path -LiteralPath $ReleaseNotes -PathType Leaf)) {
+        return $false
+    }
+    $ReleaseText = [System.IO.File]::ReadAllText($ReleaseNotes)
+    $VersionMatch = [regex]::Match($ReleaseText, '<span class="ver">([0-9.]+)')
+    return $VersionMatch.Success -and $VersionMatch.Groups[1].Value -eq $ToolVersion
+}
+
+New-Item -ItemType Directory -Path $LanguageRoot -Force | Out-Null
+if (Test-Path -LiteralPath $ChineseMessages -PathType Leaf) {
+    $ExistingLanguageHash = (Get-FileHash -LiteralPath $ChineseMessages -Algorithm SHA256).Hash
+    if ($ExistingLanguageHash -ne $ChineseMessagesSha256) {
+        Remove-Item -LiteralPath $ChineseMessages -Force
+    }
+}
+if (-not (Test-Path -LiteralPath $ChineseMessages -PathType Leaf)) {
+    Write-Host "Downloading the pinned Simplified Chinese installer messages..."
+    Invoke-WebRequest -Uri $ChineseMessagesUrl -OutFile $ChineseMessages -UseBasicParsing
+}
+$ActualLanguageHash = (Get-FileHash -LiteralPath $ChineseMessages -Algorithm SHA256).Hash
+if ($ActualLanguageHash -ne $ChineseMessagesSha256) {
+    throw "Inno Setup language checksum mismatch. Expected $ChineseMessagesSha256; found $ActualLanguageHash"
+}
+
+foreach ($Candidate in @(
+    $Compiler,
+    (Join-Path ${env:ProgramFiles(x86)} "Inno Setup 6\ISCC.exe"),
+    (Join-Path $env:LOCALAPPDATA "Programs\Inno Setup 6\ISCC.exe")
+)) {
+    if ($Candidate -and (Test-Compiler -Candidate $Candidate)) {
+        Write-Output (Resolve-Path -LiteralPath $Candidate).Path
+        exit 0
+    }
+}
+
+New-Item -ItemType Directory -Path $DownloadRoot -Force | Out-Null
+if (Test-Path -LiteralPath $Installer -PathType Leaf) {
+    $ExistingHash = (Get-FileHash -LiteralPath $Installer -Algorithm SHA256).Hash
+    if ($ExistingHash -ne $InstallerSha256) {
+        Remove-Item -LiteralPath $Installer -Force
+    }
+}
+
+if (-not (Test-Path -LiteralPath $Installer -PathType Leaf)) {
+    Write-Host "Downloading pinned Inno Setup $ToolVersion compiler..."
+    Invoke-WebRequest -Uri $InstallerUrl -OutFile $Installer -UseBasicParsing
+}
+
+$ActualHash = (Get-FileHash -LiteralPath $Installer -Algorithm SHA256).Hash
+if ($ActualHash -ne $InstallerSha256) {
+    throw "Inno Setup download checksum mismatch. Expected $InstallerSha256; found $ActualHash"
+}
+$Signature = Get-AuthenticodeSignature -LiteralPath $Installer
+if ($Signature.Status -ne [System.Management.Automation.SignatureStatus]::Valid) {
+    throw "Inno Setup download does not have a valid Authenticode signature: $($Signature.Status)"
+}
+if (-not $Signature.SignerCertificate -or
+    $Signature.SignerCertificate.Subject -notmatch "O=Pyrsys B\.V\.") {
+    throw "Inno Setup download has an unexpected signer"
+}
+
+New-Item -ItemType Directory -Path $ToolRoot -Force | Out-Null
+Write-Host "Installing the pinned Inno Setup compiler into $ToolRoot ..."
+& $Installer /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /CURRENTUSER "/DIR=$ToolRoot"
+if ($LASTEXITCODE -ne 0) {
+    throw "Inno Setup compiler installation failed with exit code $LASTEXITCODE"
+}
+if (-not (Test-Compiler -Candidate $Compiler)) {
+    throw "Inno Setup installation completed without ISCC.exe: $Compiler"
+}
+
+Write-Output $Compiler
@@ -0,0 +1,139 @@
+"""Generate deterministic application-brand assets from the approved master PNG."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from PIL import Image, ImageDraw
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+DEFAULT_MASTER = PROJECT_ROOT / "resources" / "branding" / "brand-master.png"
+BRANDING_ROOT = PROJECT_ROOT / "resources" / "branding"
+VIDEO_PUBLIC_ROOT = PROJECT_ROOT / "video_companion" / "public"
+ICON_SIZES = (16, 20, 24, 32, 40, 48, 64, 128, 256)
+
+
+def _transparent_connected_background(image: Image.Image) -> Image.Image:
+    """Remove only near-white pixels connected to the crop boundary.
+
+    The logo contains intentional white ECG strokes.  A global color-key would
+    erase them, whereas a connected-background mask preserves enclosed whites.
+    """
+
+    rgb = image.convert("RGB")
+    candidates = Image.new("L", rgb.size)
+    candidates.putdata(
+        [
+            255
+            if min(pixel) >= 185 and max(pixel) - min(pixel) <= 70
+            else 0
+            for pixel in rgb.getdata()
+        ]
+    )
+    ImageDraw.floodfill(candidates, (0, 0), 128, thresh=0)
+    alpha = candidates.point(lambda value: 0 if value == 128 else 255)
+    rgba = rgb.convert("RGBA")
+    rgba.putalpha(alpha)
+    return rgba
+
+
+def _square_icon(image: Image.Image, size: int = 1024, padding: int = 72) -> Image.Image:
+    available = size - padding * 2
+    scale = min(available / image.width, available / image.height)
+    rendered = image.resize(
+        (round(image.width * scale), round(image.height * scale)),
+        Image.Resampling.LANCZOS,
+    )
+    tile = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    tile_mask = Image.new("L", (size, size), 0)
+    ImageDraw.Draw(tile_mask).rounded_rectangle(
+        (24, 24, size - 24, size - 24),
+        radius=190,
+        fill=255,
+    )
+    white_tile = Image.new("RGBA", (size, size), (255, 255, 255, 255))
+    tile.paste(white_tile, mask=tile_mask)
+    tile.alpha_composite(
+        rendered.convert("RGBA"),
+        ((size - rendered.width) // 2, (size - rendered.height) // 2),
+    )
+    return tile
+
+
+def generate(master_path: Path) -> tuple[Path, ...]:
+    master = Image.open(master_path).convert("RGB")
+    if master.size != (1254, 1254):
+        raise ValueError(f"expected a 1254x1254 brand master, got {master.size}")
+
+    BRANDING_ROOT.mkdir(parents=True, exist_ok=True)
+    VIDEO_PUBLIC_ROOT.mkdir(parents=True, exist_ok=True)
+
+    lockup_bbox = _transparent_connected_background(master).getchannel("A").getbbox()
+    if lockup_bbox is None:
+        raise ValueError("brand lockup extraction produced an empty image")
+    left, top, right, bottom = lockup_bbox
+    full_lockup = master.crop(
+        (
+            max(0, left - 28),
+            max(0, top - 28),
+            min(master.width, right + 28),
+            min(master.height, bottom + 28),
+        )
+    )
+
+    # The supplied artwork places the pictorial mark wholly above y=720.  The
+    # crop intentionally excludes the Chinese and English lockup for legible
+    # Windows/macOS small icons.
+    mark_crop = master.crop((300, 110, 980, 720))
+    mark_bbox = _transparent_connected_background(mark_crop).getchannel("A").getbbox()
+    if mark_bbox is None:
+        raise ValueError("application icon extraction produced an empty image")
+    left, top, right, bottom = mark_bbox
+    app_icon = _square_icon(
+        mark_crop.crop(
+            (
+                max(0, left - 12),
+                max(0, top - 12),
+                min(mark_crop.width, right + 12),
+                min(mark_crop.height, bottom + 12),
+            )
+        )
+    )
+
+    lockup_path = BRANDING_ROOT / "brand-lockup.png"
+    icon_png_path = BRANDING_ROOT / "app-icon.png"
+    icon_ico_path = BRANDING_ROOT / "app-icon.ico"
+    icon_icns_path = BRANDING_ROOT / "app-icon.icns"
+    favicon_path = VIDEO_PUBLIC_ROOT / "favicon.png"
+
+    full_lockup.save(lockup_path, optimize=True)
+    app_icon.save(icon_png_path, optimize=True)
+    app_icon.save(
+        icon_ico_path,
+        format="ICO",
+        sizes=[(size, size) for size in ICON_SIZES],
+    )
+    app_icon.save(icon_icns_path, format="ICNS")
+    app_icon.resize((64, 64), Image.Resampling.LANCZOS).save(
+        favicon_path,
+        optimize=True,
+    )
+
+    return lockup_path, icon_png_path, icon_ico_path, icon_icns_path, favicon_path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--master", type=Path, default=DEFAULT_MASTER)
+    args = parser.parse_args()
+    master_path = args.master.resolve()
+    if not master_path.is_file():
+        parser.error(f"brand master is missing: {master_path}")
+    for output in generate(master_path):
+        print(output)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -17,8 +17,12 @@ $Executable = Join-Path $Artifact "DoctorWorkstation.exe"
 $DistributionRoot = Join-Path $ProjectRoot "dist"
 $ReleaseLauncherTemplate = Join-Path $ProjectRoot "packaging\windows\start_release.bat"
 $ReleaseLauncher = Join-Path $DistributionRoot "Start_DoctorWorkstation.bat"
+$InstallerDefinition = Join-Path $ProjectRoot "packaging\windows\doctor_workstation.iss"
+$EnsureInstallerCompiler = Join-Path $PSScriptRoot "ensure_inno_setup.ps1"
+$InstallerMessagesFile = Join-Path $ProjectRoot ".build-tools\inno-languages\ChineseSimplified.isl"
 $ProjectMetadata = Join-Path $ProjectRoot "pyproject.toml"
 $MediaSmokeHook = Join-Path $ProjectRoot "packaging\runtime_media_smoke.py"
+$WindowsIcon = Join-Path $ProjectRoot "resources\branding\app-icon.ico"

 function Test-BuildPython {
    param([Parameter(Mandatory = $true)][string]$Candidate)
@@ -51,7 +55,10 @@ try {
        (Join-Path $ProjectRoot "uv.lock"),
        $ProjectMetadata,
        $MediaSmokeHook,
-        $ReleaseLauncherTemplate
+        $WindowsIcon,
+        $ReleaseLauncherTemplate,
+        $InstallerDefinition,
+        $EnsureInstallerCompiler
    )) {
        if (-not (Test-Path -LiteralPath $RequiredFile -PathType Leaf)) {
            throw "Required build file is missing: $RequiredFile"
@@ -76,7 +83,7 @@ try {
            -not (Test-BuildPython -Candidate $FallbackPython)) {
            throw "Neither uv nor a usable Python environment with build dependencies was found."
        }
-        Write-Host "Windows package entry validation passed."
+        Write-Host "Windows package entry validation passed. No artifacts were generated."
        exit 0
    }

@@ -161,6 +168,8 @@ try {
    $ReleaseZip = Join-Path $DistributionRoot (
        "DoctorWorkstation-Windows-x64-$ProjectVersion.zip"
    )
+    $InstallerBaseName = "DoctorWorkstation-Setup-Windows-x64-$ProjectVersion"
+    $InstallerArtifact = Join-Path $DistributionRoot "$InstallerBaseName.exe"
    $ChecksumFile = Join-Path $DistributionRoot "SHA256SUMS.txt"
    Copy-Item -LiteralPath $ReleaseLauncherTemplate -Destination $ReleaseLauncher -Force
    if (Test-Path -LiteralPath $ReleaseZip) {
@@ -192,15 +201,54 @@ try {
        throw "Packaging completed without the expected ZIP: $ReleaseZip"
    }

+    if (Test-Path -LiteralPath $InstallerArtifact) {
+        Remove-Item -LiteralPath $InstallerArtifact -Force
+    }
+    Write-Host "Preparing the pinned Inno Setup compiler..."
+    $InnoCompiler = (& $EnsureInstallerCompiler | Select-Object -Last 1)
+    if (-not $InnoCompiler -or
+        -not (Test-Path -LiteralPath $InnoCompiler -PathType Leaf)) {
+        throw "Unable to locate the Inno Setup compiler"
+    }
+    if (-not (Test-Path -LiteralPath $InstallerMessagesFile -PathType Leaf)) {
+        throw "Simplified Chinese installer messages are missing: $InstallerMessagesFile"
+    }
+
+    Write-Host "Creating the Windows installer..."
+    & $InnoCompiler `
+        "/DAppVersion=$ProjectVersion" `
+        "/DSourceDir=$Artifact" `
+        "/DOutputDir=$DistributionRoot" `
+        "/DSetupBaseName=$InstallerBaseName" `
+        "/DChineseMessagesFile=$InstallerMessagesFile" `
+        "/DAppIconFile=$WindowsIcon" `
+        $InstallerDefinition
+    if ($LASTEXITCODE -ne 0) {
+        throw "Inno Setup failed with exit code $LASTEXITCODE"
+    }
+    if (-not (Test-Path -LiteralPath $InstallerArtifact -PathType Leaf)) {
+        throw "Installer compilation completed without the expected artifact: $InstallerArtifact"
+    }
+
    $ReleaseHash = (Get-FileHash -LiteralPath $ReleaseZip -Algorithm SHA256).Hash
-    $ChecksumLine = "$ReleaseHash  $([System.IO.Path]::GetFileName($ReleaseZip))`r`n"
+    $InstallerHash = (Get-FileHash -LiteralPath $InstallerArtifact -Algorithm SHA256).Hash
+    $ChecksumLines = @(
+        "$InstallerHash  $([System.IO.Path]::GetFileName($InstallerArtifact))",
+        "$ReleaseHash  $([System.IO.Path]::GetFileName($ReleaseZip))"
+    )
    $Utf8WithoutBom = New-Object System.Text.UTF8Encoding($false)
-    [System.IO.File]::WriteAllText($ChecksumFile, $ChecksumLine, $Utf8WithoutBom)
+    [System.IO.File]::WriteAllText(
+        $ChecksumFile,
+        (($ChecksumLines -join "`r`n") + "`r`n"),
+        $Utf8WithoutBom
+    )

    Write-Host "Windows package complete." -ForegroundColor Green
    Write-Host "Artifact: $Artifact" -ForegroundColor Green
+    Write-Host "Installer: $InstallerArtifact" -ForegroundColor Green
    Write-Host "Release ZIP: $ReleaseZip" -ForegroundColor Green
-    Write-Host "SHA-256: $ReleaseHash" -ForegroundColor Green
+    Write-Host "Installer SHA-256: $InstallerHash" -ForegroundColor Green
+    Write-Host "ZIP SHA-256: $ReleaseHash" -ForegroundColor Green
    exit 0
 }
 catch {
@@ -31,6 +31,8 @@ class _ScreenshotDiagnosisDialog(QWidget):

 consultations_module.DiagnosisDialog = _ScreenshotDiagnosisDialog

+DENSITY_SIZES = ((1366, 768), (1710, 920))
+

 def _row(identifier: int, variant: int) -> dict[str, Any]:
    common: dict[str, Any] = {
@@ -335,7 +337,7 @@ def _save_with_payment_qr(
    return path


-def render() -> list[Path]:
+def _application() -> QApplication:
    app = QApplication.instance() or QApplication([])
    # The offscreen Windows plugin does not enumerate system fonts.  Register
    # the same CJK face used by the production QSS when it is available.
@@ -345,12 +347,35 @@ def render() -> list[Path]:
        families = QFontDatabase.applicationFontFamilies(font_id)
        if families:
            app.setFont(QFont(families[0], 9))
+    return app
+
+
+def render_density() -> list[Path]:
+    """Render only the two desktop-density acceptance sizes."""
+
+    app = _application()
    root = Path(__file__).resolve().parents[1]
    output = root / "artifacts" / "diagnosis_visual"
    output.mkdir(parents=True, exist_ok=True)
    paths: list[Path] = []
    repository = ScreenshotRepository()
-    for width, height in ((1024, 640), (1440, 900)):
+    for width, height in DENSITY_SIZES:
+        page = _new_page(app, repository, width, height)
+        path = output / f"diagnosis_{width}x{height}.png"
+        paths.append(_save(page, path))
+        page.close()
+        app.processEvents()
+    return paths
+
+
+def render() -> list[Path]:
+    app = _application()
+    root = Path(__file__).resolve().parents[1]
+    output = root / "artifacts" / "diagnosis_visual"
+    output.mkdir(parents=True, exist_ok=True)
+    paths: list[Path] = []
+    repository = ScreenshotRepository()
+    for width, height in ((1024, 640), *DENSITY_SIZES, (1440, 900)):
        page = _new_page(app, repository, width, height)
        path = output / f"diagnosis_{width}x{height}.png"
        paths.append(_save(page, path))
@@ -0,0 +1,119 @@
+"""Render patient-level AI report layout regressions with the offscreen Qt backend."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+from PySide6.QtGui import QFontDatabase
+from PySide6.QtWidgets import QApplication, QLabel, QScrollArea
+
+from doctor_workstation.ui.pages.reception import _ReceptionAiAnalysisDialog
+
+
+def _report_payload(model_key: str) -> dict[str, object]:
+    model_label = "OpenAI" if model_key == "openai" else "千问"
+    return {
+        "model_key": model_key,
+        "model_label": model_label,
+        "generated_at": "2026-08-17 10:20:00",
+        "diagnosis_advice": [
+            "2型糖尿病，HbA1c 7.5%，近期空腹血糖仍有波动。",
+            "建议：1. 监测空腹血糖 2. 记录餐后2小时血糖 3. 复核低血糖症状",
+            r"保留患者原始报告结构。\n结合复诊记录动态调整随访频率。",
+        ],
+        "risk_assessment": [
+            {"label": "低血糖", "level": "high"},
+            {"label": "依从性风险", "level": "medium"},
+            {"label": "并发症筛查延误风险", "level": "low"},
+            {"label": "复诊中断风险", "level": "medium"},
+            {
+                "label": "肾功能变化可能影响二甲双胍方案，需要结合复查结果持续评估。",
+                "level": "high",
+            },
+            {"label": "饮食波动风险", "level": "low"},
+        ],
+        "treatment_advice": [
+            r"二甲双胍 0.5g，每日2次。\n复查肾功能后再评估剂量。",
+            "继续糖尿病饮食教育，并记录运动后的血糖变化。",
+            "如出现心悸、出汗或意识异常，及时复测血糖并按流程处置。",
+        ],
+    }
+
+
+def _render(
+    app: QApplication,
+    output: Path,
+    *,
+    width: int,
+    height: int,
+) -> None:
+    histories = {
+        "qwen": [_report_payload("qwen")],
+        "openai": [_report_payload("openai")],
+    }
+    dialog = _ReceptionAiAnalysisDialog(histories, preferred_model="qwen")
+    dialog.resize(width, height)
+    dialog.show()
+    for _index in range(3):
+        app.processEvents()
+
+    pixmap = dialog.grab()
+    if pixmap.width() != width or pixmap.height() != height:
+        raise RuntimeError(
+            f"unexpected render size: {pixmap.width()}x{pixmap.height()} "
+            f"(expected {width}x{height})"
+        )
+    output.parent.mkdir(parents=True, exist_ok=True)
+    if not pixmap.save(str(output), "PNG"):
+        raise RuntimeError(f"failed to save {output}")
+
+    scrolls = dialog.findChildren(QScrollArea)
+    risks = [
+        label
+        for label in dialog.findChildren(QLabel)
+        if label.property("dialogAiRisk")
+    ]
+    print(
+        "PATIENT_AI_LAYOUT",
+        f"{width}x{height}",
+        f"scrolls={len(scrolls)}",
+        f"horizontal_max={dialog.scroll_area.horizontalScrollBar().maximum()}",
+        f"risk_rows={len({label.y() for label in risks})}",
+        f"body_height={dialog.scroll_area.widget().height()}",
+    )
+    print(output)
+    dialog.close()
+    app.processEvents()
+
+
+def main() -> int:
+    app = QApplication.instance() or QApplication([])
+    font_path = Path(r"C:\Windows\Fonts\msyh.ttc")
+    if font_path.is_file():
+        QFontDatabase.addApplicationFont(str(font_path))
+
+    output_dir = (
+        Path(__file__).resolve().parents[1]
+        / "artifacts"
+        / "patient_ai_report_layout"
+    )
+    _render(
+        app,
+        output_dir / "patient_ai_report_920x760.png",
+        width=920,
+        height=760,
+    )
+    _render(
+        app,
+        output_dir / "patient_ai_report_720x560.png",
+        width=720,
+        height=560,
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,190 @@
+"""Render patient and appointment density gates in the real desktop shell."""
+
+from __future__ import annotations
+
+import os
+from datetime import date
+from pathlib import Path
+from typing import Any
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+from PySide6.QtCore import QThreadPool
+from PySide6.QtGui import QFont, QFontDatabase
+from PySide6.QtWidgets import QApplication
+
+from doctor_workstation.services import DemoDoctorRepository
+from doctor_workstation.ui import ShellWindow, apply_theme
+
+
+def _drain(application: QApplication) -> None:
+    QThreadPool.globalInstance().waitForDone(5_000)
+    for _index in range(8):
+        application.processEvents()
+
+
+def _patient_rows() -> list[dict[str, Any]]:
+    names = ("林晓岚", "赵明远", "吴诗雨", "周安然", "程静", "许清和")
+    rows: list[dict[str, Any]] = []
+    for index in range(15):
+        rows.append(
+            {
+                "id": 101 + index,
+                "diagnosis_id": 501 + index,
+                "patient_id": 301 + index,
+                "patient_name": names[index % len(names)],
+                "gender": 2 if index % 2 == 0 else 1,
+                "age": 34 + index,
+                "phone_masked": f"138****{1200 + index:04d}",
+                "assistant_id": 8,
+                "assistant_name": "周医助",
+                "appointment_id": 701 + index,
+                "appointment_status": 1,
+                "appointment_doctor_name": "陈医生",
+                "appointment_time_text": f"2026-08-{17 + index % 3:02d} {9 + index % 7:02d}:00",
+                "revisit_count": index % 4,
+                "confirmation_text": "已确认" if index % 2 == 0 else "待确认",
+                "diagnosis_date_text": "第 2 次复诊" if index % 3 else "初诊",
+                "has_id_card": index % 4 != 0,
+            }
+        )
+    return rows
+
+
+def _appointment_rows() -> list[dict[str, Any]]:
+    names = ("林晓岚", "赵明远", "吴诗雨", "周安然", "程静", "许清和")
+    today = date.today().isoformat()
+    rows: list[dict[str, Any]] = []
+    for index in range(8):
+        rows.append(
+            {
+                "id": 801 + index,
+                "diagnosis_id": 901 + index,
+                "patient_id": 401 + index,
+                "source_patient_id": 401 + index,
+                "patient_name": names[index % len(names)],
+                "patient_phone": f"1380013{8000 + index}",
+                "gender": 2 if index % 2 == 0 else 1,
+                "age": 38 + index,
+                "doctor_name": "陈医生",
+                "assistant_id": 8,
+                "assistant_name": "周医助",
+                "appointment_date": today,
+                "appointment_time": f"{9 + index:02d}:00",
+                "channel_name": "线上复诊",
+                "diagnosis_confirmed": index % 2 == 0,
+                "has_prescription": index % 3 == 0,
+                "status": 1,
+                "status_desc": "已挂号",
+                "revisit_time": "复诊" if index % 2 else "初诊",
+                "unserved_days": index,
+                "video_call_hint": (
+                    {"state": "live", "label": "视频通话进行中"}
+                    if index == 0
+                    else {"state": "idle", "label": "等待医生发起"}
+                ),
+            }
+        )
+    return rows
+
+
+def render() -> list[Path]:
+    application = QApplication.instance() or QApplication([])
+    apply_theme(application)
+    font_path = Path("C:/Windows/Fonts/msyh.ttc")
+    if font_path.is_file():
+        font_id = QFontDatabase.addApplicationFont(str(font_path))
+        families = QFontDatabase.applicationFontFamilies(font_id)
+        if families:
+            application.setFont(QFont(families[0], 9))
+
+    output = Path(__file__).resolve().parents[1] / "artifacts" / "patient_appointment_density"
+    output.mkdir(parents=True, exist_ok=True)
+    paths: list[Path] = []
+
+    for width, height in ((1366, 768), (1024, 640)):
+        repository = DemoDoctorRepository()
+        session = repository.login(repository.DEMO_ACCOUNT, repository.DEMO_PASSWORD)
+        shell = ShellWindow(
+            repository,
+            {"session": session, "demo_mode": True},
+            permissions=session.permissions,
+        )
+        shell.resize(width, height)
+        shell.show()
+        _drain(application)
+
+        if not shell.navigate("patients"):
+            raise RuntimeError("patients navigation is unavailable")
+        _drain(application)
+        patients = shell.pages["patients"]
+        patient_rows = _patient_rows()
+        patients.patient_workspace._apply_result(
+            {
+                "lists": patient_rows,
+                "count": len(patient_rows),
+                "extend": {
+                    "scope": {"label": "当前医生与部门"},
+                    "summary": {"today": 6, "tomorrow": 5, "day_after": 4},
+                },
+            },
+            patients.patient_workspace._generation,
+        )
+        application.processEvents()
+        patient_slots = patients.patient_workspace.table.viewport().height() // 40
+        if width == 1366 and patient_slots < 6:
+            raise RuntimeError(f"patient table only exposes {patient_slots} ordinary rows")
+        patient_path = output / f"patients_{width}x{height}.png"
+        if not shell.grab().save(str(patient_path), "PNG"):
+            raise RuntimeError(f"failed to save {patient_path}")
+        paths.append(patient_path)
+
+        if not shell.navigate("appointments"):
+            raise RuntimeError("appointments navigation is unavailable")
+        _drain(application)
+        appointments = shell.pages["appointments"]
+        appointments.poll_timer.stop()
+        appointment_rows = _appointment_rows()
+        appointments._loaded(
+            {
+                "lists": appointment_rows,
+                "count": len(appointment_rows),
+                "extend": {
+                    "status_count": {"1": len(appointment_rows), "3": 0},
+                    "unassigned_count": 0,
+                },
+            },
+            appointments._generation,
+            False,
+        )
+        application.processEvents()
+        row_heights = [
+            appointments.table.rowHeight(index)
+            for index in range(appointments.table.rowCount())
+        ]
+        appointment_slots = appointments.table.viewport().height() // max(row_heights)
+        if width == 1366 and appointment_slots < 4:
+            raise RuntimeError(
+                f"appointment table only exposes {appointment_slots} ordinary rows"
+            )
+        if appointments.content_layout.count() != 1:
+            raise RuntimeError("appointment list still reserves a secondary side panel")
+        if appointments.table_card.width() != appointments.content_host.width():
+            raise RuntimeError("appointment table does not fill the content viewport")
+        appointment_path = output / f"appointments_{width}x{height}.png"
+        if not shell.grab().save(str(appointment_path), "PNG"):
+            raise RuntimeError(f"failed to save {appointment_path}")
+        paths.append(appointment_path)
+        print(
+            f"{width}x{height}: patient_slots={patient_slots}, "
+            f"appointment_slots={appointment_slots}, table_full_width=True"
+        )
+        shell.close()
+        application.processEvents()
+
+    return paths
+
+
+if __name__ == "__main__":
+    for rendered in render():
+        print(rendered)
@@ -0,0 +1,180 @@
+"""Render deterministic prescription-list density acceptance screenshots."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from types import SimpleNamespace
+from typing import Any
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+from PySide6.QtGui import QFont, QFontDatabase
+from PySide6.QtWidgets import QApplication
+
+from doctor_workstation.ui.pages import prescription_library as library_module
+from doctor_workstation.ui.pages import prescriptions as prescriptions_module
+from doctor_workstation.ui.pages.prescription_library import PrescriptionLibraryPage
+from doctor_workstation.ui.pages.prescriptions import PrescriptionsPage
+from doctor_workstation.ui.theme import apply_theme
+
+DENSITY_SIZES = ((1366, 768), (1710, 920))
+
+
+def _run_immediately(
+    function: Any,
+    *args: Any,
+    on_success: Any = None,
+    on_error: Any = None,
+    on_finished: Any = None,
+    **kwargs: Any,
+) -> object:
+    try:
+        result = function(*args, **kwargs)
+    except Exception as error:
+        if on_error is not None:
+            on_error(error)
+    else:
+        if on_success is not None:
+            on_success(result)
+    finally:
+        if on_finished is not None:
+            on_finished()
+    return object()
+
+
+prescriptions_module.run_async = _run_immediately
+library_module.run_async = _run_immediately
+
+
+def _issued_row(index: int) -> dict[str, Any]:
+    return {
+        "id": 1000 + index,
+        "sn": f"CF-202608-{1000 + index}",
+        "prescription_type": "汤剂",
+        "is_system_auto": index % 2,
+        "patient_name": ("林晓岚", "周明远", "许安然")[index % 3],
+        "gender": 2 if index % 2 else 1,
+        "age": 29 + index,
+        "audit_status": index % 3,
+        "void_status": 0,
+        "has_prescription_order": index % 2,
+        "creator_id": 7,
+        "doctor_name": "陈医生",
+        "assistant_name": "赵医助",
+        "create_time": f"2026-08-{(index % 9) + 10:02d} 09:30:00",
+        "herbs": [{"name": "黄芪", "dosage": 15}],
+    }
+
+
+def _library_row(index: int) -> dict[str, Any]:
+    return {
+        "id": 2000 + index,
+        "prescription_name": ("益气养阴方", "清热祛湿方", "滋阴调和方")[index % 3],
+        "formula_type": "主方" if index % 3 else "辅方",
+        "herbs": [
+            {"name": "黄芪", "dosage": 15},
+            {"name": "党参", "dosage": 12},
+        ],
+        "efficacy": ("益气养阴", "清热祛湿", "滋阴补肾")[index % 3],
+        "is_public": index % 2,
+        "disable_edit": 0,
+        "creator_id": 7,
+        "creator_name": "陈医生",
+        "create_time": f"2026-08-{(index % 9) + 10:02d} 08:20:00",
+    }
+
+
+class ScreenshotRepository:
+    def __init__(self) -> None:
+        self.issued_rows = [_issued_row(index) for index in range(15)]
+        self.library_rows = [_library_row(index) for index in range(15)]
+
+    def list_diagnosis_doctors(self) -> list[dict[str, Any]]:
+        return [{"id": 7, "name": "陈医生"}, {"id": 8, "name": "孙医生"}]
+
+    def list_prescriptions(self, **_filters: Any) -> dict[str, Any]:
+        return {"lists": self.issued_rows, "count": 44}
+
+    def list_prescription_templates(self, **_filters: Any) -> dict[str, Any]:
+        return {"lists": self.library_rows, "count": 41}
+
+
+def _application() -> QApplication:
+    app = QApplication.instance() or QApplication([])
+    font_path = Path("C:/Windows/Fonts/msyh.ttc")
+    if font_path.is_file():
+        font_id = QFontDatabase.addApplicationFont(str(font_path))
+        families = QFontDatabase.applicationFontFamilies(font_id)
+        if families:
+            app.setFont(QFont(families[0], 9))
+    apply_theme(app)
+    return app
+
+
+def _settle(app: QApplication) -> None:
+    for _ in range(6):
+        app.processEvents()
+
+
+def _visible_rows(page: PrescriptionsPage | PrescriptionLibraryPage) -> int:
+    viewport = page.table.viewport()
+    return sum(
+        1
+        for row in range(page.table.rowCount())
+        if (
+            (item := page.table.item(row, 0)) is not None
+            and (rect := page.table.visualItemRect(item)).isValid()
+            and rect.top() >= 0
+            and rect.bottom() < viewport.height()
+        )
+    )
+
+
+def _new_page(
+    kind: str,
+    repository: ScreenshotRepository,
+) -> PrescriptionsPage | PrescriptionLibraryPage:
+    current_user = SimpleNamespace(id=7, name="陈医生", root=1, role_ids=[0])
+    if kind == "prescriptions":
+        page: PrescriptionsPage | PrescriptionLibraryPage = PrescriptionsPage(
+            repository, {"*"}, current_user
+        )
+    else:
+        page = PrescriptionLibraryPage(repository, {"*"}, current_user)
+    page.refresh()
+    return page
+
+
+def render() -> list[Path]:
+    app = _application()
+    root = Path(__file__).resolve().parents[1]
+    output = root / "artifacts" / "prescription_list_density"
+    output.mkdir(parents=True, exist_ok=True)
+    repository = ScreenshotRepository()
+    paths: list[Path] = []
+
+    for kind in ("prescriptions", "prescription_library"):
+        for width, height in DENSITY_SIZES:
+            page = _new_page(kind, repository)
+            page.resize(width, height)
+            page.show()
+            _settle(app)
+            minimum_rows = 6 if height == 768 else 9
+            visible_rows = _visible_rows(page)
+            if visible_rows < minimum_rows:
+                raise RuntimeError(
+                    f"{kind} at {width}x{height} exposes only {visible_rows} full rows"
+                )
+            path = output / f"{kind}_{width}x{height}.png"
+            if not page.grab().save(str(path), "PNG"):
+                raise RuntimeError(f"failed to save {path}")
+            paths.append(path)
+            page.close()
+            _settle(app)
+    return paths
+
+
+if __name__ == "__main__":
+    for rendered in render():
+        print(rendered)
@@ -0,0 +1,69 @@
+"""Render the reception daily-record matrix for visual acceptance."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+from PySide6.QtCore import QThreadPool
+from PySide6.QtGui import QFontDatabase
+from PySide6.QtWidgets import QApplication
+
+from doctor_workstation.services.mock_repository import DemoDoctorRepository
+from doctor_workstation.ui.shell import ShellWindow
+from doctor_workstation.ui.theme import apply_theme
+
+
+def main() -> int:
+    application = QApplication.instance() or QApplication([])
+    apply_theme(application)
+    font_path = Path(r"C:\Windows\Fonts\msyh.ttc")
+    if font_path.is_file():
+        QFontDatabase.addApplicationFont(str(font_path))
+
+    repository = DemoDoctorRepository()
+    session = repository.login("doctor", "doctor123")
+    window = ShellWindow(repository, session)
+    window.resize(1710, 920)
+    window.show()
+    if not window.navigate("reception"):
+        raise RuntimeError("reception navigation is unavailable")
+
+    for _index in range(5):
+        application.processEvents()
+        QThreadPool.globalInstance().waitForDone(10_000)
+    page = window.pages["reception"]
+    daily_index = next(
+        index
+        for index in range(page.detail_tabs.count())
+        if page.detail_tabs.tabText(index) == "日常记录"
+    )
+    page.detail_tabs.setCurrentIndex(daily_index)
+    for _index in range(3):
+        application.processEvents()
+        QThreadPool.globalInstance().waitForDone(10_000)
+
+    output = (
+        Path(__file__).resolve().parents[1]
+        / "artifacts"
+        / "reception_daily_records"
+        / "reception_daily_records_1710x920.png"
+    )
+    output.parent.mkdir(parents=True, exist_ok=True)
+    if not window.grab().save(str(output), "PNG"):
+        raise RuntimeError(f"failed to save {output}")
+    print(output)
+    print(
+        "DAILY_MATRIX",
+        page.daily_panel.matrix.rowCount(),
+        page.daily_panel.matrix.columnCount(),
+        page.daily_panel.current_range(),
+    )
+    window.close()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,157 @@
+[CmdletBinding()]
+param(
+    [string]$Installer
+)
+
+$ErrorActionPreference = "Stop"
+Add-Type -AssemblyName System.Drawing
+$ProjectRoot = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+
+function Get-AssociatedIconHash {
+    param([Parameter(Mandatory = $true)][string]$FilePath)
+
+    $Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($FilePath)
+    if (-not $Icon) {
+        throw "Unable to extract the Windows icon from: $FilePath"
+    }
+    $Bitmap = New-Object System.Drawing.Bitmap 32, 32
+    $Graphics = [System.Drawing.Graphics]::FromImage($Bitmap)
+    $Stream = New-Object System.IO.MemoryStream
+    $Hasher = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $Graphics.Clear([System.Drawing.Color]::Transparent)
+        $Graphics.DrawIcon($Icon, 0, 0)
+        $Bitmap.Save($Stream, [System.Drawing.Imaging.ImageFormat]::Png)
+        $Hash = $Hasher.ComputeHash($Stream.ToArray())
+        return ([System.BitConverter]::ToString($Hash)).Replace("-", "")
+    }
+    finally {
+        $Hasher.Dispose()
+        $Stream.Dispose()
+        $Graphics.Dispose()
+        $Bitmap.Dispose()
+        $Icon.Dispose()
+    }
+}
+if (-not $Installer) {
+    $Installer = Get-ChildItem `
+        -LiteralPath (Join-Path $ProjectRoot "dist") `
+        -Filter "DoctorWorkstation-Setup-Windows-x64-*.exe" `
+        -File |
+        Sort-Object LastWriteTime -Descending |
+        Select-Object -First 1 -ExpandProperty FullName
+}
+if (-not $Installer -or -not (Test-Path -LiteralPath $Installer -PathType Leaf)) {
+    throw "Windows installer was not found: $Installer"
+}
+$Installer = (Resolve-Path -LiteralPath $Installer).Path
+$InstallerIconHash = Get-AssociatedIconHash -FilePath $Installer
+
+$TempBase = [System.IO.Path]::GetFullPath([System.IO.Path]::GetTempPath())
+$SmokeRoot = [System.IO.Path]::GetFullPath((Join-Path $TempBase (
+    "doctor-workstation-installer-smoke-" + [guid]::NewGuid().ToString("N")
+)))
+if (-not $SmokeRoot.StartsWith($TempBase, [System.StringComparison]::OrdinalIgnoreCase) -or
+    -not ([System.IO.Path]::GetFileName($SmokeRoot)).StartsWith(
+        "doctor-workstation-installer-smoke-"
+    )) {
+    throw "Refusing to use an unsafe installer smoke directory: $SmokeRoot"
+}
+
+$InstallDirectory = Join-Path $SmokeRoot "install"
+$SetupLog = Join-Path $SmokeRoot "setup.log"
+$UninstallLog = Join-Path $SmokeRoot "uninstall.log"
+New-Item -ItemType Directory -Path $SmokeRoot -Force | Out-Null
+
+$SetupProcess = Start-Process `
+    -FilePath $Installer `
+    -ArgumentList @(
+        "/VERYSILENT",
+        "/SUPPRESSMSGBOXES",
+        "/NORESTART",
+        "/CURRENTUSER",
+        "/DIR=$InstallDirectory",
+        "/MERGETASKS=!desktopicon",
+        "/LOG=$SetupLog"
+    ) `
+    -Wait `
+    -PassThru `
+    -WindowStyle Hidden
+if ($SetupProcess.ExitCode -ne 0) {
+    throw "Installer exited with code $($SetupProcess.ExitCode). See $SetupLog"
+}
+
+$InstalledExecutable = Join-Path $InstallDirectory "DoctorWorkstation.exe"
+if (-not (Test-Path -LiteralPath $InstalledExecutable -PathType Leaf)) {
+    throw "Installed executable is missing: $InstalledExecutable"
+}
+$Uninstaller = Join-Path $InstallDirectory "unins000.exe"
+if (-not (Test-Path -LiteralPath $Uninstaller -PathType Leaf)) {
+    throw "Uninstaller is missing: $Uninstaller"
+}
+$InstalledIconHash = Get-AssociatedIconHash -FilePath $InstalledExecutable
+$UninstallerIconHash = Get-AssociatedIconHash -FilePath $Uninstaller
+if ($InstalledIconHash -ne $InstallerIconHash) {
+    throw "Installed executable icon does not match the installer brand icon"
+}
+if ($UninstallerIconHash -ne $InstallerIconHash) {
+    throw "Uninstaller icon does not match the installer brand icon"
+}
+
+$Environment = @{
+    "DOCTOR_CONFIG_DIR" = (Join-Path $SmokeRoot "config")
+    "DOCTOR_LOG_DIR" = (Join-Path $SmokeRoot "logs")
+    "DOCTOR_API_BASE_URL" = "https://127.0.0.1:9"
+    "DOCTOR_DEMO_MODE" = "true"
+    "DOCTOR_VIDEO_MODE" = "embedded"
+    "DOCTOR_SMOKE_TEST" = "1"
+    "QT_QPA_PLATFORM" = "offscreen"
+}
+$PreviousEnvironment = @{}
+$ApplicationExitCode = $null
+$UninstallExitCode = $null
+try {
+    foreach ($Name in $Environment.Keys) {
+        $PreviousEnvironment[$Name] = [Environment]::GetEnvironmentVariable($Name, "Process")
+        [Environment]::SetEnvironmentVariable($Name, $Environment[$Name], "Process")
+    }
+    $ApplicationProcess = Start-Process `
+        -FilePath $InstalledExecutable `
+        -ArgumentList "--smoke-test" `
+        -Wait `
+        -PassThru `
+        -WindowStyle Hidden
+    $ApplicationExitCode = $ApplicationProcess.ExitCode
+}
+finally {
+    foreach ($Name in $Environment.Keys) {
+        [Environment]::SetEnvironmentVariable($Name, $PreviousEnvironment[$Name], "Process")
+    }
+    if (Test-Path -LiteralPath $Uninstaller -PathType Leaf) {
+        $UninstallProcess = Start-Process `
+            -FilePath $Uninstaller `
+            -ArgumentList @(
+                "/VERYSILENT",
+                "/SUPPRESSMSGBOXES",
+                "/NORESTART",
+                "/LOG=$UninstallLog"
+            ) `
+            -Wait `
+            -PassThru `
+            -WindowStyle Hidden
+        $UninstallExitCode = $UninstallProcess.ExitCode
+    }
+}
+if ($ApplicationExitCode -ne 0) {
+    throw "Installed application smoke test exited with code $ApplicationExitCode"
+}
+if ($UninstallExitCode -ne 0) {
+    throw "Uninstaller exited with code $UninstallExitCode. See $UninstallLog"
+}
+Start-Sleep -Milliseconds 500
+if (Test-Path -LiteralPath $InstalledExecutable) {
+    throw "Uninstaller left the installed executable behind: $InstalledExecutable"
+}
+
+Write-Host "Installer icon/install/start/uninstall smoke test passed." -ForegroundColor Green
+Write-Host "Smoke logs and isolated user data: $SmokeRoot"
@@ -26,7 +26,7 @@ from doctor_workstation.config import AppConfig
 from doctor_workstation.core import Session
 from doctor_workstation.core.errors import AuthenticationExpiredError
 from doctor_workstation.logging_setup import configure_logging
-from doctor_workstation.resources import resource_path, video_dist_path
+from doctor_workstation.resources import app_icon_path, video_dist_path
 from doctor_workstation.services import (
    DemoDoctorRepository,
    RemoteDoctorRepository,
@@ -34,6 +34,7 @@ from doctor_workstation.services import (
    build_repository,
 )
 from doctor_workstation.ui import LoginWindow, ShellWindow, apply_theme
+from doctor_workstation.ui.dialogs.app_update import AppUpdateSession
 from doctor_workstation.ui.widgets import (
    friendly_error,
    run_async,
@@ -138,20 +139,20 @@ class DemoVideoDialog(QDialog):
        self.setWindowTitle("视频面诊 · 演示模式")
        self.setMinimumSize(760, 520)
        self.resize(980, 660)
-        self.setModal(False)
-        self.setStyleSheet(
-            "QDialog{background:#F7F9FE;color:#111F46;}"
-            "QLabel{color:#111F46;}"
-            "QFrame#RemoteStage{background:#0E1421;border:1px solid #29334F;border-radius:16px;}"
-            "QFrame#RemoteStage QLabel{color:#F7F9FE;}"
-            "QFrame#LocalStage{background:#151D31;border:1px solid #3F4E75;border-radius:12px;}"
-            "QPushButton{min-width:96px;min-height:40px;padding:0 16px;border-radius:9px;"
-            "background:#FFFFFF;color:#3F4E75;border:1px solid #E6EAF5;font-weight:600;}"
-            "QPushButton:hover{color:#4451E2;background:#F0F2FF;border-color:#5761F4;}"
-            "QPushButton:checked{color:#FFFFFF;background:#5761F4;border-color:#5761F4;}"
-            "QPushButton#Hangup{color:#FFFFFF;background:#F15B67;border-color:#F15B67;}"
-            "QPushButton#Hangup:hover{background:#D94857;border-color:#D94857;}"
-        )
+        self.setModal(False)
+        self.setStyleSheet(
+            "QDialog{background:#F7F9FE;color:#111F46;}"
+            "QLabel{color:#111F46;}"
+            "QFrame#RemoteStage{background:#0E1421;border:1px solid #29334F;border-radius:16px;}"
+            "QFrame#RemoteStage QLabel{color:#F7F9FE;}"
+            "QFrame#LocalStage{background:#151D31;border:1px solid #3F4E75;border-radius:12px;}"
+            "QPushButton{min-width:96px;min-height:40px;padding:0 16px;border-radius:9px;"
+            "background:#FFFFFF;color:#3F4E75;border:1px solid #E6EAF5;font-weight:600;}"
+            "QPushButton:hover{color:#4451E2;background:#F0F2FF;border-color:#5761F4;}"
+            "QPushButton:checked{color:#FFFFFF;background:#5761F4;border-color:#5761F4;}"
+            "QPushButton#Hangup{color:#FFFFFF;background:#F15B67;border-color:#F15B67;}"
+            "QPushButton#Hangup:hover{background:#D94857;border-color:#D94857;}"
+        )

        root = QVBoxLayout(self)
        root.setContentsMargins(22, 18, 22, 22)
@@ -162,7 +163,7 @@ class DemoVideoDialog(QDialog):
        header.addWidget(title)
        header.addStretch(1)
        demo = QLabel("● 演示模式 · 未连接腾讯云")
-        demo.setStyleSheet("color:#7886AA;font-size:12px;")
+        demo.setStyleSheet("color:#7886AA;font-size:12px;")
        header.addWidget(demo)
        self.duration_label = QLabel("00:00")
        self.duration_label.setStyleSheet("font-weight:700;")
@@ -177,8 +178,8 @@ class DemoVideoDialog(QDialog):
        avatar = QLabel((patient_name or "患")[:1])
        avatar.setAlignment(Qt.AlignmentFlag.AlignCenter)
        avatar.setFixedSize(104, 104)
-        avatar.setStyleSheet(
-            "background:#F0F2FF;color:#5761F4;border-radius:52px;font-size:42px;font-weight:700;"
+        avatar.setStyleSheet(
+            "background:#F0F2FF;color:#5761F4;border-radius:52px;font-size:42px;font-weight:700;"
        )
        stage_layout.addWidget(avatar, 0, Qt.AlignmentFlag.AlignHCenter)
        waiting = QLabel("等待患者接听…")
@@ -187,7 +188,7 @@ class DemoVideoDialog(QDialog):
        stage_layout.addWidget(waiting)
        hint = QLabel("生产模式将通过后端短时 UserSig 初始化腾讯 TUICallKit")
        hint.setAlignment(Qt.AlignmentFlag.AlignCenter)
-        hint.setStyleSheet("color:#A4ADC3;font-size:12px;")
+        hint.setStyleSheet("color:#A4ADC3;font-size:12px;")
        stage_layout.addWidget(hint)
        stage_layout.addStretch(1)

@@ -197,7 +198,7 @@ class DemoVideoDialog(QDialog):
        local_layout = QVBoxLayout(local)
        local_label = QLabel("医生画面")
        local_label.setAlignment(Qt.AlignmentFlag.AlignCenter)
-        local_label.setStyleSheet("color:#D9E0F2;font-weight:600;")
+        local_label.setStyleSheet("color:#D9E0F2;font-weight:600;")
        local_layout.addWidget(local_label)
        root.addWidget(stage, 1)

@@ -255,6 +256,7 @@ class ApplicationController(QObject):
        self._shutting_down = False
        self._authentication_expiry_in_progress = False
        self._rebuild_remote_repository()
+        self.app_updater = AppUpdateSession(self)
        set_authentication_expired_handler(self._on_authentication_expired)
        application.aboutToQuit.connect(self.shutdown)

@@ -263,6 +265,7 @@ class ApplicationController(QObject):

        self._show_login()
        self._begin_session_restore()
+        self.app_updater.schedule()

    def _base_repository(self) -> Any:
        return self.remote_repository or _UnconfiguredRepository()
@@ -333,6 +336,7 @@ class ApplicationController(QObject):
                self.login_window.repository = self._base_repository()
                if not self.login_window.demo_check.isChecked():
                    self.login_window.active_repository = self._base_repository()
+            self.app_updater.schedule()
        if self.login_window is not None:
            self.login_window.config = self.config

@@ -512,12 +516,16 @@ class ApplicationController(QObject):
        self.shell_window = ShellWindow(repository, payload, session.permissions)
        self.shell_window.logout_requested.connect(self._logout)
        self.shell_window.video_requested.connect(self._request_video)
+        self.shell_window.update_check_requested.connect(
+            lambda: self.app_updater.check(interactive=True)
+        )
        self._apply_window_icon(self.shell_window)
        if self.login_window is not None:
            self.login_window.hide()
        self.shell_window.show()
        self.shell_window.raise_()
        self.shell_window.activateWindow()
+        self.app_updater.schedule(delay_ms=400)

    def _login_guard_error(self, message: str) -> None:
        if self.login_window is not None:
@@ -764,9 +772,9 @@ class ApplicationController(QObject):
            LOGGER.warning("video lifecycle cleanup exceeded its bounded deadline")
        return complete

-    @staticmethod
-    def _apply_window_icon(window: QWidget) -> None:
-        icon_file = resource_path("icon.svg")
+    @staticmethod
+    def _apply_window_icon(window: QWidget) -> None:
+        icon_file = app_icon_path()
        if icon_file.exists():
            window.setWindowIcon(QIcon(str(icon_file)))

@@ -788,6 +796,53 @@ class ApplicationController(QObject):
                self.remote_repository.client.close()


+def _prefer_native_tls_backend() -> None:
+    """Keep Qt's HTTPS stack off OpenSSL.
+
+    PySide6 on Windows ships no OpenSSL DLLs of its own, so Qt's OpenSSL
+    TLS backend resolves to CPython's ``libcrypto-3-x64.dll`` and ends up
+    sharing one OpenSSL instance with the httpx stack.  Concurrent use from
+    both stacks has crashed the process inside libcrypto (access violation
+    at a stable offset) while pages downloaded images through
+    ``QNetworkAccessManager``.  Route Qt network requests through the
+    native Schannel backend instead, which uses the Windows certificate
+    store and never touches OpenSSL.
+    """
+
+    with suppress(Exception):
+        from PySide6.QtNetwork import QSslSocket
+
+        backends = QSslSocket.availableBackends()
+        if "schannel" in backends and "openssl" in backends:
+            QSslSocket.setActiveBackend("schannel")
+
+
+_CRASH_LOG_HANDLE: Any = None
+
+
+def _install_crash_handler(config: AppConfig) -> None:
+    """Write per-thread Python tracebacks of native crashes into the log dir.
+
+    Debug launchers already pass ``-X faulthandler`` and dump to stderr;
+    keep that behavior and only redirect into ``crash.log`` for packaged
+    or plain runs where stderr is lost.
+    """
+
+    global _CRASH_LOG_HANDLE
+    try:
+        import faulthandler
+
+        if faulthandler.is_enabled():
+            return
+        path = config.log_dir / "crash.log"
+        handle = path.open("a", encoding="utf-8", buffering=1)
+        handle.write(f"\n=== process started {time.strftime('%Y-%m-%d %H:%M:%S')} ===\n")
+        faulthandler.enable(file=handle, all_threads=True)
+        _CRASH_LOG_HANDLE = handle
+    except Exception:
+        LOGGER.exception("crash handler could not be installed")
+
+
 def _create_application(argv: list[str]) -> QApplication:
    with suppress(AttributeError):
        QGuiApplication.setHighDpiScaleFactorRoundingPolicy(
@@ -796,13 +851,14 @@ def _create_application(argv: list[str]) -> QApplication:
    with suppress(AttributeError):
        QApplication.setAttribute(Qt.ApplicationAttribute.AA_DontCreateNativeWidgetSiblings, True)
    application = QApplication(argv)
+    _prefer_native_tls_backend()
    _install_chinese_translations(application)
    application.setApplicationName("甄养堂医生工作站")
    application.setApplicationDisplayName("甄养堂医生工作站")
    application.setOrganizationName("ZhenYangTang")
    application.setOrganizationDomain("zhenyangtang.com")
    application.setQuitOnLastWindowClosed(True)
-    icon_file = resource_path("icon.svg")
+    icon_file = app_icon_path()
    if icon_file.exists():
        application.setWindowIcon(QIcon(str(icon_file)))
    apply_theme(application)
@@ -814,6 +870,7 @@ def main(argv: list[str] | None = None) -> int:

    config = AppConfig.load()
    configure_logging(config.log_dir, config.log_level)
+    _install_crash_handler(config)
    LOGGER.info("doctor workstation starting", extra={"demo_mode": config.demo_mode})
    raw_argv = list(sys.argv if argv is None else argv)
    smoke_test = "--smoke-test" in raw_argv
@@ -17,6 +17,14 @@ def resource_path(*parts: str) -> Path:
    return project_root().joinpath("resources", *parts)


+def app_icon_path() -> Path:
+    return resource_path("branding", "app-icon.png")
+
+
+def brand_lockup_path() -> Path:
+    return resource_path("branding", "brand-lockup.png")
+
+
 def video_dist_path() -> Path:
    candidates = (
        project_root() / "video_companion" / "dist" / "index.html",
@@ -2,9 +2,11 @@

 from __future__ import annotations

+import json
 import time
-from collections.abc import Callable, Mapping
-from threading import RLock
+from collections.abc import Callable, Iterator, Mapping
+from contextlib import contextmanager
+from threading import Condition, RLock
 from typing import Any
 from urllib.parse import urljoin, urlsplit, urlunsplit

@@ -32,6 +34,7 @@ class ApiClient:
    """

    API_VERSION = "1.9.4"
+    DEFAULT_MAX_PARALLEL_REQUESTS = 8

    def __init__(
        self,
@@ -45,6 +48,7 @@ class ApiClient:
        transport: httpx.BaseTransport | None = None,
        client: httpx.Client | None = None,
        sleep: Callable[[float], None] = time.sleep,
+        max_parallel_requests: int = DEFAULT_MAX_PARALLEL_REQUESTS,
    ) -> None:
        """Create a client without performing any network requests."""

@@ -54,6 +58,8 @@ class ApiClient:
            raise ValueError("retry_backoff must be non-negative")
        if client is not None and transport is not None:
            raise ValueError("pass either client or transport, not both")
+        if max_parallel_requests <= 0:
+            raise ValueError("max_parallel_requests must be positive")
        self.base_url = self.normalise_base_url(base_url)
        self.timeout = timeout
        self.max_retries = max_retries
@@ -61,8 +67,68 @@ class ApiClient:
        self._sleep = sleep
        self._token = token.strip()
        self._lock = RLock()
+        self._transport_lock = RLock()
+        self._client_condition = Condition(RLock())
+        self._available_clients: list[httpx.Client] = []
+        self._pooled_clients: list[httpx.Client] = []
+        self._active_requests = 0
+        self._closing = False
+        self._closed = False
+        self._max_parallel_requests = max_parallel_requests
+        # Production requests use a bounded pool of independent clients.  This
+        # permits unrelated patient requests to run concurrently without
+        # sharing the SSLContext that previously caused native TLS crashes.
+        # A pool also works across PySide QRunnable boundaries, where Python
+        # thread-local state is not retained reliably.
+        # Explicit clients/transports remain on one locked client because
+        # their ownership and thread-safety contracts are unknown.
+        self._uses_client_pool = client is None and transport is None
        self._owns_client = client is None
-        self._client = client or httpx.Client(transport=transport, verify=verify)
+        self._stream_transport = transport
+        self._verify = verify
+        self._client = (
+            None
+            if self._uses_client_pool
+            else client or httpx.Client(transport=transport, verify=verify)
+        )
+
+    @contextmanager
+    def _borrow_client(self) -> Iterator[httpx.Client]:
+        """Yield a safe synchronous client for the calling worker thread."""
+
+        if not self._uses_client_pool:
+            with self._transport_lock:
+                with self._client_condition:
+                    if self._closing or self._closed:
+                        raise RuntimeError("ApiClient is closed")
+                if self._client is None:  # Defensive; this mode always has one.
+                    raise RuntimeError("ApiClient transport is unavailable")
+                yield self._client
+            return
+
+        with self._client_condition:
+            while True:
+                if self._closing or self._closed:
+                    raise RuntimeError("ApiClient is closed")
+                if self._available_clients:
+                    pooled_client = self._available_clients.pop()
+                    break
+                if len(self._pooled_clients) < self._max_parallel_requests:
+                    pooled_client = httpx.Client(verify=self._verify)
+                    self._pooled_clients.append(pooled_client)
+                    break
+                self._client_condition.wait()
+            self._active_requests += 1
+        try:
+            yield pooled_client
+        finally:
+            with self._client_condition:
+                self._active_requests -= 1
+                self._available_clients.append(pooled_client)
+                if self._active_requests == 0:
+                    self._client_condition.notify_all()
+                else:
+                    self._client_condition.notify()

    @staticmethod
    def normalise_base_url(base_url: str) -> str:
@@ -162,6 +228,64 @@ class ApiClient:
            headers=headers,
        )

+    def post_event_stream(
+        self,
+        endpoint: str,
+        payload: Mapping[str, Any],
+        *,
+        timeout: float | httpx.Timeout | None = None,
+        cancelled: Callable[[], bool] | None = None,
+    ) -> Iterator[dict[str, Any]]:
+        """POST JSON and yield parsed server-sent events on an isolated client.
+
+        Streaming deliberately does not use the bounded short-request client
+        pool.  A diagnosis response can remain open for more than a minute and
+        must not consume capacity needed by unrelated page requests.
+        """
+
+        url = self._endpoint_url(endpoint)
+        headers = self._headers({"Accept": "text/event-stream"})
+        request_timeout = self.timeout if timeout is None else timeout
+        try:
+            with httpx.Client(
+                transport=self._stream_transport,
+                verify=self._verify,
+            ) as stream_client, stream_client.stream(
+                "POST",
+                url,
+                json=dict(payload),
+                headers=headers,
+                timeout=request_timeout,
+            ) as response:
+                request_id = self._request_id(response)
+                if not 200 <= response.status_code < 300:
+                    raise ApiHttpError(
+                        f"API returned HTTP {response.status_code}",
+                        status_code=response.status_code,
+                        request_id=request_id,
+                    )
+                content_type = response.headers.get("content-type", "").lower()
+                if "text/event-stream" not in content_type:
+                    response.read()
+                    if "json" in content_type:
+                        self._unwrap(response)
+                    raise ApiProtocolError(
+                        "API response is not an event stream",
+                        status_code=response.status_code,
+                        request_id=request_id,
+                    )
+                yield from _iter_event_stream(response.iter_lines(), cancelled=cancelled)
+        except httpx.TimeoutException as exc:
+            raise ApiTimeoutError(
+                f"POST {endpoint} stream timed out",
+                data={"method": "POST", "endpoint": endpoint},
+            ) from exc
+        except httpx.RequestError as exc:
+            raise ApiTransportError(
+                f"POST {endpoint} stream failed: {exc}",
+                data={"method": "POST", "endpoint": endpoint},
+            ) from exc
+
    def get_bytes(self, url: str, *, max_bytes: int = 5 * 1024 * 1024) -> bytes:
        """Download a public binary asset without applying the JSON envelope contract."""

@@ -175,12 +299,13 @@ class ApiClient:
        if parsed.scheme not in {"http", "https"} or not parsed.netloc:
            raise ValueError("url must resolve to an absolute http(s) URL")
        try:
-            response = self._client.get(
-                target,
-                headers={"Accept": "image/*,application/octet-stream;q=0.8"},
-                timeout=self.timeout,
-                follow_redirects=True,
-            )
+            with self._borrow_client() as client:
+                response = client.get(
+                    target,
+                    headers={"Accept": "image/*,application/octet-stream;q=0.8"},
+                    timeout=self.timeout,
+                    follow_redirects=True,
+                )
        except httpx.TimeoutException as exc:
            raise ApiTimeoutError("Image download timed out", data={"url": target}) from exc
        except httpx.RequestError as exc:
@@ -253,34 +378,35 @@ class ApiClient:
        attempts = self.max_retries + 1 if verb == "GET" else 1
        response: httpx.Response | None = None
        request_timeout = self.timeout if timeout is None else timeout
-        for attempt in range(attempts):
-            try:
-                response = self._client.request(
-                    verb,
-                    url,
-                    params=dict(params) if params is not None else None,
-                    json=dict(json) if verb == "POST" and json is not None else None,
-                    data=dict(data) if verb == "POST" and data is not None else None,
-                    files=dict(files) if files is not None else None,
-                    headers=request_headers,
-                    timeout=request_timeout,
-                )
-                break
-            except httpx.TimeoutException as exc:
-                if attempt + 1 < attempts:
-                    delay = self.retry_backoff * (2**attempt)
-                    if delay:
-                        self._sleep(delay)
-                    continue
-                raise ApiTimeoutError(
-                    f"{verb} {endpoint} timed out after {attempt + 1} attempt(s)",
-                    data={"method": verb, "endpoint": endpoint, "attempts": attempt + 1},
-                ) from exc
-            except httpx.RequestError as exc:
-                raise ApiTransportError(
-                    f"{verb} {endpoint} failed: {exc}",
-                    data={"method": verb, "endpoint": endpoint},
-                ) from exc
+        with self._borrow_client() as client:
+            for attempt in range(attempts):
+                try:
+                    response = client.request(
+                        verb,
+                        url,
+                        params=dict(params) if params is not None else None,
+                        json=dict(json) if verb == "POST" and json is not None else None,
+                        data=dict(data) if verb == "POST" and data is not None else None,
+                        files=dict(files) if files is not None else None,
+                        headers=request_headers,
+                        timeout=request_timeout,
+                    )
+                    break
+                except httpx.TimeoutException as exc:
+                    if attempt + 1 < attempts:
+                        delay = self.retry_backoff * (2**attempt)
+                        if delay:
+                            self._sleep(delay)
+                        continue
+                    raise ApiTimeoutError(
+                        f"{verb} {endpoint} timed out after {attempt + 1} attempt(s)",
+                        data={"method": verb, "endpoint": endpoint, "attempts": attempt + 1},
+                    ) from exc
+                except httpx.RequestError as exc:
+                    raise ApiTransportError(
+                        f"{verb} {endpoint} failed: {exc}",
+                        data={"method": verb, "endpoint": endpoint},
+                    ) from exc
        if response is None:  # Defensive; the loop always returns or raises.
            raise ApiTransportError(f"{verb} {endpoint} produced no response")
        return self._unwrap(response)
@@ -288,8 +414,42 @@ class ApiClient:
    def close(self) -> None:
        """Close the internally-created HTTP transport."""

-        if self._owns_client:
-            self._client.close()
+        with self._client_condition:
+            if self._closed:
+                return
+            if self._closing:
+                while not self._closed:
+                    self._client_condition.wait()
+                return
+            self._closing = True
+            self._client_condition.notify_all()
+
+        clients: list[httpx.Client] = []
+        if self._uses_client_pool:
+            with self._client_condition:
+                while self._active_requests:
+                    self._client_condition.wait()
+                clients = list(self._pooled_clients)
+                self._available_clients.clear()
+                self._pooled_clients.clear()
+        else:
+            with self._transport_lock:
+                if self._owns_client and self._client is not None:
+                    clients = [self._client]
+
+        close_error: Exception | None = None
+        for client in clients:
+            try:
+                client.close()
+            except Exception as error:  # Close every transport before surfacing one failure.
+                if close_error is None:
+                    close_error = error
+        with self._client_condition:
+            self._closed = True
+            self._closing = False
+            self._client_condition.notify_all()
+        if close_error is not None:
+            raise close_error

    def __enter__(self) -> ApiClient:
        """Return this client for use as a context manager."""
@@ -414,3 +574,62 @@ class ApiClient:

 def _mapping(value: object) -> Mapping[str, Any]:
    return value if isinstance(value, Mapping) else {}
+
+
+def _iter_event_stream(
+    lines: Iterator[str],
+    *,
+    cancelled: Callable[[], bool] | None = None,
+) -> Iterator[dict[str, Any]]:
+    """Parse SSE fields, including multi-line data and a final unterminated event."""
+
+    event_name = ""
+    event_id = ""
+    data_lines: list[str] = []
+
+    def build_event() -> dict[str, Any] | None:
+        nonlocal event_name, event_id, data_lines
+        if not event_name and not data_lines:
+            event_id = ""
+            return None
+        raw_data = "\n".join(data_lines)
+        try:
+            data: Any = json.loads(raw_data) if raw_data else {}
+        except (TypeError, ValueError):
+            data = raw_data
+        inferred = data.get("event") or data.get("type") if isinstance(data, Mapping) else ""
+        kind = event_name or str(inferred or "message")
+        if raw_data.strip() == "[DONE]":
+            kind, data = "done", {}
+        event = {"event": kind, "data": data}
+        if event_id:
+            event["id"] = event_id
+        event_name = ""
+        event_id = ""
+        data_lines = []
+        return event
+
+    for raw_line in lines:
+        if cancelled is not None and cancelled():
+            return
+        line = raw_line.lstrip("\ufeff")
+        if not line:
+            event = build_event()
+            if event is not None:
+                yield event
+            continue
+        if line.startswith(":"):
+            continue
+        field, separator, value = line.partition(":")
+        if separator and value.startswith(" "):
+            value = value[1:]
+        if field == "event":
+            event_name = value
+        elif field == "data":
+            data_lines.append(value)
+        elif field == "id":
+            event_id = value
+    if cancelled is None or not cancelled():
+        event = build_event()
+        if event is not None:
+            yield event
@@ -0,0 +1,734 @@
+"""Detect, download and apply doctor-workstation desktop updates."""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import platform
+import shutil
+import stat
+import subprocess
+import sys
+import zipfile
+from collections.abc import Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlsplit
+
+import httpx
+
+from doctor_workstation import __version__
+from doctor_workstation.core.errors import (
+    ApiHttpError,
+    ApiTimeoutError,
+    ApiTransportError,
+)
+from doctor_workstation.services.api_client import ApiClient
+
+CHECK_ENDPOINT = "setting.desktop_workstation/check"
+MAX_PACKAGE_BYTES = 2 * 1024 * 1024 * 1024
+WINDOWS_EXE_NAME = "DoctorWorkstation.exe"
+MACOS_APP_NAME = "DoctorWorkstation.app"
+PACKAGE_TYPE_ARCHIVE = "archive"
+PACKAGE_TYPE_INNO_SETUP = "inno_setup"
+SUPPORTED_PACKAGE_TYPES = {PACKAGE_TYPE_ARCHIVE, PACKAGE_TYPE_INNO_SETUP}
+ProgressCallback = Callable[[int, int], None]
+CancelCallback = Callable[[], bool]
+
+
+class AppUpdateError(RuntimeError):
+    """A desktop update could not be checked, downloaded or applied."""
+
+
+@dataclass(frozen=True, slots=True)
+class UpdatePackage:
+    url: str
+    sha256: str
+    size: int
+    filename: str
+    type: str = PACKAGE_TYPE_ARCHIVE
+
+
+@dataclass(frozen=True, slots=True)
+class UpdateOffer:
+    has_update: bool
+    force: bool
+    enabled: bool
+    current_version: str
+    latest_version: str
+    min_version: str
+    title: str
+    notes: str
+    platform: str
+    arch: str
+    package: UpdatePackage | None
+    can_install: bool
+
+
+def current_app_version() -> str:
+    return normalize_version(__version__) or "0.0.0"
+
+
+def is_frozen_install() -> bool:
+    return bool(getattr(sys, "frozen", False))
+
+
+def current_platform() -> str:
+    if sys.platform == "win32":
+        return "windows"
+    if sys.platform == "darwin":
+        return "macos"
+    return sys.platform
+
+
+def current_arch() -> str:
+    machine = platform.machine().lower()
+    if machine in {"amd64", "x86_64", "x64"}:
+        return "x64"
+    if machine in {"arm64", "aarch64"}:
+        return "arm64"
+    return machine
+
+
+def normalize_version(value: str | None) -> str:
+    text = str(value or "").strip()
+    if not text:
+        return ""
+    parts = []
+    for raw in text.split("."):
+        if not raw.isdigit():
+            return ""
+        parts.append(str(int(raw)))
+        if len(parts) == 3:
+            break
+    if not parts:
+        return ""
+    while len(parts) < 3:
+        parts.append("0")
+    return ".".join(parts)
+
+
+def compare_version(left: str, right: str) -> int:
+    def parts(value: str) -> tuple[int, int, int]:
+        normalized = normalize_version(value)
+        if not normalized:
+            return (0, 0, 0)
+        numbers = [int(item) for item in normalized.split(".")]
+        return (numbers[0], numbers[1], numbers[2])
+
+    left_parts = parts(left)
+    right_parts = parts(right)
+    return (left_parts > right_parts) - (left_parts < right_parts)
+
+
+def frozen_install_root() -> Path | None:
+    if not is_frozen_install():
+        return None
+    executable = Path(sys.executable).resolve()
+    if sys.platform == "darwin":
+        macos_dir = executable.parent
+        contents = macos_dir.parent
+        bundle = contents.parent
+        if macos_dir.name == "MacOS" and contents.name == "Contents" and bundle.suffix == ".app":
+            return bundle
+        return macos_dir
+    return executable.parent
+
+
+def parse_update_offer(
+    payload: dict[str, Any] | None,
+    *,
+    current_version: str,
+    platform_name: str | None = None,
+    arch: str | None = None,
+) -> UpdateOffer:
+    data = dict(payload or {})
+    expected_platform = platform_name or current_platform()
+    expected_arch = arch or current_arch()
+    response_platform = str(data.get("platform") or expected_platform).strip().lower()
+    response_arch = str(data.get("arch") or expected_arch).strip().lower()
+    package_payload = data.get("package")
+    package = None
+    if isinstance(package_payload, dict):
+        url = str(package_payload.get("url") or "").strip()
+        sha256 = str(package_payload.get("sha256") or "").strip().lower()
+        filename = str(package_payload.get("filename") or "").strip()
+        package_type = str(package_payload.get("type") or PACKAGE_TYPE_ARCHIVE).strip().lower()
+        try:
+            size = max(0, int(package_payload.get("size") or 0))
+        except (TypeError, ValueError):
+            size = 0
+        package_type_supported = package_type in SUPPORTED_PACKAGE_TYPES
+        package_platform_supported = (
+            package_type != PACKAGE_TYPE_INNO_SETUP or expected_platform == "windows"
+        )
+        if url and package_type_supported and package_platform_supported:
+            package = UpdatePackage(
+                url=url,
+                sha256=sha256,
+                size=size,
+                filename=filename,
+                type=package_type,
+            )
+    normalized_current = normalize_version(current_version) or "0.0.0"
+    latest_version = normalize_version(str(data.get("latest_version") or "")) or ""
+    response_matches = response_platform == expected_platform and response_arch == expected_arch
+    has_update = (
+        bool(data.get("has_update"))
+        and bool(data.get("enabled"))
+        and bool(latest_version)
+        and compare_version(normalized_current, latest_version) < 0
+        and response_matches
+    )
+    digest_is_valid = bool(
+        package is not None
+        and len(package.sha256) == 64
+        and all(character in "0123456789abcdef" for character in package.sha256)
+    )
+    installer_transport_is_valid = bool(
+        package is None
+        or package.type != PACKAGE_TYPE_INNO_SETUP
+        or _is_secure_installer_url(package.url)
+    )
+    can_install = (
+        bool(data.get("can_install"))
+        and package is not None
+        and digest_is_valid
+        and installer_transport_is_valid
+        and has_update
+    )
+    return UpdateOffer(
+        has_update=has_update,
+        force=bool(data.get("force")) and can_install,
+        enabled=bool(data.get("enabled")),
+        current_version=normalized_current,
+        latest_version=latest_version,
+        min_version=normalize_version(str(data.get("min_version") or "")) or "",
+        title=str(data.get("title") or "").strip(),
+        notes=str(data.get("notes") or "").strip(),
+        platform=response_platform,
+        arch=response_arch,
+        package=package if can_install else None,
+        can_install=can_install,
+    )
+
+
+def fetch_update_offer(
+    client: ApiClient,
+    *,
+    current_version: str | None = None,
+    platform_name: str | None = None,
+    arch: str | None = None,
+) -> UpdateOffer:
+    version = normalize_version(current_version or current_app_version()) or "0.0.0"
+    try:
+        payload = client.get(
+            CHECK_ENDPOINT,
+            {
+                "current_version": version,
+                "platform": platform_name or current_platform(),
+                "arch": arch or current_arch(),
+            },
+        )
+    except (ApiTimeoutError, ApiTransportError, ApiHttpError) as error:
+        raise AppUpdateError(str(error)) from error
+    if payload is not None and not isinstance(payload, dict):
+        raise AppUpdateError("升级检测返回的数据格式不正确")
+    return parse_update_offer(
+        payload if isinstance(payload, dict) else {},
+        current_version=version,
+        platform_name=platform_name or current_platform(),
+        arch=arch or current_arch(),
+    )
+
+
+def safe_extract_zip(archive: Path, destination: Path) -> None:
+    destination = destination.resolve()
+    destination.mkdir(parents=True, exist_ok=True)
+    with zipfile.ZipFile(archive) as bundle:
+        for info in bundle.infolist():
+            name = info.filename.replace("\\", "/")
+            if name.startswith("/") or (len(name) > 1 and name[1] == ":"):
+                raise AppUpdateError("安装包包含非法路径，已拒绝解压")
+            target = Path(os.path.normpath(destination / name))
+            try:
+                target.relative_to(destination)
+            except ValueError as error:
+                raise AppUpdateError("安装包包含非法路径，已拒绝解压") from error
+        bundle.extractall(destination)
+
+
+def discover_payload(extracted_root: Path, *, platform_name: str | None = None) -> Path:
+    root = extracted_root.resolve()
+    os_name = platform_name or current_platform()
+    if os_name == "macos":
+        apps = [
+            path
+            for path in root.rglob("*.app")
+            if path.is_dir() and (path / "Contents" / "MacOS").is_dir()
+        ]
+        named = [path for path in apps if path.name == MACOS_APP_NAME]
+        candidates = named or apps
+        if not candidates:
+            raise AppUpdateError("安装包中未找到 DoctorWorkstation.app")
+        return sorted(candidates, key=lambda path: len(path.relative_to(root).parts))[0]
+    executables = [path for path in root.rglob(WINDOWS_EXE_NAME) if path.is_file()]
+    if not executables:
+        raise AppUpdateError("安装包中未找到 DoctorWorkstation.exe")
+
+    def score(path: Path) -> tuple[int, int]:
+        has_internal = 0 if (path.parent / "_internal").is_dir() else 1
+        return (has_internal, len(path.relative_to(root).parts))
+
+    return sorted(executables, key=score)[0].parent
+
+
+def download_package(
+    url: str,
+    destination: Path,
+    *,
+    sha256: str,
+    verify: bool = True,
+    expected_size: int = 0,
+    progress: ProgressCallback | None = None,
+    cancelled: CancelCallback | None = None,
+    transport: httpx.BaseTransport | None = None,
+) -> Path:
+    target = url.strip()
+    parsed = urlsplit(target)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise AppUpdateError("安装包地址无效")
+    digest = (sha256 or "").strip().lower()
+    if len(digest) != 64 or any(character not in "0123456789abcdef" for character in digest):
+        raise AppUpdateError("安装包缺少有效的 SHA-256，已取消下载")
+    if expected_size < 0 or expected_size > MAX_PACKAGE_BYTES:
+        raise AppUpdateError("安装包声明的文件大小不正确")
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    partial = destination.with_name(f"{destination.name}.part")
+    partial.unlink(missing_ok=True)
+    timeout = httpx.Timeout(connect=30.0, read=None, write=30.0, pool=30.0)
+    hasher = hashlib.sha256()
+    received = 0
+    try:
+        with (
+            httpx.Client(
+                verify=verify,
+                follow_redirects=True,
+                timeout=timeout,
+                transport=transport,
+            ) as client,
+            client.stream("GET", target) as response,
+        ):
+            if not 200 <= response.status_code < 300:
+                raise AppUpdateError(f"下载安装包失败（HTTP {response.status_code}）")
+            try:
+                total = int(response.headers.get("content-length") or expected_size or 0)
+            except (TypeError, ValueError):
+                total = expected_size
+            if total > MAX_PACKAGE_BYTES:
+                raise AppUpdateError("安装包超过允许的最大体积")
+            if expected_size > 0 and total > 0 and total != expected_size:
+                raise AppUpdateError("安装包文件大小与发布信息不一致")
+            with partial.open("wb") as handle:
+                for chunk in response.iter_bytes(256 * 1024):
+                    if cancelled is not None and cancelled():
+                        raise AppUpdateError("已取消下载")
+                    if not chunk:
+                        continue
+                    received += len(chunk)
+                    if received > MAX_PACKAGE_BYTES:
+                        raise AppUpdateError("安装包超过允许的最大体积")
+                    handle.write(chunk)
+                    hasher.update(chunk)
+                    if progress is not None:
+                        progress(received, total)
+                handle.flush()
+                os.fsync(handle.fileno())
+    except AppUpdateError:
+        partial.unlink(missing_ok=True)
+        raise
+    except httpx.TimeoutException as error:
+        partial.unlink(missing_ok=True)
+        raise AppUpdateError("下载安装包超时") from error
+    except httpx.RequestError as error:
+        partial.unlink(missing_ok=True)
+        raise AppUpdateError(f"下载安装包失败：{error}") from error
+    if expected_size > 0 and received != expected_size:
+        partial.unlink(missing_ok=True)
+        raise AppUpdateError("安装包文件大小与发布信息不一致")
+    actual = hasher.hexdigest()
+    if actual != digest:
+        partial.unlink(missing_ok=True)
+        raise AppUpdateError("安装包校验失败，文件可能已损坏或被替换")
+    os.replace(partial, destination)
+    if progress is not None:
+        progress(received, received if total <= 0 else total)
+    return destination
+
+
+def _is_secure_installer_url(url: str) -> bool:
+    parsed = urlsplit(url.strip())
+    local_hosts = {"localhost", "127.0.0.1", "::1"}
+    return parsed.scheme == "https" or (
+        parsed.scheme == "http" and (parsed.hostname or "").lower() in local_hosts
+    )
+
+
+def validate_installer_download_policy(url: str, *, verify_ssl: bool) -> None:
+    """Require authenticated transport before automatically executing an installer."""
+
+    if not verify_ssl:
+        raise AppUpdateError("自动安装 Windows 更新必须开启 HTTPS 证书校验")
+    if not _is_secure_installer_url(url):
+        raise AppUpdateError("自动安装 Windows 更新仅允许使用 HTTPS 下载地址")
+
+
+def validate_windows_installer(installer: Path) -> Path:
+    candidate = installer.resolve()
+    if candidate.suffix.lower() != ".exe" or not candidate.is_file():
+        raise AppUpdateError("Windows 更新包不是有效的 Setup.exe 安装程序")
+    try:
+        with candidate.open("rb") as handle:
+            header = handle.read(2)
+    except OSError as error:
+        raise AppUpdateError(f"无法读取 Windows 安装程序：{error}") from error
+    if header != b"MZ":
+        raise AppUpdateError("Windows 更新包不是有效的 PE 安装程序")
+    return candidate
+
+
+def apply_extracted_update(payload: Path, *, install_root: Path | None = None) -> None:
+    target_root = install_root or frozen_install_root()
+    if target_root is None:
+        raise AppUpdateError("当前为源码运行，无法自动替换安装目录")
+    payload = payload.resolve()
+    target_root = target_root.resolve()
+    if not payload.exists():
+        raise AppUpdateError("解压后的安装包不完整")
+    log_file = payload.parent / "apply.log"
+    restart_exe = _installed_restart_executable(target_root)
+    script = _write_apply_script(
+        payload=payload,
+        install_root=target_root,
+        restart_exe=restart_exe,
+        log_file=log_file,
+    )
+    _spawn_applier(
+        script,
+        payload=payload,
+        install_root=target_root,
+        restart_exe=restart_exe,
+        log_file=log_file,
+    )
+
+
+def apply_downloaded_update(
+    payload: Path,
+    *,
+    package_type: str,
+    install_root: Path | None = None,
+) -> None:
+    if package_type == PACKAGE_TYPE_ARCHIVE:
+        apply_extracted_update(payload, install_root=install_root)
+        return
+    if package_type == PACKAGE_TYPE_INNO_SETUP:
+        apply_inno_setup_update(payload, install_root=install_root)
+        return
+    raise AppUpdateError("不支持的桌面更新包类型")
+
+
+def apply_inno_setup_update(
+    installer: Path,
+    *,
+    install_root: Path | None = None,
+) -> None:
+    if sys.platform != "win32":
+        raise AppUpdateError("Inno Setup 更新仅支持 Windows")
+    target_root = install_root or frozen_install_root()
+    if target_root is None:
+        raise AppUpdateError("当前为源码运行，无法自动安装 Windows 更新")
+    target_root = target_root.resolve()
+    installer = validate_windows_installer(installer)
+    restart_exe = _installed_restart_executable(target_root)
+    helper_log_file = installer.parent / "update_helper.log"
+    installer_log_file = installer.parent / "inno_setup.log"
+    try:
+        script = _write_inno_setup_script(
+            installer=installer,
+            restart_exe=restart_exe,
+            helper_log_file=helper_log_file,
+            installer_log_file=installer_log_file,
+        )
+        _spawn_inno_setup_applier(
+            script,
+            installer=installer,
+            restart_exe=restart_exe,
+            helper_log_file=helper_log_file,
+            installer_log_file=installer_log_file,
+        )
+    except OSError as error:
+        raise AppUpdateError(f"无法启动 Windows 更新助手：{error}") from error
+
+
+def _installed_restart_executable(install_root: Path) -> Path:
+    if install_root.suffix == ".app" or (install_root / "Contents" / "MacOS").is_dir():
+        return install_root
+    exe = install_root / WINDOWS_EXE_NAME
+    if exe.is_file():
+        return exe
+    raise AppUpdateError("当前安装目录中找不到可重启的工作站程序")
+
+
+def _restart_executable(payload: Path) -> Path:
+    if payload.suffix == ".app" or (payload / "Contents" / "MacOS").is_dir():
+        return payload
+    exe = payload / WINDOWS_EXE_NAME
+    if exe.is_file():
+        return exe
+    raise AppUpdateError("解压结果中找不到可启动的工作站程序")
+
+
+def _write_apply_script(
+    *,
+    payload: Path,
+    install_root: Path,
+    restart_exe: Path,
+    log_file: Path,
+) -> Path:
+    directory = payload.parent
+    if sys.platform == "win32":
+        script = directory / "apply_update.ps1"
+        script.write_text(
+            "\n".join(
+                [
+                    "param(",
+                    "    [Parameter(Mandatory=$true)][int]$TargetPid,",
+                    "    [Parameter(Mandatory=$true)][string]$Payload,",
+                    "    [Parameter(Mandatory=$true)][string]$InstallDir,",
+                    "    [Parameter(Mandatory=$true)][string]$RestartExe,",
+                    "    [Parameter(Mandatory=$true)][string]$LogFile",
+                    ")",
+                    '$ErrorActionPreference = "Continue"',
+                    "function Write-Log([string]$Message) {",
+                    '    Add-Content -LiteralPath $LogFile -Value ("{0} {1}" -f (Get-Date -Format o), $Message)',
+                    "}",
+                    'Write-Log "waiting for pid $TargetPid"',
+                    "while (Get-Process -Id $TargetPid -ErrorAction SilentlyContinue) { Start-Sleep -Milliseconds 400 }",
+                    "Start-Sleep -Seconds 1",
+                    'Write-Log "copy $Payload -> $InstallDir"',
+                    '$result = (Start-Process -FilePath "robocopy.exe" -ArgumentList @($Payload, $InstallDir, "/E", "/IS", "/IT", "/R:3", "/W:2", "/NFL", "/NDL", "/NJH", "/NJS", "/NC", "/NS", "/NP") -Wait -PassThru).ExitCode',
+                    'Write-Log "robocopy exit $result"',
+                    'if ($result -ge 8) { Write-Log "copy failed"; exit $result }',
+                    'Write-Log "restart $RestartExe"',
+                    "Start-Process -FilePath $RestartExe -WorkingDirectory ([System.IO.Path]::GetDirectoryName($RestartExe))",
+                    "exit 0",
+                    "",
+                ]
+            ),
+            encoding="utf-8",
+        )
+        return script
+    script = directory / "apply_update.sh"
+    script.write_text(
+        "\n".join(
+            [
+                "#!/bin/bash",
+                "set -eu",
+                'TARGET_PID="$1"',
+                'PAYLOAD="$2"',
+                'INSTALL_DIR="$3"',
+                'LOG_FILE="$4"',
+                'log() { printf "%s %s\\n" "$(date -Iseconds 2>/dev/null || date)" "$1" >>"$LOG_FILE"; }',
+                'log "waiting for pid $TARGET_PID"',
+                'while kill -0 "$TARGET_PID" 2>/dev/null; do sleep 0.3; done',
+                "sleep 1",
+                'log "replace $INSTALL_DIR with $PAYLOAD"',
+                'TMP_DIR="${INSTALL_DIR}.next"',
+                'rm -rf "$TMP_DIR"',
+                'if command -v ditto >/dev/null 2>&1; then ditto "$PAYLOAD" "$TMP_DIR"; else cp -R "$PAYLOAD" "$TMP_DIR"; fi',
+                'rm -rf "$INSTALL_DIR"',
+                'mv "$TMP_DIR" "$INSTALL_DIR"',
+                'log "open $INSTALL_DIR"',
+                'open "$INSTALL_DIR"',
+                "",
+            ]
+        ),
+        encoding="utf-8",
+    )
+    script.chmod(script.stat().st_mode | stat.S_IEXEC)
+    return script
+
+
+def _write_inno_setup_script(
+    *,
+    installer: Path,
+    restart_exe: Path,
+    helper_log_file: Path,
+    installer_log_file: Path,
+) -> Path:
+    script = installer.parent / "install_update.ps1"
+    script.write_text(
+        "\n".join(
+            [
+                "param(",
+                "    [Parameter(Mandatory=$true)][int]$TargetPid,",
+                "    [Parameter(Mandatory=$true)][string]$Installer,",
+                "    [Parameter(Mandatory=$true)][string]$RestartExe,",
+                "    [Parameter(Mandatory=$true)][string]$HelperLogFile,",
+                "    [Parameter(Mandatory=$true)][string]$InstallerLogFile",
+                ")",
+                '$ErrorActionPreference = "Stop"',
+                "function Write-Log([string]$Message) {",
+                '    Add-Content -LiteralPath $HelperLogFile -Value ("{0} {1}" -f (Get-Date -Format o), $Message)',
+                "}",
+                "function Restart-Application {",
+                "    if (Test-Path -LiteralPath $RestartExe -PathType Leaf) {",
+                '        Write-Log "restart $RestartExe"',
+                "        Start-Process -FilePath $RestartExe -WorkingDirectory ([System.IO.Path]::GetDirectoryName($RestartExe))",
+                "    } else {",
+                '        Write-Log "restart executable missing: $RestartExe"',
+                "    }",
+                "}",
+                'Write-Log "waiting for pid $TargetPid"',
+                "while (Get-Process -Id $TargetPid -ErrorAction SilentlyContinue) { Start-Sleep -Milliseconds 400 }",
+                "Start-Sleep -Milliseconds 600",
+                "$arguments = @(",
+                '    "/VERYSILENT",',
+                '    "/SUPPRESSMSGBOXES",',
+                '    "/SP-",',
+                '    "/NORESTART",',
+                '    "/RESTARTEXITCODE=3010",',
+                '    "/CLOSEAPPLICATIONS",',
+                '    "/NOFORCECLOSEAPPLICATIONS",',
+                '    "/NORESTARTAPPLICATIONS",',
+                '    ("/LOG=`"{0}`"" -f $InstallerLogFile)',
+                ")",
+                "try {",
+                '    Write-Log "launch installer $Installer"',
+                "    $process = Start-Process -FilePath $Installer -ArgumentList $arguments -Wait -PassThru -WindowStyle Hidden",
+                "    $exitCode = $process.ExitCode",
+                '    Write-Log "installer exit $exitCode"',
+                "} catch {",
+                '    Write-Log ("installer launch failed: {0}" -f $_.Exception.Message)',
+                "    Restart-Application",
+                "    exit 1",
+                "}",
+                "if ($exitCode -eq 0 -or $exitCode -eq 3010) {",
+                '    Write-Log "installation completed"',
+                "    Restart-Application",
+                "    exit 0",
+                "}",
+                'Write-Log "installation failed or was cancelled; restarting existing application"',
+                "Restart-Application",
+                "exit $exitCode",
+                "",
+            ]
+        ),
+        encoding="utf-8-sig",
+    )
+    del restart_exe, helper_log_file, installer_log_file
+    return script
+
+
+def _spawn_inno_setup_applier(
+    script: Path,
+    *,
+    installer: Path,
+    restart_exe: Path,
+    helper_log_file: Path,
+    installer_log_file: Path,
+) -> None:
+    flags = getattr(subprocess, "DETACHED_PROCESS", 0)
+    flags |= getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0)
+    flags |= getattr(subprocess, "CREATE_NO_WINDOW", 0)
+    subprocess.Popen(
+        [
+            "powershell.exe",
+            "-NoProfile",
+            "-ExecutionPolicy",
+            "Bypass",
+            "-WindowStyle",
+            "Hidden",
+            "-File",
+            str(script),
+            "-TargetPid",
+            str(os.getpid()),
+            "-Installer",
+            str(installer),
+            "-RestartExe",
+            str(restart_exe),
+            "-HelperLogFile",
+            str(helper_log_file),
+            "-InstallerLogFile",
+            str(installer_log_file),
+        ],
+        close_fds=True,
+        creationflags=flags,
+        cwd=str(script.parent),
+    )
+
+
+def _spawn_applier(
+    script: Path,
+    *,
+    payload: Path,
+    install_root: Path,
+    restart_exe: Path,
+    log_file: Path,
+) -> None:
+    pid = os.getpid()
+    if sys.platform == "win32":
+        flags = getattr(subprocess, "DETACHED_PROCESS", 0)
+        flags |= getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0)
+        flags |= getattr(subprocess, "CREATE_NO_WINDOW", 0)
+        subprocess.Popen(
+            [
+                "powershell.exe",
+                "-NoProfile",
+                "-ExecutionPolicy",
+                "Bypass",
+                "-WindowStyle",
+                "Hidden",
+                "-File",
+                str(script),
+                "-TargetPid",
+                str(pid),
+                "-Payload",
+                str(payload),
+                "-InstallDir",
+                str(install_root),
+                "-RestartExe",
+                str(restart_exe),
+                "-LogFile",
+                str(log_file),
+            ],
+            close_fds=True,
+            creationflags=flags,
+            cwd=str(script.parent),
+        )
+        return
+    subprocess.Popen(
+        ["/bin/bash", str(script), str(pid), str(payload), str(install_root), str(log_file)],
+        start_new_session=True,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        cwd=str(script.parent),
+    )
+    del restart_exe
+
+
+def prepare_update_workspace(config_dir: Path, version: str) -> Path:
+    workspace = config_dir / "updates" / normalize_version(version).replace(".", "_")
+    if workspace.exists():
+        shutil.rmtree(workspace, ignore_errors=True)
+    workspace.mkdir(parents=True, exist_ok=True)
+    return workspace
+
+
+def package_filename(package: UpdatePackage, version: str) -> str:
+    name = Path(package.filename or urlsplit(package.url).path).name
+    if not name:
+        suffix = ".exe" if package.type == PACKAGE_TYPE_INNO_SETUP else ".zip"
+        name = f"DoctorWorkstation-{version}{suffix}"
+    return name
@@ -0,0 +1,602 @@
+"""Persistent local-audio capture and COS upload queue.
+
+Local call recordings are medical records.  They must survive application
+restarts and failed network requests, so the queue deliberately keeps the
+audio file after a successful upload as well as after a failed one.
+"""
+
+from __future__ import annotations
+
+import queue
+import sqlite3
+import threading
+from collections.abc import Callable
+from concurrent.futures import Future
+from contextlib import suppress
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from os import PathLike
+from pathlib import Path
+from typing import Any
+from uuid import uuid4
+
+from platformdirs import user_data_path
+
+_MAX_UPLOAD_WORKERS = 3
+_RETRYABLE_STATUSES = {"pending", "failed"}
+_RECOVERY_LOCK = threading.Lock()
+_RECOVERED_DATABASES: set[Path] = set()
+_MANAGER_LOCK = threading.Lock()
+_MANAGERS: dict[tuple[int, Path], LocalAudioUploadManager] = {}
+
+
+def _utc_now() -> str:
+    return datetime.now(UTC).isoformat(timespec="seconds")
+
+
+def _clean_room_id(value: Any) -> str:
+    room_id = str(value or "").strip()
+    return "" if room_id == "0" else room_id
+
+
+def _clean_call_record_id(value: Any, *, required: bool) -> int | None:
+    if value in (None, "") and not required:
+        return None
+    try:
+        call_record_id = int(value)
+    except (TypeError, ValueError) as error:
+        raise ValueError("通话记录 ID 无效。") from error
+    if call_record_id <= 0:
+        raise ValueError("通话记录 ID 无效。")
+    return call_record_id
+
+
+def _default_root() -> Path:
+    return (
+        user_data_path(
+            "ZhenyangDoctorWorkstation",
+            appauthor="ZhenYangTang",
+            ensure_exists=True,
+        )
+        / "local-call-audio"
+    )
+
+
+@dataclass(frozen=True, slots=True)
+class LocalAudioRecord:
+    id: int
+    session_id: str
+    diagnosis_id: int
+    call_record_id: int | None
+    room_id: str
+    mime_type: str
+    file_path: Path
+    size_bytes: int
+    status: str
+    error_text: str
+    uploaded_url: str
+    attempts: int
+    created_at: str
+    updated_at: str
+    uploaded_at: str
+
+    @property
+    def exists(self) -> bool:
+        return self.file_path.is_file()
+
+
+class LocalAudioQueueStore:
+    """SQLite-backed manifest for durable local call recordings."""
+
+    def __init__(self, root: str | PathLike[str] | None = None) -> None:
+        self.root = Path(root).expanduser().resolve() if root else _default_root().resolve()
+        self.files_dir = self.root / "files"
+        self.files_dir.mkdir(parents=True, exist_ok=True)
+        self.database_path = self.root / "queue.sqlite3"
+        self._initialize()
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.database_path, timeout=10.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA busy_timeout = 10000")
+        return connection
+
+    def _initialize(self) -> None:
+        with self._connect() as connection:
+            connection.execute("PRAGMA journal_mode = WAL")
+            # Serialise schema inspection and ALTER TABLE across two workstation
+            # processes. The second process waits, then re-checks the columns.
+            connection.execute("BEGIN IMMEDIATE")
+            connection.execute(
+                """
+                CREATE TABLE IF NOT EXISTS local_audio_uploads (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    session_id TEXT NOT NULL UNIQUE,
+                    diagnosis_id INTEGER NOT NULL,
+                    call_record_id INTEGER,
+                    room_id TEXT NOT NULL DEFAULT '',
+                    mime_type TEXT NOT NULL,
+                    file_path TEXT NOT NULL,
+                    size_bytes INTEGER NOT NULL DEFAULT 0,
+                    status TEXT NOT NULL,
+                    error_text TEXT NOT NULL DEFAULT '',
+                    uploaded_url TEXT NOT NULL DEFAULT '',
+                    attempts INTEGER NOT NULL DEFAULT 0,
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL,
+                    uploaded_at TEXT NOT NULL DEFAULT ''
+                )
+                """
+            )
+            columns = {
+                str(row["name"])
+                for row in connection.execute(
+                    "PRAGMA table_info(local_audio_uploads)"
+                ).fetchall()
+            }
+            if "room_id" not in columns:
+                connection.execute(
+                    "ALTER TABLE local_audio_uploads "
+                    "ADD COLUMN room_id TEXT NOT NULL DEFAULT ''"
+                )
+            connection.execute(
+                "CREATE INDEX IF NOT EXISTS idx_local_audio_diagnosis "
+                "ON local_audio_uploads(diagnosis_id, id DESC)"
+            )
+        # Recover interrupted work once per process. Creating the management
+        # dialog while a worker is active must not move that worker back to
+        # ``pending`` and accidentally upload the same medical file twice.
+        with _RECOVERY_LOCK:
+            if self.database_path in _RECOVERED_DATABASES:
+                return
+            with self._connect() as connection:
+                now = _utc_now()
+                connection.execute(
+                    """
+                    UPDATE local_audio_uploads
+                       SET status = 'pending',
+                           error_text = '应用上次退出时上传尚未完成，可重试。',
+                           updated_at = ?
+                     WHERE status = 'uploading'
+                    """,
+                    (now,),
+                )
+                connection.execute(
+                    """
+                    UPDATE local_audio_uploads
+                       SET status = 'invalid',
+                           error_text = '应用上次退出时录音尚未完成。',
+                           updated_at = ?
+                     WHERE status = 'recording'
+                    """,
+                    (now,),
+                )
+            _RECOVERED_DATABASES.add(self.database_path)
+
+    @staticmethod
+    def _from_row(row: sqlite3.Row) -> LocalAudioRecord:
+        raw_call_record_id = row["call_record_id"]
+        return LocalAudioRecord(
+            id=int(row["id"]),
+            session_id=str(row["session_id"]),
+            diagnosis_id=int(row["diagnosis_id"]),
+            call_record_id=(
+                int(raw_call_record_id) if raw_call_record_id not in (None, "") else None
+            ),
+            room_id=_clean_room_id(row["room_id"]),
+            mime_type=str(row["mime_type"]),
+            file_path=Path(str(row["file_path"])).resolve(),
+            size_bytes=int(row["size_bytes"] or 0),
+            status=str(row["status"]),
+            error_text=str(row["error_text"] or ""),
+            uploaded_url=str(row["uploaded_url"] or ""),
+            attempts=int(row["attempts"] or 0),
+            created_at=str(row["created_at"]),
+            updated_at=str(row["updated_at"]),
+            uploaded_at=str(row["uploaded_at"] or ""),
+        )
+
+    def begin_recording(
+        self,
+        *,
+        session_id: str,
+        diagnosis_id: int,
+        mime_type: str,
+        call_record_id: int | None = None,
+        room_id: str = "",
+    ) -> LocalAudioRecord:
+        suffix = ".ogg" if mime_type.startswith("audio/ogg") else ".webm"
+        timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+        name = f"call-{int(diagnosis_id)}-{timestamp}-{uuid4().hex[:10]}{suffix}.part"
+        path = (self.files_dir / name).resolve()
+        now = _utc_now()
+        clean_call_record_id = _clean_call_record_id(call_record_id, required=False)
+        clean_room_id = _clean_room_id(room_id)
+        with self._connect() as connection:
+            cursor = connection.execute(
+                """
+                INSERT INTO local_audio_uploads (
+                    session_id, diagnosis_id, call_record_id, room_id,
+                    mime_type, file_path,
+                    status, created_at, updated_at
+                ) VALUES (?, ?, ?, ?, ?, ?, 'recording', ?, ?)
+                """,
+                (
+                    session_id,
+                    int(diagnosis_id),
+                    clean_call_record_id,
+                    clean_room_id,
+                    mime_type,
+                    str(path),
+                    now,
+                    now,
+                ),
+            )
+            record_id = int(cursor.lastrowid)
+        record = self.get(record_id)
+        if record is None:  # pragma: no cover - SQLite insert/read invariant.
+            raise RuntimeError("无法创建本地录音记录。")
+        return record
+
+    def finalize_recording(self, record_id: int, *, size_bytes: int) -> LocalAudioRecord:
+        record = self.require(record_id)
+        if record.status != "recording":
+            raise RuntimeError("本地录音记录状态不允许完成。")
+        if record.file_path.suffix == ".part":
+            final_path = record.file_path.with_suffix("")
+            record.file_path.replace(final_path)
+        else:
+            final_path = record.file_path
+        now = _utc_now()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET file_path = ?, size_bytes = ?, status = 'pending',
+                       error_text = '', updated_at = ?
+                 WHERE id = ?
+                """,
+                (str(final_path), int(size_bytes), now, int(record_id)),
+            )
+        return self.require(record_id)
+
+    def mark_invalid(self, record_id: int, message: str) -> LocalAudioRecord:
+        record = self.require(record_id)
+        size = record.file_path.stat().st_size if record.file_path.is_file() else 0
+        now = _utc_now()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET size_bytes = ?, status = 'invalid', error_text = ?, updated_at = ?
+                 WHERE id = ?
+                """,
+                (size, str(message)[:1000], now, int(record_id)),
+            )
+        return self.require(record_id)
+
+    def bind_identity(
+        self,
+        record_id: int,
+        *,
+        call_record_id: int,
+        room_id: str = "",
+    ) -> LocalAudioRecord:
+        """Bind one recording to a call without overwriting a different identity."""
+
+        clean_call_record_id = _clean_call_record_id(call_record_id, required=True)
+        assert clean_call_record_id is not None
+        clean_room_id = _clean_room_id(room_id)
+        now = _utc_now()
+        with self._connect() as connection:
+            cursor = connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET call_record_id = CASE
+                           WHEN call_record_id IS NULL THEN ?
+                           ELSE call_record_id
+                       END,
+                       room_id = CASE
+                           WHEN room_id = '' AND ? <> '' THEN ?
+                           ELSE room_id
+                       END,
+                       updated_at = ?
+                 WHERE id = ?
+                   AND (call_record_id IS NULL OR call_record_id = ?)
+                   AND (? = '' OR room_id = '' OR room_id = ?)
+                """,
+                (
+                    clean_call_record_id,
+                    clean_room_id,
+                    clean_room_id,
+                    now,
+                    int(record_id),
+                    clean_call_record_id,
+                    clean_room_id,
+                    clean_room_id,
+                ),
+            )
+            if cursor.rowcount != 1:
+                exists = connection.execute(
+                    "SELECT 1 FROM local_audio_uploads WHERE id = ?",
+                    (int(record_id),),
+                ).fetchone()
+                if exists is None:
+                    raise LookupError("本地录音记录不存在。")
+                raise RuntimeError("本地录音的通话记录 ID 或房间号发生冲突。")
+        return self.require(record_id)
+
+    def set_call_record_id(self, record_id: int, call_record_id: int) -> None:
+        self.bind_identity(record_id, call_record_id=call_record_id)
+
+    def update_status(self, record_id: int, status: str, message: str = "") -> None:
+        if status not in {"pending", "uploading", "uploaded", "failed", "invalid"}:
+            raise ValueError("unsupported local-audio status")
+        now = _utc_now()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET status = ?, error_text = ?, updated_at = ?
+                 WHERE id = ?
+                """,
+                (status, str(message)[:1000], now, int(record_id)),
+            )
+
+    def get(self, record_id: int) -> LocalAudioRecord | None:
+        with self._connect() as connection:
+            row = connection.execute(
+                "SELECT * FROM local_audio_uploads WHERE id = ?",
+                (int(record_id),),
+            ).fetchone()
+        return self._from_row(row) if row is not None else None
+
+    def require(self, record_id: int) -> LocalAudioRecord:
+        record = self.get(record_id)
+        if record is None:
+            raise LookupError("本地录音记录不存在。")
+        return record
+
+    def list_records(self, *, diagnosis_id: int | None = None) -> list[LocalAudioRecord]:
+        with self._connect() as connection:
+            if diagnosis_id is None:
+                rows = connection.execute(
+                    "SELECT * FROM local_audio_uploads ORDER BY id DESC"
+                ).fetchall()
+            else:
+                rows = connection.execute(
+                    """
+                    SELECT * FROM local_audio_uploads
+                     WHERE diagnosis_id = ?
+                     ORDER BY id DESC
+                    """,
+                    (int(diagnosis_id),),
+                ).fetchall()
+        return [self._from_row(row) for row in rows]
+
+    def claim_upload(self, record_id: int) -> LocalAudioRecord | None:
+        now = _utc_now()
+        with self._connect() as connection:
+            cursor = connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET status = 'uploading', error_text = '', attempts = attempts + 1,
+                       updated_at = ?
+                 WHERE id = ? AND status IN ('pending', 'failed')
+                """,
+                (now, int(record_id)),
+            )
+            if cursor.rowcount != 1:
+                return None
+        return self.require(record_id)
+
+    def mark_uploaded(self, record_id: int, uploaded_url: str = "") -> None:
+        now = _utc_now()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET status = 'uploaded', uploaded_url = ?, error_text = '',
+                       uploaded_at = ?, updated_at = ?
+                 WHERE id = ?
+                """,
+                (str(uploaded_url)[:2000], now, now, int(record_id)),
+            )
+
+    def mark_failed(self, record_id: int, message: str) -> None:
+        now = _utc_now()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET status = 'failed', error_text = ?, updated_at = ?
+                 WHERE id = ?
+                """,
+                (str(message)[:1000] or "上传失败。", now, int(record_id)),
+            )
+
+    def retry(self, record_id: int) -> LocalAudioRecord:
+        record = self.require(record_id)
+        if record.status not in {"failed", "pending"}:
+            raise RuntimeError("当前录音状态不允许重试上传。")
+        if not record.file_path.is_file() or record.file_path.stat().st_size <= 0:
+            raise RuntimeError("本地录音文件不存在或为空。")
+        now = _utc_now()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                UPDATE local_audio_uploads
+                   SET status = 'pending', error_text = '', updated_at = ?
+                 WHERE id = ?
+                """,
+                (now, int(record_id)),
+            )
+        return self.require(record_id)
+
+
+def _upload_url(result: Any) -> str:
+    if not isinstance(result, dict):
+        return ""
+    data = result.get("data")
+    payload = data if isinstance(data, dict) else result
+    for key in ("file_url", "fileUrl", "url", "recording_url"):
+        value = payload.get(key)
+        if value:
+            return str(value)
+    return ""
+
+
+class LocalAudioUploadManager:
+    """Small daemon worker pool that uploads up to three recordings at once."""
+
+    def __init__(
+        self,
+        repository: Any,
+        store: LocalAudioQueueStore,
+        *,
+        max_workers: int = _MAX_UPLOAD_WORKERS,
+    ) -> None:
+        self.repository = repository
+        self.store = store
+        self.max_workers = max(1, min(int(max_workers), 8))
+        self._jobs: queue.Queue[tuple[int, Future[bool]]] = queue.Queue()
+        self._active: dict[int, Future[bool]] = {}
+        self._upload_listeners: set[Callable[[LocalAudioRecord], None]] = set()
+        self._lock = threading.Lock()
+        for index in range(self.max_workers):
+            threading.Thread(
+                target=self._worker,
+                name=f"local-audio-upload-{index + 1}",
+                daemon=True,
+            ).start()
+
+    def submit(self, record_id: int) -> Future[bool]:
+        record_id = int(record_id)
+        with self._lock:
+            existing = self._active.get(record_id)
+            if existing is not None:
+                return existing
+            future: Future[bool] = Future()
+            self._active[record_id] = future
+        self._jobs.put((record_id, future))
+        return future
+
+    def add_upload_listener(
+        self,
+        listener: Callable[[LocalAudioRecord], None],
+    ) -> None:
+        with self._lock:
+            self._upload_listeners.add(listener)
+
+    def remove_upload_listener(
+        self,
+        listener: Callable[[LocalAudioRecord], None],
+    ) -> None:
+        with self._lock:
+            self._upload_listeners.discard(listener)
+
+    def _notify_uploaded(self, record_id: int) -> None:
+        try:
+            record = self.store.require(record_id)
+        except Exception:
+            return
+        with self._lock:
+            listeners = tuple(self._upload_listeners)
+        for listener in listeners:
+            with suppress(Exception):
+                listener(record)
+
+    def submit_retryable(self, *, diagnosis_id: int | None = None) -> list[Future[bool]]:
+        futures: list[Future[bool]] = []
+        for record in self.store.list_records(diagnosis_id=diagnosis_id):
+            if record.status in _RETRYABLE_STATUSES:
+                futures.append(self.submit(record.id))
+        return futures
+
+    def submit_pending(self, *, diagnosis_id: int | None = None) -> list[Future[bool]]:
+        """Resume only queued work; failed uploads require an explicit retry."""
+
+        return [
+            self.submit(record.id)
+            for record in self.store.list_records(diagnosis_id=diagnosis_id)
+            if record.status == "pending"
+        ]
+
+    def _worker(self) -> None:
+        while True:
+            record_id, future = self._jobs.get()
+            try:
+                try:
+                    succeeded = self._upload(record_id)
+                except Exception as error:  # Defensive boundary around a daemon worker.
+                    with suppress(Exception):
+                        self.store.mark_failed(
+                            record_id,
+                            str(error) or "本地录音上传失败。",
+                        )
+                    succeeded = False
+                if not future.done():
+                    future.set_result(succeeded)
+            finally:
+                with self._lock:
+                    self._active.pop(record_id, None)
+                self._jobs.task_done()
+
+    def _upload(self, record_id: int) -> bool:
+        record = self.store.claim_upload(record_id)
+        if record is None:
+            current = self.store.get(record_id)
+            return bool(current and current.status == "uploaded")
+        if not record.file_path.is_file() or record.file_path.stat().st_size <= 0:
+            self.store.mark_failed(record.id, "本地录音文件不存在或为空。")
+            return False
+        if record.call_record_id is None or record.call_record_id <= 0:
+            self.store.mark_failed(record.id, "未保存对应的通话记录编号，暂不能上传。")
+            return False
+        upload = getattr(self.repository, "upload_call_recording", None)
+        if not callable(upload):
+            self.store.mark_failed(record.id, "当前服务未提供本地录音上传接口。")
+            return False
+        try:
+            result = upload(
+                path=record.file_path,
+                diagnosis_id=record.diagnosis_id,
+                call_record_id=record.call_record_id,
+                mime_type=record.mime_type,
+            )
+        except Exception as error:
+            self.store.mark_failed(record.id, str(error) or "本地录音上传 COS 失败。")
+            return False
+        uploaded_url = _upload_url(result)
+        if not uploaded_url:
+            self.store.mark_failed(record.id, "服务器未返回本地录音文件地址。")
+            return False
+        self.store.mark_uploaded(record.id, uploaded_url)
+        self._notify_uploaded(record.id)
+        return True
+
+
+def get_local_audio_upload_manager(
+    repository: Any,
+    store: LocalAudioQueueStore | None = None,
+) -> tuple[LocalAudioQueueStore, LocalAudioUploadManager]:
+    """Return one three-worker uploader per repository and manifest.
+
+    Video windows and the recording-management dialog may be opened many times
+    during a workstation session. Sharing the pool prevents each window from
+    creating another set of background threads while SQLite's atomic claim still
+    protects against duplicate uploads across processes.
+    """
+
+    resolved_store = store or LocalAudioQueueStore()
+    key = (id(repository), resolved_store.database_path)
+    with _MANAGER_LOCK:
+        manager = _MANAGERS.get(key)
+        if manager is None:
+            manager = LocalAudioUploadManager(
+                repository,
+                resolved_store,
+                max_workers=_MAX_UPLOAD_WORKERS,
+            )
+            _MANAGERS[key] = manager
+    return resolved_store, manager
@@ -28,9 +28,10 @@ from doctor_workstation.core.models import (
 from doctor_workstation.core.permissions import PermissionSet
 from doctor_workstation.core.session import Session

-from .repository import (
-    AuditAction,
-    _audit_action,
+from .repository import (
+    AuditAction,
+    _ai_patient_option,
+    _audit_action,
    _body,
    _daily_record_body,
    _identified_body,
@@ -1049,10 +1050,11 @@ class DemoDoctorRepository:
        if len(clean_prompt) > 500:
            raise ValueError("prompt must not exceed 500 characters")
        if task not in {
-            "summary",
-            "tcm_pattern",
-            "prescription_review",
-            "medication_review",
+            "summary",
+            "tcm_pattern",
+            "prescription_review",
+            "prescription_generate",
+            "medication_review",
            "exam_review",
            "complication_risk",
            "guideline_review",
@@ -1074,8 +1076,54 @@ class DemoDoctorRepository:
                ),
                "model_key": model_key,
                "model_label": "千问" if model_key == "qwen" else "OpenAI",
-                "task": task,
-            }
+                "task": task,
+            }
+
+    def generate_ai_prescription(self, diagnosis_id: int) -> dict[str, Any]:
+        """Return a deterministic full-context prescription draft in demo mode."""
+
+        with self._lock:
+            consultation = self._find_consultation(diagnosis_id)
+            raw = consultation.raw if isinstance(consultation.raw, Mapping) else {}
+            clinical = str(
+                raw.get("clinical_diagnosis") or raw.get("symptoms") or "待辨证"
+            ).strip()
+            draft = {
+                "prescription_name": "AI辨证处方草稿",
+                "clinical_diagnosis": clinical,
+                "prescription_type": "饮片",
+                "tongue": str(raw.get("tongue") or raw.get("tongue_coating") or ""),
+                "tongue_image": "",
+                "pulse": str(raw.get("pulse") or ""),
+                "pulse_condition": str(raw.get("pulse_condition") or ""),
+                "herbs": [
+                    {"name": "黄芪", "dosage": 15.0, "formula_type": "主方"},
+                    {"name": "山药", "dosage": 15.0, "formula_type": "主方"},
+                ],
+                "dose_count": 7,
+                "dose_unit": "剂",
+                "usage_days": 7,
+                "times_per_day": 2,
+                "usage_instruction": "水煎服，一日二次",
+                "usage_time": "饭后",
+                "usage_way": "温服",
+                "dietary_taboo": ["辛辣食物", "生冷食物"],
+                "usage_notes": "请结合舌脉与最新检查逐味复核。",
+                "rationale": "已依据患者纵向资料生成演示草稿，请医生逐项复核并签名。",
+                "risk_warnings": "演示数据不可替代真实临床判断。",
+                "requires_doctor_review": True,
+                "audit_status": 0,
+            }
+            return {
+                "diagnosis_id": consultation.id,
+                "answer": draft["rationale"],
+                "model_key": "qwen",
+                "model_label": "千问",
+                "task": "prescription_generate",
+                "context_scope": "patient_longitudinal",
+                "context_version": "patient-context-assistant-v2",
+                "prescription_draft": draft,
+            }

    def get_diagnosis_ai_analysis(
        self,
@@ -1657,9 +1705,9 @@ class DemoDoctorRepository:
        }
        return deepcopy(dictionaries.get(dictionary_type, []))

-    def list_patients(
-        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
-    ) -> PageResult[Patient]:
+    def list_patients(
+        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
+    ) -> PageResult[Patient]:
        """Return doctor-scoped demo patients and summary extension data."""

        with self._lock:
@@ -1695,17 +1743,78 @@ class DemoDoctorRepository:
                ),
                "day_after": 0,
            }
-            return _page(
-                rows,
-                page_no,
-                page_size,
+            return _page(
+                rows,
+                page_no,
+                page_size,
                {
                    "summary": summary,
                    "scope": {"label": "演示数据（仅本机内存）"},
-                },
-            )
-
-    def patient_orders(
+                },
+            )
+
+    def list_ai_patient_options(
+        self, *, page_no: int = 1, page_size: int = 20, keyword: str = ""
+    ) -> PageResult[dict[str, Any]]:
+        """Return deterministic diagnosis choices without plaintext patient data."""
+
+        clean_keyword = str(keyword or "").strip().lower()
+        with self._lock:
+            consultations = {row.id: row for row in self._consultations}
+            patients = sorted(
+                self._patients,
+                key=lambda row: (row.diagnosis_id or row.id, row.source_patient_id or 0),
+                reverse=True,
+            )
+            rows: list[dict[str, Any]] = []
+            for patient in patients:
+                diagnosis_id = patient.diagnosis_id or patient.id
+                consultation = consultations.get(diagnosis_id)
+                searchable = " ".join(
+                    (
+                        patient.name,
+                        patient.phone,
+                        patient.phone_masked,
+                        str(diagnosis_id),
+                        str(patient.source_patient_id or ""),
+                        consultation.clinical_diagnosis if consultation else "",
+                        str(consultation.raw.get("syndrome_type") or "")
+                        if consultation
+                        else "",
+                    )
+                ).lower()
+                if clean_keyword and clean_keyword not in searchable:
+                    continue
+                diagnosis_date = consultation.diagnosis_date if consultation else ""
+                next_appointment_at = patient.appointment_time_text
+                rows.append(
+                    _ai_patient_option(
+                        {
+                            "diagnosis_id": diagnosis_id,
+                            "source_patient_id": patient.source_patient_id,
+                            "patient_name": patient.name,
+                            "phone_masked": patient.phone_masked,
+                            "gender": patient.gender,
+                            "gender_desc": patient.gender_desc,
+                            "age": patient.age,
+                            "diagnosis_date": diagnosis_date,
+                            "diagnosis_summary": (
+                                consultation.clinical_diagnosis if consultation else ""
+                            ),
+                            "syndrome_type": (
+                                consultation.raw.get("syndrome_type") if consultation else ""
+                            ),
+                            "clinical_diagnosis": (
+                                consultation.clinical_diagnosis if consultation else ""
+                            ),
+                            "last_visit_at": diagnosis_date,
+                            "next_appointment_at": next_appointment_at,
+                        }
+                    )
+                )
+            return _page(rows, page_no, page_size)
+
+    def patient_orders(
        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
    ) -> PageResult[dict[str, Any]]:
        """Return the scoped demo order workspace and its summary extension."""
@@ -2588,8 +2697,11 @@ class DemoDoctorRepository:
                "room_id": "manual-upload",
                "status": 2,
                "status_text": "已结束",
-                "recording_status_text": "待上传",
-                "recording_urls_list": [],
+                "recording_status_text": "待上传",
+                "recording_urls_list": [],
+                "local_audio_status": 0,
+                "local_audio_status_text": "无本地录音",
+                "local_audio_urls_list": [],
                "transcription_status": "not_started",
                "transcription_status_text": "未生成文字",
                "transcript_text": "",
@@ -2633,36 +2745,75 @@ class DemoDoctorRepository:
            record["recording_status_text"] = "录制完成"
            return deepcopy(record)

-    def upload_call_recording(
-        self,
-        path: str | PathLike[str],
-        diagnosis_id: int,
-        *,
-        call_record_id: int | None = None,
-    ) -> dict[str, Any]:
-        """Upload then attach a demo video using the production sequence."""
-
-        file_url = self.upload_material(path, "video")
-        target_id = call_record_id
-        if target_id is None:
-            target_id = int(self.create_manual_call_record(diagnosis_id)["id"])
-        self.attach_local_call_recording(diagnosis_id, file_url, call_record_id=target_id)
-        return {
-            "diagnosis_id": diagnosis_id,
-            "call_record_id": target_id,
-            "file_url": file_url,
-        }
+    def upload_call_recording(
+        self,
+        path: str | PathLike[str],
+        diagnosis_id: int,
+        *,
+        call_record_id: int | None = None,
+        mime_type: str = "audio/webm",
+    ) -> dict[str, Any]:
+        """Upload then attach a demo local-audio file using the production sequence."""
+
+        source_path = Path(path)
+        is_audio = source_path.suffix.lower() in {
+            ".ogg",
+            ".opus",
+            ".mp3",
+            ".wav",
+            ".m4a",
+            ".aac",
+            ".amr",
+            ".wma",
+        } or (
+            source_path.suffix.lower() == ".webm"
+            and str(mime_type or "").lower().startswith("audio/")
+        )
+        file_url = self.upload_material(path, "file" if is_audio else "video")
+        target_id = call_record_id
+        if target_id is None:
+            target_id = int(self.create_manual_call_record(diagnosis_id)["id"])
+        if is_audio:
+            with self._lock:
+                record = next(
+                    (
+                        row
+                        for row in self._call_records.setdefault(diagnosis_id, [])
+                        if int(row.get("id") or 0) == int(target_id)
+                    ),
+                    None,
+                )
+                if record is None:
+                    raise RepositoryNotFoundError("call record not found")
+                urls = record.setdefault("local_audio_urls_list", [])
+                if file_url not in urls:
+                    urls.append(file_url)
+                record["local_audio_status"] = 2
+                record["local_audio_status_text"] = "已保存"
+        else:
+            self.attach_local_call_recording(diagnosis_id, file_url, call_record_id=target_id)
+        return {
+            "diagnosis_id": diagnosis_id,
+            "call_record_id": target_id,
+            "file_url": file_url,
+            "media_kind": "local_audio" if is_audio else "video",
+            "completed": True,
+        }

    def list_im_chat_messages(
        self, diagnosis_id: int, *, only_archived: bool = True
    ) -> dict[str, Any]:
        """Return the demo archive in the server response envelope shape."""

-        with self._lock:
-            consultation = self._find_consultation(diagnosis_id)
-            return deepcopy(
-                {
-                    "lists": self._im_messages.get(diagnosis_id, []),
+        with self._lock:
+            consultation = self._find_consultation(diagnosis_id)
+            rows = [
+                {**row, "diagnosis_id": diagnosis_id}
+                for row in self._im_messages.get(diagnosis_id, [])
+            ]
+            return deepcopy(
+                {
+                    "lists": rows,
                    "patient_im_id": f"patient_{consultation.patient_id}",
                    "patient_name": consultation.patient_name,
                    "doctor_accounts_queried": [] if only_archived else ["doctor_1001"],
@@ -2890,8 +3041,11 @@ class DemoDoctorRepository:
            replay = {
                **record,
                "status_text": "呼叫中",
-                "recording_status_text": "未录制",
-                "recording_urls_list": [],
+                "recording_status_text": "未录制",
+                "recording_urls_list": [],
+                "local_audio_status": 0,
+                "local_audio_status_text": "无本地录音",
+                "local_audio_urls_list": [],
                "transcription_status": "not_started",
                "transcription_status_text": "未生成文字",
                "transcript_text": "",
@@ -2903,13 +3057,21 @@ class DemoDoctorRepository:
            self._call_records.setdefault(diagnosis_id, []).insert(0, replay)
            return deepcopy(record)

-    def end_call(self, diagnosis_id: int) -> dict[str, Any]:
+    def end_call(
+        self, diagnosis_id: int, *, call_record_id: int | str | None = None
+    ) -> dict[str, Any]:
        """Persistently mark the demo call record ended."""

        with self._lock:
-            record = self._calls.get(diagnosis_id)
-            if record is None:
-                raise RepositoryNotFoundError(f"active call for {diagnosis_id} not found")
+            record = self._calls.get(diagnosis_id)
+            if record is None:
+                raise RepositoryNotFoundError(f"active call for {diagnosis_id} not found")
+            if call_record_id is not None and str(record.get("id") or "") != str(
+                call_record_id
+            ):
+                raise RepositoryNotFoundError(
+                    f"active call record {call_record_id} for {diagnosis_id} not found"
+                )
            record["status"] = "ended"
            record["ended_at"] = datetime.now().replace(microsecond=0).isoformat(sep=" ")
            replay = next(
@@ -2930,15 +3092,27 @@ class DemoDoctorRepository:
                )
            return deepcopy(record)

-    def bind_call_room(self, diagnosis_id: int, room_id: str) -> dict[str, Any]:
+    def bind_call_room(
+        self,
+        diagnosis_id: int,
+        room_id: str,
+        *,
+        call_record_id: int | str | None = None,
+    ) -> dict[str, Any]:
        """Persist the room identifier on the active demo call."""

        if not room_id.strip():
            raise ValueError("room_id is required")
        with self._lock:
-            record = self._calls.get(diagnosis_id)
-            if record is None:
-                raise RepositoryNotFoundError(f"active call for {diagnosis_id} not found")
+            record = self._calls.get(diagnosis_id)
+            if record is None:
+                raise RepositoryNotFoundError(f"active call for {diagnosis_id} not found")
+            if call_record_id is not None and str(record.get("id") or "") != str(
+                call_record_id
+            ):
+                raise RepositoryNotFoundError(
+                    f"active call record {call_record_id} for {diagnosis_id} not found"
+                )
            record["room_id"] = room_id.strip()
            record["status"] = "connected"
            replay = next(
@@ -2957,9 +3131,10 @@ class DemoDoctorRepository:
                        "status_text": "通话中",
                    }
                )
-            return {
-                "diagnosis_id": diagnosis_id,
-                "room_id": room_id.strip(),
+            return {
+                "diagnosis_id": diagnosis_id,
+                "call_record_id": record["id"],
+                "room_id": room_id.strip(),
                "cloud_recording": {"started": False, "message": "演示模式不录制"},
            }

@@ -2,22 +2,27 @@

 from __future__ import annotations

-import mimetypes
-import re
-import time
-from collections.abc import Mapping, Sequence
-from contextlib import suppress
-from datetime import date
+import mimetypes
+import re
+import time
+from collections.abc import Callable, Iterator, Mapping, Sequence
+from contextlib import suppress
+from datetime import date
+from inspect import Parameter, signature
 from io import BytesIO
 from os import PathLike
-from pathlib import Path
-from typing import Any, Final, Literal, Protocol
+from pathlib import Path
+from typing import Any, Final, Literal, Protocol
+from uuid import uuid4

-from doctor_workstation.core.errors import (
-    ApiProtocolError,
-    ApiTransportError,
-    AuthenticationExpiredError,
-)
+from doctor_workstation.core.errors import (
+    ApiBusinessError,
+    ApiHttpError,
+    ApiProtocolError,
+    ApiTimeoutError,
+    ApiTransportError,
+    AuthenticationExpiredError,
+)
 from doctor_workstation.core.models import (
    Appointment,
    CallTicket,
@@ -93,10 +98,15 @@ class DoctorRepository(Protocol):
    ) -> PageResult[Patient]:
        """Return a doctor-scoped patient page."""

-    def list_consultations(
-        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
-    ) -> PageResult[Consultation]:
-        """Return a diagnosis/consultation page."""
+    def list_consultations(
+        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
+    ) -> PageResult[Consultation]:
+        """Return a diagnosis/consultation page."""
+
+    def list_ai_patient_options(
+        self, *, page_no: int = 1, page_size: int = 20, keyword: str = ""
+    ) -> PageResult[dict[str, Any]]:
+        """Return privacy-safe diagnosis choices for patient AI workflows."""

    def list_prescription_templates(
        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
@@ -191,6 +201,19 @@ class DoctorRepository(Protocol):
    ) -> dict[str, Any]:
        """Ask the first-party diagnosis assistant; the server selects the model."""

+    def stream_diagnosis_ai(
+        self,
+        diagnosis_id: int,
+        prompt: str,
+        *,
+        task: str = "custom",
+        cancelled: Callable[[], bool] | None = None,
+    ) -> Iterator[dict[str, Any]]:
+        """Yield normalized ``start``/``delta``/``done`` assistant events."""
+
+    def generate_ai_prescription(self, diagnosis_id: int) -> dict[str, Any]:
+        """Generate a server-validated prescription draft for doctor review."""
+
    def get_diagnosis_ai_analysis(
        self,
        diagnosis_id: int,
@@ -618,14 +641,15 @@ class DoctorRepository(Protocol):
    ) -> Any:
        """Attach one uploaded replay URI to a call record."""

-    def upload_call_recording(
-        self,
-        path: str | PathLike[str],
-        diagnosis_id: int,
-        *,
-        call_record_id: int | None = None,
-    ) -> dict[str, Any]:
-        """Upload a local video then attach it to a real call record."""
+    def upload_call_recording(
+        self,
+        path: str | PathLike[str],
+        diagnosis_id: int,
+        *,
+        call_record_id: int | None = None,
+        mime_type: str = "audio/webm",
+    ) -> dict[str, Any]:
+        """Upload a locally captured call recording to a real call record."""

    def list_im_chat_messages(
        self, diagnosis_id: int, *, only_archived: bool = True
@@ -686,11 +710,19 @@ class DoctorRepository(Protocol):
    def start_call(self, diagnosis_id: int, patient_id: int, *, call_type: int = 2) -> Any:
        """Create a call record."""

-    def end_call(self, diagnosis_id: int) -> Any:
-        """End the active diagnosis call."""
-
-    def bind_call_room(self, diagnosis_id: int, room_id: str) -> Any:
-        """Bind a TRTC room to the active call."""
+    def end_call(
+        self, diagnosis_id: int, *, call_record_id: int | str | None = None
+    ) -> Any:
+        """End the exact active call when its server identity is available."""
+
+    def bind_call_room(
+        self,
+        diagnosis_id: int,
+        room_id: str,
+        *,
+        call_record_id: int | str | None = None,
+    ) -> Any:
+        """Bind a TRTC room to the exact active call and start cloud recording."""

    def start_call_transcription(
        self,
@@ -1328,25 +1360,7 @@ class RemoteDoctorRepository:
    ) -> dict[str, Any]:
        """Submit a diagnosis question to the first-party server assistant."""

-        if diagnosis_id <= 0:
-            raise ValueError("diagnosis_id must be positive")
-        clean_prompt = prompt.strip()
-        if not clean_prompt:
-            raise ValueError("prompt is required")
-        if len(clean_prompt) > 500:
-            raise ValueError("prompt must not exceed 500 characters")
-        clean_task = task.strip().lower() or "custom"
-        if clean_task not in {
-            "summary",
-            "tcm_pattern",
-            "prescription_review",
-            "medication_review",
-            "exam_review",
-            "complication_risk",
-            "guideline_review",
-            "custom",
-        }:
-            raise ValueError("task is not supported")
+        clean_prompt, clean_task = _diagnosis_ai_request(diagnosis_id, prompt, task)
        payload = _client_request(
            self.client,
            "post",
@@ -1359,6 +1373,72 @@ class RemoteDoctorRepository:
        )
        return dict(_require_mapping(payload, "tcm.diagnosis/aiAssistant"))

+    def stream_diagnosis_ai(
+        self,
+        diagnosis_id: int,
+        prompt: str,
+        *,
+        task: str = "custom",
+        cancelled: Callable[[], bool] | None = None,
+    ) -> Iterator[dict[str, Any]]:
+        """Stream a diagnosis answer, with one legacy fallback before first content."""
+
+        clean_prompt, clean_task = _diagnosis_ai_request(diagnosis_id, prompt, task)
+        body = {"id": diagnosis_id, "prompt": clean_prompt, "task": clean_task}
+        received_delta = False
+        received_done = False
+        try:
+            for raw_event in self.client.post_event_stream(
+                "tcm.diagnosis/aiAssistantStream",
+                body,
+                timeout=105.0,
+                cancelled=cancelled,
+            ):
+                if cancelled is not None and cancelled():
+                    return
+                event = _normalise_diagnosis_ai_event(raw_event)
+                if event is None:
+                    continue
+                kind = event["event"]
+                if kind == "delta":
+                    received_delta = True
+                elif kind == "done":
+                    received_done = True
+                yield event
+                if kind == "done":
+                    return
+            if cancelled is not None and cancelled():
+                return
+            if not received_done:
+                raise ApiProtocolError("AI assistant stream ended before done")
+        except (ApiHttpError, ApiProtocolError, ApiTimeoutError, ApiTransportError):
+            if received_delta or (cancelled is not None and cancelled()):
+                raise
+
+        # Older deployments do not expose the stream route. Submit exactly one
+        # request through the confirmed non-streaming endpoint in that case.
+        result = self.analyze_diagnosis_ai(
+            diagnosis_id,
+            clean_prompt,
+            task=clean_task,
+        )
+        if cancelled is not None and cancelled():
+            return
+        yield {"event": "start", "fallback": True}
+        answer = str(result.get("answer") or result.get("content") or "")
+        if answer:
+            yield {"event": "delta", "text": answer, "fallback": True}
+        yield {**result, "event": "done", "fallback": True}
+
+    def generate_ai_prescription(self, diagnosis_id: int) -> dict[str, Any]:
+        """Generate a structured draft using the server's full patient context."""
+
+        return self.analyze_diagnosis_ai(
+            diagnosis_id,
+            "请依据患者全部纵向资料生成一份可复核的中医处方草稿。",
+            task="prescription_generate",
+        )
+
    def get_diagnosis_ai_analysis(
        self,
        diagnosis_id: int,
@@ -1929,10 +2009,10 @@ class RemoteDoctorRepository:

        return self.get_diagnosis_detail(diagnosis_id, readonly=True)

-    def list_consultations(
-        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
-    ) -> PageResult[Consultation]:
-        """List diagnosis records using ``tcm.diagnosis/lists``."""
+    def list_consultations(
+        self, *, page_no: int = 1, page_size: int = 20, **filters: Any
+    ) -> PageResult[Consultation]:
+        """List diagnosis records using ``tcm.diagnosis/lists``."""

        request_filters = dict(filters)
        start_date = str(request_filters.pop("start_date", "") or "").strip()
@@ -1954,9 +2034,26 @@ class RemoteDoctorRepository:
            "tcm.diagnosis/lists",
            _page_params(page_no, page_size, request_filters),
        )
-        return PageResult.from_payload(
-            payload, Consultation.from_dict, page_no=page_no, page_size=page_size
-        )
+        return PageResult.from_payload(
+            payload, Consultation.from_dict, page_no=page_no, page_size=page_size
+        )
+
+    def list_ai_patient_options(
+        self, *, page_no: int = 1, page_size: int = 20, keyword: str = ""
+    ) -> PageResult[dict[str, Any]]:
+        """List privacy-safe diagnosis choices through the dedicated AI endpoint."""
+
+        clean_keyword = str(keyword or "").strip()
+        payload = self.client.get(
+            "tcm.diagnosis/aiPatientOptions",
+            _page_params(page_no, page_size, {"keyword": clean_keyword}),
+        )
+        return PageResult.from_payload(
+            payload,
+            _ai_patient_option,
+            page_no=page_no,
+            page_size=page_size,
+        )

    def get_diagnosis_detail(self, diagnosis_id: int, *, readonly: bool = False) -> dict[str, Any]:
        """Load a full diagnosis using the appropriate routed endpoint."""
@@ -2270,31 +2367,75 @@ class RemoteDoctorRepository:
            body["call_record_id"] = call_record_id
        return self.client.post("tcm.diagnosis/attachLocalCallRecording", body)

-    def upload_call_recording(
-        self,
-        path: str | PathLike[str],
-        diagnosis_id: int,
-        *,
-        call_record_id: int | None = None,
-    ) -> dict[str, Any]:
-        """Perform the same upload/create/attach sequence as ``CallRecordPanel``."""
-
-        if diagnosis_id <= 0:
-            raise ValueError("diagnosis_id must be positive")
-        # Match the admin component exactly: upload first so a failed upload does
-        # not leave behind an empty synthetic call record.
-        file_url = self.upload_material(path, "video")
-        target_id = call_record_id
-        if target_id is None:
-            target_id = int(self.create_manual_call_record(diagnosis_id).get("id") or 0)
-            if target_id <= 0:
-                raise ApiProtocolError("tcm.diagnosis/createManualCallRecord returned no id")
-        self.attach_local_call_recording(diagnosis_id, file_url, call_record_id=target_id)
-        return {
-            "diagnosis_id": diagnosis_id,
-            "call_record_id": target_id,
-            "file_url": file_url,
-        }
+    def upload_call_recording(
+        self,
+        path: str | PathLike[str],
+        diagnosis_id: int,
+        *,
+        call_record_id: int | None = None,
+        mime_type: str = "audio/webm",
+    ) -> dict[str, Any]:
+        """Chunk-upload one local audio recording and attach it atomically."""
+
+        if diagnosis_id <= 0:
+            raise ValueError("diagnosis_id must be positive")
+        if call_record_id is not None and call_record_id <= 0:
+            raise ValueError("call_record_id must be positive")
+        recording_path = Path(path).expanduser().resolve()
+        if not recording_path.is_file():
+            raise ValueError(f"recording file does not exist: {recording_path}")
+        file_size = recording_path.stat().st_size
+        if file_size <= 0:
+            raise ValueError("recording file must not be empty")
+
+        chunk_size = 4 * 1024 * 1024
+        chunk_total = (file_size + chunk_size - 1) // chunk_size
+        upload_id = f"local_audio_{uuid4().hex}"
+        file_name = recording_path.name
+        clean_mime = str(mime_type or "audio/webm").strip()[:120] or "audio/webm"
+        final_result: Mapping[str, Any] | None = None
+        bound_call_record_id = call_record_id
+        with recording_path.open("rb") as stream:
+            for chunk_index in range(chunk_total):
+                content = stream.read(chunk_size)
+                if not content:
+                    raise ApiProtocolError("local recording ended before all chunks were read")
+                result = self.client.post_multipart(
+                    "tcm.diagnosis/uploadCallRecording",
+                    files={"file": (file_name, content, clean_mime)},
+                    data={
+                        "diagnosis_id": diagnosis_id,
+                        "call_record_id": bound_call_record_id or 0,
+                        "upload_id": upload_id,
+                        "file_name": file_name,
+                        "file_size": file_size,
+                        "mime_type": clean_mime,
+                        "chunk_index": chunk_index,
+                        "chunk_total": chunk_total,
+                    },
+                )
+                final_result = _require_mapping(
+                    result,
+                    "tcm.diagnosis/uploadCallRecording",
+                )
+                returned_id = int(final_result.get("call_record_id") or 0)
+                if returned_id <= 0:
+                    raise ApiProtocolError(
+                        "uploadCallRecording returned no call_record_id"
+                    )
+                if bound_call_record_id is None:
+                    bound_call_record_id = returned_id
+                elif returned_id != bound_call_record_id:
+                    raise ApiProtocolError(
+                        "uploadCallRecording returned a different call_record_id"
+                    )
+
+        if final_result is None or not bool(final_result.get("completed")):
+            raise ApiProtocolError("uploadCallRecording did not complete the local audio upload")
+        file_url = str(final_result.get("file_url") or "").strip()
+        if not file_url:
+            raise ApiProtocolError("uploadCallRecording returned no COS file URL")
+        return dict(final_result)

    def list_im_chat_messages(
        self, diagnosis_id: int, *, only_archived: bool = True
@@ -2494,20 +2635,53 @@ class RemoteDoctorRepository:
            )
        return {"call_record_id": call_record_id}

-    def end_call(self, diagnosis_id: int) -> Any:
-        """End the active call/recording associated with a diagnosis."""
-
-        return self.client.post("tcm.diagnosis/endCall", {"diagnosis_id": diagnosis_id})
-
-    def bind_call_room(self, diagnosis_id: int, room_id: str) -> Any:
-        """Bind the actual TRTC room to the active call record."""
-
-        if not room_id.strip():
-            raise ValueError("room_id is required")
-        return self.client.post(
-            "tcm.diagnosis/bindCallRoom",
-            {"diagnosis_id": diagnosis_id, "room_id": room_id.strip()},
-        )
+    @staticmethod
+    def _optional_call_record_id(call_record_id: int | str | None) -> int | str | None:
+        if call_record_id is None:
+            return None
+        if isinstance(call_record_id, bool) or not str(call_record_id).strip():
+            raise ValueError("call_record_id must be a positive identifier")
+        try:
+            normalized = int(str(call_record_id).strip())
+        except (TypeError, ValueError) as exc:
+            raise ValueError("call_record_id must be a positive identifier") from exc
+        if normalized <= 0:
+            raise ValueError("call_record_id must be a positive identifier")
+        return normalized
+
+    def end_call(
+        self, diagnosis_id: int, *, call_record_id: int | str | None = None
+    ) -> Any:
+        """Stop COS cloud recording and end the exact call record."""
+
+        body: dict[str, Any] = {"diagnosis_id": diagnosis_id}
+        normalized_id = self._optional_call_record_id(call_record_id)
+        if normalized_id is not None:
+            body["call_record_id"] = normalized_id
+        return self.client.post("tcm.diagnosis/endCall", body)
+
+    def bind_call_room(
+        self,
+        diagnosis_id: int,
+        room_id: str,
+        *,
+        call_record_id: int | str | None = None,
+    ) -> Any:
+        """Bind the actual TRTC room and auto-start COS cloud recording."""
+
+        if not room_id.strip():
+            raise ValueError("room_id is required")
+        body: dict[str, Any] = {
+            "diagnosis_id": diagnosis_id,
+            "room_id": room_id.strip(),
+        }
+        normalized_id = self._optional_call_record_id(call_record_id)
+        if normalized_id is not None:
+            body["call_record_id"] = normalized_id
+        return self.client.post(
+            "tcm.diagnosis/bindCallRoom",
+            body,
+        )

    @staticmethod
    def _transcription_identity(
@@ -2638,7 +2812,67 @@ class RemoteDoctorRepository:
        return self.update_prescription_template(template, changes, **fields)


-def _page_params(page_no: int, page_size: int, filters: Mapping[str, Any]) -> dict[str, Any]:
+def _diagnosis_ai_request(diagnosis_id: int, prompt: str, task: str) -> tuple[str, str]:
+    if diagnosis_id <= 0:
+        raise ValueError("diagnosis_id must be positive")
+    clean_prompt = prompt.strip()
+    if not clean_prompt:
+        raise ValueError("prompt is required")
+    if len(clean_prompt) > 500:
+        raise ValueError("prompt must not exceed 500 characters")
+    clean_task = task.strip().lower() or "custom"
+    if clean_task not in {
+        "summary",
+        "tcm_pattern",
+        "prescription_review",
+        "prescription_generate",
+        "medication_review",
+        "exam_review",
+        "complication_risk",
+        "guideline_review",
+        "custom",
+    }:
+        raise ValueError("task is not supported")
+    return clean_prompt, clean_task
+
+
+def _normalise_diagnosis_ai_event(raw: Mapping[str, Any]) -> dict[str, Any] | None:
+    kind = str(raw.get("event") or "message").strip().lower()
+    data = raw.get("data")
+    payload = dict(data) if isinstance(data, Mapping) else {}
+    if kind == "message":
+        kind = str(payload.get("event") or payload.get("type") or "message").lower()
+    if kind == "start":
+        payload.pop("event", None)
+        payload.pop("type", None)
+        return {**payload, "event": "start"}
+    if kind == "delta":
+        text = (
+            data
+            if isinstance(data, str)
+            else payload.get("delta")
+            or payload.get("content")
+            or payload.get("text")
+            or ""
+        )
+        if not isinstance(text, str):
+            raise ApiProtocolError("AI assistant delta content must be text", data=data)
+        return {"event": "delta", "text": text}
+    if kind == "done":
+        payload.pop("event", None)
+        payload.pop("type", None)
+        return {**payload, "event": "done"}
+    if kind == "error":
+        message = (
+            data
+            if isinstance(data, str)
+            else payload.get("message") or payload.get("msg") or payload.get("error")
+        )
+        raise ApiBusinessError(str(message or "AI assistant stream failed"), data=data)
+    return None
+
+
+def _page_params(page_no: int, page_size: int, filters: Mapping[str, Any]) -> dict[str, Any]:
    if page_no < 1 or page_size < 1:
        raise ValueError("page_no and page_size must be positive")
    result = {
@@ -2646,8 +2880,39 @@ def _page_params(page_no: int, page_size: int, filters: Mapping[str, Any]) -> di
        for key, value in filters.items()
        if value is not None and not (isinstance(value, (list, tuple, set)) and not value)
    }
-    result.update({"page_no": page_no, "page_size": page_size})
-    return result
+    result.update({"page_no": page_no, "page_size": page_size})
+    return result
+
+
+def _ai_patient_option(row: Mapping[str, Any]) -> dict[str, Any]:
+    """Project one AI patient option without exposing a plaintext phone number."""
+
+    diagnosis_id = _to_int(row.get("diagnosis_id", row.get("id")), 0)
+    source_patient_id = _to_int(row.get("source_patient_id", row.get("patient_id")), 0)
+    phone = str(row.get("phone_masked") or "").strip()
+    digits = re.sub(r"\D", "", phone)
+    if len(digits) >= 7 and "*" not in phone:
+        phone = f"{digits[:3]}****{digits[-4:]}"
+    option: dict[str, Any] = {
+        "diagnosis_id": diagnosis_id,
+        "source_patient_id": source_patient_id,
+        "patient_name": str(row.get("patient_name", row.get("name")) or "").strip(),
+        "phone_masked": phone,
+    }
+    for key in (
+        "gender",
+        "gender_desc",
+        "age",
+        "diagnosis_date",
+        "diagnosis_summary",
+        "syndrome_type",
+        "clinical_diagnosis",
+        "last_visit_at",
+        "next_appointment_at",
+    ):
+        if key in row:
+            option[key] = row[key]
+    return option


 def _require_mapping(value: object, endpoint: str) -> Mapping[str, Any]:
@@ -2656,24 +2921,40 @@ def _require_mapping(value: object, endpoint: str) -> Mapping[str, Any]:
    return value


-def _client_request(
+def _client_request(
    client: Any,
    method: str,
    endpoint: str,
    payload: Mapping[str, Any] | None = None,
    *,
    timeout: float | None = None,
-) -> Any:
-    """Call get/post, ignoring timeout kwargs that test doubles do not accept."""
-
-    fn = getattr(client, method)
-    params = dict(payload or {})
-    try:
-        if timeout is None:
-            return fn(endpoint, params)
-        return fn(endpoint, params, timeout=timeout)
-    except TypeError:
-        return fn(endpoint, params)
+) -> Any:
+    """Call get/post once, omitting timeout for legacy test doubles.
+
+    Capability is determined before invocation.  Catching ``TypeError`` from
+    the call itself is unsafe for POST because the transport may already have
+    submitted the write before raising, and a fallback call would duplicate it.
+    """
+
+    fn = getattr(client, method)
+    params = dict(payload or {})
+    if timeout is not None:
+        try:
+            parameters = signature(fn).parameters.values()
+        except (TypeError, ValueError):
+            parameters = ()
+        accepts_timeout = any(
+            parameter.kind is Parameter.VAR_KEYWORD
+            or (
+                parameter.name == "timeout"
+                and parameter.kind
+                in {Parameter.POSITIONAL_OR_KEYWORD, Parameter.KEYWORD_ONLY}
+            )
+            for parameter in parameters
+        )
+        if accepts_timeout:
+            return fn(endpoint, params, timeout=timeout)
+    return fn(endpoint, params)


 def _material_kind(
@@ -2526,14 +2526,29 @@ class _RemoteImageButton(QPushButton):
        request = QNetworkRequest(url)
        request.setTransferTimeout(10_000)
        request.setMaximumRedirectsAllowed(4)
-        request.setAttribute(
-            QNetworkRequest.Attribute.RedirectPolicyAttribute,
-            QNetworkRequest.RedirectPolicy.NoLessSafeRedirectPolicy,
-        )
-        reply = self._manager.get(request)
-        self._reply = reply
-        reply.setProperty("diagnosisImageGeneration", generation)
-        reply.finished.connect(self._reply_finished)
+        request.setAttribute(
+            QNetworkRequest.Attribute.RedirectPolicyAttribute,
+            QNetworkRequest.RedirectPolicy.SameOriginRedirectPolicy,
+        )
+        reply = self._manager.get(request)
+        self._reply = reply
+        reply.setProperty("diagnosisImageGeneration", generation)
+        reply.setProperty("diagnosisImageOversize", False)
+        reply.downloadProgress.connect(self._download_progress)
+        reply.finished.connect(self._reply_finished)
+
+    def _download_progress(self, bytes_received: int, bytes_total: int) -> None:
+        """Abort a current reply as soon as its received or declared size is unsafe."""
+
+        reply = self.sender()
+        if reply is not self._reply:
+            return
+        if bytes_received <= self._MAX_IMAGE_BYTES and (
+            bytes_total < 0 or bytes_total <= self._MAX_IMAGE_BYTES
+        ):
+            return
+        reply.setProperty("diagnosisImageOversize", True)
+        reply.abort()

    def _reply_finished(self) -> None:
        """Use a QObject receiver connection so destruction auto-disconnects the callback."""
@@ -2553,16 +2568,19 @@ class _RemoteImageButton(QPushButton):
            reply.deleteLater()
            return
        self._reply = None
-        if not self._owner_is_current():
-            reply.deleteLater()
-            return
-        error = reply.error()
-        payload = bytes(reply.readAll())
-        reply.deleteLater()
-        if error != QNetworkReply.NetworkError.NoError:
-            self._show_fallback()
-            return
-        self._apply_payload(payload, generation)
+        if not self._owner_is_current():
+            reply.deleteLater()
+            return
+        error = reply.error()
+        if bool(reply.property("diagnosisImageOversize")) or (
+            error != QNetworkReply.NetworkError.NoError
+        ):
+            reply.deleteLater()
+            self._show_fallback()
+            return
+        payload = bytes(reply.readAll())
+        reply.deleteLater()
+        self._apply_payload(payload, generation)

    def _apply_payload(self, payload: bytes, generation: int) -> bool:
        """Decode a current reply; kept separate so offline tests can exercise rendering."""
@@ -61,22 +61,44 @@ from PySide6.QtWidgets import (
    QWidgetItem,
 )

+from .theme import crisp_pixmap
 from .widgets import display_text, first_value, gender_text, get_value

-PRIMARY = QColor("#5265F6")
-TEXT = QColor("#15224A")
-SECONDARY = QColor("#7481A3")
-PLACEHOLDER = QColor("#A4ADC3")
+PRIMARY = QColor("#5265F6")
+TEXT = QColor("#15224A")
+SECONDARY = QColor("#7481A3")
+PLACEHOLDER = QColor("#A4ADC3")
 _INVALID_INDEX = QModelIndex()
-_TABLE_COLUMN_WIDTHS = (48, 70, 60, 100, 175, 88, 120, 100, 72, 110, 120, 340)
+_TABLE_COLUMN_WIDTHS = (48, 70, 60, 100, 175, 88, 120, 100, 72, 110, 120, 410)
+
+
+def _render_signature(value: Any) -> Any:
+    """Freeze repository DTOs into a stable, order-independent render key."""
+
+    if isinstance(value, Mapping):
+        items = ((str(key), _render_signature(item)) for key, item in value.items())
+        return ("mapping", tuple(sorted(items, key=lambda item: item[0])))
+    if isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
+        return ("sequence", tuple(_render_signature(item) for item in value))
+    if isinstance(value, set | frozenset):
+        items = (_render_signature(item) for item in value)
+        return ("set", tuple(sorted(items, key=repr)))
+    try:
+        hash(value)
+    except TypeError:
+        return ("repr", repr(value))
+    return ("value", value)
+
+
+def _rows_render_signature(rows: Sequence[Any]) -> tuple[Any, ...]:
+    return tuple(_render_signature(row) for row in rows)


 def _menu_action_icon(kind: str, *, danger: bool = False) -> QIcon:
    """Draw the admin menu glyphs without relying on a symbol font."""

    size = 18
-    pixmap = QPixmap(size, size)
-    pixmap.fill(Qt.GlobalColor.transparent)
+    pixmap = crisp_pixmap(size)
    painter = QPainter(pixmap)
    painter.setRenderHint(QPainter.RenderHint.Antialiasing, True)
    color = QColor("#C43E55" if danger else "#667085")
@@ -242,6 +264,27 @@ def _appointment_active(record: Any) -> bool:
    return _has_appointment(record) and _appointment_status(record) == 1


+def video_call_state(record: Any) -> str:
+    """Return the server-owned state of the latest video-call session."""
+
+    return str(
+        first_value(
+            record,
+            "video_call_hint.state",
+            "video_hint.state",
+            "video_hint",
+            default="none",
+        )
+        or "none"
+    ).strip().lower()
+
+
+def video_call_is_live(record: Any) -> bool:
+    """Only a room already opened by the doctor may be joined from this list."""
+
+    return video_call_state(record) == "live"
+
+
 def _single_cancellable_appointment(record: Any) -> Any | None:
    """Return the sole cancellable appointment, never an ambiguous row-level fallback."""

@@ -295,12 +338,34 @@ def _video_ids_complete(record: Any) -> bool:
    )


-def _prescription_action_label(record: Any, *, force_open: bool = False) -> str:
+def prescription_action(record: Any, *, force_open: bool = False) -> tuple[str, str]:
+    """Return the label and immutable click intent for the current appointment."""
+
    if force_open:
-        return "开方"
+        return "开方", "open"
    audit = _as_int(first_value(record, "prescription_audit_status", "audit_status"), -1)
    voided = _as_int(first_value(record, "prescription_void_status", "void_status"), 0)
-    return "查看处方" if audit == 1 and voided != 1 else "开方"
+    explicit_current = first_value(record, "current_has_prescription", default=None)
+    if explicit_current is not None:
+        has_current = _as_bool(explicit_current)
+    elif _as_int(first_value(record, "current_prescription_id", default=0)) > 0:
+        has_current = True
+    else:
+        explicit_legacy = first_value(record, "has_prescription", default=None)
+        has_current = (
+            _as_bool(explicit_legacy)
+            if explicit_legacy is not None
+            else audit in {0, 1, 2}
+        )
+    if not has_current:
+        return "开方", "open"
+    if audit == 1 and voided != 1:
+        return "查看处方", "view"
+    return "编辑处方", "edit"
+
+
+def _prescription_action_label(record: Any, *, force_open: bool = False) -> str:
+    return prescription_action(record, force_open=force_open)[0]


 class FlowLayout(QLayout):
@@ -453,6 +518,7 @@ class DiagnosisTableModel(QAbstractTableModel):
    def __init__(self, rows: Iterable[Any] = (), parent: QWidget | None = None) -> None:
        super().__init__(parent)
        self.rows: list[Any] = list(rows)
+        self._render_signature = _rows_render_signature(self.rows)
        self._checked_ids: set[int] = set()
        self._hover_row = -1
        self._sort_direction = ""
@@ -526,15 +592,24 @@ class DiagnosisTableModel(QAbstractTableModel):
    def record(self, row: int) -> Any:
        return self.rows[row] if 0 <= row < len(self.rows) else None

-    def set_rows(self, rows: Iterable[Any]) -> None:
+    @property
+    def render_signature(self) -> tuple[Any, ...]:
+        return self._render_signature
+
+    def set_rows(self, rows: Iterable[Any]) -> bool:
        materialized = list(rows)
+        render_signature = _rows_render_signature(materialized)
+        if render_signature == self._render_signature:
+            return False
        valid_ids = {self.record_id(row) for row in materialized}
        self.beginResetModel()
        self.rows = materialized
+        self._render_signature = render_signature
        self._checked_ids.intersection_update(valid_ids)
        self._hover_row = -1
        self.endResetModel()
        self.selection_changed.emit(len(self._checked_ids))
+        return True

    def checked_records(self) -> list[Any]:
        return [row for row in self.rows if self.record_id(row) in self._checked_ids]
@@ -1158,7 +1233,8 @@ class DiagnosisTableView(QTableView):
        self.itemSelectionChanged.emit()

    def set_rows(self, rows: Iterable[Any]) -> None:
-        self._diagnosis_model().set_rows(rows)
+        if not self._diagnosis_model().set_rows(rows):
+            return
        self.clearSelection()
        self.setCurrentIndex(QModelIndex())
        self.rows_replaced.emit()
@@ -1295,6 +1371,9 @@ class DiagnosisTableHost(QFrame):
    LEFT_WIDTHS = _TABLE_COLUMN_WIDTHS[:10]
    FIXED_WIDTHS = _TABLE_COLUMN_WIDTHS[10:]

+    #: Inline row actions kept before the rest fall back to the 更多 menu.
+    MAX_INLINE_ACTIONS = 2
+
    def __init__(
        self,
        *,
@@ -1303,6 +1382,8 @@ class DiagnosisTableHost(QFrame):
    ) -> None:
        super().__init__(parent)
        self.setObjectName("DiagnosisTableHost")
+        self.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Expanding)
+        self.setMinimumHeight(0)
        self.action_policy = dict(action_policy or {})
        self.force_open_prescription = False
        self.model = DiagnosisTableModel(parent=self)
@@ -1316,10 +1397,13 @@ class DiagnosisTableHost(QFrame):
            view.setModel(self.model)
            view.setSelectionModel(self.selection)
            view.setItemDelegate(self.delegate)
-            view.setVerticalScrollBarPolicy(Qt.ScrollBarPolicy.ScrollBarAlwaysOff)
+            view.setMinimumHeight(0)
+            view.setVerticalScrollMode(QAbstractItemView.ScrollMode.ScrollPerPixel)
            view.setHorizontalScrollMode(QAbstractItemView.ScrollMode.ScrollPerPixel)
            view.horizontalHeader().setSectionResizeMode(QHeaderView.ResizeMode.Fixed)
            view.horizontalHeader().setStretchLastSection(False)
+        self.main.setVerticalScrollBarPolicy(Qt.ScrollBarPolicy.ScrollBarAsNeeded)
+        self.fixed.setVerticalScrollBarPolicy(Qt.ScrollBarPolicy.ScrollBarAlwaysOff)
        self.main.setHorizontalScrollBarPolicy(Qt.ScrollBarPolicy.ScrollBarAsNeeded)
        self.fixed.setHorizontalScrollBarPolicy(Qt.ScrollBarPolicy.ScrollBarAlwaysOff)
        self.main.setMinimumWidth(0)
@@ -1335,6 +1419,7 @@ class DiagnosisTableHost(QFrame):
        layout.setSpacing(0)
        layout.addWidget(self.main, 1)
        layout.addWidget(self.fixed)
+        layout.setAlignment(self.fixed, Qt.AlignmentFlag.AlignTop)
        self.fixed_shadow = _FixedColumnShadow(self)
        self.fixed_shadow.show()
        self.empty_label = QLabel("暂无数据", self)
@@ -1349,17 +1434,22 @@ class DiagnosisTableHost(QFrame):
        self.fixed.hovered_row.connect(self._set_hover_row)
        self.model.selection_changed.connect(self._checked_changed)
        self.main.horizontalHeader().sectionClicked.connect(self._header_clicked)
-        self._update_height()
+        self.main.verticalScrollBar().valueChanged.connect(self.fixed.verticalScrollBar().setValue)
+        self.fixed.verticalScrollBar().valueChanged.connect(self.main.verticalScrollBar().setValue)
+        self.main.horizontalScrollBar().rangeChanged.connect(self._schedule_fixed_height_sync)
+        self._fixed_render_signature: tuple[Any, ...] | None = None

    def set_rows(self, rows: Iterable[Any]) -> None:
        previous_id = DiagnosisTableModel.record_id(self.main.current_data())
-        self.model.set_rows(rows)
+        rows_changed = self.model.set_rows(rows)
        self.empty_label.setText("暂无数据")
        self.empty_label.setProperty("stateKind", "empty")
        self.empty_label.style().unpolish(self.empty_label)
        self.empty_label.style().polish(self.empty_label)
-        self._rows_changed()
-        if previous_id > 0:
+        fixed_widgets_changed = self._fixed_widgets_signature() != self._fixed_render_signature
+        if rows_changed or fixed_widgets_changed:
+            self._rows_changed()
+        if rows_changed and previous_id > 0:
            for index, record in enumerate(self.model.rows):
                if DiagnosisTableModel.record_id(record) == previous_id:
                    self.main.selectRow(index)
@@ -1392,10 +1482,18 @@ class DiagnosisTableHost(QFrame):
    def _rows_changed(self) -> None:
        self._sync_row_heights()
        self._install_fixed_widgets()
+        self._fixed_render_signature = self._fixed_widgets_signature()
        self.empty_label.setVisible(self.model.rowCount() == 0)
-        self._update_height()
        self._position_empty()
        self._position_fixed_shadow()
+        self._schedule_fixed_height_sync()
+
+    def _fixed_widgets_signature(self) -> tuple[Any, ...]:
+        return (
+            self.model.render_signature,
+            self.force_open_prescription,
+            tuple(sorted(self.action_policy.items())),
+        )

    def _sync_row_heights(self) -> None:
        for row, record in enumerate(self.model.rows):
@@ -1434,12 +1532,13 @@ class DiagnosisTableHost(QFrame):
        layout.setContentsMargins(3, 2, 3, 2)
        layout.setAlignment(Qt.AlignmentFlag.AlignCenter)
        video_capable = self.action_policy.get("video_call", False)
-        if video_capable and _appointment_active(record):
+        call_state = video_call_state(record)
+        if video_capable and _appointment_active(record) and call_state == "live":
            button = QToolButton(host)
            button.setText("进入视频问诊")
            button.setProperty("rowLink", "primary")
            button.setCursor(Qt.CursorShape.PointingHandCursor)
-            button.setToolTip("进入医生端视频问诊（将使用摄像头和麦克风）")
+            button.setToolTip("医生已发起视频会话，点击进入（将使用摄像头和麦克风）")
            button.setEnabled(_video_ids_complete(record))
            if not button.isEnabled():
                button.setToolTip("患者、诊单或挂号标识不完整，无法进入视频问诊")
@@ -1450,9 +1549,15 @@ class DiagnosisTableHost(QFrame):
        else:
            status = "—"
            if video_capable:
-                status = {3: "已完成", 4: "已过号"}.get(
-                    _appointment_status(record), "未挂号" if not _has_appointment(record) else "—"
-                )
+                if call_state == "pending_room":
+                    status = "等待接通"
+                elif _appointment_active(record):
+                    status = "暂无通话"
+                else:
+                    status = {3: "已完成", 4: "已过号"}.get(
+                        _appointment_status(record),
+                        "未挂号" if not _has_appointment(record) else "—",
+                    )
            label = QLabel(display_text(status), host)
            label.setProperty("fixedMuted", True)
            label.setAlignment(Qt.AlignmentFlag.AlignCenter)
@@ -1466,23 +1571,33 @@ class DiagnosisTableHost(QFrame):
        layout = QHBoxLayout(host)
        layout.setContentsMargins(4, 2, 4, 2)
        layout.setSpacing(2)
+        # 该列曾把全部有权限的操作平铺出来，一行最多七个链接，既撑宽操作列，
+        # 又让每一行的宽度都不一样。这里只保留“看诊单 / 开方”两个闭环主操作，
+        # 其余按原顺序降级进本就存在的“更多”菜单。
+        candidates: list[tuple[str, str, str]] = []
        if self.action_policy.get("view", False):
-            layout.addWidget(self._action_button("查看", "view", record, "primary"))
+            candidates.append(("查看", "view", "primary"))
        if self.action_policy.get("edit", False):
-            layout.addWidget(self._action_button("诊单", "edit", record, "primary"))
+            candidates.append(("诊单", "edit", "primary"))
        if self.action_policy.get("prescription", False):
-            layout.addWidget(
-                self._action_button(
+            candidates.append(
+                (
                    _prescription_action_label(record, force_open=self.force_open_prescription),
                    "prescription",
-                    record,
                    "primary",
                )
            )
+        if self.action_policy.get("ai_consult", False):
+            candidates.append(("AI 分析", "ai_consult", "primary"))
        if self.action_policy.get("appointment", False):
-            layout.addWidget(self._action_button("预约", "appointment", record, "success"))
+            candidates.append(("预约", "appointment", "success"))
        if self.action_policy.get("edit", False):
-            layout.addWidget(self._action_button("补全身份证", "fill_id_card", record, "warning"))
+            candidates.append(("补全身份证", "fill_id_card", "warning"))
+
+        inline_actions = candidates[: self.MAX_INLINE_ACTIONS]
+        demoted_actions = candidates[self.MAX_INLINE_ACTIONS :]
+        for label, action, semantic in inline_actions:
+            layout.addWidget(self._action_button(label, action, record, semantic))
        more = QToolButton(host)
        more.setText("更多")
        more.setArrowType(Qt.ArrowType.DownArrow)
@@ -1499,6 +1614,17 @@ class DiagnosisTableHost(QFrame):
            "QMenu::item:disabled{color:#98A2B3;}"
            "QMenu::separator{height:1px;background:#D8DEEA;margin:5px 8px;}"
        )
+        for label, action, _semantic in demoted_actions:
+            _add_menu_action(
+                menu,
+                label,
+                "document",
+                lambda _checked=False, command=action, item=record: self.action_requested.emit(
+                    command, item
+                ),
+            )
+        if demoted_actions and self.action_policy.get("assign", False):
+            menu.addSeparator()
        if self.action_policy.get("assign", False):
            _add_menu_action(
                menu,
@@ -1604,14 +1730,23 @@ class DiagnosisTableHost(QFrame):
        self.set_sort_direction(direction)
        self.sort_unserved_requested.emit(direction)

-    def _update_height(self) -> None:
-        rows_height = sum(self.main.rowHeight(row) for row in range(self.model.rowCount()))
-        body_height = rows_height if rows_height else 60
-        horizontal = self.main.horizontalScrollBar().sizeHint().height()
-        self.setFixedHeight(39 + body_height + horizontal + 2)
+    def _schedule_fixed_height_sync(self, *_range: int) -> None:
+        """Keep both table viewports equally tall when the main x-scrollbar appears."""
+
+        QTimer.singleShot(0, self._sync_fixed_height)
+
+    def _sync_fixed_height(self) -> None:
+        horizontal = self.main.horizontalScrollBar()
+        reserved = horizontal.sizeHint().height() if horizontal.maximum() > 0 else 0
+        target = max(0, self.height() - reserved)
+        if self.fixed.height() != target:
+            self.fixed.setFixedHeight(target)

    def _position_empty(self) -> None:
-        self.empty_label.setGeometry(0, 39, self.width(), 60)
+        horizontal = self.main.horizontalScrollBar()
+        reserved = horizontal.sizeHint().height() if horizontal.maximum() > 0 else 0
+        body_height = max(0, self.height() - 39 - reserved)
+        self.empty_label.setGeometry(0, 39, self.width(), body_height)
        self.empty_label.raise_()

    def _position_fixed_shadow(self) -> None:
@@ -1626,6 +1761,7 @@ class DiagnosisTableHost(QFrame):

    def resizeEvent(self, event: QResizeEvent) -> None:
        super().resizeEvent(event)
+        self._sync_fixed_height()
        self._position_empty()
        self._position_fixed_shadow()

@@ -1639,14 +1775,16 @@ class DiagnosisPager(QWidget):
    def __init__(self, page_size: int = 15, parent: QWidget | None = None) -> None:
        super().__init__(parent)
        self.setObjectName("DiagnosisPager")
+        self.setFixedHeight(42)
+        self.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Fixed)
        self.page = 1
        self.page_size = page_size
        self.total = 0
        self._setting = False
        self._page_buttons: list[QToolButton] = []
        layout = QHBoxLayout(self)
-        layout.setContentsMargins(16, 10, 16, 16)
-        layout.setSpacing(8)
+        layout.setContentsMargins(12, 4, 12, 4)
+        layout.setSpacing(6)
        layout.addStretch(1)
        self.summary = QLabel("共 0 条")
        self.summary.setProperty("pagerMuted", True)
@@ -2138,4 +2276,5 @@ __all__ = [
    "DiagnosisTableModel",
    "FlowLayout",
    "FlowWidget",
+    "prescription_action",
 ]
@@ -1,5 +1,24 @@
 """Reusable doctor-workstation dialogs."""

+from .ai_consult import AiConsultDialog, can_open_ai_consult, present_ai_consult
+from .ai_consult_picker import (
+    AiConsultTarget,
+    AiConsultTargetDialog,
+    select_and_present_ai_consult,
+)
+from .app_update import AppUpdateDialog, AppUpdateSession
 from .diagnosis import DiagnosisDialog, OrderDetailDrawer, present_order_detail

-__all__ = ["DiagnosisDialog", "OrderDetailDrawer", "present_order_detail"]
+__all__ = [
+    "AiConsultDialog",
+    "AiConsultTarget",
+    "AiConsultTargetDialog",
+    "AppUpdateDialog",
+    "AppUpdateSession",
+    "DiagnosisDialog",
+    "OrderDetailDrawer",
+    "can_open_ai_consult",
+    "present_ai_consult",
+    "present_order_detail",
+    "select_and_present_ai_consult",
+]
@@ -0,0 +1,428 @@
+"""Permission-scoped diagnosis picker for the global AI assistant entry points."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+from PySide6.QtCore import Qt, QTimer
+from PySide6.QtWidgets import (
+    QAbstractItemView,
+    QDialog,
+    QDialogButtonBox,
+    QHBoxLayout,
+    QLabel,
+    QLineEdit,
+    QPushButton,
+    QVBoxLayout,
+    QWidget,
+)
+
+from ..theme import mark_business_dialog
+from ..widgets import (
+    BusyOverlay,
+    EmptyState,
+    MessageBanner,
+    OverlayHost,
+    Pager,
+    SortableTable,
+    TableColumn,
+    first_value,
+    friendly_error,
+    gender_text,
+    get_value,
+    invoke,
+    page_items,
+    page_total,
+    run_async,
+)
+from .ai_consult import can_open_ai_consult, present_ai_consult
+
+
+def _positive_int(value: Any) -> int:
+    try:
+        number = int(value)
+    except (TypeError, ValueError):
+        return 0
+    return number if number > 0 else 0
+
+
+def _gender_age(_value: Any, row: Any) -> str:
+    gender = gender_text(get_value(row, "gender", None))
+    age = str(get_value(row, "age", "") or "").strip()
+    parts = [part for part in (gender if gender != "—" else "", f"{age}岁" if age else "") if part]
+    return " · ".join(parts) or "—"
+
+
+@dataclass(frozen=True, slots=True)
+class AiConsultTarget:
+    """A diagnosis-level AI target with a separately verified patient identity."""
+
+    diagnosis_id: int
+    patient_id: int
+    patient_name: str
+    gender: Any = None
+    age: Any = None
+    phone_masked: str = ""
+    diagnosis_date: str = ""
+    diagnosis_summary: str = ""
+    last_visit_at: str = ""
+    next_appointment_at: str = ""
+
+    @classmethod
+    def from_row(cls, row: Any) -> AiConsultTarget | None:
+        diagnosis_id = _positive_int(first_value(row, "diagnosis_id", "id"))
+        if not diagnosis_id:
+            return None
+        # Patient identity must never fall back to the diagnosis primary key.
+        patient_id = _positive_int(first_value(row, "source_patient_id", "patient_id"))
+        return cls(
+            diagnosis_id=diagnosis_id,
+            patient_id=patient_id,
+            patient_name=str(first_value(row, "patient_name", "name", default="")).strip(),
+            gender=get_value(row, "gender", None),
+            age=get_value(row, "age", None),
+            # Deliberately do not fall back to a raw phone field.
+            phone_masked=str(get_value(row, "phone_masked", "") or "").strip(),
+            diagnosis_date=str(get_value(row, "diagnosis_date", "") or "").strip(),
+            diagnosis_summary=str(
+                first_value(
+                    row,
+                    "diagnosis_summary",
+                    "clinical_diagnosis",
+                    "syndrome_type",
+                    default="",
+                )
+                or ""
+            ).strip(),
+            last_visit_at=str(get_value(row, "last_visit_at", "") or "").strip(),
+            next_appointment_at=str(
+                get_value(row, "next_appointment_at", "") or ""
+            ).strip(),
+        )
+
+    @property
+    def seed(self) -> dict[str, Any]:
+        """Return only the minimum non-sensitive context needed by the AI dialog."""
+
+        return {
+            "diagnosis_id": self.diagnosis_id,
+            "source_patient_id": self.patient_id,
+            "patient_name": self.patient_name,
+            "gender": self.gender,
+            "age": self.age,
+            "phone_masked": self.phone_masked,
+            "diagnosis_date": self.diagnosis_date,
+            "diagnosis_summary": self.diagnosis_summary,
+            "last_visit_at": self.last_visit_at,
+            "next_appointment_at": self.next_appointment_at,
+        }
+
+
+class AiConsultTargetDialog(QDialog):
+    """Search and select one accessible patient diagnosis before opening AI chat."""
+
+    PAGE_SIZE = 20
+    SEARCH_DELAY_MS = 300
+
+    def __init__(
+        self,
+        repository: Any,
+        permissions: Any,
+        parent: QWidget | None = None,
+        *,
+        initial_query: str = "",
+    ) -> None:
+        super().__init__(parent)
+        self.repository = repository
+        self.permissions = permissions
+        self._page = 1
+        self._generation = 0
+        self._active = True
+        self._loading = False
+        self._selected: AiConsultTarget | None = None
+        self._started = False
+
+        self.setWindowTitle("选择患者资料")
+        self.resize(980, 650)
+        self.setMinimumSize(760, 520)
+
+        root = QVBoxLayout(self)
+        root.setContentsMargins(24, 22, 24, 20)
+        root.setSpacing(14)
+
+        title = QLabel("选择患者资料", self)
+        title.setProperty("role", "pageTitle")
+        root.addWidget(title)
+        description = QLabel(
+            "从当前账号可查看的全部患者中选择一份诊单，AI 将结合患者资料进行分析。",
+            self,
+        )
+        description.setProperty("role", "muted")
+        description.setWordWrap(True)
+        root.addWidget(description)
+
+        filters = QHBoxLayout()
+        filters.setSpacing(10)
+        self.search_edit = QLineEdit(self)
+        self.search_edit.setObjectName("AiConsultTargetSearch")
+        self.search_edit.setPlaceholderText("搜索患者姓名、掩码手机号或诊单号")
+        self.search_edit.setClearButtonEnabled(True)
+        self.search_edit.setText(str(initial_query or "").strip())
+        self.search_edit.textEdited.connect(self._queue_search)
+        self.search_edit.returnPressed.connect(self.search_now)
+        filters.addWidget(self.search_edit, 1)
+        self.search_button = QPushButton("查询", self)
+        self.search_button.setProperty("variant", "secondary")
+        self.search_button.setAutoDefault(False)
+        self.search_button.clicked.connect(self.search_now)
+        filters.addWidget(self.search_button)
+        root.addLayout(filters)
+
+        self.banner = MessageBanner(parent=self)
+        root.addWidget(self.banner)
+
+        self.body = OverlayHost(self)
+        body_layout = QVBoxLayout(self.body)
+        body_layout.setContentsMargins(0, 0, 0, 0)
+        body_layout.setSpacing(0)
+        self.table = SortableTable(
+            (
+                TableColumn("patient_name", "患者", 100),
+                TableColumn("gender", "性别 / 年龄", 90, _gender_age),
+                TableColumn("phone_masked", "手机号", 110),
+                TableColumn("diagnosis_id", "诊单号", 80),
+                TableColumn("diagnosis_date", "建档日期", 100),
+                TableColumn("last_visit_at", "最近就诊", 120),
+                TableColumn("next_appointment_at", "下次预约", 150),
+                TableColumn("diagnosis_summary", "诊断摘要", 140),
+            ),
+            self.body,
+        )
+        # Preserve the server's permission-scoped, recent-first order.
+        self.table.setSortingEnabled(False)
+        self.table.setSelectionBehavior(QAbstractItemView.SelectionBehavior.SelectRows)
+        self.table.itemSelectionChanged.connect(self._selection_changed)
+        self.table.itemDoubleClicked.connect(lambda _item: self.accept())
+        body_layout.addWidget(self.table, 1)
+
+        self.empty_state = EmptyState(
+            "未找到患者诊单",
+            "可尝试患者姓名、掩码手机号或诊单号。",
+            "重新加载",
+            self.body,
+        )
+        self.empty_state.action_requested.connect(self.retry)
+        self.empty_state.hide()
+        body_layout.addWidget(self.empty_state, 1)
+
+        self.busy_overlay = BusyOverlay(self.body, "正在加载患者诊单…")
+        self.body.busy_overlay = self.busy_overlay
+        root.addWidget(self.body, 1)
+
+        self.pager = Pager(self.PAGE_SIZE, self)
+        self.pager.page_changed.connect(self._change_page)
+        root.addWidget(self.pager)
+
+        self.buttons = QDialogButtonBox(QDialogButtonBox.StandardButton.Cancel, self)
+        cancel = self.buttons.button(QDialogButtonBox.StandardButton.Cancel)
+        cancel.setText("取消")
+        cancel.setAutoDefault(False)
+        self.start_button = self.buttons.addButton(
+            "开始对话", QDialogButtonBox.ButtonRole.AcceptRole
+        )
+        self.start_button.setObjectName("AiConsultTargetStart")
+        self.start_button.setProperty("variant", "primary")
+        self.start_button.setAutoDefault(False)
+        self.start_button.setDefault(False)
+        self.start_button.setEnabled(False)
+        self.start_button.clicked.connect(self.accept)
+        self.buttons.rejected.connect(self.reject)
+        root.addWidget(self.buttons)
+
+        self._search_timer = QTimer(self)
+        self._search_timer.setSingleShot(True)
+        self._search_timer.setInterval(self.SEARCH_DELAY_MS)
+        self._search_timer.timeout.connect(self.search_now)
+
+        mark_business_dialog(self, "AiConsultTargetDialog")
+        QTimer.singleShot(0, self._initial_load)
+
+    def _initial_load(self) -> None:
+        if self._active and not self._started:
+            self._started = True
+            self.load(1)
+            self.search_edit.setFocus(Qt.FocusReason.OtherFocusReason)
+
+    def selected_target(self) -> AiConsultTarget | None:
+        return self._selected
+
+    def _queue_search(self, _text: str) -> None:
+        self._invalidate_selection()
+        self._search_timer.start()
+
+    def search_now(self) -> None:
+        self._search_timer.stop()
+        self.load(1)
+
+    def retry(self) -> None:
+        self.load(self._page)
+
+    def _change_page(self, page: int) -> None:
+        self.load(page)
+
+    def load(self, page: int) -> None:
+        if not self._active:
+            return
+        self._page = max(1, int(page))
+        self._generation += 1
+        generation = self._generation
+        page_snapshot = self._page
+        keyword_snapshot = self.search_edit.text().strip()
+        self._invalidate_selection()
+        self._set_loading(True)
+        self.banner.clear()
+
+        run_async(
+            lambda: invoke(
+                self.repository,
+                "list_ai_patient_options",
+                page_no=page_snapshot,
+                page_size=self.PAGE_SIZE,
+                keyword=keyword_snapshot,
+            ),
+            on_success=lambda result: self._apply_result(
+                result, generation, page_snapshot, keyword_snapshot
+            ),
+            on_error=lambda error: self._apply_error(error, generation),
+        )
+
+    def _apply_result(
+        self,
+        result: Any,
+        generation: int,
+        page_snapshot: int,
+        keyword_snapshot: str,
+    ) -> None:
+        if not self._is_current(generation):
+            return
+        # A text edit can arrive before its debounce timer fires. Never paint a
+        # response for the previous text during that interval.
+        if keyword_snapshot != self.search_edit.text().strip():
+            return
+
+        targets = [
+            target
+            for target in (AiConsultTarget.from_row(row) for row in page_items(result))
+            if target is not None
+        ]
+        total = max(0, page_total(result, len(targets)))
+        page_count = max(1, (total + self.PAGE_SIZE - 1) // self.PAGE_SIZE)
+        if page_snapshot > page_count:
+            self.load(page_count)
+            return
+
+        self._page = page_snapshot
+        self.table.set_rows(targets)
+        self.table.setSortingEnabled(False)
+        self.table.clearSelection()
+        self.pager.update_state(page_snapshot, total)
+        self.empty_state.setVisible(not targets)
+        self.table.setVisible(bool(targets))
+        self.banner.clear()
+        self._set_loading(False)
+
+    def _apply_error(self, error: Exception, generation: int) -> None:
+        if not self._is_current(generation):
+            return
+        self.table.set_rows(())
+        self.table.setSortingEnabled(False)
+        self.table.clearSelection()
+        self.table.hide()
+        self.empty_state.show()
+        self.pager.update_state(1, 0)
+        self.banner.show_message(
+            f"患者诊单加载失败：{friendly_error(error)}", "danger"
+        )
+        self._set_loading(False)
+
+    def _is_current(self, generation: int) -> bool:
+        return self._active and generation == self._generation
+
+    def _invalidate_selection(self) -> None:
+        self._selected = None
+        self.table.clearSelection()
+        self.start_button.setEnabled(False)
+
+    def _selection_changed(self) -> None:
+        target = self.table.current_data()
+        self.start_button.setEnabled(
+            not self._loading
+            and isinstance(target, AiConsultTarget)
+            and target.diagnosis_id > 0
+        )
+
+    def _set_loading(self, loading: bool) -> None:
+        self._loading = loading
+        self.table.setEnabled(not loading)
+        self.pager.setEnabled(not loading)
+        self.start_button.setEnabled(False if loading else self.table.currentRow() >= 0)
+        self.busy_overlay.setVisible(loading)
+        if loading:
+            self.busy_overlay.raise_()
+
+    def accept(self) -> None:
+        target = self.table.current_data()
+        if not isinstance(target, AiConsultTarget) or target.diagnosis_id <= 0:
+            self.banner.show_message("请选择一条患者诊单。", "warning")
+            self._selected = None
+            return
+        self._selected = target
+        super().accept()
+
+    def done(self, result: int) -> None:
+        self._active = False
+        self._generation += 1
+        self._search_timer.stop()
+        super().done(result)
+
+
+def select_and_present_ai_consult(
+    repository: Any,
+    permissions: Any,
+    parent: QWidget | None,
+    *,
+    initial_query: str = "",
+) -> bool:
+    """Select an accessible diagnosis, then open the existing AI workspace."""
+
+    if not can_open_ai_consult(permissions):
+        return False
+    dialog = AiConsultTargetDialog(
+        repository,
+        permissions,
+        parent,
+        initial_query=initial_query,
+    )
+    if dialog.exec() != QDialog.DialogCode.Accepted:
+        return False
+    target = dialog.selected_target()
+    if target is None or target.diagnosis_id <= 0:
+        return False
+    present_ai_consult(
+        repository,
+        permissions,
+        parent,
+        diagnosis_id=target.diagnosis_id,
+        patient_id=target.patient_id,
+        seed=target.seed,
+        source_title="AI 助手",
+    )
+    return True
+
+
+__all__ = [
+    "AiConsultTarget",
+    "AiConsultTargetDialog",
+    "select_and_present_ai_consult",
+]
@@ -0,0 +1,487 @@
+"""Desktop update prompt with progress and optional forced install."""
+
+from __future__ import annotations
+
+import logging
+import os
+import sys
+import traceback
+from collections.abc import Callable
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import Any
+
+from PySide6.QtCore import QObject, QRunnable, Qt, QThreadPool, QTimer, Signal, Slot
+from PySide6.QtGui import QCloseEvent, QShowEvent
+from PySide6.QtWidgets import (
+    QApplication,
+    QDialog,
+    QHBoxLayout,
+    QLabel,
+    QProgressBar,
+    QPushButton,
+    QTextEdit,
+    QVBoxLayout,
+    QWidget,
+)
+
+from doctor_workstation.services.app_update import (
+    PACKAGE_TYPE_INNO_SETUP,
+    AppUpdateError,
+    UpdateOffer,
+    apply_downloaded_update,
+    current_app_version,
+    discover_payload,
+    download_package,
+    fetch_update_offer,
+    frozen_install_root,
+    is_frozen_install,
+    package_filename,
+    prepare_update_workspace,
+    safe_extract_zip,
+    validate_installer_download_policy,
+    validate_windows_installer,
+)
+from doctor_workstation.ui.widgets import friendly_error, show_toast
+
+LOGGER = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True, slots=True)
+class _PreparedUpdate:
+    package_type: str
+    payload: Path
+
+
+def _format_bytes(value: int) -> str:
+    size = max(0, int(value))
+    if size < 1024:
+        return f"{size} B"
+    if size < 1024 * 1024:
+        return f"{size / 1024:.1f} KB"
+    if size < 1024 * 1024 * 1024:
+        return f"{size / (1024 * 1024):.1f} MB"
+    return f"{size / (1024 * 1024 * 1024):.2f} GB"
+
+
+class _TaskSignals(QObject):
+    result = Signal(object)
+    error = Signal(object, str)
+    finished = Signal()
+    progress = Signal(int, int)
+    status = Signal(str)
+
+
+class _Task(QRunnable):
+    def __init__(self, function: Callable[[], Any], signals: _TaskSignals) -> None:
+        super().__init__()
+        self.function = function
+        self.signals = signals
+
+    @Slot()
+    def run(self) -> None:
+        try:
+            result = self.function()
+        except Exception as exc:
+            self.signals.error.emit(exc, traceback.format_exc())
+        else:
+            self.signals.result.emit(result)
+        finally:
+            self.signals.finished.emit()
+
+
+class AppUpdateDialog(QDialog):
+    """Offer, download and apply a workstation package."""
+
+    update_accepted = Signal()
+    update_deferred = Signal()
+    download_cancelled = Signal()
+
+    def __init__(self, offer: UpdateOffer, parent: QWidget | None = None) -> None:
+        super().__init__(parent)
+        self.offer = offer
+        self._busy = False
+        self.setObjectName("AppUpdateDialog")
+        self.setProperty("businessDialog", True)
+        title = offer.title.strip() or (
+            f"医生工作站 {offer.latest_version}".strip() if offer.latest_version else "软件更新"
+        )
+        self.setWindowTitle(title)
+        self.setModal(True)
+        self.setMinimumWidth(520)
+        flags = (
+            Qt.WindowType.Dialog
+            | Qt.WindowType.WindowTitleHint
+            | Qt.WindowType.WindowSystemMenuHint
+        )
+        if not offer.force:
+            flags |= Qt.WindowType.WindowCloseButtonHint
+        self.setWindowFlags(flags)
+        if offer.force:
+            self.setWindowModality(Qt.WindowModality.ApplicationModal)
+
+        root = QVBoxLayout(self)
+        root.setContentsMargins(22, 20, 22, 18)
+        root.setSpacing(12)
+
+        self.badge = QLabel("必须更新后才能继续使用" if offer.force else "发现新版本")
+        self.badge.setObjectName("UpdateBadge")
+        self.badge.setStyleSheet(
+            "color:#B45309;background:#FFF5E6;border-radius:8px;padding:4px 10px;font-weight:600;"
+            if offer.force
+            else "color:#4451E2;background:#F0F2FF;border-radius:8px;padding:4px 10px;font-weight:600;"
+        )
+        root.addWidget(self.badge, 0, Qt.AlignmentFlag.AlignLeft)
+
+        self.headline = QLabel(title or "医生工作站有新版本")
+        self.headline.setObjectName("UpdateHeadline")
+        self.headline.setStyleSheet("font-size:18px;font-weight:700;")
+        self.headline.setWordWrap(True)
+        root.addWidget(self.headline)
+
+        current = offer.current_version or current_app_version()
+        latest = offer.latest_version or "新版本"
+        self.version_label = QLabel(f"当前版本 {current}  →  最新版本 {latest}")
+        self.version_label.setObjectName("UpdateVersionLabel")
+        self.version_label.setStyleSheet("color:#7886AA;")
+        root.addWidget(self.version_label)
+
+        self.notes = QTextEdit()
+        self.notes.setObjectName("UpdateNotes")
+        self.notes.setReadOnly(True)
+        self.notes.setPlainText(offer.notes or "本次更新包含功能与稳定性改进。")
+        self.notes.setMinimumHeight(140)
+        self.notes.setMaximumHeight(220)
+        root.addWidget(self.notes)
+
+        self.status_label = QLabel("")
+        self.status_label.setObjectName("UpdateStatus")
+        self.status_label.setWordWrap(True)
+        self.status_label.setStyleSheet("color:#3F4E75;")
+        self.status_label.hide()
+        root.addWidget(self.status_label)
+
+        self.progress = QProgressBar()
+        self.progress.setObjectName("UpdateProgress")
+        self.progress.setRange(0, 100)
+        self.progress.setValue(0)
+        self.progress.setTextVisible(False)
+        self.progress.setFixedHeight(10)
+        self.progress.hide()
+        root.addWidget(self.progress)
+
+        self.progress_text = QLabel("")
+        self.progress_text.setObjectName("UpdateProgressText")
+        self.progress_text.setStyleSheet("color:#7886AA;font-size:12px;")
+        self.progress_text.hide()
+        root.addWidget(self.progress_text)
+
+        buttons = QHBoxLayout()
+        buttons.addStretch(1)
+        self.later_button = QPushButton("稍后提醒")
+        self.later_button.setObjectName("UpdateLaterButton")
+        self.later_button.setProperty("variant", "secondary")
+        self.later_button.clicked.connect(self._defer)
+        self.later_button.setVisible(not offer.force)
+        buttons.addWidget(self.later_button)
+        self.cancel_button = QPushButton("取消下载")
+        self.cancel_button.setObjectName("UpdateCancelButton")
+        self.cancel_button.setProperty("variant", "secondary")
+        self.cancel_button.clicked.connect(self.download_cancelled.emit)
+        self.cancel_button.hide()
+        buttons.addWidget(self.cancel_button)
+        self.update_button = QPushButton("立即更新" if offer.can_install else "暂不可安装")
+        self.update_button.setObjectName("UpdateNowButton")
+        self.update_button.setProperty("variant", "primary")
+        self.update_button.clicked.connect(self._accept_update)
+        buttons.addWidget(self.update_button)
+        root.addLayout(buttons)
+
+        if not offer.can_install:
+            self.status_label.setText("后台尚未配置当前系统对应的安装包，请联系管理员上传后再试。")
+            self.status_label.show()
+            self.update_button.setEnabled(False)
+
+    def set_busy(self, busy: bool) -> None:
+        self._busy = busy
+        self.update_button.setEnabled((not busy) and self.offer.can_install)
+        self.later_button.setEnabled(not busy)
+        self.cancel_button.setVisible(busy and not self.offer.force)
+        self.notes.setEnabled(not busy)
+
+    def show_download_progress(self, received: int, total: int) -> None:
+        self.progress.show()
+        self.progress_text.show()
+        self.status_label.setStyleSheet("color:#3F4E75;")
+        self.status_label.setText("正在下载安装包…")
+        self.status_label.show()
+        if total > 0:
+            self.progress.setRange(0, 100)
+            self.progress.setValue(min(100, int(received * 100 / total)))
+            self.progress_text.setText(f"{_format_bytes(received)} / {_format_bytes(total)}")
+        else:
+            self.progress.setRange(0, 0)
+            self.progress_text.setText(_format_bytes(received))
+
+    def show_status(self, message: str, *, determinate: bool = False) -> None:
+        self.status_label.setStyleSheet("color:#3F4E75;")
+        self.status_label.setText(message)
+        self.status_label.show()
+        self.progress.show()
+        self.progress_text.hide()
+        if determinate:
+            self.progress.setRange(0, 100)
+            self.progress.setValue(100)
+        else:
+            self.progress.setRange(0, 0)
+
+    def show_error(self, message: str) -> None:
+        self._busy = False
+        self.status_label.setText(message)
+        self.status_label.setStyleSheet("color:#F15B67;")
+        self.status_label.show()
+        self.progress.hide()
+        self.progress_text.hide()
+        self.update_button.setText("重试")
+        self.update_button.setEnabled(self.offer.can_install)
+        self.later_button.setEnabled(True)
+        self.cancel_button.hide()
+        self.notes.setEnabled(True)
+
+    def _accept_update(self) -> None:
+        if self._busy or not self.offer.can_install:
+            return
+        self.update_accepted.emit()
+
+    def _defer(self) -> None:
+        if self.offer.force or self._busy:
+            return
+        self.update_deferred.emit()
+        self.reject()
+
+    def closeEvent(self, event: QCloseEvent) -> None:  # noqa: N802
+        if self.offer.force or self._busy:
+            event.ignore()
+            return
+        super().closeEvent(event)
+
+    def keyPressEvent(self, event: Any) -> None:  # noqa: N802
+        if self.offer.force and event.key() == Qt.Key.Key_Escape:
+            event.ignore()
+            return
+        super().keyPressEvent(event)
+
+    def showEvent(self, event: QShowEvent) -> None:  # noqa: N802
+        super().showEvent(event)
+        self.setProperty("businessDialog", True)
+
+
+class AppUpdateSession(QObject):
+    """Owns update checks for the login and authenticated shell."""
+
+    def __init__(self, host: Any) -> None:
+        super().__init__(host)
+        self.host = host
+        self.dialog: AppUpdateDialog | None = None
+        self._generation = 0
+        self._dismissed: set[str] = set()
+        self._cancel = False
+        self._signals: _TaskSignals | None = None
+
+    def schedule(self, *, interactive: bool = False, delay_ms: int = 700) -> None:
+        self._generation += 1
+        generation = self._generation
+        QTimer.singleShot(
+            max(0, delay_ms),
+            lambda: self.check(interactive=interactive, generation=generation),
+        )
+
+    def check(self, *, interactive: bool = False, generation: int | None = None) -> None:
+        if generation is None:
+            self._generation += 1
+            generation = self._generation
+        if generation != self._generation:
+            return
+        if not self._should_check() and not interactive:
+            return
+        client = self._client()
+        parent = self._parent_window()
+        if client is None:
+            if interactive and parent is not None:
+                show_toast(parent, "请先填写服务器地址后再检查更新。", "warning")
+            return
+        signals = _TaskSignals()
+        self._signals = signals
+        worker = _Task(
+            lambda: fetch_update_offer(client, current_version=current_app_version()),
+            signals,
+        )
+        signals.result.connect(
+            lambda offer: self._on_offer(offer, interactive=interactive, generation=generation)
+        )
+        signals.error.connect(
+            lambda error, _tb: self._on_check_error(
+                error, interactive=interactive, generation=generation
+            )
+        )
+        QThreadPool.globalInstance().start(worker)
+
+    def _should_check(self) -> bool:
+        if getattr(self.host, "_shutting_down", False):
+            return False
+        if os.getenv("DOCTOR_SMOKE_TEST") == "1":
+            return False
+        if "--smoke-test" in sys.argv:
+            return False
+        config = getattr(self.host, "config", None)
+        return bool(getattr(config, "api_base_url", ""))
+
+    def _client(self) -> Any:
+        repository = getattr(self.host, "remote_repository", None)
+        return getattr(repository, "client", None) if repository is not None else None
+
+    def _parent_window(self) -> QWidget | None:
+        shell = getattr(self.host, "shell_window", None)
+        if shell is not None:
+            return shell
+        return getattr(self.host, "login_window", None)
+
+    def _on_check_error(self, error: Exception, *, interactive: bool, generation: int) -> None:
+        if generation != self._generation:
+            return
+        LOGGER.info("desktop update check failed: %s", error)
+        parent = self._parent_window()
+        if interactive and parent is not None:
+            show_toast(parent, f"检查更新失败：{friendly_error(error)}", "warning", 4200)
+
+    def _on_offer(self, offer: object, *, interactive: bool, generation: int) -> None:
+        if generation != self._generation or not isinstance(offer, UpdateOffer):
+            return
+        parent = self._parent_window()
+        if not offer.has_update:
+            if interactive and parent is not None:
+                current = offer.current_version or current_app_version()
+                show_toast(parent, f"当前已是最新版本 {current}。", "success")
+            return
+        if not offer.force and not interactive and offer.latest_version in self._dismissed:
+            return
+        if offer.package is not None and offer.package.type == PACKAGE_TYPE_INNO_SETUP:
+            config = getattr(self.host, "config", None)
+            try:
+                validate_installer_download_policy(
+                    offer.package.url,
+                    verify_ssl=bool(getattr(config, "verify_ssl", True)),
+                )
+            except AppUpdateError:
+                offer = replace(offer, force=False, package=None, can_install=False)
+        if offer.force and not is_frozen_install():
+            offer = replace(offer, force=False)
+        self._present(offer)
+
+    def _present(self, offer: UpdateOffer) -> None:
+        parent = self._parent_window()
+        if self.dialog is not None:
+            self.dialog.close()
+            self.dialog.deleteLater()
+        dialog = AppUpdateDialog(offer, parent)
+        dialog.update_accepted.connect(lambda: self._start_install(dialog, offer))
+        dialog.update_deferred.connect(lambda: self._dismissed.add(offer.latest_version))
+        dialog.download_cancelled.connect(lambda: self._request_cancel(dialog))
+        self.dialog = dialog
+        dialog.show()
+        dialog.raise_()
+        dialog.activateWindow()
+
+    def _request_cancel(self, dialog: AppUpdateDialog) -> None:
+        if dialog.offer.force:
+            return
+        self._cancel = True
+        dialog.show_status("正在取消…")
+
+    def _start_install(self, dialog: AppUpdateDialog, offer: UpdateOffer) -> None:
+        package = offer.package
+        if package is None:
+            return
+        if not is_frozen_install():
+            dialog.show_error("当前为源码运行，无法自动安装。请先安装正式发布版后再更新。")
+            return
+        if frozen_install_root() is None:
+            dialog.show_error("无法确定当前安装目录，已取消自动更新。")
+            return
+        config = getattr(self.host, "config", None)
+        if config is None:
+            dialog.show_error("无法读取本地配置目录，已取消自动更新。")
+            return
+        config_dir = Path(config.config_dir)
+        verify = bool(getattr(config, "verify_ssl", True))
+        self._cancel = False
+        dialog.set_busy(True)
+        dialog.show_download_progress(0, package.size)
+        signals = _TaskSignals()
+        self._signals = signals
+
+        def job() -> _PreparedUpdate:
+            workspace = prepare_update_workspace(config_dir, offer.latest_version)
+            downloaded = workspace / package_filename(package, offer.latest_version)
+            if package.type == PACKAGE_TYPE_INNO_SETUP:
+                validate_installer_download_policy(package.url, verify_ssl=verify)
+            download_package(
+                package.url,
+                downloaded,
+                sha256=package.sha256,
+                verify=verify,
+                expected_size=package.size,
+                progress=lambda received, total: signals.progress.emit(received, total),
+                cancelled=lambda: self._cancel,
+            )
+            if package.type == PACKAGE_TYPE_INNO_SETUP:
+                signals.status.emit("正在校验 Windows 安装程序…")
+                return _PreparedUpdate(
+                    package_type=package.type,
+                    payload=validate_windows_installer(downloaded),
+                )
+            signals.status.emit("正在校验并解压安装包…")
+            extracted = workspace / "payload"
+            safe_extract_zip(downloaded, extracted)
+            return _PreparedUpdate(
+                package_type=package.type,
+                payload=discover_payload(extracted),
+            )
+
+        worker = _Task(job, signals)
+        signals.progress.connect(dialog.show_download_progress)
+        signals.status.connect(dialog.show_status)
+        signals.result.connect(lambda prepared: self._finish_install(dialog, prepared))
+        signals.error.connect(lambda error, _tb: self._install_failed(dialog, error))
+        QThreadPool.globalInstance().start(worker)
+
+    def _install_failed(self, dialog: AppUpdateDialog, error: Exception) -> None:
+        LOGGER.exception("desktop update failed")
+        if self._cancel and not dialog.offer.force:
+            dialog.show_error("已取消下载。")
+            self._cancel = False
+            return
+        message = str(error) if isinstance(error, AppUpdateError) else friendly_error(error)
+        dialog.show_error(f"更新失败：{message}")
+
+    def _finish_install(self, dialog: AppUpdateDialog, prepared: object) -> None:
+        if not isinstance(prepared, _PreparedUpdate):
+            dialog.show_error("安装包准备结果无效。")
+            return
+        message = (
+            "即将关闭程序并自动安装，系统可能会请求管理员权限…"
+            if prepared.package_type == PACKAGE_TYPE_INNO_SETUP
+            else "即将关闭并完成安装…"
+        )
+        dialog.show_status(message, determinate=True)
+        try:
+            apply_downloaded_update(
+                prepared.payload,
+                package_type=prepared.package_type,
+            )
+        except AppUpdateError as error:
+            dialog.show_error(str(error))
+            return
+        application = QApplication.instance()
+        if application is not None:
+            QTimer.singleShot(300, application.quit)
@@ -3,6 +3,7 @@
 from __future__ import annotations

 import re
+import sqlite3
 from collections.abc import Mapping, Sequence
 from contextlib import suppress
 from typing import Any
@@ -69,6 +70,7 @@ from ..widgets import (
    page_total,
    run_async,
 )
+from .local_audio_queue import LocalAudioQueueDialog
 from .prescription_ai import can_open_diagnosis_ai_report, present_diagnosis_ai_report

 _PHONE_PERMISSION = "tcm.diagnosis/phonePlain"
@@ -747,6 +749,7 @@ class DiagnosisDialog(QDialog):
    """

    saved = Signal()
+    _local_audio_upload_completed = Signal(int, int)

    def __init__(
        self,
@@ -841,6 +844,10 @@ class DiagnosisDialog(QDialog):
        self._recording_players: list[RecordingPlayerDialog] = []
        self._inline_recording_cells: list[RecordingPlaybackCell] = []
        self._last_order_detail_dialog: QDialog | None = None
+        self._local_audio_dialog: LocalAudioQueueDialog | None = None
+        self._local_audio_upload_manager: Any = None
+        self._local_audio_upload_listener: Any = None
+        self._video_reload_pending = False
        self._orders_page = 1
        self._orders_page_size = 10
        self._orders_total = 0
@@ -868,6 +875,10 @@ class DiagnosisDialog(QDialog):
        self._daily_panels: list[DailyRecordPanel] = []
        self._owner = None
        self._owner_filter_installed = False
+        self._local_audio_upload_completed.connect(
+            self._local_audio_upload_succeeded,
+            type=Qt.ConnectionType.QueuedConnection,
+        )

        self.setObjectName("DiagnosisDialogRoot")
        self.setWindowFlags(Qt.WindowType.Dialog | Qt.WindowType.FramelessWindowHint)
@@ -1433,6 +1444,11 @@ class DiagnosisDialog(QDialog):
        hint.setWordWrap(True)
        toolbar.addWidget(hint, 1)
        toolbar.addStretch(1)
+        self.local_audio_queue_button = QPushButton("本机录音文件")
+        self.local_audio_queue_button.setObjectName("DiagnosisLocalAudioQueueButton")
+        self.local_audio_queue_button.setAccessibleName("查看本机录音文件及上传状态")
+        self.local_audio_queue_button.clicked.connect(self._open_local_audio_queue)
+        toolbar.addWidget(self.local_audio_queue_button)
        self.video_upload_button = QPushButton("上传本地回放")
        self.video_upload_button.setProperty("variant", "primary")
        self.video_upload_button.clicked.connect(
@@ -1556,10 +1572,10 @@ class DiagnosisDialog(QDialog):
            ),
            "video": (
                ("录制回放", 440),
+                ("房间号", 180),
                ("开始时间", 170),
                ("结束时间", 170),
                ("通话类型", 100),
-                ("房间号", 180),
                ("时长", 110),
                ("状态", 90),
                ("录制 / 文字", 120),
@@ -1695,6 +1711,10 @@ class DiagnosisDialog(QDialog):
            )
        self.prescribe_button.setVisible(self._editable and self._can_prescribe)
        self.video_upload_button.setVisible(self._editable and self._can_video_upload)
+        self.local_audio_queue_button.setVisible(self._can_video_upload)
+        self.local_audio_queue_button.setEnabled(
+            self._diagnosis_id > 0 and self._can_video_upload
+        )
        offset_visible = self._editable and self._can_offset
        self.order_offset.setVisible(offset_visible)
        self.order_offset_save.setVisible(offset_visible)
@@ -1914,6 +1934,10 @@ class DiagnosisDialog(QDialog):
            with suppress(RuntimeError):
                self._last_order_detail_dialog.close()
            self._last_order_detail_dialog = None
+        if self._local_audio_dialog is not None:
+            with suppress(RuntimeError):
+                self._local_audio_dialog.close()
+            self._local_audio_dialog = None
        self._diagnosis_id = int(diagnosis_id)
        self._patient_id = 0
        self._editable = bool(
@@ -1939,6 +1963,7 @@ class DiagnosisDialog(QDialog):
            self._tab_generations[key] += 1
        self._loaded_tabs.clear()
        self._loading_tabs.clear()
+        self._video_reload_pending = False
        self._daily_todo_status = None
        self._orders_page = 1
        self._orders_total = 0
@@ -2208,6 +2233,8 @@ class DiagnosisDialog(QDialog):
        self._ensure_tab_loaded(self._current_tab_key(), force=True)

    def _invalidate_requests(self) -> None:
+        self._stop_watching_local_audio_uploads()
+        self._video_reload_pending = False
        self._generation += 1
        self._save_generation += 1
        self._orders_generation += 1
@@ -2232,6 +2259,11 @@ class DiagnosisDialog(QDialog):
            with suppress(RuntimeError):
                order_dialog.close()
        self._last_order_detail_dialog = None
+        local_audio_dialog = getattr(self, "_local_audio_dialog", None)
+        if local_audio_dialog is not None:
+            with suppress(RuntimeError):
+                local_audio_dialog.close()
+        self._local_audio_dialog = None
        if hasattr(self, "readonly_loading"):
            self.readonly_loading.hide()
        if hasattr(self, "drawer_loading"):
@@ -2474,7 +2506,11 @@ class DiagnosisDialog(QDialog):
    def _tab_changed(self, _index: int) -> None:
        self._sync_save_button()
        if self._authoritative_detail_loaded and not self._standalone_readonly:
-            self._ensure_tab_loaded(self._current_tab_key())
+            key = self._current_tab_key()
+            if key == "video":
+                self._reload_video_records(self._diagnosis_id)
+            else:
+                self._ensure_tab_loaded(key)

    def _load_visible_readonly_sections(self) -> None:
        permission_map = {key: codes for key, _label, codes in _TAB_DEFINITIONS}
@@ -2635,6 +2671,8 @@ class DiagnosisDialog(QDialog):
                panel.set_messages(rows)
        if not self._standalone_readonly and self._current_tab_key() == key:
            self._clear_message()
+        if key == "video":
+            self._flush_video_reload_if_pending(diagnosis_id)

    def _tab_load_error(
        self,
@@ -2650,6 +2688,8 @@ class DiagnosisDialog(QDialog):
        self._set_tab_error(key, text)
        if not self._standalone_readonly and self._current_tab_key() == key:
            self._show_message(text, "danger", action_text="重试")
+        if key == "video":
+            self._flush_video_reload_if_pending(diagnosis_id)

    def _load_daily_range(self, start: str, end: str, *, force: bool = False) -> None:
        key = "daily"
@@ -3116,6 +3156,91 @@ class DiagnosisDialog(QDialog):
            "video",
        )

+    def _open_local_audio_queue(self) -> None:
+        if self._diagnosis_id <= 0 or not self._can_video_upload:
+            self._show_message("当前账号无本机录音上传权限或接口不可用。", "warning")
+            return
+        current = self._local_audio_dialog
+        if current is not None and current.isVisible():
+            current.raise_()
+            current.activateWindow()
+            return
+        try:
+            dialog = LocalAudioQueueDialog(
+                self.repository,
+                self._diagnosis_id,
+                self,
+            )
+        except (OSError, RuntimeError, sqlite3.Error) as error:
+            self._show_message(f"无法打开本机录音文件：{error}", "danger")
+            return
+        self._local_audio_dialog = dialog
+        opened_diagnosis_id = self._diagnosis_id
+        self._watch_local_audio_uploads(dialog.manager)
+
+        def clear_dialog(_result: int) -> None:
+            if self._local_audio_dialog is dialog:
+                self._local_audio_dialog = None
+
+        dialog.finished.connect(clear_dialog)
+        dialog.open()
+        # Opening the queue commonly follows a background upload that completed
+        # before this dialog existed, so also refresh the server-backed rows now.
+        self._reload_video_records(opened_diagnosis_id)
+
+    def _local_audio_upload_succeeded(
+        self,
+        diagnosis_id: int,
+        _call_record_id: int,
+    ) -> None:
+        if self._local_audio_upload_manager is None:
+            return
+        self._reload_video_records(diagnosis_id)
+
+    def _reload_video_records(self, diagnosis_id: int) -> None:
+        if int(diagnosis_id) != self._diagnosis_id:
+            return
+        if "video" in self._loading_tabs:
+            self._video_reload_pending = True
+            return
+        self._video_reload_pending = False
+        self._loaded_tabs.discard("video")
+        self._ensure_tab_loaded("video", force=True)
+
+    def _watch_local_audio_uploads(self, manager: Any) -> None:
+        if self._local_audio_upload_manager is manager:
+            return
+        self._stop_watching_local_audio_uploads()
+
+        def notify(record: Any) -> None:
+            with suppress(RuntimeError):
+                self._local_audio_upload_completed.emit(
+                    int(record.diagnosis_id),
+                    int(record.call_record_id or 0),
+                )
+
+        manager.add_upload_listener(notify)
+        self._local_audio_upload_manager = manager
+        self._local_audio_upload_listener = notify
+
+    def _stop_watching_local_audio_uploads(self) -> None:
+        manager = self._local_audio_upload_manager
+        listener = self._local_audio_upload_listener
+        self._local_audio_upload_manager = None
+        self._local_audio_upload_listener = None
+        if manager is not None and listener is not None:
+            with suppress(Exception):
+                manager.remove_upload_listener(listener)
+
+    def _flush_video_reload_if_pending(self, diagnosis_id: int) -> None:
+        if not self._video_reload_pending or diagnosis_id != self._diagnosis_id:
+            return
+        self._video_reload_pending = False
+        QTimer.singleShot(
+            0,
+            lambda expected_id=diagnosis_id: self._reload_video_records(expected_id),
+        )
+
    def _sync_chat_archive(self) -> None:
        if not self._can_chat_sync or self._diagnosis_id <= 0:
            self._show_message("当前账号无聊天归档同步权限或接口不可用。", "warning")
@@ -3616,6 +3741,7 @@ class DiagnosisDialog(QDialog):
        self._stop_inline_recordings()
        matrix: list[tuple[Any, ...]] = []
        row_urls: list[list[str]] = []
+        row_audio_urls: list[list[str]] = []
        record_ids: list[int] = []
        transcripts: list[str] = []
        for row in rows:
@@ -3629,6 +3755,22 @@ class DiagnosisDialog(QDialog):
                if url and url not in normalized:
                    normalized.append(url)
            row_urls.append(normalized)
+            raw_audio_urls = first_value(
+                row,
+                "local_audio_urls_list",
+                "local_audio_urls",
+                default=[],
+            ) or []
+            if isinstance(raw_audio_urls, str) or not isinstance(
+                raw_audio_urls, Sequence
+            ):
+                raw_audio_urls = [raw_audio_urls]
+            normalized_audio: list[str] = []
+            for candidate in raw_audio_urls:
+                url = str(candidate or "").strip()
+                if url and url not in normalized_audio:
+                    normalized_audio.append(url)
+            row_audio_urls.append(normalized_audio)
            record_ids.append(_int(first_value(row, "id", "call_record_id"), 0))
            transcript = self._call_transcript_text(row)
            transcripts.append(transcript)
@@ -3651,22 +3793,41 @@ class DiagnosisDialog(QDialog):
            recording_status = first_value(
                row, "recording_status_text", "record_status_text", "record_status"
            )
+            local_audio_status = first_value(
+                row,
+                "local_audio_status_text",
+                default="本机录音已保存" if normalized_audio else "无本机录音",
+            )
            transcript_status = first_value(
                row,
                "transcription_status_text",
                "transcript_status_text",
                default="文字已生成" if transcript else "未生成文字",
            )
+            room_id = str(
+                first_value(
+                    row,
+                    "room_id_text",
+                    "room_id",
+                    "room_no",
+                    default="",
+                )
+                or ""
+            ).strip()
            matrix.append(
                (
                    "" if normalized else "暂无录制回放",
+                    room_id or "历史记录未保存",
                    first_value(row, "start_time_text", "start_time"),
                    first_value(row, "end_time_text", "end_time"),
                    call_type,
-                    first_value(row, "room_id", "room_no"),
                    first_value(row, "duration_text", "duration"),
                    status,
-                    f"{display_text(recording_status)}\n{display_text(transcript_status)}",
+                    (
+                        f"云端视频：{display_text(recording_status)}\n"
+                        f"本机录音：{display_text(local_audio_status)}\n"
+                        f"转写文字：{display_text(transcript_status)}"
+                    ),
                    "",
                )
            )
@@ -3692,6 +3853,19 @@ class DiagnosisDialog(QDialog):
                        item.setText("")
                call_record_id = record_ids[row_index]
                actions: list[QPushButton] = []
+                audio_urls = row_audio_urls[row_index]
+                if audio_urls and call_record_id > 0:
+                    play_audio = self._action_button(
+                        "播放录音", f"播放通话记录 #{call_record_id} 的本机混音录音"
+                    )
+                    play_audio.setObjectName("DiagnosisLocalAudioPlayback")
+                    play_audio.setProperty("callRecordId", call_record_id)
+                    play_audio.clicked.connect(
+                        lambda _checked=False, target=audio_urls[0]: self._open_recording_player(
+                            target
+                        )
+                    )
+                    actions.append(play_audio)
                transcript = transcripts[row_index]
                if transcript and call_record_id > 0:
                    view_transcript = self._action_button(
@@ -0,0 +1,625 @@
+"""Local call-audio upload queue shown from a diagnosis video-history tab."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Any
+
+from PySide6.QtCore import Qt, QTimer, QUrl
+from PySide6.QtGui import QColor, QDesktopServices
+from PySide6.QtWidgets import (
+    QAbstractItemView,
+    QDialog,
+    QFrame,
+    QHBoxLayout,
+    QHeaderView,
+    QLabel,
+    QPushButton,
+    QTableWidget,
+    QTableWidgetItem,
+    QVBoxLayout,
+    QWidget,
+)
+
+from ...services.local_audio_queue import (
+    LocalAudioQueueStore,
+    LocalAudioRecord,
+    LocalAudioUploadManager,
+    get_local_audio_upload_manager,
+)
+from ..widgets import run_async
+
+_STATUS_LABELS = {
+    "recording": "录制中",
+    "pending": "待上传",
+    "uploading": "上传中",
+    "uploaded": "已上传",
+    "failed": "上传失败",
+    "invalid": "无效录音",
+}
+_STATUS_COLORS = {
+    "recording": "#5364F5",
+    "pending": "#B26A00",
+    "uploading": "#2F6FEB",
+    "uploaded": "#07966B",
+    "failed": "#DC4054",
+    "invalid": "#7886AA",
+}
+_BUSINESS_TIMEZONE = timezone(timedelta(hours=8))
+
+_LOCAL_AUDIO_QSS = """
+QDialog#LocalAudioQueueDialog {
+    background: #F6F8FD;
+    color: #111F46;
+}
+QFrame#LocalAudioQueueHeader, QFrame#LocalAudioQueueSummary,
+QFrame#LocalAudioQueueTableCard, QFrame#LocalAudioQueueFooter {
+    background: #FFFFFF;
+    border: 1px solid #E2E7F4;
+    border-radius: 14px;
+}
+QLabel#LocalAudioQueueTitle {
+    color: #111F46;
+    font-size: 20px;
+    font-weight: 700;
+}
+QLabel#LocalAudioQueueSubtitle, QLabel#LocalAudioQueueHint {
+    color: #6E7C9F;
+    font-size: 13px;
+}
+QLabel[queueSummary="true"] {
+    background: #F3F5FB;
+    border: 1px solid #E6EAF5;
+    border-radius: 10px;
+    color: #3F4E75;
+    font-size: 13px;
+    font-weight: 600;
+    padding: 8px 12px;
+}
+QPushButton {
+    min-height: 34px;
+    border: 1px solid #D9E0F2;
+    border-radius: 9px;
+    background: #FFFFFF;
+    color: #354365;
+    padding: 0 14px;
+    font-weight: 600;
+}
+QPushButton:hover { background: #F1F3FF; border-color: #AEB8FF; }
+QPushButton:disabled { color: #A5AFC6; background: #F7F8FC; }
+QPushButton[variant="primary"] {
+    color: #FFFFFF;
+    background: #5661F4;
+    border-color: #5661F4;
+}
+QPushButton[variant="danger"] { color: #D83E51; background: #FFF6F7; }
+QTableWidget#LocalAudioQueueTable {
+    background: #FFFFFF;
+    alternate-background-color: #FAFBFE;
+    border: 0;
+    gridline-color: #E8ECF5;
+    color: #263452;
+    selection-background-color: #EEF1FF;
+    selection-color: #111F46;
+}
+QTableWidget#LocalAudioQueueTable::item { padding: 8px; }
+QHeaderView::section {
+    background: #F5F7FC;
+    color: #53617F;
+    border: 0;
+    border-bottom: 1px solid #E1E6F1;
+    padding: 10px 8px;
+    font-weight: 700;
+}
+"""
+
+
+def _human_size(size: int) -> str:
+    value = max(0, int(size))
+    if value < 1024:
+        return f"{value} B"
+    if value < 1024 * 1024:
+        return f"{value / 1024:.1f} KB"
+    return f"{value / 1024 / 1024:.1f} MB"
+
+
+def _display_time(value: str) -> str:
+    raw = str(value or "").strip()
+    if not raw:
+        return "—"
+    try:
+        parsed = datetime.fromisoformat(raw.replace("Z", "+00:00"))
+    except ValueError:
+        return raw.replace("T", " ")
+    if parsed.tzinfo is not None:
+        parsed = parsed.astimezone(_BUSINESS_TIMEZONE)
+    return parsed.strftime("%Y-%m-%d %H:%M:%S")
+
+
+class LocalAudioQueueDialog(QDialog):
+    """Persistent local-audio list with concurrent upload and retry."""
+
+    def __init__(
+        self,
+        repository: Any,
+        diagnosis_id: int | None,
+        parent: QWidget | None = None,
+        *,
+        store: LocalAudioQueueStore | None = None,
+        manager: LocalAudioUploadManager | None = None,
+    ) -> None:
+        super().__init__(parent)
+        self.repository = repository
+        self._global_scope = diagnosis_id is None
+        self.diagnosis_id = int(diagnosis_id) if diagnosis_id is not None else None
+        if manager is None:
+            self.store, self.manager = get_local_audio_upload_manager(repository, store)
+        else:
+            self.store = store or manager.store
+            self.manager = manager
+        self._signature: tuple[Any, ...] = ()
+        self._room_fetch_generation = 0
+        self._room_fetch_inflight: set[int] = set()
+        self._room_fetch_attempted: set[int] = set()
+        self._room_fetch_errors: dict[int, str] = {}
+        self._closed = False
+
+        self.setObjectName("LocalAudioQueueDialog")
+        self.setProperty("businessDialog", True)
+        self.setWindowTitle(
+            "本机录音上传管理" if self._global_scope else "本机录音文件"
+        )
+        self.setModal(True)
+        self.setMinimumSize(760, 480)
+        self.resize(1160, 620)
+        self.setStyleSheet(_LOCAL_AUDIO_QSS)
+        self._build_ui()
+
+        self.poll_timer = QTimer(self)
+        self.poll_timer.setInterval(500)
+        self.poll_timer.timeout.connect(self.refresh_records)
+        self.poll_timer.start()
+        self.manager.submit_pending(diagnosis_id=self.diagnosis_id)
+        self.refresh_records(force=True)
+
+    def _build_ui(self) -> None:
+        root = QVBoxLayout(self)
+        root.setContentsMargins(18, 18, 18, 18)
+        root.setSpacing(12)
+
+        header = QFrame()
+        header.setObjectName("LocalAudioQueueHeader")
+        header_layout = QVBoxLayout(header)
+        header_layout.setContentsMargins(18, 14, 18, 14)
+        header_layout.setSpacing(4)
+        self.title_label = QLabel(
+            "本机录音上传管理" if self._global_scope else "本机录音文件"
+        )
+        self.title_label.setObjectName("LocalAudioQueueTitle")
+        header_layout.addWidget(self.title_label)
+        if self._global_scope:
+            subtitle_text = (
+                "集中查看所有诊单的本机录音上传记录；成功文件和未成功文件都会保留。"
+                "最多同时上传 3 个文件，失败后可重试。"
+            )
+        else:
+            subtitle_text = (
+                "每次通话的本地录音会先保存在本机，再上传到 COS；最多同时上传 3 个文件。"
+                "上传失败不会删除文件，可随时重试。"
+            )
+        subtitle = QLabel(subtitle_text)
+        subtitle.setObjectName("LocalAudioQueueSubtitle")
+        subtitle.setWordWrap(True)
+        header_layout.addWidget(subtitle)
+        root.addWidget(header)
+
+        summary = QFrame()
+        summary.setObjectName("LocalAudioQueueSummary")
+        summary_layout = QHBoxLayout(summary)
+        summary_layout.setContentsMargins(12, 10, 12, 10)
+        summary_layout.setSpacing(8)
+        self.summary_total = self._summary_label()
+        self.summary_pending = self._summary_label()
+        self.summary_uploading = self._summary_label()
+        self.summary_uploaded = self._summary_label()
+        self.summary_failed = self._summary_label()
+        for label in (
+            self.summary_total,
+            self.summary_pending,
+            self.summary_uploading,
+            self.summary_uploaded,
+            self.summary_failed,
+        ):
+            summary_layout.addWidget(label)
+        summary_layout.addStretch(1)
+        self.upload_pending_button = QPushButton("上传待处理")
+        self.upload_pending_button.setObjectName("LocalAudioUploadPendingButton")
+        self.upload_pending_button.setProperty("variant", "primary")
+        self.upload_pending_button.clicked.connect(self._upload_pending)
+        summary_layout.addWidget(self.upload_pending_button)
+        self.retry_failed_button = QPushButton("重试全部失败")
+        self.retry_failed_button.setObjectName("LocalAudioRetryAllButton")
+        self.retry_failed_button.setProperty("variant", "danger")
+        self.retry_failed_button.clicked.connect(self._retry_all_failed)
+        summary_layout.addWidget(self.retry_failed_button)
+        refresh_button = QPushButton("刷新")
+        refresh_button.setObjectName("LocalAudioRefreshButton")
+        refresh_button.clicked.connect(self._manual_refresh)
+        summary_layout.addWidget(refresh_button)
+        root.addWidget(summary)
+
+        card = QFrame()
+        card.setObjectName("LocalAudioQueueTableCard")
+        card_layout = QVBoxLayout(card)
+        card_layout.setContentsMargins(1, 1, 1, 1)
+        headers = ["录制时间"]
+        if self._global_scope:
+            headers.append("诊单 ID")
+        headers.extend(
+            [
+                "通话记录 ID",
+                "房间号",
+                "音频文件",
+                "大小",
+                "上传状态",
+                "失败原因",
+                "操作",
+            ]
+        )
+        self._diagnosis_column = 1 if self._global_scope else None
+        self._call_column = 2 if self._global_scope else 1
+        self._room_column = 3 if self._global_scope else 2
+        self._file_column = 4 if self._global_scope else 3
+        self._size_column = 5 if self._global_scope else 4
+        self._status_column = 6 if self._global_scope else 5
+        self._error_column = 7 if self._global_scope else 6
+        self._action_column = 8 if self._global_scope else 7
+
+        self.table = QTableWidget(0, len(headers))
+        self.table.setObjectName("LocalAudioQueueTable")
+        self.table.setHorizontalHeaderLabels(headers)
+        self.table.verticalHeader().hide()
+        self.table.setAlternatingRowColors(True)
+        self.table.setEditTriggers(QAbstractItemView.EditTrigger.NoEditTriggers)
+        self.table.setSelectionBehavior(QAbstractItemView.SelectionBehavior.SelectRows)
+        self.table.setSelectionMode(QAbstractItemView.SelectionMode.SingleSelection)
+        self.table.setWordWrap(False)
+        header_view = self.table.horizontalHeader()
+        header_view.setSectionResizeMode(QHeaderView.ResizeMode.Interactive)
+        header_view.setSectionResizeMode(
+            self._file_column, QHeaderView.ResizeMode.Stretch
+        )
+        header_view.setSectionResizeMode(
+            self._error_column, QHeaderView.ResizeMode.Stretch
+        )
+        self.table.setColumnWidth(0, 160)
+        if self._diagnosis_column is not None:
+            self.table.setColumnWidth(self._diagnosis_column, 90)
+        self.table.setColumnWidth(self._call_column, 90)
+        self.table.setColumnWidth(self._room_column, 180)
+        self.table.setColumnWidth(self._size_column, 88)
+        self.table.setColumnWidth(self._status_column, 100)
+        self.table.setColumnWidth(self._action_column, 190)
+        card_layout.addWidget(self.table)
+        root.addWidget(card, 1)
+
+        footer = QFrame()
+        footer.setObjectName("LocalAudioQueueFooter")
+        footer_layout = QHBoxLayout(footer)
+        footer_layout.setContentsMargins(14, 9, 14, 9)
+        hint = QLabel("已上传文件仍保留在本机；请按机构的数据保留制度定期归档。")
+        hint.setObjectName("LocalAudioQueueHint")
+        footer_layout.addWidget(hint, 1)
+        close_button = QPushButton("关闭")
+        close_button.setObjectName("LocalAudioQueueCloseButton")
+        close_button.setProperty("variant", "primary")
+        close_button.clicked.connect(self.accept)
+        footer_layout.addWidget(close_button)
+        root.addWidget(footer)
+
+    @staticmethod
+    def _summary_label() -> QLabel:
+        label = QLabel()
+        label.setProperty("queueSummary", True)
+        return label
+
+    def _records(self) -> list[LocalAudioRecord]:
+        return self.store.list_records(diagnosis_id=self.diagnosis_id)
+
+    def refresh_records(self, *, force: bool = False) -> None:
+        records = self._records()
+        self._schedule_room_lookups(records)
+        signature = tuple(
+            (
+                record.id,
+                record.diagnosis_id,
+                record.status,
+                record.error_text,
+                record.call_record_id,
+                record.room_id,
+                record.size_bytes,
+                record.uploaded_url,
+                record.exists,
+                record.attempts,
+                self._room_fetch_state(record),
+            )
+            for record in records
+        )
+        if not force and signature == self._signature:
+            return
+        self._signature = signature
+        self._update_summary(records)
+        self.table.setRowCount(len(records))
+        for row, record in enumerate(records):
+            self.table.setRowHeight(row, 54)
+            self._set_item(row, 0, _display_time(record.created_at))
+            if self._diagnosis_column is not None:
+                self._set_item(row, self._diagnosis_column, str(record.diagnosis_id))
+            self._set_item(
+                row, self._call_column, str(record.call_record_id or "待关联")
+            )
+            room_text, room_tooltip = self._room_display(record)
+            room_item = self._set_item(row, self._room_column, room_text)
+            room_item.setToolTip(room_tooltip)
+            file_item = self._set_item(row, self._file_column, record.file_path.name)
+            file_item.setToolTip(str(record.file_path))
+            self._set_item(row, self._size_column, _human_size(record.size_bytes))
+            status_item = self._set_item(
+                row,
+                self._status_column,
+                _STATUS_LABELS.get(record.status, record.status),
+            )
+            status_item.setForeground(QColor(_STATUS_COLORS.get(record.status, "#53617F")))
+            status_item.setToolTip(
+                f"已尝试 {record.attempts} 次"
+                + (f"\nCOS：{record.uploaded_url}" if record.uploaded_url else "")
+            )
+            error_item = self._set_item(
+                row, self._error_column, record.error_text or "—"
+            )
+            error_item.setToolTip(record.error_text)
+            self.table.setCellWidget(row, self._action_column, self._actions(record))
+
+    def _room_fetch_state(self, record: LocalAudioRecord) -> str:
+        diagnosis_id = record.diagnosis_id
+        if record.room_id:
+            return record.room_id
+        if diagnosis_id in self._room_fetch_inflight:
+            return "loading"
+        if diagnosis_id in self._room_fetch_errors:
+            return f"error:{self._room_fetch_errors[diagnosis_id]}"
+        if diagnosis_id in self._room_fetch_attempted:
+            return "missing"
+        return "idle"
+
+    def _room_display(self, record: LocalAudioRecord) -> tuple[str, str]:
+        if record.room_id:
+            return record.room_id, record.room_id
+        if record.call_record_id is None:
+            return "—", "尚未关联通话记录，无法取得房间号。"
+        diagnosis_id = record.diagnosis_id
+        if diagnosis_id in self._room_fetch_inflight:
+            return "查询中…", "正在从服务端通话记录查询房间号。"
+        error = self._room_fetch_errors.get(diagnosis_id)
+        if error:
+            return "获取失败", error
+        return "未记录", "服务端通话记录未保存房间号。"
+
+    def _schedule_room_lookups(self, records: list[LocalAudioRecord]) -> None:
+        if self._closed:
+            return
+        method = getattr(self.repository, "list_call_records", None)
+        if not callable(method):
+            method = getattr(self.repository, "get_call_records", None)
+        if not callable(method):
+            return
+
+        target_ids: dict[int, set[int]] = {}
+        for record in records:
+            call_record_id = int(record.call_record_id or 0)
+            if record.room_id or call_record_id <= 0:
+                continue
+            target_ids.setdefault(record.diagnosis_id, set()).add(call_record_id)
+        diagnosis_ids = tuple(
+            sorted(
+                diagnosis_id
+                for diagnosis_id in target_ids
+                if diagnosis_id not in self._room_fetch_inflight
+                and diagnosis_id not in self._room_fetch_attempted
+            )
+        )
+        if not diagnosis_ids:
+            return
+
+        generation = self._room_fetch_generation
+        self._room_fetch_inflight.update(diagnosis_ids)
+        self._room_fetch_attempted.update(diagnosis_ids)
+
+        def load_rooms() -> tuple[dict[tuple[int, int], str], dict[int, str]]:
+            rooms: dict[tuple[int, int], str] = {}
+            errors: dict[int, str] = {}
+            for diagnosis_id in diagnosis_ids:
+                try:
+                    payload = method(diagnosis_id)
+                    rows = payload if isinstance(payload, list) else []
+                    for row in rows:
+                        if not isinstance(row, Mapping):
+                            continue
+                        raw_record_id = row.get("id", row.get("call_record_id"))
+                        try:
+                            call_record_id = int(raw_record_id or 0)
+                        except (TypeError, ValueError):
+                            continue
+                        if call_record_id not in target_ids[diagnosis_id]:
+                            continue
+                        room_id = str(
+                            row.get("room_id")
+                            or row.get("roomId")
+                            or row.get("room_id_text")
+                            or row.get("room_no")
+                            or ""
+                        ).strip()
+                        if room_id and room_id != "0":
+                            rooms[(diagnosis_id, call_record_id)] = room_id
+                except Exception as error:
+                    errors[diagnosis_id] = str(error)[:300] or "房间号获取失败。"
+            return rooms, errors
+
+        run_async(
+            load_rooms,
+            on_success=lambda result: self._apply_room_lookups(
+                generation,
+                diagnosis_ids,
+                result,
+            ),
+            on_error=lambda error: self._fail_room_lookups(
+                generation,
+                diagnosis_ids,
+                error,
+            ),
+        )
+
+    def _apply_room_lookups(
+        self,
+        generation: int,
+        diagnosis_ids: tuple[int, ...],
+        result: tuple[dict[tuple[int, int], str], dict[int, str]],
+    ) -> None:
+        if self._closed or generation != self._room_fetch_generation:
+            return
+        rooms, errors = result
+        self._room_fetch_inflight.difference_update(diagnosis_ids)
+        self._room_fetch_errors.update(errors)
+        records_by_key: dict[tuple[int, int], list[LocalAudioRecord]] = {}
+        for record in self._records():
+            if record.call_record_id is None:
+                continue
+            key = (record.diagnosis_id, record.call_record_id)
+            records_by_key.setdefault(key, []).append(record)
+        for key, room_id in rooms.items():
+            for record in records_by_key.get(key, []):
+                try:
+                    self.store.bind_identity(
+                        record.id,
+                        call_record_id=key[1],
+                        room_id=room_id,
+                    )
+                except (LookupError, RuntimeError, ValueError) as error:
+                    self._room_fetch_errors[key[0]] = str(error)[:300]
+        self.refresh_records(force=True)
+
+    def _fail_room_lookups(
+        self,
+        generation: int,
+        diagnosis_ids: tuple[int, ...],
+        error: Exception,
+    ) -> None:
+        if self._closed or generation != self._room_fetch_generation:
+            return
+        self._room_fetch_inflight.difference_update(diagnosis_ids)
+        message = str(error)[:300] or "房间号获取失败。"
+        self._room_fetch_errors.update(
+            {diagnosis_id: message for diagnosis_id in diagnosis_ids}
+        )
+        self.refresh_records(force=True)
+
+    def _manual_refresh(self) -> None:
+        self._room_fetch_generation += 1
+        self._room_fetch_inflight.clear()
+        self._room_fetch_attempted.clear()
+        self._room_fetch_errors.clear()
+        self.refresh_records(force=True)
+
+    def _set_item(self, row: int, column: int, text: str) -> QTableWidgetItem:
+        item = QTableWidgetItem(str(text))
+        item.setTextAlignment(Qt.AlignmentFlag.AlignVCenter | Qt.AlignmentFlag.AlignLeft)
+        self.table.setItem(row, column, item)
+        return item
+
+    def _update_summary(self, records: list[LocalAudioRecord]) -> None:
+        counts = {status: 0 for status in _STATUS_LABELS}
+        for record in records:
+            counts[record.status] = counts.get(record.status, 0) + 1
+        self.summary_total.setText(f"全部 {len(records)}")
+        self.summary_pending.setText(f"待上传 {counts['pending']}")
+        self.summary_uploading.setText(f"上传中 {counts['uploading']}")
+        self.summary_uploaded.setText(f"已上传 {counts['uploaded']}")
+        self.summary_failed.setText(f"失败 {counts['failed']}")
+        self.upload_pending_button.setEnabled(counts["pending"] > 0)
+        self.retry_failed_button.setEnabled(counts["failed"] > 0)
+
+    def _actions(self, record: LocalAudioRecord) -> QWidget:
+        host = QWidget()
+        layout = QHBoxLayout(host)
+        layout.setContentsMargins(4, 5, 4, 5)
+        layout.setSpacing(5)
+        if record.status == "pending":
+            upload = QPushButton("上传")
+            upload.setAccessibleName(f"上传录音 {record.file_path.name}")
+            upload.clicked.connect(lambda _checked=False, record_id=record.id: self._upload_one(record_id))
+            layout.addWidget(upload)
+        elif record.status == "failed":
+            retry = QPushButton("重试")
+            retry.setProperty("variant", "danger")
+            retry.setAccessibleName(f"重试上传录音 {record.file_path.name}")
+            retry.clicked.connect(lambda _checked=False, record_id=record.id: self._retry_one(record_id))
+            layout.addWidget(retry)
+        elif record.status == "uploading":
+            busy = QPushButton("上传中")
+            busy.setEnabled(False)
+            layout.addWidget(busy)
+        if record.exists:
+            reveal = QPushButton("打开位置")
+            reveal.setAccessibleName(f"打开录音文件位置 {record.file_path.name}")
+            reveal.clicked.connect(
+                lambda _checked=False, path=record.file_path: self._open_location(path)
+            )
+            layout.addWidget(reveal)
+        layout.addStretch(1)
+        return host
+
+    def _upload_pending(self) -> None:
+        self.manager.submit_pending(diagnosis_id=self.diagnosis_id)
+        self.refresh_records(force=True)
+
+    def _upload_one(self, record_id: int) -> None:
+        self.manager.submit(record_id)
+        self.refresh_records(force=True)
+
+    def _retry_one(self, record_id: int) -> None:
+        try:
+            self.store.retry(record_id)
+        except (OSError, RuntimeError, LookupError) as error:
+            self._show_local_error(str(error))
+            return
+        self.manager.submit(record_id)
+        self.refresh_records(force=True)
+
+    def _retry_all_failed(self) -> None:
+        for record in self._records():
+            if record.status != "failed":
+                continue
+            try:
+                self.store.retry(record.id)
+            except (OSError, RuntimeError, LookupError):
+                continue
+            self.manager.submit(record.id)
+        self.refresh_records(force=True)
+
+    def _show_local_error(self, message: str) -> None:
+        self.summary_failed.setText(str(message)[:160])
+        self.summary_failed.setToolTip(str(message))
+
+    @staticmethod
+    def _open_location(path: Path) -> None:
+        target = path.parent if path.parent.is_dir() else path
+        QDesktopServices.openUrl(QUrl.fromLocalFile(str(target)))
+
+    def done(self, result: int) -> None:
+        self._closed = True
+        self._room_fetch_generation += 1
+        if hasattr(self, "poll_timer"):
+            self.poll_timer.stop()
+        super().done(result)
@@ -93,6 +93,7 @@ from ..widgets import (
    MessageBanner,
    display_text,
    first_value,
+    format_record_time,
    friendly_error,
    get_value,
    has_permission,
@@ -3692,6 +3693,11 @@ class PrescriptionEditorDialog(QDialog):
        hidden_keys = (
            "id",
            "diagnosis_id",
+            "appointment_id",
+            "patient_id",
+            "phone",
+            "case_record",
+            "prescription_name",
            "creator_id",
            "is_system_auto",
            "is_shared",
@@ -4233,20 +4239,9 @@ def render_prescription_html(
    def date_text() -> str:
        raw = source.get("create_time") or source.get("update_time")
        if raw not in (None, ""):
-            raw_text = str(raw).strip()
-            if re.fullmatch(r"\d{10,13}(?:\.\d+)?", raw_text):
-                stamp = float(raw_text)
-                if stamp >= 10_000_000_000:
-                    stamp /= 1000
-                try:
-                    return datetime.fromtimestamp(stamp).strftime("%Y-%m-%d %H:%M")
-                except (OSError, OverflowError, ValueError):
-                    pass
-            normalized = raw_text.replace("T", " ").replace("Z", "")
-            if len(normalized) >= 16:
-                return normalized[:16]
-            if normalized:
-                return normalized
+            formatted = format_record_time(raw, default="")
+            if formatted:
+                return formatted
        return display_text(source.get("prescription_date"))

    def usage_text(values: Mapping[str, Any], *, fallback: Mapping[str, Any]) -> str:
@@ -5117,6 +5112,10 @@ class DiagnosisDetailDialog(QDialog):
        source = _mapping(diagnosis)
        self.repository = repository
        self.permissions = permissions
+        self._order_detail_generation = 0
+        self._order_detail_order_id = 0
+        self._order_detail_table: QTableWidget | None = None
+        self._order_detail_button: QPushButton | None = None
        self.setWindowTitle("诊单详情（只读）")
        self.resize(880, 700)
        root = QVBoxLayout(self)
@@ -5195,6 +5194,7 @@ class DiagnosisDetailDialog(QDialog):
        table.setSelectionBehavior(QAbstractItemView.SelectionBehavior.SelectRows)
        table.verticalHeader().hide()
        table.horizontalHeader().setStretchLastSection(True)
+        self._order_detail_table = table
        for row_index, row in enumerate(rows):
            values = (
                first_value(row, "order_no", "sn", "id"),
@@ -5212,36 +5212,78 @@ class DiagnosisDetailDialog(QDialog):
        actions = QHBoxLayout()
        view = QPushButton("查看订单详情")
        view.setProperty("variant", "primary")
-
-        def open_selected() -> None:
-            row = table.currentRow()
-            item = table.item(row, 0) if row >= 0 else None
-            order = item.data(Qt.ItemDataRole.UserRole) if item is not None else None
-            if order is None:
-                return
-            order_id = _int(first_value(order, "id", "order_id"), 0)
-            if order_id > 0 and callable(getattr(self.repository, "get_prescription_order", None)):
-                try:  # noqa: SIM105 - retain the embedded row if detail lookup fails
-                    order = self.repository.get_prescription_order(order_id)
-                except Exception:  # noqa: BLE001 - fall back to embedded row
-                    pass
-            from .diagnosis import present_order_detail
-
-            present_order_detail(
-                self.window() if self.window() is not None else self,
-                order,
-                order_id=order_id,
-                permissions=self.permissions,
-                exec_=True,
-            )
-
-        view.clicked.connect(open_selected)
-        table.itemDoubleClicked.connect(lambda _item: open_selected())
+        self._order_detail_button = view
+        view.clicked.connect(self._open_selected_order)
+        table.itemDoubleClicked.connect(lambda _item: self._open_selected_order())
        actions.addWidget(view)
        actions.addStretch(1)
        layout.addLayout(actions)
        return host

+    def _set_order_detail_loading(self, loading: bool) -> None:
+        if self._order_detail_table is not None:
+            self._order_detail_table.setEnabled(not loading)
+        if self._order_detail_button is not None:
+            self._order_detail_button.setEnabled(not loading)
+
+    def _open_selected_order(self) -> None:
+        table = self._order_detail_table
+        if table is None:
+            return
+        row = table.currentRow()
+        item = table.item(row, 0) if row >= 0 else None
+        order = item.data(Qt.ItemDataRole.UserRole) if item is not None else None
+        if order is None:
+            return
+        order_id = _int(first_value(order, "id", "order_id"), 0)
+        self._order_detail_generation += 1
+        generation = self._order_detail_generation
+        self._order_detail_order_id = order_id
+        getter = getattr(self.repository, "get_prescription_order", None)
+        if order_id <= 0 or not callable(getter):
+            self._set_order_detail_loading(False)
+            self._present_order_detail(order, order_id)
+            return
+
+        self._set_order_detail_loading(True)
+        run_async(
+            lambda: getter(order_id),
+            on_success=lambda result: self._order_detail_success(result, order_id, generation),
+            on_error=lambda error: self._order_detail_error(error, order, order_id, generation),
+            on_finished=lambda: self._order_detail_finished(order_id, generation),
+        )
+
+    def _order_detail_success(self, order: Any, order_id: int, generation: int) -> None:
+        if generation != self._order_detail_generation or order_id != self._order_detail_order_id:
+            return
+        self._present_order_detail(order, order_id)
+
+    def _order_detail_error(
+        self,
+        _error: Exception,
+        fallback_order: Any,
+        order_id: int,
+        generation: int,
+    ) -> None:
+        if generation != self._order_detail_generation or order_id != self._order_detail_order_id:
+            return
+        self._present_order_detail(fallback_order, order_id)
+
+    def _order_detail_finished(self, order_id: int, generation: int) -> None:
+        if generation == self._order_detail_generation and order_id == self._order_detail_order_id:
+            self._set_order_detail_loading(False)
+
+    def _present_order_detail(self, order: Any, order_id: int) -> None:
+        from .diagnosis import present_order_detail
+
+        present_order_detail(
+            self.window() if self.window() is not None else self,
+            order,
+            order_id=order_id,
+            permissions=self.permissions,
+            exec_=True,
+        )
+

 class PrescriptionOrderDialog(QDialog):
    """Create a fulfilment order from one issued prescription."""
@@ -8,7 +8,7 @@ from collections.abc import Callable
 from dataclasses import dataclass, field
 from typing import Any

-from PySide6.QtCore import Qt
+from PySide6.QtCore import QCoreApplication, QEvent, Qt
 from PySide6.QtWidgets import (
    QDialog,
    QFrame,
@@ -1086,11 +1086,15 @@ class PrescriptionAiReportDialog(QDialog):

    def _clear_host(self) -> None:
        while self.host_layout.count():
-            item = self.host_layout.takeAt(0)
-            widget = item.widget()
-            if widget is not None:
-                widget.setParent(None)
-                widget.deleteLater()
+            item = self.host_layout.takeAt(0)
+            widget = item.widget()
+            if widget is not None:
+                # Keep the parent until Qt processes the deferred deletion.
+                # Detaching a visible child promotes it to a native top-level
+                # window on Windows and causes a small title-bar window to flash.
+                widget.hide()
+                widget.deleteLater()
+                QCoreApplication.sendPostedEvents(widget, QEvent.Type.DeferredDelete)

    def _add_label(
        self,
@@ -40,6 +40,10 @@ from PySide6.QtWidgets import (
    QWidget,
 )

+from doctor_workstation import __version__
+from doctor_workstation.resources import app_icon_path, brand_lockup_path
+
+from .theme import crisp_pixmap
 from .widgets import BusyOverlay, MessageBanner, friendly_error, invoke, run_async


@@ -131,47 +135,7 @@ class _BrandPanel(QWidget):
        self.setMinimumWidth(320)
        self.setMaximumWidth(824)
        self.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Expanding)
-
-    @staticmethod
-    def _draw_mark(painter: QPainter, rect: QRectF, *, faint: bool = False) -> None:
-        alpha = 112 if faint else 255
-        gradient = QLinearGradient(rect.topLeft(), rect.bottomRight())
-        gradient.setColorAt(0.0, QColor(122, 137, 255, alpha))
-        gradient.setColorAt(1.0, QColor(71, 82, 238, alpha))
-        painter.setPen(Qt.PenStyle.NoPen)
-        painter.setBrush(gradient)
-        painter.drawRoundedRect(rect, rect.width() * 0.27, rect.width() * 0.27)
-
-        pen = QPen(
-            QColor(255, 255, 255, 235 if not faint else 150),
-            max(2.0, rect.width() / 24),
-        )
-        pen.setCapStyle(Qt.PenCapStyle.RoundCap)
-        pen.setJoinStyle(Qt.PenJoinStyle.RoundJoin)
-        painter.setPen(pen)
-        painter.setBrush(Qt.BrushStyle.NoBrush)
-        bag = QRectF(
-            rect.left() + rect.width() * 0.24,
-            rect.top() + rect.height() * 0.35,
-            rect.width() * 0.52,
-            rect.height() * 0.38,
-        )
-        painter.drawRoundedRect(bag, rect.width() * 0.06, rect.width() * 0.06)
-        handle = QRectF(
-            rect.left() + rect.width() * 0.39,
-            rect.top() + rect.height() * 0.25,
-            rect.width() * 0.22,
-            rect.height() * 0.15,
-        )
-        painter.drawRoundedRect(handle, rect.width() * 0.04, rect.width() * 0.04)
-        cx, cy = rect.center().x(), rect.top() + rect.height() * 0.54
-        painter.drawLine(
-            QPointF(cx - rect.width() * 0.13, cy), QPointF(cx + rect.width() * 0.13, cy)
-        )
-        painter.drawLine(
-            QPointF(cx, cy - rect.height() * 0.13),
-            QPointF(cx, cy + rect.height() * 0.13),
-        )
+        self._brand_lockup = QPixmap(str(brand_lockup_path()))

    @staticmethod
    def _draw_cube(painter: QPainter, center: QPointF, size: float, kind: str) -> None:
@@ -337,10 +301,17 @@ class _BrandPanel(QWidget):
        self._draw_illustration(painter, width, height)

        left = 64.0 if width >= 620 else 38.0
-        self._draw_mark(painter, QRectF(left, 51, 70, 70))
-        painter.setPen(QColor("#14224A"))
-        painter.setFont(_font(28, QFont.Weight.Bold))
-        painter.drawText(QPointF(left + 93, 98), "甄养堂医疗")
+        if not self._brand_lockup.isNull():
+            logo_width = 180.0
+            logo_height = logo_width * (
+                self._brand_lockup.height() / self._brand_lockup.width()
+            )
+            painter.setRenderHint(QPainter.RenderHint.SmoothPixmapTransform)
+            painter.drawPixmap(
+                QRectF(left, 24, logo_width, logo_height),
+                self._brand_lockup,
+                QRectF(self._brand_lockup.rect()),
+            )

        tag_rect = QRectF(left, 238, 119, 40)
        painter.setPen(Qt.PenStyle.NoPen)
@@ -900,6 +871,12 @@ class LoginWindow(QMainWindow):
        footnote.setFixedHeight(40)
        footnote_row.addWidget(footnote, 1)
        card_layout.addLayout(footnote_row)
+        self.version_label = QLabel(f"当前版本 {__version__}")
+        self.version_label.setObjectName("LoginVersionLabel")
+        self.version_label.setProperty("role", "muted")
+        self.version_label.setStyleSheet("color:#8B98B5; font-size:13px;")
+        self.version_label.setContentsMargins(0, 8, 0, 0)
+        card_layout.addWidget(self.version_label, 0, Qt.AlignmentFlag.AlignRight)

        outer.addWidget(
            self.card, 0, Qt.AlignmentFlag.AlignLeft | Qt.AlignmentFlag.AlignTop
@@ -910,18 +887,11 @@ class LoginWindow(QMainWindow):

    @staticmethod
    def _window_icon() -> QIcon:
-        pixmap = QPixmap(64, 64)
-        pixmap.fill(Qt.GlobalColor.transparent)
-        painter = QPainter(pixmap)
-        painter.setRenderHint(QPainter.RenderHint.Antialiasing)
-        _BrandPanel._draw_mark(painter, QRectF(1, 1, 62, 62))
-        painter.end()
-        return QIcon(pixmap)
+        return QIcon(str(app_icon_path()))

    @staticmethod
    def _account_icon() -> QIcon:
-        pixmap = QPixmap(24, 24)
-        pixmap.fill(Qt.GlobalColor.transparent)
+        pixmap = crisp_pixmap(24)
        painter = QPainter(pixmap)
        painter.setRenderHint(QPainter.RenderHint.Antialiasing)
        painter.setPen(_round_pen("#8292B6", 2))
@@ -933,8 +903,7 @@ class LoginWindow(QMainWindow):

    @staticmethod
    def _lock_icon() -> QIcon:
-        pixmap = QPixmap(20, 20)
-        pixmap.fill(Qt.GlobalColor.transparent)
+        pixmap = crisp_pixmap(20)
        painter = QPainter(pixmap)
        painter.setRenderHint(QPainter.RenderHint.Antialiasing)
        painter.setPen(_round_pen("#8FA0C4", 1.6))
@@ -29,6 +29,7 @@ from PySide6.QtWidgets import (
    QMessageBox,
    QPushButton,
    QScrollArea,
+    QSizePolicy,
    QSpinBox,
    QTableWidget,
    QTableWidgetItem,
@@ -44,8 +45,11 @@ from ..diagnosis_index_widgets import (
    DiagnosisPager,
    DiagnosisTableHost,
    FlowWidget,
+    prescription_action,
+    video_call_is_live,
 )
 from ..dialogs import DiagnosisDialog
+from ..dialogs.ai_consult import can_open_ai_consult, present_ai_consult
 from ..dialogs.prescription import (
    PrescriptionDetailDialog,
    PrescriptionEditorDialog,
@@ -68,8 +72,12 @@ from ..widgets import (
    show_toast,
 )

+_PAGE_HEADER_HEIGHT = 62
+_STATUS_CARD_HEIGHT = 50
+_FILTERS_COLLAPSED_HEIGHT = 90
+
 CONSULTATIONS_REFERENCE_QSS = """
-#DiagnosisIndex QWidget#PageHeader { min-height: 72px; }
+#DiagnosisIndex QWidget#PageHeader { min-height: 62px; max-height: 62px; }
 #DiagnosisIndex QLabel[role="pageTitle"] {
    color: #15224A; font-size: 22px; font-weight: 700;
 }
@@ -82,7 +90,7 @@ CONSULTATIONS_REFERENCE_QSS = """
    background: #FFFFFF; border: 1px solid #E2E7F4; border-radius: 13px;
 }
 #DiagnosisIndex QFrame#DiagnosisStatusCard {
-    min-height: 60px; max-height: 60px;
+    min-height: 50px; max-height: 50px;
 }
 #DiagnosisIndex QFrame#DiagnosisStatusCard QToolButton[diagnosisChip="true"] {
    min-height: 34px; max-height: 34px; min-width: 56px;
@@ -103,7 +111,7 @@ CONSULTATIONS_REFERENCE_QSS = """
    min-width: 116px; max-width: 116px;
 }
 #DiagnosisIndex QFrame#DiagnosisFilterCard {
-    min-height: 106px;
+    min-height: 88px;
 }
 #DiagnosisIndex QWidget#DiagnosisDateFilters,
 #DiagnosisIndex QWidget#DiagnosisSecondaryFilters {
@@ -147,7 +155,7 @@ CONSULTATIONS_REFERENCE_QSS = """
    border-radius: 8px; font-size: 12px;
 }
 #DiagnosisIndex QFrame#DiagnosisListToolbar {
-    min-height: 54px; max-height: 54px; background: #FFFFFF;
+    min-height: 44px; max-height: 44px; background: #FFFFFF;
    border-bottom: 1px solid #E7EBF5;
 }
 #DiagnosisIndex QFrame#DiagnosisListToolbar QPushButton {
@@ -167,7 +175,7 @@ CONSULTATIONS_REFERENCE_QSS = """
 }
 #DiagnosisIndex QTableView { background: #FFFFFF; alternate-background-color: #FBFCFF; }
 #DiagnosisIndex QToolButton[rowLink] { font-size: 11px; padding: 2px; }
-#DiagnosisIndex QWidget#DiagnosisPager { min-height: 48px; max-height: 48px; }
+#DiagnosisIndex QWidget#DiagnosisPager { min-height: 42px; max-height: 42px; }
 #DiagnosisIndex QToolButton[pagerButton="true"] {
    min-width: 32px; min-height: 32px; max-height: 32px;
    border: 1px solid #E2E7F4; border-radius: 7px; background: #FFFFFF;
@@ -367,6 +375,9 @@ def _video_payload(record: Any) -> dict[str, Any]:
        "patient_id": first_value(record, "patient_id", "source_patient_id"),
        "diagnosis_id": first_value(record, "diagnosis_id", "id"),
        "patient_name": first_value(record, "patient_name", default="患者"),
+        # This page is the assistant/admin receiver.  IM mode logs in and waits
+        # for the doctor's existing invitation; it must never call startCall.
+        "mode": "im",
        "record": record,
    }

@@ -383,17 +394,7 @@ def is_diagnosis_confirmed(record: Any) -> bool:


 def prescription_action_label(record: Any) -> str:
-    audit = _as_int(first_value(record, "prescription_audit_status", "audit_status"), -1)
-    voided = _as_int(first_value(record, "prescription_void_status", "void_status"), 0)
-    explicit = first_value(record, "has_prescription", default=None)
-    has_prescription = (
-        _as_bool(explicit)
-        if explicit is not None
-        else _as_int(first_value(record, "prescription_id", default=0), 0) > 0 or audit in {0, 1, 2}
-    )
-    if not has_prescription:
-        return "开方"
-    return "查看处方" if audit == 1 and voided != 1 else "编辑处方"
+    return prescription_action(record)[0]


 def can_void_prescription(record: Any) -> bool:
@@ -1068,30 +1069,31 @@ class ConsultationsPage(QWidget):
        self.page_scroll.setWidgetResizable(True)
        self.page_scroll.setFrameShape(QFrame.Shape.NoFrame)
        self.page_scroll.setHorizontalScrollBarPolicy(Qt.ScrollBarPolicy.ScrollBarAlwaysOff)
+        self.page_scroll.setVerticalScrollBarPolicy(Qt.ScrollBarPolicy.ScrollBarAsNeeded)
        root.addWidget(self.page_scroll)
        content = QWidget()
        content.setObjectName("DiagnosisIndexContent")
        content.setAutoFillBackground(False)
        self.page_scroll.setWidget(content)
        page_layout = QVBoxLayout(content)
-        page_layout.setContentsMargins(20, 18, 29, 16)
-        page_layout.setSpacing(12)
+        page_layout.setContentsMargins(18, 10, 18, 10)
+        page_layout.setSpacing(8)

-        page_layout.addWidget(
-            PageHeader(
-                "问诊列表",
-                "按状态与日期管理患者队列，完成通话、开方与接诊闭环。",
-                content,
-            )
+        self.page_header = PageHeader(
+            "问诊列表",
+            "按状态与日期管理患者队列，完成通话、开方与接诊闭环。",
+            content,
        )
+        self.page_header.setFixedHeight(_PAGE_HEADER_HEIGHT)
+        page_layout.addWidget(self.page_header)

        status_card = QFrame()
        status_card.setObjectName("DiagnosisStatusCard")
-        status_card.setFixedHeight(62)
+        status_card.setFixedHeight(_STATUS_CARD_HEIGHT)
        self.status_card = status_card
        status_card_layout = QHBoxLayout(status_card)
-        status_card_layout.setContentsMargins(12, 7, 12, 7)
-        status_card_layout.setSpacing(12)
+        status_card_layout.setContentsMargins(12, 5, 12, 5)
+        status_card_layout.setSpacing(10)

        status_tabs = QWidget(status_card)
        status_tabs.setObjectName("DiagnosisStatusTabs")
@@ -1160,8 +1162,8 @@ class ConsultationsPage(QWidget):
        filters.setObjectName("DiagnosisFilterCard")
        self.filters_card = filters
        filter_layout = QVBoxLayout(filters)
-        filter_layout.setContentsMargins(14, 10, 14, 10)
-        filter_layout.setSpacing(7)
+        filter_layout.setContentsMargins(12, 6, 12, 6)
+        filter_layout.setSpacing(4)

        date_filters = QWidget(filters)
        date_filters.setObjectName("DiagnosisDateFilters")
@@ -1365,11 +1367,12 @@ class ConsultationsPage(QWidget):
        advanced_layout.addWidget(self.advanced_filter_flow)
        self.advanced_filters.hide()
        filter_layout.addWidget(self.advanced_filters)
-        filters.setFixedHeight(108)
+        filters.setFixedHeight(_FILTERS_COLLAPSED_HEIGHT)
        page_layout.addWidget(filters)

        card = QFrame()
        card.setObjectName("DiagnosisListCard")
+        card.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Expanding)
        self.list_card = card
        card_layout = QVBoxLayout(card)
        card_layout.setContentsMargins(0, 0, 0, 0)
@@ -1377,8 +1380,8 @@ class ConsultationsPage(QWidget):
        toolbar = QFrame()
        toolbar.setObjectName("DiagnosisListToolbar")
        toolbar_layout = QHBoxLayout(toolbar)
-        toolbar_layout.setContentsMargins(14, 6, 14, 6)
-        toolbar_layout.setSpacing(8)
+        toolbar_layout.setContentsMargins(12, 4, 12, 4)
+        toolbar_layout.setSpacing(6)
        self.add_button = QPushButton("＋  新增患者", toolbar)
        self.add_button.setProperty("variant", "primary")
        self.add_button.setVisible(_canonical_allowed(permissions, "tcm.diagnosis/add"))
@@ -1479,14 +1482,16 @@ class ConsultationsPage(QWidget):
        toolbar_layout.addWidget(self.refresh_button)

        table_wrap = QWidget()
+        table_wrap.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Expanding)
        table_wrap_layout = QVBoxLayout(table_wrap)
-        table_wrap_layout.setContentsMargins(12, 8, 12, 0)
+        table_wrap_layout.setContentsMargins(12, 4, 12, 0)
        table_wrap_layout.setSpacing(0)
        self.table_host = DiagnosisTableHost(
            action_policy={
                "view": _canonical_allowed(permissions, "tcm.diagnosis/readonlyDetail"),
                "edit": _canonical_allowed(permissions, "tcm.diagnosis/edit"),
                "prescription": _canonical_allowed(permissions, "tcm.diagnosis/kaifang"),
+                "ai_consult": can_open_ai_consult(permissions),
                "appointment": _canonical_allowed(permissions, "tcm.diagnosis/guahao"),
                "assign": _canonical_allowed(permissions, "tcm.diagnosis/assign"),
                "delete": _canonical_allowed(permissions, "tcm.diagnosis/delete"),
@@ -1526,15 +1531,14 @@ class ConsultationsPage(QWidget):
        self.table_host.video_requested.connect(self._row_video)
        self.table_host.checked_changed.connect(self._checked_changed)
        self.table_host.sort_unserved_requested.connect(self._sort_unserved)
-        table_wrap_layout.addWidget(self.table_host)
+        table_wrap_layout.addWidget(self.table_host, 1)
        self.loading_overlay = DiagnosisLoadingOverlay(self.table_host)
-        card_layout.addWidget(table_wrap)
+        card_layout.addWidget(table_wrap, 1)
        self.pager = DiagnosisPager(self._page_size)
        self.pager.page_changed.connect(self._change_page)
        self.pager.page_size_changed.connect(self._change_page_size)
        card_layout.addWidget(self.pager)
-        page_layout.addWidget(card)
-        page_layout.addStretch(1)
+        page_layout.addWidget(card, 1)

        self.poll_timer = QTimer(self)
        self.poll_timer.setInterval(20_000)
@@ -1703,7 +1707,9 @@ class ConsultationsPage(QWidget):
    def _toggle_advanced_filters(self, checked: bool) -> None:
        self.advanced_filters.setVisible(checked)
        self.filters_card.setFixedHeight(
-            108 + self.advanced_filters.sizeHint().height() + 8 if checked else 108
+            _FILTERS_COLLAPSED_HEIGHT + self.advanced_filters.sizeHint().height() + 8
+            if checked
+            else _FILTERS_COLLAPSED_HEIGHT
        )
        self.more_filter_button.setText("收起" if checked else "更多筛选")
        self.more_filter_button.setArrowType(
@@ -2244,6 +2250,7 @@ class ConsultationsPage(QWidget):
            "view": self._open_readonly,
            "edit": self._open_edit,
            "prescription": self._open_prescription,
+            "ai_consult": self._open_ai_consult,
            "appointment": self._book_selected_appointment,
            "fill_id_card": self._fill_selected_id_card,
            "assign": self._assign_selected,
@@ -2919,10 +2926,21 @@ class ConsultationsPage(QWidget):
        self.edit_button.setEnabled(has_record)
        self.delete_button.setEnabled(has_record)
        self.prescription_button.setText(
-            prescription_action_label(record) if record is not None else "开方"
+            prescription_action(
+                record,
+                force_open=self.table_host.force_open_prescription,
+            )[0]
+            if record is not None
+            else "开方"
        )
        self.prescription_button.setEnabled(has_record and not self._prescription_busy)
-        row_has_prescription = _as_bool(first_value(record, "has_prescription", default=False))
+        row_has_prescription = _as_bool(
+            first_value(
+                record,
+                "current_has_prescription",
+                default=first_value(record, "has_prescription", default=False),
+            )
+        )
        self.void_button.setEnabled(
            has_record
            and row_has_prescription
@@ -2934,7 +2952,12 @@ class ConsultationsPage(QWidget):
            _as_int(payload.get(key), 0) > 0
            for key in ("appointment_id", "patient_id", "diagnosis_id")
        )
-        self.video_button.setEnabled(has_record and is_video_available(record) and valid_ids)
+        self.video_button.setEnabled(
+            has_record
+            and is_video_available(record)
+            and video_call_is_live(record)
+            and valid_ids
+        )

    @property
    def _diagnosis_dialog(self) -> DiagnosisDialog:
@@ -2954,6 +2977,34 @@ class ConsultationsPage(QWidget):
            return
        self._diagnosis_dialog.open_view_only(diagnosis_id, seed=record)

+    def open_selected_ai_consult(self) -> bool:
+        """Open the assistant with the selected diagnosis as its authority key."""
+
+        record = self.table.current_data()
+        diagnosis_id = _as_int(first_value(record, "diagnosis_id", "id", default=0))
+        if (
+            record is None
+            or diagnosis_id <= 0
+            or not can_open_ai_consult(self.permissions)
+        ):
+            return False
+        present_ai_consult(
+            self.repository,
+            self.permissions,
+            self,
+            diagnosis_id=diagnosis_id,
+            patient_id=_as_int(
+                first_value(record, "source_patient_id", "patient_id", default=0)
+            ),
+            seed=record,
+            source_title="问诊列表",
+        )
+        return True
+
+    def _open_ai_consult(self) -> None:
+        if not self.open_selected_ai_consult():
+            show_toast(self, "请先选择一条有效诊单。", "warning")
+
    def _open_edit(self) -> None:
        if not _canonical_allowed(self.permissions, "tcm.diagnosis/edit"):
            return
@@ -3049,7 +3100,11 @@ class ConsultationsPage(QWidget):
        record = self.table.current_data()
        if _as_int(first_value(record, "diagnosis_id", "id", default=0)) <= 0:
            return
-        self._begin_prescription_load(record, mode="open")
+        _label, mode = prescription_action(
+            record,
+            force_open=self.table_host.force_open_prescription,
+        )
+        self._begin_prescription_load(record, mode=mode)

    def _void_selected_prescription(self) -> None:
        if not _canonical_allowed(self.permissions, "tcm.diagnosis/kaifang"):
@@ -3087,6 +3142,28 @@ class ConsultationsPage(QWidget):
        if existing is not None:
            approved = _as_int(first_value(existing, "audit_status", "status"), -1) == 1
            voided = _as_int(first_value(existing, "void_status", "is_void"), 0) == 1
+            actual_id = _as_int(first_value(existing, "id", "prescription_id", default=0))
+            expected_id = _as_int(
+                first_value(record, "current_prescription_id", default=0)
+            )
+            actual_appointment_id = _as_int(
+                first_value(existing, "appointment_id", default=0)
+            )
+            expected_appointment_id = _appointment_id(record)
+            identity_changed = (
+                (expected_id > 0 and actual_id != expected_id)
+                or (
+                    actual_appointment_id > 0
+                    and expected_appointment_id > 0
+                    and actual_appointment_id != expected_appointment_id
+                )
+            )
+            if mode == "view" and (not approved or voided or identity_changed):
+                self.banner.show_message(
+                    "当前挂号的处方状态已变化，请刷新列表后重试。",
+                    "warning",
+                )
+                return
            if not approved or voided:
                self._open_existing_prescription_editor(existing)
            else:
@@ -3100,6 +3177,12 @@ class ConsultationsPage(QWidget):
                detail.diagnosis_requested.connect(self._open_diagnosis_id)
                detail.exec()
            return
+        if mode == "view":
+            self.banner.show_message(
+                "当前挂号没有可查看的处方，请刷新列表后重试。",
+                "warning",
+            )
+            return
        self._begin_case_record_load(record)

    def _open_existing_prescription_editor(self, prescription: Any) -> None:
@@ -3312,6 +3395,9 @@ class ConsultationsPage(QWidget):
        if record is None or not is_video_available(record):
            self.banner.show_message("仅当前“已预约”的挂号可进入视频问诊。", "warning")
            return
+        if not video_call_is_live(record):
+            self.banner.show_message("医生尚未发起视频会话，请等待会话开始。", "warning")
+            return
        payload = _video_payload(record)
        if not all(
            _as_int(payload.get(key), 0) > 0
@@ -3324,7 +3410,11 @@ class ConsultationsPage(QWidget):
    def _poll_refresh(self) -> None:
        """Refresh rows and chip counts without showing the table mask."""

-        if not self.isVisible() or self._order_flow_generation is not None:
+        if (
+            not self.isVisible()
+            or self._loading
+            or self._order_flow_generation is not None
+        ):
            return
        self.refresh(silent=True)
        self._refresh_counts()
@@ -37,14 +37,17 @@ from PySide6.QtWidgets import (
 )

 from ..appointment_drawer import AppointmentDrawer
-from ..dialogs import DiagnosisDialog, present_order_detail
+from ..dialogs import DiagnosisDialog, present_ai_consult, present_order_detail
+from ..dialogs.ai_consult import can_open_ai_consult
 from ..dialogs.prescription import PrescriptionOrderListDialog
-from ..theme import mark_business_dialog
+from ..theme import crisp_pixmap, mark_business_dialog
 from ..widgets import (
    EmptyState,
    MessageBanner,
    PageHeader,
    Pager,
+    RowAction,
+    RowActions,
    SortableTable,
    StatusBadge,
    TableColumn,
@@ -98,7 +101,7 @@ _SEMANTIC_COLORS = {
 }

 PATIENTS_LIGHT_QSS = """
-#PatientsPage QWidget#PageHeader { min-height: 88px; max-height: 88px; }
+#PatientsPage QWidget#PageHeader { min-height: 62px; max-height: 62px; }
 #PatientsPage QWidget#PageHeader QLabel[role="pageTitle"] {
    color: #10204A;
    font-size: 20px;
@@ -109,8 +112,8 @@ PATIENTS_LIGHT_QSS = """
    font-size: 12px;
 }
 #PatientsPage QPushButton[patientSearchAction="true"] {
-    min-height: 34px;
-    max-height: 34px;
+    min-height: 32px;
+    max-height: 32px;
    color: #FFFFFF;
    background-color: #5265F6;
    border: 1px solid #5265F6;
@@ -122,24 +125,24 @@ PATIENTS_LIGHT_QSS = """
    border-color: #4557E7;
 }
 #PatientsPage QFrame[patientListFilter="true"] {
-    min-height: 112px;
-    max-height: 112px;
+    min-height: 88px;
+    max-height: 88px;
    background-color: #FFFFFF;
    border: 1px solid #E6EAF5;
    border-radius: 11px;
 }
 #PatientsPage QFrame[patientListFilter="true"] QLineEdit,
 #PatientsPage QFrame[patientListFilter="true"] QDateEdit {
-    min-height: 34px;
-    max-height: 34px;
+    min-height: 32px;
+    max-height: 32px;
    background-color: #FFFFFF;
    border: 1px solid #E2E7F4;
    border-radius: 7px;
 }
 #PatientsPage QPushButton[patientStatusChip="true"] {
-    min-height: 34px;
-    max-height: 34px;
-    padding: 0 13px;
+    min-height: 32px;
+    max-height: 32px;
+    padding: 0 10px;
    color: #405074;
    background-color: #F8F9FD;
    border: 0;
@@ -155,9 +158,9 @@ PATIENTS_LIGHT_QSS = """
    border: 1px solid #9EA8FF;
 }
 #PatientsPage QPushButton[patientQuickDate="true"] {
-    min-height: 34px;
-    max-height: 34px;
-    padding: 0 12px;
+    min-height: 32px;
+    max-height: 32px;
+    padding: 0 9px;
    color: #29365C;
    background-color: transparent;
    border: 1px solid transparent;
@@ -179,7 +182,7 @@ PATIENTS_LIGHT_QSS = """
 }
 #PatientsPage QTabWidget#PatientWorkspaceTabs QTabBar::tab {
    min-width: 86px;
-    min-height: 40px;
+    min-height: 34px;
    padding: 0 6px;
    margin-right: 8px;
    color: #59698E;
@@ -193,9 +196,9 @@ PATIENTS_LIGHT_QSS = """
    border-bottom-color: #5265F6;
 }
 #PatientsPage QPushButton[summaryCard="true"] {
-    min-height: 54px;
-    max-height: 54px;
-    padding: 0 13px;
+    min-height: 42px;
+    max-height: 42px;
+    padding: 0 11px;
    color: #5265F6;
    background-color: #F7F8FF;
    border: 1px solid #E1E5FF;
@@ -301,8 +304,7 @@ PATIENTS_LIGHT_QSS = """
 def _summary_calendar_icon() -> QIcon:
    """Paint the compact calendar tile from the reference without a font glyph."""

-    pixmap = QPixmap(34, 34)
-    pixmap.fill(Qt.GlobalColor.transparent)
+    pixmap = crisp_pixmap(34)
    painter = QPainter(pixmap)
    painter.setRenderHint(QPainter.RenderHint.Antialiasing)
    painter.setPen(Qt.PenStyle.NoPen)
@@ -1277,6 +1279,7 @@ class PatientListWorkspace(QWidget):
    fill_id_requested = Signal(object)
    cancel_requested = Signal(object)
    orders_requested = Signal(object)
+    ai_consult_requested = Signal(object)
    scope_changed = Signal(str)

    def __init__(self, repository: Any, permissions: Any, parent: QWidget | None = None) -> None:
@@ -1289,15 +1292,18 @@ class PatientListWorkspace(QWidget):
        self._date_mode = "all"
        self._scope = "按权限加载"
        self._setting_dates = False
+        self.setMinimumHeight(0)

        root = QVBoxLayout(self)
        root.setContentsMargins(0, 2, 0, 0)
-        root.setSpacing(10)
-        root.addWidget(self._build_filters())
+        root.setSpacing(6)
+        self.filter_card = self._build_filters()
+        root.addWidget(self.filter_card)
        root.addLayout(self._build_summary())
        self.banner = MessageBanner()
        root.addWidget(self.banner)
-        root.addWidget(self._build_table(), 1)
+        self.table_card = self._build_table()
+        root.addWidget(self.table_card, 1)

    @property
    def scope(self) -> str:
@@ -1308,20 +1314,21 @@ class PatientListWorkspace(QWidget):
        card.setObjectName("FilterBar")
        card.setProperty("patientListFilter", True)
        panel = QVBoxLayout(card)
-        panel.setContentsMargins(18, 18, 18, 12)
-        panel.setSpacing(10)
+        panel.setContentsMargins(12, 8, 12, 8)
+        panel.setSpacing(6)

        top_row = QHBoxLayout()
+        top_row.setObjectName("PatientFilterTopRow")
        top_row.setContentsMargins(0, 0, 0, 0)
-        top_row.setSpacing(0)
+        top_row.setSpacing(6)
+        top_row.setAlignment(Qt.AlignmentFlag.AlignLeft)
        self.keyword_edit = QLineEdit()
+        self.keyword_edit.setObjectName("PatientKeywordInput")
+        self.keyword_edit.setMaximumWidth(620)
        self.keyword_edit.setPlaceholderText("患者姓名 / 手机号 / 助理 / 医生")
        self.keyword_edit.setClearButtonEnabled(True)
-        self.keyword_edit.setMinimumWidth(300)
-        self.keyword_edit.setMaximumWidth(605)
        self.keyword_edit.returnPressed.connect(self.search)
-        top_row.addWidget(self.keyword_edit, 1)
-        top_row.addSpacing(21)
+        top_row.addWidget(self.keyword_edit, 3)
        # Compatibility-only control: it is intentionally hidden and never
        # inserted into a layout, so it needs an explicit parent to avoid
        # becoming a transient top-level Windows HWND during page creation.
@@ -1332,11 +1339,12 @@ class PatientListWorkspace(QWidget):
        self.status_combo.addItem("已完成", "completed")
        self.status_combo.addItem("已过号", "missed")
        self.status_combo.hide()
-        status_host = QWidget()
-        status_host.setFixedWidth(396)
-        status_row = QHBoxLayout(status_host)
+        self.status_host = QWidget()
+        self.status_host.setObjectName("PatientStatusFilterHost")
+        self.status_host.setMaximumWidth(440)
+        status_row = QHBoxLayout(self.status_host)
        status_row.setContentsMargins(0, 0, 0, 0)
-        status_row.setSpacing(0)
+        status_row.setSpacing(2)
        self.status_group = QButtonGroup(self)
        self.status_group.setExclusive(True)
        self.status_buttons: dict[str, QPushButton] = {}
@@ -1368,30 +1376,31 @@ class PatientListWorkspace(QWidget):
            self.status_buttons[value] = button
            status_row.addWidget(button, 1)
        self.status_buttons[""].setChecked(True)
-        top_row.addWidget(status_host)
-        top_row.addStretch(1)
-        search = QPushButton("查询")
-        search.setProperty("variant", "primary")
-        search.setProperty("patientSearchAction", True)
-        search.setFixedWidth(72)
-        search.clicked.connect(self.search)
-        top_row.addWidget(search)
-        top_row.addSpacing(12)
-        reset = QPushButton("重置")
-        reset.setProperty("variant", "ghost")
-        reset.setFixedWidth(72)
-        reset.clicked.connect(self.reset_filters)
-        top_row.addWidget(reset)
+        top_row.addWidget(self.status_host, 2)
+        self.search_button = QPushButton("查询")
+        self.search_button.setObjectName("PatientSearchButton")
+        self.search_button.setProperty("variant", "primary")
+        self.search_button.setProperty("patientSearchAction", True)
+        self.search_button.clicked.connect(self.search)
+        top_row.addWidget(self.search_button)
+        self.reset_button = QPushButton("重置")
+        self.reset_button.setObjectName("PatientResetButton")
+        self.reset_button.setProperty("variant", "ghost")
+        self.reset_button.clicked.connect(self.reset_filters)
+        top_row.addWidget(self.reset_button)
        panel.addLayout(top_row)

        bottom_row = QHBoxLayout()
+        bottom_row.setObjectName("PatientFilterDateRow")
        bottom_row.setContentsMargins(0, 0, 0, 0)
-        bottom_row.setSpacing(0)
-        quick_host = QWidget()
-        quick_host.setFixedWidth(730)
-        quick = QHBoxLayout(quick_host)
+        bottom_row.setSpacing(6)
+        bottom_row.setAlignment(Qt.AlignmentFlag.AlignLeft)
+        self.quick_host = QWidget()
+        self.quick_host.setObjectName("PatientQuickDateHost")
+        self.quick_host.setMaximumWidth(620)
+        quick = QHBoxLayout(self.quick_host)
        quick.setContentsMargins(0, 0, 0, 0)
-        quick.setSpacing(0)
+        quick.setSpacing(2)
        self.quick_group = QButtonGroup(self)
        self.quick_group.setExclusive(True)
        self.quick_buttons: dict[str, QPushButton] = {}
@@ -1412,16 +1421,16 @@ class PatientListWorkspace(QWidget):
            self.quick_buttons[mode] = button
            quick.addWidget(button, 1)
        self.quick_buttons["all"].setChecked(True)
-        bottom_row.addWidget(quick_host)
-        bottom_row.addSpacing(20)
+        bottom_row.addWidget(self.quick_host, 3)

-        date_host = QWidget()
-        date_host.setMinimumWidth(390)
-        date_host.setMaximumWidth(476)
-        dates = QHBoxLayout(date_host)
+        self.date_host = QWidget()
+        self.date_host.setObjectName("PatientDateRangeHost")
+        self.date_host.setMaximumWidth(420)
+        dates = QHBoxLayout(self.date_host)
        dates.setContentsMargins(0, 0, 0, 0)
-        dates.setSpacing(10)
+        dates.setSpacing(6)
        self.start_date = QDateEdit(QDate.currentDate())
+        self.start_date.setObjectName("PatientStartDateEdit")
        self.start_date.setCalendarPopup(True)
        self.start_date.setDisplayFormat("yyyy-MM-dd")
        self.start_date.setEnabled(False)
@@ -1430,28 +1439,28 @@ class PatientListWorkspace(QWidget):
        separator = QLabel("~")
        separator.setAlignment(Qt.AlignmentFlag.AlignCenter)
        separator.setProperty("role", "muted")
-        separator.setFixedWidth(24)
        dates.addWidget(separator)
        self.end_date = QDateEdit(QDate.currentDate())
+        self.end_date.setObjectName("PatientEndDateEdit")
        self.end_date.setCalendarPopup(True)
        self.end_date.setDisplayFormat("yyyy-MM-dd")
        self.end_date.setEnabled(False)
        self.end_date.editingFinished.connect(self._custom_date_changed)
        dates.addWidget(self.end_date, 1)
-        bottom_row.addWidget(date_host, 1)
-        bottom_row.addSpacing(20)
-        custom = QPushButton("自定义")
-        custom.setProperty("variant", "ghost")
-        custom.setFixedWidth(100)
-        custom.clicked.connect(lambda: self.set_date_mode("custom"))
-        bottom_row.addWidget(custom)
-        bottom_row.addStretch(1)
+        bottom_row.addWidget(self.date_host, 2)
+        self.custom_date_button = QPushButton("自定义")
+        self.custom_date_button.setObjectName("PatientCustomDateButton")
+        self.custom_date_button.setProperty("variant", "ghost")
+        self.custom_date_button.clicked.connect(lambda: self.set_date_mode("custom"))
+        bottom_row.addWidget(self.custom_date_button)
        panel.addLayout(bottom_row)
        return card

    def _build_summary(self) -> QHBoxLayout:
        layout = QHBoxLayout()
+        layout.setObjectName("PatientSummaryRow")
        layout.setSpacing(8)
+        layout.setAlignment(Qt.AlignmentFlag.AlignLeft)
        self.summary_buttons: dict[str, QPushButton] = {}
        for key, label, mode in (
            ("today", "今日预约", "today"),
@@ -1459,8 +1468,16 @@ class PatientListWorkspace(QWidget):
            ("day_after", "后天预约", "day_after"),
        ):
            button = QPushButton(f"{label}\n0 人")
+            button.setObjectName(
+                {
+                    "today": "PatientSummaryToday",
+                    "tomorrow": "PatientSummaryTomorrow",
+                    "day_after": "PatientSummaryDayAfter",
+                }[key]
+            )
            button.setProperty("summaryCard", True)
-            button.setFixedHeight(56)
+            button.setFixedHeight(42)
+            button.setMaximumWidth(420)
            button.setIcon(_summary_calendar_icon())
            button.setIconSize(QSize(34, 34))
            button.clicked.connect(lambda _checked=False, value=mode: self.set_date_mode(value))
@@ -1471,9 +1488,10 @@ class PatientListWorkspace(QWidget):
    def _build_table(self) -> QWidget:
        card = QFrame()
        card.setObjectName("Card")
+        card.setMinimumHeight(0)
        layout = QVBoxLayout(card)
-        layout.setContentsMargins(14, 12, 14, 12)
-        layout.setSpacing(8)
+        layout.setContentsMargins(10, 8, 10, 8)
+        layout.setSpacing(6)
        heading = QHBoxLayout()
        title = QLabel("患者列表")
        title.setProperty("role", "sectionTitle")
@@ -1485,56 +1503,66 @@ class PatientListWorkspace(QWidget):
        heading.addWidget(self.scope_label)
        layout.addLayout(heading)
        self.content_stack = QStackedWidget()
+        self.content_stack.setMinimumHeight(0)
        host = QWidget()
+        host.setMinimumHeight(0)
        host_layout = QVBoxLayout(host)
        host_layout.setContentsMargins(0, 0, 0, 0)
-        host_layout.setSpacing(8)
+        host_layout.setSpacing(6)
        self.table = SortableTable(
            [
                TableColumn("_selected", "", 40, alignment=Qt.AlignmentFlag.AlignCenter),
+                # 手机号另有独立列，姓名列不再重复第二行，单行即可放下完整姓名。
                TableColumn(
                    "patient_name",
                    "患者信息",
-                    180,
+                    168,
                    lambda _value, row: (
                        f"{display_text(first_value(row, 'patient_name', 'name'))} · "
                        f"{gender_text(first_value(row, 'gender_desc', 'gender'))} · "
-                        f"{display_text(first_value(row, 'age'))}岁\n"
-                        f"{display_text(first_value(row, 'phone_masked', 'phone'), '—')}"
+                        f"{display_text(first_value(row, 'age'))}岁"
                    ),
                ),
-                TableColumn("assistant_name", "归属助理", 84),
+                TableColumn("assistant_name", "归属助理", 90),
                TableColumn(
                    "appointment_doctor_name",
                    "预约医生",
-                    108,
+                    150,
                    lambda _value, row: (
                        f"{display_text(first_value(row, 'appointment_doctor_name'), '未预约')} / "
                        f"{_patient_status(row)[0]}"
                    ),
                ),
-                TableColumn("appointment_time_text", "预约时间", 116),
+                TableColumn("appointment_time_text", "预约时间", 150),
                TableColumn(
                    "revisit_count",
                    "复诊",
-                    72,
+                    64,
                    lambda value, _row: f"{display_text(value, '0')} 次",
                    Qt.AlignmentFlag.AlignCenter,
                ),
                TableColumn("confirmation_text", "确认信息", 88),
-                TableColumn("diagnosis_date_text", "诊单日期", 96),
+                TableColumn("diagnosis_date_text", "诊单日期", 104),
                TableColumn("phone_masked", "手机", 116),
-                TableColumn("_actions", "操作", 430),
+                # 行操作收敛为“2 个常用 + 更多”后，这一列不再需要 500px 的宽度，
+                # 让出的空间还给此前被省略号截断的数据列。
+                TableColumn("_actions", "操作", 210),
            ]
        )
        self.table.setObjectName("PatientTable")
-        self.table.horizontalHeader().setFixedHeight(38)
+        self.table.setMinimumHeight(0)
+        self.table.horizontalHeader().setFixedHeight(34)
        self.table.verticalHeader().setDefaultSectionSize(40)
        self.table.itemSelectionChanged.connect(self._update_actions)
        self.table.itemDoubleClicked.connect(lambda _item: self._open_selected_diagnosis())
        host_layout.addWidget(self.table, 1)
-        host_layout.addLayout(self._build_actions())
+        self.bottom_actions = QWidget(host)
+        self.bottom_actions.setObjectName("PatientBottomActions")
+        self.bottom_actions.setLayout(self._build_actions())
+        self.bottom_actions.hide()
+        host_layout.addWidget(self.bottom_actions)
        self.pager = Pager(self._page_size)
+        self.pager.setMaximumHeight(38)
        self.pager.page_changed.connect(self._change_page)
        host_layout.addWidget(self.pager)
        self.content_stack.addWidget(host)
@@ -1567,25 +1595,16 @@ class PatientListWorkspace(QWidget):
            selector_item = self.table.item(row_index, 0)
            if selector_item is not None:
                selector_item.setText("")
-            host = QWidget(self.table)
-            layout = QHBoxLayout(host)
-            layout.setContentsMargins(5, 3, 5, 3)
-            layout.setSpacing(4)
+            row_actions: list[RowAction] = []

            def add_action(
                label: str,
                callback: Any,
                *,
                danger: bool = False,
-                _host: QWidget = host,
-                _layout: QHBoxLayout = layout,
+                _sink: list[RowAction] = row_actions,
            ) -> None:
-                button = QPushButton(label, _host)
-                button.setProperty("rowAction", True)
-                if danger:
-                    button.setProperty("variant", "danger")
-                button.clicked.connect(callback)
-                _layout.addWidget(button)
+                _sink.append(RowAction(label, callback, danger=danger))

            if editable or readable:
                add_action(
@@ -1594,6 +1613,11 @@ class PatientListWorkspace(QWidget):
                        value, can_edit
                    ),
                )
+            if can_open_ai_consult(self.permissions):
+                add_action(
+                    "AI 分析",
+                    lambda _checked=False, value=row: self.ai_consult_requested.emit(value),
+                )
            if can_book:
                add_action(
                    "预约",
@@ -1622,12 +1646,12 @@ class PatientListWorkspace(QWidget):
                    lambda _checked=False, value=row: self.cancel_requested.emit(value),
                    danger=True,
                )
-            layout.addStretch(1)
+            host = RowActions(row_actions, self.table)
            self.table.setCellWidget(row_index, action_column, host)
            action_item = self.table.item(row_index, action_column)
            if action_item is not None:
                action_item.setText("")
-            self.table.setRowHeight(row_index, 40)
+            self.table.setRowHeight(row_index, 36)

    def _build_actions(self) -> QHBoxLayout:
        layout = QHBoxLayout()
@@ -1636,6 +1660,12 @@ class PatientListWorkspace(QWidget):
        self.diagnosis_button.setProperty("variant", "primary")
        self.diagnosis_button.clicked.connect(self._open_selected_diagnosis)
        layout.addWidget(self.diagnosis_button)
+        self.ai_consult_button = QPushButton("AI 分析", self)
+        self.ai_consult_button.clicked.connect(
+            lambda: self._emit_selected(self.ai_consult_requested)
+        )
+        self.ai_consult_button.setVisible(can_open_ai_consult(self.permissions))
+        layout.addWidget(self.ai_consult_button)
        self.appointment_button = QPushButton("预约", self)
        self.appointment_button.clicked.connect(
            lambda: self._emit_selected(self.appointment_requested)
@@ -1682,6 +1712,8 @@ class PatientListWorkspace(QWidget):
        self.diagnosis_button.setVisible(editable or readable)
        self.diagnosis_button.setText("诊单" if editable else "查看")
        self.diagnosis_button.setEnabled(selected)
+        self.ai_consult_button.setVisible(can_open_ai_consult(self.permissions))
+        self.ai_consult_button.setEnabled(selected)
        self.appointment_button.setVisible(can_book)
        self.appointment_button.setEnabled(selected)
        self.assign_button.setVisible(can_assign)
@@ -2606,19 +2638,20 @@ class PatientsPage(QWidget):
        self._assistant_generation = 0

        root = QVBoxLayout(self)
-        root.setContentsMargins(25, 4, 30, 14)
+        root.setContentsMargins(20, 2, 24, 10)
        root.setSpacing(0)
-        header = PageHeader("我的患者", "患者、挂号与诊单按当前角色和部门数据范围展示。")
+        self.header = PageHeader("我的患者", "患者、挂号与诊单按当前角色和部门数据范围展示。")
        self.scope_badge = StatusBadge("按权限加载", "neutral")
-        header.add_action(self.scope_badge)
+        self.header.add_action(self.scope_badge)
        refresh = QPushButton("刷新")
        refresh.setProperty("variant", "primary")
        refresh.clicked.connect(self.refresh)
-        header.add_action(refresh)
-        root.addWidget(header)
+        self.header.add_action(refresh)
+        root.addWidget(self.header)

        self.tabs = QTabWidget()
        self.tabs.setObjectName("PatientWorkspaceTabs")
+        self.tabs.setMinimumHeight(0)
        self.patient_workspace = PatientListWorkspace(repository, permissions)
        self.order_workspace = PatientOrdersWorkspace(repository, permissions)
        self.progress_workspace = PatientProgressWorkspace(repository)
@@ -2628,6 +2661,7 @@ class PatientsPage(QWidget):
        root.addWidget(self.tabs, 1)

        self.patient_workspace.diagnosis_requested.connect(self._open_diagnosis)
+        self.patient_workspace.ai_consult_requested.connect(self._open_ai_consult)
        self.patient_workspace.appointment_requested.connect(self._book_appointment)
        self.patient_workspace.assign_requested.connect(self._load_assistants)
        self.patient_workspace.fill_id_requested.connect(self._fill_id_card)
@@ -2689,6 +2723,35 @@ class PatientsPage(QWidget):
        else:
            self._ensure_diagnosis_dialog().open_view_only(diagnosis_id, seed=row)

+    def _open_ai_consult(self, row: Any) -> None:
+        present_ai_consult(
+            self.repository,
+            self.permissions,
+            self,
+            diagnosis_id=self._diagnosis_id(row),
+            patient_id=_as_int(first_value(row, "patient_id", "source_patient_id", default=0)),
+            seed=row,
+            source_title="我的患者",
+        )
+
+    def open_selected_ai_consult(self) -> bool:
+        """Open AI chat for the selected row in the active patient workspace."""
+
+        if not can_open_ai_consult(self.permissions):
+            return False
+        workspace = self.tabs.currentWidget()
+        row = None
+        for table_name in ("table", "queue_table"):
+            table = getattr(workspace, table_name, None)
+            current_data = getattr(table, "current_data", None)
+            if callable(current_data):
+                row = current_data()
+                break
+        if row is None or self._diagnosis_id(row) <= 0:
+            return False
+        self._open_ai_consult(row)
+        return True
+
    def _open_order_diagnosis(self, row: Any) -> None:
        editable = _canonical_allowed(self.permissions, "tcm.diagnosis/edit")
        readable = _canonical_allowed(self.permissions, "tcm.diagnosis/readonlyDetail")
@@ -8,7 +8,6 @@ from typing import Any
 from PySide6.QtCore import QSize, Qt
 from PySide6.QtGui import QColor, QFont
 from PySide6.QtWidgets import (
-    QAbstractItemView,
    QComboBox,
    QDialog,
    QFrame,
@@ -26,6 +25,7 @@ from PySide6.QtWidgets import (
 from ..dialogs.prescription import PrescriptionTemplateDialog
 from ..dialogs.prescription_ai import PrescriptionAiReportDialog, can_open_ai_explain
 from ..widgets import (
+    BusinessPager,
    EmptyState,
    MessageBanner,
    MetricCard,
@@ -34,6 +34,7 @@ from ..widgets import (
    TableColumn,
    display_text,
    first_value,
+    format_record_time,
    friendly_error,
    get_value,
    has_permission,
@@ -44,7 +45,6 @@ from ..widgets import (
    show_toast,
 )
 from .prescriptions import (
-    BusinessPager,
    _cell_host,
    _painted_icon,
    _row_action_button,
@@ -54,27 +54,27 @@ from .prescriptions import (

 PRESCRIPTION_LIBRARY_PAGE_QSS = """
 #PrescriptionLibraryPage { background: #F8FAFF; }
-#PrescriptionLibraryPage QWidget#PageHeader { min-height: 84px; max-height: 84px; }
+#PrescriptionLibraryPage QWidget#PageHeader { min-height: 62px; max-height: 62px; }
 #PrescriptionLibraryPage QWidget#PageHeader QLabel[role="breadcrumb"],
 #PrescriptionLibraryPage QWidget#PageHeader QLabel[role="breadcrumbSeparator"],
 #PrescriptionLibraryPage QWidget#PageHeader QLabel[role="breadcrumbCurrent"] {
-    min-height: 16px; max-height: 16px;
+    min-height: 14px; max-height: 14px;
 }
 #PrescriptionLibraryPage QLabel[role="pageTitle"] {
    color: #15224A; font-size: 20px; font-weight: 700;
 }
 #PrescriptionLibraryPage QWidget#PageHeader QLabel[role="muted"] {
-    color: #7481A3; font-size: 12px; padding-top: 5px;
+    color: #7481A3; font-size: 12px;
 }
 #PrescriptionLibraryPage QFrame#MetricCard {
-    min-height: 80px; max-height: 80px;
+    min-height: 64px; max-height: 64px;
    border: 1px solid #E2E7F4; border-radius: 12px; background: #FFFFFF;
 }
 #PrescriptionLibraryPage QFrame#MetricCard QLabel[role="metricTitle"] {
    color: #405074; font-size: 12px; font-weight: 600;
 }
 #PrescriptionLibraryPage QFrame#MetricCard QLabel[role="metricValue"] {
-    color: #5265F6; font-size: 22px; font-weight: 700;
+    color: #5265F6; font-size: 20px; font-weight: 700;
 }
 #PrescriptionLibraryPage QLabel[metricIcon="true"] {
    border: 1px solid #DCE3FF; border-radius: 11px; background: #EEF1FF;
@@ -97,7 +97,7 @@ PRESCRIPTION_LIBRARY_PAGE_QSS = """
    border-top-left-radius: 13px; border-top-right-radius: 13px;
 }
 #PrescriptionLibraryPage QFrame#PrescriptionLibraryToolbar QPushButton[toolbarTab="true"] {
-    min-width: 82px; min-height: 36px; max-height: 36px;
+    min-width: 82px; min-height: 32px; max-height: 32px;
    padding: 0 8px; margin: 0 4px 0 0;
    color: #59698E; background: transparent; border: 0;
    border-bottom: 2px solid transparent; border-radius: 0;
@@ -107,7 +107,7 @@ PRESCRIPTION_LIBRARY_PAGE_QSS = """
 }
 #PrescriptionLibraryPage QFrame#PrescriptionLibraryFilterBar QLineEdit,
 #PrescriptionLibraryPage QFrame#PrescriptionLibraryFilterBar QComboBox {
-    min-height: 36px; max-height: 36px; padding: 0 11px;
+    min-height: 32px; max-height: 32px; padding: 0 11px;
    border-radius: 8px; font-size: 12px;
 }
 #PrescriptionLibraryPage QPushButton {
@@ -159,11 +159,14 @@ PRESCRIPTION_LIBRARY_PAGE_QSS = """
    min-width: 34px; max-width: 34px; min-height: 32px; max-height: 32px;
    padding: 0; background: #FFFFFF; color: #405074; border-color: #E2E7F4;
 }
+#PrescriptionLibraryPage QWidget#BusinessPager QPushButton {
+    min-height: 32px; max-height: 32px;
+}
 #PrescriptionLibraryPage QWidget#BusinessPager QPushButton[pagerPage="true"][active="true"] {
    background: #5265F6; color: #FFFFFF; border-color: #5265F6;
 }
-#PrescriptionLibraryPage QWidget#BusinessPager QComboBox {
-    min-height: 32px; max-height: 32px; min-width: 92px; padding: 0 9px;
+#PrescriptionLibraryPage QWidget#BusinessPager QLabel[pagerSize="true"] {
+    min-width: 64px; color: #7481A3; font-size: 12px;
 }
 """

@@ -212,15 +215,20 @@ def _efficacy_text(_value: Any, row: Any) -> str:
    )


+def _create_time_cell(value: Any, _row: Any) -> str:
+    raw = first_value(_row, "create_time_text", "create_time", default=value)
+    return format_record_time(raw)
+
+
 def _metric_card(title: str, kind: str = "accent") -> MetricCard:
    card = MetricCard(title, "0", kind=kind, glyph="")
-    card.setFixedHeight(80)
-    card.layout().setContentsMargins(18, 12, 16, 12)
+    card.setFixedHeight(64)
+    card.layout().setContentsMargins(16, 8, 14, 8)
    icon = QLabel(card)
    icon.setProperty("metricIcon", True)
    icon.setProperty("kind", kind)
    icon.setAlignment(Qt.AlignmentFlag.AlignCenter)
-    icon.setFixedSize(42, 42)
+    icon.setFixedSize(36, 36)
    colors = {
        "accent": "#5365F5",
        "info": "#8268E8",
@@ -261,6 +269,7 @@ class PrescriptionLibraryPage(QWidget):
            "处方库",
            "管理常用处方模板，支持 AI 解析辅助开方。",
        )
+        header.layout().setSpacing(4)
        header.actions.setSpacing(16)
        self.new_button = QPushButton("新增处方", header)
        self.new_button.setMinimumWidth(124)
@@ -274,8 +283,8 @@ class PrescriptionLibraryPage(QWidget):
        root.addWidget(header)

        metrics = QHBoxLayout()
-        metrics.setContentsMargins(0, 0, 0, 5)
-        metrics.setSpacing(24)
+        metrics.setContentsMargins(0, 0, 0, 0)
+        metrics.setSpacing(16)
        self.metric_cards = {
            "total": _metric_card("全部处方"),
            "private": _metric_card("仅自己", "info"),
@@ -295,9 +304,10 @@ class PrescriptionLibraryPage(QWidget):

        filters = QFrame()
        filters.setObjectName("PrescriptionLibraryFilterBar")
+        filters.setFixedHeight(52)
        grid = QGridLayout(filters)
-        grid.setContentsMargins(16, 11, 16, 11)
-        grid.setHorizontalSpacing(20)
+        grid.setContentsMargins(16, 9, 16, 9)
+        grid.setHorizontalSpacing(12)
        self.name_filter = QLineEdit()
        self.name_filter.setPlaceholderText("搜索处方名称、药材、功效等关键词")
        self.name_filter.setClearButtonEnabled(True)
@@ -319,10 +329,10 @@ class PrescriptionLibraryPage(QWidget):
        self.effect_filter.addItem("清热祛湿", "清热祛湿")
        self.effect_filter.addItem("滋阴补肾", "滋阴补肾")
        grid.addWidget(self.effect_filter, 0, 3)
-        self.name_filter.setMinimumWidth(500)
-        self.formula_filter.setFixedWidth(190)
-        self.visibility_filter.setFixedWidth(174)
-        self.effect_filter.setFixedWidth(190)
+        self.name_filter.setMinimumWidth(220)
+        self.formula_filter.setMinimumWidth(132)
+        self.visibility_filter.setMinimumWidth(148)
+        self.effect_filter.setMinimumWidth(144)
        self.query_button = QPushButton("查询")
        self.query_button.setFixedWidth(66)
        self.query_button.setProperty("variant", "secondary")
@@ -335,7 +345,10 @@ class PrescriptionLibraryPage(QWidget):
        self.reset_button.setCursor(Qt.CursorShape.PointingHandCursor)
        self.reset_button.clicked.connect(self._reset_filters)
        grid.addWidget(self.reset_button, 0, 5)
-        grid.setColumnStretch(0, 1)
+        grid.setColumnStretch(0, 4)
+        grid.setColumnStretch(1, 1)
+        grid.setColumnStretch(2, 1)
+        grid.setColumnStretch(3, 1)
        root.addWidget(filters)

        self.banner = MessageBanner()
@@ -347,8 +360,9 @@ class PrescriptionLibraryPage(QWidget):
        card_layout.setSpacing(0)
        toolbar_host = QFrame(card)
        toolbar_host.setObjectName("PrescriptionLibraryToolbar")
+        toolbar_host.setFixedHeight(46)
        toolbar = QHBoxLayout(toolbar_host)
-        toolbar.setContentsMargins(16, 10, 16, 9)
+        toolbar.setContentsMargins(16, 7, 16, 7)
        toolbar.setSpacing(8)
        self.all_tab = QPushButton("处方列表", toolbar_host)
        self.all_tab.setProperty("toolbarTab", True)
@@ -419,14 +433,13 @@ class PrescriptionLibraryPage(QWidget):
                TableColumn("efficacy", "功效主治", 170, _efficacy_text),
                TableColumn("is_public", "公开范围", 135, _visibility_text),
                TableColumn("creator_name", "创建人", 100),
-                TableColumn("create_time", "创建时间", 178),
+                TableColumn("create_time", "创建时间", 178, _create_time_cell),
                TableColumn("__actions__", "操作", 160, lambda _value, _row: ""),
            ]
        )
-        self.table.verticalHeader().setDefaultSectionSize(37)
-        self.table.horizontalHeader().setFixedHeight(41)
+        self.table.verticalHeader().setDefaultSectionSize(36)
+        self.table.horizontalHeader().setFixedHeight(38)
        self.table.setWordWrap(False)
-        self.table.setHorizontalScrollMode(QAbstractItemView.ScrollMode.ScrollPerPixel)
        self.table.itemSelectionChanged.connect(self._selection_changed)
        self.table.itemDoubleClicked.connect(lambda _item: self._view_selected())
        table_layout.addWidget(self.table, 1)
@@ -6,10 +6,9 @@ from collections.abc import Callable, Mapping
 from datetime import datetime, timedelta
 from typing import Any

-from PySide6.QtCore import QDateTime, QRectF, QSize, Qt, Signal
+from PySide6.QtCore import QDateTime, QRectF, QSize, Qt
 from PySide6.QtGui import QColor, QFont, QIcon, QPainter, QPen, QPixmap
 from PySide6.QtWidgets import (
-    QAbstractItemView,
    QComboBox,
    QDateTimeEdit,
    QDialog,
@@ -37,7 +36,9 @@ from ..dialogs.prescription import (
    PrescriptionOrderDialog,
    PrescriptionOrderListDialog,
 )
+from ..theme import crisp_pixmap
 from ..widgets import (
+    BusinessPager,
    EmptyState,
    MessageBanner,
    PageHeader,
@@ -45,6 +46,7 @@ from ..widgets import (
    TableColumn,
    display_text,
    first_value,
+    format_record_time,
    friendly_error,
    get_value,
    has_permission,
@@ -57,17 +59,17 @@ from ..widgets import (

 PRESCRIPTIONS_PAGE_QSS = """
 #PrescriptionsPage { background: #F8FAFF; }
-#PrescriptionsPage QWidget#PageHeader { min-height: 84px; max-height: 84px; }
+#PrescriptionsPage QWidget#PageHeader { min-height: 62px; max-height: 62px; }
 #PrescriptionsPage QWidget#PageHeader QLabel[role="breadcrumb"],
 #PrescriptionsPage QWidget#PageHeader QLabel[role="breadcrumbSeparator"],
 #PrescriptionsPage QWidget#PageHeader QLabel[role="breadcrumbCurrent"] {
-    min-height: 16px; max-height: 16px;
+    min-height: 14px; max-height: 14px;
 }
 #PrescriptionsPage QLabel[role="pageTitle"] {
    color: #15224A; font-size: 20px; font-weight: 700;
 }
 #PrescriptionsPage QWidget#PageHeader QLabel[role="muted"] {
-    color: #7481A3; font-size: 12px; padding-top: 5px;
+    color: #7481A3; font-size: 12px;
 }
 #PrescriptionsPage QFrame#PrescriptionFilterBar,
 #PrescriptionsPage QFrame#PrescriptionTableCard {
@@ -85,7 +87,7 @@ PRESCRIPTIONS_PAGE_QSS = """
 #PrescriptionsPage QFrame#PrescriptionFilterBar QLineEdit,
 #PrescriptionsPage QFrame#PrescriptionFilterBar QComboBox,
 #PrescriptionsPage QFrame#PrescriptionFilterBar QDateTimeEdit {
-    min-height: 34px; max-height: 34px; padding: 0 11px;
+    min-height: 32px; max-height: 32px; padding: 0 11px;
    border-radius: 8px; font-size: 12px;
 }
 #PrescriptionsPage QPushButton {
@@ -105,6 +107,10 @@ PRESCRIPTIONS_PAGE_QSS = """
    padding: 0; border-radius: 7px; background: #FFFFFF;
    border: 1px solid #DCE3F5;
 }
+#PrescriptionsPage QPushButton[rowAction="true"][labeled="true"] {
+    min-width: 64px; max-width: 64px; padding: 0 9px;
+    color: #315CF4; font-weight: 600;
+}
 #PrescriptionsPage QPushButton[rowAction="true"]:hover {
    background: #F3F5FF; border-color: #AAB7FF;
 }
@@ -142,11 +148,14 @@ PRESCRIPTIONS_PAGE_QSS = """
    min-width: 34px; max-width: 34px; min-height: 32px; max-height: 32px;
    padding: 0; background: #FFFFFF; color: #405074; border-color: #E2E7F4;
 }
+#PrescriptionsPage QWidget#BusinessPager QPushButton {
+    min-height: 32px; max-height: 32px;
+}
 #PrescriptionsPage QWidget#BusinessPager QPushButton[pagerPage="true"][active="true"] {
    background: #5265F6; color: #FFFFFF; border-color: #5265F6;
 }
-#PrescriptionsPage QWidget#BusinessPager QComboBox {
-    min-height: 32px; max-height: 32px; min-width: 92px; padding: 0 9px;
+#PrescriptionsPage QWidget#BusinessPager QLabel[pagerSize="true"] {
+    min-width: 64px; color: #7481A3; font-size: 12px;
 }
 """

@@ -154,8 +163,7 @@ PRESCRIPTIONS_PAGE_QSS = """
 def _painted_icon(kind: str, color: str = "#5265F6", size: int = 16) -> QIcon:
    """Return a crisp page-local icon without relying on emoji or icon fonts."""

-    pixmap = QPixmap(size, size)
-    pixmap.fill(Qt.GlobalColor.transparent)
+    pixmap = crisp_pixmap(size)
    painter = QPainter(pixmap)
    painter.setRenderHint(QPainter.RenderHint.Antialiasing, True)
    pen = QPen(QColor(color), max(1.25, size / 11.5))
@@ -262,13 +270,20 @@ def _row_action_button(
    *,
    danger: bool = False,
    enabled: bool = True,
+    label: str = "",
+    mutation: bool = False,
 ) -> QPushButton:
    button = QPushButton(parent)
    button.setProperty("rowAction", True)
    button.setProperty("danger", danger)
+    button.setProperty("labeled", bool(label))
+    button.setProperty("mutationAction", mutation)
+    button.setProperty("rowAllowed", enabled)
+    button.setText(label)
    button.setAccessibleName(tooltip)
    button.setToolTip(tooltip)
    button.setCursor(Qt.CursorShape.PointingHandCursor)
+    button.setFixedSize(64 if label else 28, 28)
    button.setIcon(_painted_icon(kind, "#F34E64" if danger else "#4965F5", 15))
    button.setIconSize(QSize(15, 15))
    button.setEnabled(enabled)
@@ -276,88 +291,6 @@ def _row_action_button(
    return button


-class BusinessPager(QWidget):
-    """Reference-style numbered pager while retaining the page's fixed size contract."""
-
-    page_changed = Signal(int)
-
-    def __init__(self, page_size: int = 15, parent: QWidget | None = None) -> None:
-        super().__init__(parent)
-        self.setObjectName("BusinessPager")
-        self.page = 1
-        self.page_size = page_size
-        self.total = 0
-        layout = QHBoxLayout(self)
-        layout.setContentsMargins(0, 6, 0, 0)
-        layout.setSpacing(7)
-        self.summary = QLabel("共 0 条", self)
-        self.summary.setProperty("role", "muted")
-        layout.addWidget(self.summary)
-        layout.addStretch(1)
-        self.previous = QPushButton("‹", self)
-        self.previous.setProperty("variant", "ghost")
-        self.previous.clicked.connect(lambda: self._request(self.page - 1))
-        layout.addWidget(self.previous)
-        self.pages_host = QWidget(self)
-        self.pages_layout = QHBoxLayout(self.pages_host)
-        self.pages_layout.setContentsMargins(0, 0, 0, 0)
-        self.pages_layout.setSpacing(5)
-        layout.addWidget(self.pages_host)
-        self.next = QPushButton("›", self)
-        self.next.setProperty("variant", "ghost")
-        self.next.clicked.connect(lambda: self._request(self.page + 1))
-        layout.addWidget(self.next)
-        self.size_combo = QComboBox(self)
-        self.size_combo.addItem(f"{page_size} 条/页", page_size)
-        layout.addWidget(self.size_combo)
-        self.page_label: QPushButton | None = None
-        self.update_state(1, 0)
-
-    @property
-    def page_count(self) -> int:
-        return max(1, (self.total + self.page_size - 1) // self.page_size)
-
-    def update_state(self, page: int, total: int) -> None:
-        self.page = max(1, page)
-        self.total = max(0, total)
-        self.summary.setText(f"共 {self.total} 条")
-        while self.pages_layout.count():
-            item = self.pages_layout.takeAt(0)
-            if item.widget() is not None:
-                item.widget().deleteLater()
-        count = self.page_count
-        if count <= 4:
-            pages: list[int | None] = list(range(1, count + 1))
-        elif self.page <= 3:
-            pages = [1, 2, 3, None, count]
-        elif self.page >= count - 2:
-            pages = [1, None, count - 2, count - 1, count]
-        else:
-            pages = [1, None, self.page, None, count]
-        self.page_label = None
-        for number in pages:
-            if number is None:
-                ellipsis = QLabel("…", self.pages_host)
-                ellipsis.setAlignment(Qt.AlignmentFlag.AlignCenter)
-                ellipsis.setFixedWidth(24)
-                self.pages_layout.addWidget(ellipsis)
-                continue
-            button = QPushButton(str(number), self.pages_host)
-            button.setProperty("pagerPage", True)
-            button.setProperty("active", number == self.page)
-            button.setCursor(Qt.CursorShape.PointingHandCursor)
-            button.clicked.connect(lambda _checked=False, value=number: self._request(value))
-            self.pages_layout.addWidget(button)
-            if number == self.page:
-                self.page_label = button
-        self.previous.setEnabled(self.page > 1)
-        self.next.setEnabled(self.page < count)
-
-    def _request(self, page: int) -> None:
-        if 1 <= page <= self.page_count and page != self.page:
-            self.page_changed.emit(page)
-
-
 def _int(value: Any, default: int = 0) -> int:
    try:
        return int(value)
@@ -506,6 +439,11 @@ def _doctor_cell(_value: Any, row: Any) -> str:
    return str(first_value(row, "doctor_name", "creator_name", default="—"))


+def _create_time_cell(value: Any, _row: Any) -> str:
+    raw = first_value(_row, "create_time_text", "create_time", default=value)
+    return format_record_time(raw)
+
+
 class DoctorMultiSelect(QWidget):
    """Compact checkable doctor selector fed by list rows/extend data."""

@@ -609,6 +547,7 @@ class PrescriptionsPage(QWidget):
            "已开处方",
            "管理处方审核、患者修正与履约订单；已通过且未作废的处方只允许查看。",
        )
+        header.layout().setSpacing(4)
        header.actions.setSpacing(16)
        self.orders_button = QPushButton("业务订单", header)
        self.orders_button.setMinimumWidth(86)
@@ -635,10 +574,11 @@ class PrescriptionsPage(QWidget):
    def _build_filters(self) -> QWidget:
        frame = QFrame()
        frame.setObjectName("PrescriptionFilterBar")
+        frame.setFixedHeight(88)
        grid = QGridLayout(frame)
-        grid.setContentsMargins(14, 17, 14, 17)
+        grid.setContentsMargins(16, 8, 16, 8)
        grid.setHorizontalSpacing(18)
-        grid.setVerticalSpacing(15)
+        grid.setVerticalSpacing(8)
        self.quick_date = QComboBox()
        self.quick_date.addItem("全部时间", "all")
        self.quick_date.addItem("今日", "today")
@@ -712,8 +652,9 @@ class PrescriptionsPage(QWidget):
        layout.setSpacing(0)
        toolbar_host = QFrame(card)
        toolbar_host.setObjectName("PrescriptionToolbar")
+        toolbar_host.setFixedHeight(46)
        toolbar = QHBoxLayout(toolbar_host)
-        toolbar.setContentsMargins(16, 11, 16, 11)
+        toolbar.setContentsMargins(16, 7, 16, 7)
        toolbar.setSpacing(8)
        title = QLabel("处方列表")
        title.setProperty("role", "sectionTitle")
@@ -758,6 +699,7 @@ class PrescriptionsPage(QWidget):
            [
                TableColumn("__selected__", "", 46, lambda _value, _row: ""),
                TableColumn("sn", "处方编号", 174, _sn_cell),
+                TableColumn("__actions__", "操作", 150, lambda _value, _row: ""),
                TableColumn("prescription_type", "处方类型", 96),
                TableColumn("is_system_auto", "来源", 88, _source_cell),
                TableColumn("patient_name", "患者信息", 190, _patient_cell),
@@ -765,14 +707,12 @@ class PrescriptionsPage(QWidget):
                TableColumn("void_status", "作废", 72, _void_cell),
                TableColumn("doctor_name", "医生信息", 180, _doctor_cell),
                TableColumn("assistant_name", "医助", 125),
-                TableColumn("create_time", "创建时间", 180),
-                TableColumn("__actions__", "操作", 150, lambda _value, _row: ""),
+                TableColumn("create_time", "创建时间", 180, _create_time_cell),
            ]
        )
        self.table.verticalHeader().setDefaultSectionSize(36)
        self.table.horizontalHeader().setFixedHeight(38)
        self.table.setWordWrap(False)
-        self.table.setHorizontalScrollMode(QAbstractItemView.ScrollMode.ScrollPerPixel)
        self.table.horizontalHeaderItem(0).setIcon(_painted_icon("checkbox", "#AEB9D4", 14))
        self.table.horizontalHeaderItem(0).setTextAlignment(Qt.AlignmentFlag.AlignCenter)
        self.table.itemSelectionChanged.connect(self._selection_changed)
@@ -917,7 +857,7 @@ class PrescriptionsPage(QWidget):
            return
        rows = page_items(result)
        self.table.set_rows(rows)
-        self._decorate_rows(rows)
+        self._decorate_rows()
        total = page_total(result, len(rows))
        self.pager.update_state(requested_page, total)
        self.count_badge.setText(f"共 {total} 条")
@@ -941,20 +881,27 @@ class PrescriptionsPage(QWidget):
            self.table.selectRow(0)
        self._selection_changed()

-    def _decorate_rows(self, rows: list[Any]) -> None:
+    def _decorate_rows(self) -> None:
        """Apply the reference table's tags, checkbox, avatar, and row actions."""

-        for row_index, row in enumerate(rows):
+        for row_index in range(self.table.rowCount()):
            selector = self.table.item(row_index, 0)
-            if selector is not None:
-                selector.setFlags(
-                    selector.flags()
-                    | Qt.ItemFlag.ItemIsUserCheckable
-                    | Qt.ItemFlag.ItemIsEnabled
-                    | Qt.ItemFlag.ItemIsSelectable
-                )
-                selector.setCheckState(Qt.CheckState.Unchecked)
-                selector.setTextAlignment(Qt.AlignmentFlag.AlignCenter)
+            if selector is None:
+                continue
+            # Read the row back from the visual table. SortableTable may have
+            # already reordered rows, so decorating the original result list
+            # can bind an action button to the wrong visible prescription.
+            row = selector.data(Qt.ItemDataRole.UserRole)
+            if row is None:
+                continue
+            selector.setFlags(
+                selector.flags()
+                | Qt.ItemFlag.ItemIsUserCheckable
+                | Qt.ItemFlag.ItemIsEnabled
+                | Qt.ItemFlag.ItemIsSelectable
+            )
+            selector.setCheckState(Qt.CheckState.Unchecked)
+            selector.setTextAlignment(Qt.AlignmentFlag.AlignCenter)

            sn_item = self.table.item(row_index, 1)
            if sn_item is not None:
@@ -971,7 +918,7 @@ class PrescriptionsPage(QWidget):
            )
            self.table.setCellWidget(
                row_index,
-                2,
+                3,
                _style_row_host(
                    _cell_host(_tag_label(prescription_type, "accent", self.table.viewport())),
                    row_index,
@@ -980,11 +927,11 @@ class PrescriptionsPage(QWidget):

            audit_text, audit_kind = prescription_status(row)
            audit = _tag_label(audit_text, audit_kind, self.table.viewport())
-            audit_item = self.table.item(row_index, 5)
+            audit_item = self.table.item(row_index, 6)
            if audit_item is not None and "\n" in audit_item.text():
                audit.setToolTip(audit_item.text())
            self.table.setCellWidget(
-                row_index, 5, _style_row_host(_cell_host(audit), row_index)
+                row_index, 6, _style_row_host(_cell_host(audit), row_index)
            )

            doctor_name = _doctor_cell(None, row)
@@ -1005,13 +952,13 @@ class PrescriptionsPage(QWidget):
            doctor_label.setStyleSheet("color:#31416A;background:transparent;border:0;")
            doctor_layout.addWidget(doctor_label)
            doctor_layout.addStretch(1)
-            self.table.setCellWidget(row_index, 7, doctor_host)
+            self.table.setCellWidget(row_index, 8, doctor_host)

            actions_host = QWidget(self.table.viewport())
            _style_row_host(actions_host, row_index)
            actions = QHBoxLayout(actions_host)
-            actions.setContentsMargins(7, 0, 7, 0)
-            actions.setSpacing(7)
+            actions.setContentsMargins(3, 0, 3, 0)
+            actions.setSpacing(3)
            actions.addStretch(1)
            if has_permission(self.permissions, "cf.prescription/read"):
                actions.addWidget(
@@ -1034,6 +981,8 @@ class PrescriptionsPage(QWidget):
                        ),
                        actions_host,
                        enabled=can_edit_or_delete(row),
+                        label="编辑",
+                        mutation=True,
                    )
                )
            if has_permission(self.permissions, "cf.prescription/del"):
@@ -1047,23 +996,31 @@ class PrescriptionsPage(QWidget):
                        actions_host,
                        danger=True,
                        enabled=can_edit_or_delete(row),
+                        mutation=True,
                    )
                )
            actions.addStretch(1)
-            self.table.setCellWidget(row_index, 10, actions_host)
+            self.table.setCellWidget(row_index, 2, actions_host)
+        self._sync_row_mutation_actions()

    def _run_row_action(self, row: Any, callback: Callable[[], None]) -> None:
-        target_id = first_value(row, "id", "prescription_id", default=None)
+        target_id = _int(first_value(row, "id", "prescription_id", default=None), 0)
+        if target_id <= 0:
+            self.banner.show_message("处方 ID 无效，请刷新列表后重试。", "warning")
+            return
        for row_index in range(self.table.rowCount()):
            item = self.table.item(row_index, 0)
            candidate = item.data(Qt.ItemDataRole.UserRole) if item is not None else None
-            candidate_id = first_value(candidate, "id", "prescription_id", default=None)
+            candidate_id = _int(
+                first_value(candidate, "id", "prescription_id", default=None), 0
+            )
            if candidate is row or (
-                target_id is not None and str(candidate_id) == str(target_id)
+                candidate_id > 0 and candidate_id == target_id
            ):
                self.table.selectRow(row_index)
-                break
-        callback()
+                callback()
+                return
+        self.banner.show_message("该处方已不在当前列表，请刷新后重试。", "warning")

    def _load_error(self, error: Exception, generation: int) -> None:
        if generation == self._generation:
@@ -1090,8 +1047,17 @@ class PrescriptionsPage(QWidget):
        self._mutation_pending = pending
        self.add_button.setEnabled(not pending)
        self.orders_button.setEnabled(not pending)
+        self._sync_row_mutation_actions()
        self._selection_changed()

+    def _sync_row_mutation_actions(self) -> None:
+        for button in self.table.findChildren(QPushButton):
+            if not bool(button.property("mutationAction")):
+                continue
+            button.setEnabled(
+                not self._mutation_pending and bool(button.property("rowAllowed"))
+            )
+
    def _selected(self) -> Any:
        return self.table.current_data()

@@ -1131,6 +1097,10 @@ class PrescriptionsPage(QWidget):
    ) -> None:
        if generation != self._detail_generation or prescription_id != self._detail_target:
            return
+        detail_id = _int(first_value(detail, "id", "prescription_id"), 0)
+        if detail_id != prescription_id:
+            self.banner.show_message("处方详情与当前选择不一致，请刷新后重试。", "danger")
+            return
        self.banner.clear()
        callback(detail)

@@ -1225,6 +1195,7 @@ class PrescriptionsPage(QWidget):
        row = self._selected()
        if (
            row is None
+            or self._mutation_pending
            or not has_permission(self.permissions, "cf.prescription/edit")
            or not can_edit_or_delete(row)
        ):
@@ -1236,6 +1207,9 @@ class PrescriptionsPage(QWidget):
        )

    def _open_editor(self, detail: Any) -> None:
+        if not can_edit_or_delete(detail):
+            self.banner.show_message("该处方状态已变化，当前不能编辑。", "warning")
+            return
        dialog = PrescriptionEditorDialog(
            self.repository,
            detail,
@@ -1285,6 +1259,7 @@ class PrescriptionsPage(QWidget):
        row = self._selected()
        if (
            row is None
+            or self._mutation_pending
            or not has_permission(self.permissions, "cf.prescription/del")
            or not can_edit_or_delete(row)
        ):
@@ -1299,6 +1274,9 @@ class PrescriptionsPage(QWidget):
        if answer != QMessageBox.StandardButton.Yes:
            return
        prescription_id = _int(first_value(row, "id", "prescription_id"), 0)
+        if prescription_id <= 0:
+            self.banner.show_message("处方 ID 无效，请刷新列表后重试。", "warning")
+            return
        self._set_mutation_pending(True)
        run_async(
            lambda: self.repository.delete_prescription(prescription_id),
@@ -1434,6 +1412,7 @@ class PrescriptionsPage(QWidget):


 __all__ = [
+    "BusinessPager",
    "PrescriptionsPage",
    "can_audit",
    "can_create_order",
@@ -2,17 +2,18 @@

 from __future__ import annotations

+import sqlite3
 from collections.abc import Mapping, Sequence
 from dataclasses import dataclass
+from functools import wraps
 from typing import Any

-from PySide6.QtCore import QPointF, QRectF, QSize, Qt, Signal
+from PySide6.QtCore import QPointF, QRectF, QSize, Qt, QTimer, Signal
 from PySide6.QtGui import (
    QColor,
    QFont,
    QIcon,
    QKeySequence,
-    QLinearGradient,
    QMouseEvent,
    QPainter,
    QPen,
@@ -21,6 +22,7 @@ from PySide6.QtGui import (
    QShortcut,
 )
 from PySide6.QtWidgets import (
+    QApplication,
    QButtonGroup,
    QFrame,
    QHBoxLayout,
@@ -37,6 +39,11 @@ from PySide6.QtWidgets import (
    QWidget,
 )

+from doctor_workstation.resources import app_icon_path
+
+from .dialogs.ai_consult import can_open_ai_consult
+from .dialogs.ai_consult_picker import select_and_present_ai_consult
+from .dialogs.local_audio_queue import LocalAudioQueueDialog
 from .pages import (
    AppointmentsPage,
    ConsultationsPage,
@@ -45,6 +52,7 @@ from .pages import (
    PrescriptionsPage,
    ReceptionPage,
 )
+from .theme import crisp_pixmap
 from .widgets import (
    EmptyState,
    StatusBadge,
@@ -60,6 +68,25 @@ _SHELL_TOPBAR_HEIGHT = 62
 _SHELL_TABS_HEIGHT = 0
 _SHELL_OUTER_GUTTER = 13
 _SHELL_PANEL_GAP = 0
+_SHELL_DESIGN_SIZE = QSize(1710, 920)
+_SHELL_MINIMUM_SIZE = QSize(1024, 640)
+
+
+def _bounded_initial_window_size(available_size: QSize | None) -> QSize:
+    """Fit the design viewport inside the screen's logical available geometry."""
+
+    if available_size is None or not available_size.isValid():
+        return QSize(_SHELL_DESIGN_SIZE.width(), _SHELL_DESIGN_SIZE.height())
+    return QSize(
+        max(
+            _SHELL_MINIMUM_SIZE.width(),
+            min(_SHELL_DESIGN_SIZE.width(), available_size.width()),
+        ),
+        max(
+            _SHELL_MINIMUM_SIZE.height(),
+            min(_SHELL_DESIGN_SIZE.height(), available_size.height()),
+        ),
+    )

 # The references place the workspace at page-specific global x anchors while
 # keeping a 13 px outer gutter.  These are the actual rail widths inside that
@@ -85,8 +112,10 @@ class NavigationItem:

 NAVIGATION = (
    NavigationItem(
+        # 挂号与诊单是两条独立队列，早期两项都叫“问诊列表”，侧边栏出现两个同名
+        # 入口，医生无法判断该点哪个。按各自的业务对象命名以消除歧义。
        "appointments",
-        "问诊列表",
+        "挂号列表",
        "号",
        AppointmentsPage,
        ("doctor.appointment/lists",),
@@ -326,8 +355,7 @@ def _resolve_navigation(
 def _painted_shell_icon(kind: str, size: int = 18) -> QIcon:
    """Create a font-independent shell icon once, before widget painting."""

-    pixmap = QPixmap(size, size)
-    pixmap.fill(Qt.GlobalColor.transparent)
+    pixmap = crisp_pixmap(size)
    painter = QPainter(pixmap)
    painter.setRenderHint(QPainter.RenderHint.Antialiasing)
    try:
@@ -495,8 +523,7 @@ def _painted_navigation_icon(kind: str, size: int = 18) -> QIcon:
    """Return a compact line icon with a dedicated checked-state color."""

    def render(color: str) -> QPixmap:
-        pixmap = QPixmap(size, size)
-        pixmap.fill(Qt.GlobalColor.transparent)
+        pixmap = crisp_pixmap(size)
        painter = QPainter(pixmap)
        painter.setRenderHint(QPainter.RenderHint.Antialiasing)
        pen = QPen(QColor(color), 1.55)
@@ -549,25 +576,19 @@ def _painted_navigation_icon(kind: str, size: int = 18) -> QIcon:


 class _ShellBrandMark(QWidget):
-    """Paint the supplied indigo M mark without a font-glyph asset."""
+    """Render the approved application brand mark in the navigation rail."""
+
+    def __init__(self, parent: QWidget | None = None) -> None:
+        super().__init__(parent)
+        self._brand_pixmap = QPixmap(str(app_icon_path()))

    def paintEvent(self, event: Any) -> None:  # noqa: N802 - Qt virtual
        del event
        painter = QPainter(self)
-        painter.setRenderHint(QPainter.RenderHint.Antialiasing)
+        painter.setRenderHint(QPainter.RenderHint.SmoothPixmapTransform)
        rect = QRectF(self.rect()).adjusted(0.75, 0.75, -0.75, -0.75)
-        gradient = QLinearGradient(rect.topLeft(), rect.bottomRight())
-        gradient.setColorAt(0.0, QColor("#6F7BFA"))
-        gradient.setColorAt(1.0, QColor("#5260ED"))
-        painter.setPen(QPen(QColor(117, 130, 255, 150), 1.0))
-        painter.setBrush(gradient)
-        painter.drawRoundedRect(rect, 10, 10)
-        painter.setPen(QColor("#FFFFFF"))
-        font = QFont(painter.font())
-        font.setPixelSize(18)
-        font.setWeight(QFont.Weight.Bold)
-        painter.setFont(font)
-        painter.drawText(rect, Qt.AlignmentFlag.AlignCenter, "M")
+        if not self._brand_pixmap.isNull():
+            painter.drawPixmap(rect, self._brand_pixmap, QRectF(self._brand_pixmap.rect()))


 class _AssistantRobot(QWidget):
@@ -659,24 +680,29 @@ class _PaintedIconButton(QToolButton):
        self.setFixedSize(size, size)
        self.setIcon(_painted_shell_icon(kind, icon_size))
        self.setIconSize(QSize(icon_size, icon_size))
+        content_size = max(0, size - 2)
        self.setStyleSheet(
-            """
-            QToolButton#ShellPaintedIconButton {
+            f"""
+            QToolButton#ShellPaintedIconButton {{
+                min-width: {content_size}px;
+                max-width: {content_size}px;
+                min-height: {content_size}px;
+                max-height: {content_size}px;
                background: transparent;
                border: 1px solid transparent;
                border-radius: 9px;
-            }
-            QToolButton#ShellPaintedIconButton:hover {
+            }}
+            QToolButton#ShellPaintedIconButton:hover {{
                background: #F0F3FC;
                border-color: #E2E7F4;
-            }
-            QToolButton#ShellPaintedIconButton:pressed { background: #EEF1FF; }
-            QToolButton#ShellPaintedIconButton:focus { border-color: #8D9BFF; }
-            QToolButton#ShellPaintedIconButton[windowControl="close"]:hover {
+            }}
+            QToolButton#ShellPaintedIconButton:pressed {{ background: #EEF1FF; }}
+            QToolButton#ShellPaintedIconButton:focus {{ border-color: #8D9BFF; }}
+            QToolButton#ShellPaintedIconButton[windowControl="close"]:hover {{
                background: #FFF0F2;
                border-color: #F4C4CC;
-            }
-            QToolButton#ShellPaintedIconButton::menu-indicator { image: none; width: 0; }
+            }}
+            QToolButton#ShellPaintedIconButton::menu-indicator {{ image: none; width: 0; }}
            """
        )

@@ -696,8 +722,7 @@ class _UserMenuButton(QToolButton):
        self.setFixedWidth(max(104, min(174, name_width + 72)))
        self.setAccessibleName(f"用户菜单：{self.display_name}")
        self.setText(self.display_name)
-        avatar = QPixmap(34, 34)
-        avatar.fill(Qt.GlobalColor.transparent)
+        avatar = crisp_pixmap(34)
        painter = QPainter(avatar)
        painter.setRenderHint(QPainter.RenderHint.Antialiasing)
        painter.setPen(Qt.PenStyle.NoPen)
@@ -814,6 +839,7 @@ class ShellWindow(QMainWindow):
    logout_requested = Signal()
    video_requested = Signal(dict)
    page_changed = Signal(str)
+    update_check_requested = Signal()

    def __init__(
        self,
@@ -844,6 +870,7 @@ class ShellWindow(QMainWindow):
                if session_permissions is not None
                else get_value(self.current_user, "permissions", None)
            )
+        self._can_ai_assistant = can_open_ai_consult(self.permissions)
        session_menu = get_value(self.session, "menu", None)
        self.menu = (
            session_menu if session_menu is not None else get_value(session, "menu", [])
@@ -863,9 +890,16 @@ class ShellWindow(QMainWindow):
        self.page_titles: dict[int, str] = {}
        self._fixed_tab_key: str | None = None
        self._sidebar_collapsed = False
+        self._active_page_key: str | None = None
+        self._activation_page: QWidget | None = None
+        self._activation_generation = 0
+        self._activation_refreshed = False
+        self._local_audio_settings_dialog: LocalAudioQueueDialog | None = None

-        self.setMinimumSize(1024, 640)
-        self.resize(1710, 920)
+        self.setMinimumSize(_SHELL_MINIMUM_SIZE)
+        screen = self.screen() or QApplication.primaryScreen()
+        available_size = screen.availableGeometry().size() if screen is not None else None
+        self.resize(_bounded_initial_window_size(available_size))

        canvas = _ShellCanvas(self)
        canvas.setObjectName("AppCanvas")
@@ -997,7 +1031,20 @@ class ShellWindow(QMainWindow):
                font-weight: 700;
            }
            QPushButton#ShellAssistantButton:hover { background-color: #4658E8; }
-            QLabel#ShellModelLabel { color: #8A95AF; font-size: 10px; }
+            QPushButton#ShellSettingsButton {
+                min-height: 42px;
+                color: #6E7C9F;
+                font-size: 11px;
+                font-weight: 600;
+                background-color: transparent;
+                border: 1px solid transparent;
+                border-radius: 10px;
+            }
+            QPushButton#ShellSettingsButton:hover {
+                color: #5265F6;
+                background-color: #EEF1FF;
+            }
+            QPushButton#ShellSettingsButton:focus { border-color: #8D9BFF; }
            """
        )
        layout = QVBoxLayout(sidebar)
@@ -1068,12 +1115,19 @@ class ShellWindow(QMainWindow):
        outer_assistant.setContentsMargins(13, 0, 13, 0)
        outer_assistant.addWidget(self.assistant_card)
        layout.addLayout(outer_assistant)
+        self.assistant_card.setVisible(self._can_ai_assistant)

-        self.model_label = QLabel("模型：GPT-4o 医疗版  ›", sidebar)
-        self.model_label.setObjectName("ShellModelLabel")
-        self.model_label.setAlignment(Qt.AlignmentFlag.AlignCenter)
-        self.model_label.setFixedHeight(76)
-        layout.addWidget(self.model_label)
+        self.upload_settings_button = QPushButton("设置  ›", sidebar)
+        self.upload_settings_button.setObjectName("ShellSettingsButton")
+        self.upload_settings_button.setAccessibleName("本机录音上传设置")
+        self.upload_settings_button.setToolTip("查看本机录音上传记录")
+        self.upload_settings_button.setCursor(Qt.CursorShape.PointingHandCursor)
+        self.upload_settings_button.setFixedHeight(76)
+        self.upload_settings_button.clicked.connect(self._open_local_audio_settings)
+        # Keep the former attribute as a compatibility alias for integrations
+        # that inspect the bottom sidebar control.
+        self.model_label = self.upload_settings_button
+        layout.addWidget(self.upload_settings_button)
        return sidebar

    def _build_topbar(self) -> QWidget:
@@ -1090,10 +1144,6 @@ class ShellWindow(QMainWindow):
                border-top-right-radius: 16px;
            }
            QFrame#ShellGlobalSearch {
-                min-width: 265px;
-                max-width: 265px;
-                min-height: 36px;
-                max-height: 36px;
                background-color: #F8FAFF;
                border: 1px solid #E2E7F4;
                border-radius: 10px;
@@ -1107,6 +1157,23 @@ class ShellWindow(QMainWindow):
                border: 0;
                border-radius: 9px;
            }
+            QLineEdit#ShellGlobalSearchInput QToolButton {
+                min-width: 22px;
+                max-width: 22px;
+                min-height: 18px;
+                max-height: 18px;
+                margin: 0;
+                padding: 0;
+                background-color: transparent;
+                border: 0;
+                border-radius: 0;
+            }
+            QLineEdit#ShellGlobalSearchInput QToolButton:hover,
+            QLineEdit#ShellGlobalSearchInput QToolButton:pressed,
+            QLineEdit#ShellGlobalSearchInput QToolButton:focus {
+                background-color: transparent;
+                border: 0;
+            }
            QLabel#ShellShortcutHint {
                color: #8A95AF;
                background-color: #F0F3FC;
@@ -1202,7 +1269,9 @@ class ShellWindow(QMainWindow):
        search_layout.addWidget(self.global_search, 1)
        shortcut_hint = QLabel("Ctrl K", search_host)
        shortcut_hint.setObjectName("ShellShortcutHint")
-        search_layout.addWidget(shortcut_hint)
+        shortcut_hint.setAlignment(Qt.AlignmentFlag.AlignCenter)
+        shortcut_hint.setSizePolicy(QSizePolicy.Policy.Fixed, QSizePolicy.Policy.Fixed)
+        search_layout.addWidget(shortcut_hint, 0, Qt.AlignmentFlag.AlignVCenter)
        layout.addWidget(search_host)

        self.context_label = QLabel("工作台", topbar)
@@ -1219,6 +1288,7 @@ class ShellWindow(QMainWindow):
        self.ai_top_button.setAccessibleName("AI 助手")
        self.ai_top_button.clicked.connect(self._open_ai_assistant)
        layout.addWidget(self.ai_top_button)
+        self.ai_top_button.setVisible(self._can_ai_assistant)

        self.notification_button = _PaintedIconButton(
            "notification", size=38, parent=topbar
@@ -1255,6 +1325,9 @@ class ShellWindow(QMainWindow):
        account_action = user_menu.addAction(self._role_text())
        account_action.setEnabled(False)
        user_menu.addSeparator()
+        update_action = user_menu.addAction("检查更新")
+        update_action.triggered.connect(self.update_check_requested.emit)
+        user_menu.addSeparator()
        logout_action = user_menu.addAction("退出登录")
        logout_action.triggered.connect(lambda: self.logout_requested.emit())
        self.user_menu_button.setMenu(user_menu)
@@ -1387,8 +1460,10 @@ class ShellWindow(QMainWindow):
            else self._expanded_sidebar_width()
        )
        self.brand_copy.setVisible(not self._sidebar_collapsed)
-        self.assistant_card.setVisible(not self._sidebar_collapsed)
-        self.model_label.setVisible(not self._sidebar_collapsed)
+        self.assistant_card.setVisible(
+            self._can_ai_assistant and not self._sidebar_collapsed
+        )
+        self.upload_settings_button.setVisible(not self._sidebar_collapsed)
        margins = (7, 14, 7, 0) if self._sidebar_collapsed else (12, 19, 12, 0)
        self.nav_layout.setContentsMargins(*margins)
        self.fold_button.kind = "expand" if self._sidebar_collapsed else "fold"
@@ -1473,14 +1548,41 @@ class ShellWindow(QMainWindow):
        show_toast(self, f"正在当前页面搜索“{query}”。", "info")

    def _open_ai_assistant(self) -> None:
-        self.navigate("reception")
-        show_toast(
+        if not self._can_ai_assistant:
+            show_toast(self, "当前账号没有使用 AI 问诊助手的权限。", "danger")
+            return
+
+        # The shell assistant is the global entry point. Always let the doctor
+        # choose from the complete permission-scoped patient list, even when a
+        # page happens to retain a selected row. Page-level AI actions keep the
+        # faster "open the selected patient" behaviour.
+        select_and_present_ai_consult(
+            self.repository,
+            self.permissions,
            self,
-            "已进入接诊台；选择患者后可查看 AI 报告与辅助分析。",
-            "info",
-            3600,
+            initial_query=self.global_search.text().strip(),
        )

+    def _open_local_audio_settings(self) -> None:
+        current = self._local_audio_settings_dialog
+        if current is not None and current.isVisible():
+            current.raise_()
+            current.activateWindow()
+            return
+        try:
+            dialog = LocalAudioQueueDialog(self.repository, None, self)
+        except (OSError, RuntimeError, ValueError, sqlite3.Error) as error:
+            show_toast(self, f"无法打开本机录音上传设置：{error}", "error")
+            return
+        self._local_audio_settings_dialog = dialog
+
+        def clear_dialog(_result: int) -> None:
+            if self._local_audio_settings_dialog is dialog:
+                self._local_audio_settings_dialog = None
+
+        dialog.finished.connect(clear_dialog)
+        dialog.open()
+
    def _tab_index_for_key(self, key: str) -> int:
        for index in range(self.tab_bar.count()):
            if self.tab_bar.tabData(index) == key:
@@ -1614,6 +1716,7 @@ class ShellWindow(QMainWindow):
                current_user=self.current_user,
                parent=self.stack,
            )
+            self._install_activation_refresh_gate(page)
            if hasattr(page, "video_requested"):
                page.video_requested.connect(
                    lambda payload: self.video_requested.emit(payload)
@@ -1662,9 +1765,49 @@ class ShellWindow(QMainWindow):
            ),
        )

+    def _install_activation_refresh_gate(self, page: QWidget) -> None:
+        """Coalesce lifecycle and shell refreshes during one page activation."""
+
+        refresh = getattr(page, "refresh", None)
+        if not callable(refresh):
+            return
+
+        @wraps(refresh)
+        def activation_refresh(*args: Any, **kwargs: Any) -> Any:
+            if page is self._activation_page:
+                if self._activation_refreshed:
+                    return None
+                self._activation_refreshed = True
+            return refresh(*args, **kwargs)
+
+        page.refresh = activation_refresh  # type: ignore[attr-defined,method-assign]
+
+    def _ensure_activation_refresh(self, page: QWidget, generation: int) -> None:
+        if generation != self._activation_generation or page is not self._activation_page:
+            return
+        if not self._activation_refreshed:
+            refresh = getattr(page, "refresh", None)
+            if callable(refresh):
+                refresh()
+
+    def _finish_activation(self, page: QWidget, generation: int) -> None:
+        if generation != self._activation_generation or page is not self._activation_page:
+            return
+        self._ensure_activation_refresh(page, generation)
+        self._activation_page = None
+
    def _navigate(self, index: int, key: str) -> None:
        if index < 0 or index >= self.stack.count():
            return
+        page = self.stack.widget(index)
+        if page is None:
+            return
+        if self._active_page_key == key and self.stack.currentWidget() is page:
+            return
+        self._activation_generation += 1
+        activation_generation = self._activation_generation
+        self._activation_page = page
+        self._activation_refreshed = False
        self.stack.setCurrentIndex(index)
        if not self._sidebar_collapsed:
            self.sidebar.setFixedWidth(self._expanded_sidebar_width(key))
@@ -1675,10 +1818,15 @@ class ShellWindow(QMainWindow):
        button = self.nav_buttons.get(key)
        if button is not None:
            button.setChecked(True)
-        page = self.stack.widget(index)
-        refresh = getattr(page, "refresh", None)
-        if callable(refresh):
-            refresh()
+        self._active_page_key = key
+        self._ensure_activation_refresh(page, activation_generation)
+        if self.isVisible():
+            QTimer.singleShot(
+                0,
+                lambda page=page, generation=activation_generation: self._finish_activation(
+                    page, generation
+                ),
+            )
        self.page_changed.emit(key)

    def navigate(self, key: str) -> bool:
@@ -1697,6 +1845,17 @@ class ShellWindow(QMainWindow):
        if callable(refresh):
            refresh()

+    def showEvent(self, event: Any) -> None:  # noqa: N802 - Qt virtual
+        super().showEvent(event)
+        page = self.stack.currentWidget()
+        if page is None or page is not self._activation_page:
+            return
+        generation = self._activation_generation
+        QTimer.singleShot(
+            0,
+            lambda page=page, generation=generation: self._finish_activation(page, generation),
+        )
+
    def setVisible(self, visible: bool) -> None:  # noqa: N802 - Qt API
        if visible:
            self.setAttribute(Qt.WidgetAttribute.WA_DontShowOnScreen, False)
@@ -2,6 +2,11 @@

 The palette and density follow the supplied product references: a quiet blue
 canvas, crisp white data surfaces, luminous indigo actions and compact tables.
+
+Every size in the interface comes from the token tables below.  Before they
+existed the UI had grown 19 distinct font sizes and 8 control heights, which is
+what made neighbouring controls look subtly mismatched; keep new work on the
+scale instead of introducing another one-off pixel value.
 """

 from __future__ import annotations
@@ -12,7 +17,7 @@ from pathlib import Path
 from string import Template

 from PySide6.QtCore import QEvent, QObject, Qt
-from PySide6.QtGui import QColor, QFont, QFontDatabase, QPalette
+from PySide6.QtGui import QColor, QFont, QFontDatabase, QPalette, QPixmap
 from PySide6.QtWidgets import (
    QApplication,
    QDialog,
@@ -66,13 +71,70 @@ COLORS = {
 }


+# --- Type scale -----------------------------------------------------------
+# Six steps, tuned for 简体中文 at Windows 100%–150% scaling.  CJK glyphs carry
+# more ink than Latin at the same pixel size, so the steps are spaced widely
+# enough that two adjacent levels are always distinguishable.
+TYPE = {
+    "fs_caption": "12px",   # table headers, hints, badges, timestamps
+    "fs_body": "13px",      # default UI text
+    "fs_strong": "14px",    # emphasised body, dialog prompts
+    "fs_section": "16px",   # card and section titles
+    "fs_title": "20px",     # page titles, dialog titles
+    "fs_display": "26px",   # metric values, empty-state glyphs
+}
+
+# --- Control metrics ------------------------------------------------------
+# Three interactive heights.  ``h_default`` drops from the previous 36px: the
+# old value made every toolbar, filter row and inline action read as heavy,
+# which is the main reason the workspace felt clunky.
+METRICS = {
+    "h_compact": "28px",    # inline row actions, chips, links
+    "h_default": "32px",    # buttons, inputs, combos, tabs
+    "h_cta": "38px",        # primary dialog actions, sidebar navigation
+    "h_bar": "52px",        # dialog header / footer bars
+    "r_sm": "6px",
+    "r_md": "8px",
+    "r_lg": "12px",
+    "r_xl": "16px",
+    "pad_control": "12px",  # horizontal padding inside default controls
+    "pad_compact": "9px",
+}
+
+_QSS_TOKENS = {**COLORS, **TYPE, **METRICS}
+
+
+def crisp_pixmap(width: int, height: int | None = None) -> QPixmap:
+    """Return a transparent pixmap that stays sharp on scaled displays.
+
+    Every shell/page icon is painted by hand rather than shipped as an asset.
+    Allocating those pixmaps at their logical size makes Qt upscale them on the
+    125%/150% Windows scale factors most clinic workstations run at, which is
+    what made the icon set look soft next to crisply hinted text.  Backing the
+    pixmap with the screen's device pixel ratio keeps the painter in logical
+    coordinates while giving it real device pixels to draw into.
+    """
+
+    height = width if height is None else height
+    ratio = 1.0
+    app = QApplication.instance()
+    if app is not None:
+        screen = app.primaryScreen()
+        if screen is not None:
+            ratio = max(1.0, float(screen.devicePixelRatio()))
+    pixmap = QPixmap(round(width * ratio), round(height * ratio))
+    pixmap.setDevicePixelRatio(ratio)
+    pixmap.fill(Qt.GlobalColor.transparent)
+    return pixmap
+
+
 GLOBAL_QSS = Template(
    r"""
 QWidget {
    color: $text;
    background-color: transparent;
    font-family: "Microsoft YaHei UI", "PingFang SC", "Noto Sans CJK SC", sans-serif;
-    font-size: 13px;
+    font-size: $fs_body;
 }

 QMainWindow, QDialog, QWidget#LoginCanvas {
@@ -89,24 +151,24 @@ QDialog[businessDialog="true"] QFrame[dialogSurface="true"] {
 }
 QDialog[businessDialog="true"] QFrame#DialogHeader,
 QDialog[businessDialog="true"] QFrame[dialogRole="header"] {
-    min-height: 58px;
+    min-height: $h_bar;
    background-color: $surface;
    border: 0;
    border-bottom: 1px solid $line;
 }
 QDialog[businessDialog="true"] QLabel[dialogRole="title"] {
    color: $text;
-    font-size: 18px;
+    font-size: $fs_section;
    font-weight: 700;
 }
 QDialog[businessDialog="true"] QLabel[dialogRole="subtitle"] {
    color: $muted;
-    font-size: 12px;
+    font-size: $fs_caption;
 }
 QDialog[businessDialog="true"] QDialogButtonBox,
 QMessageBox QDialogButtonBox,
 QInputDialog QDialogButtonBox {
-    min-height: 58px;
+    min-height: $h_bar;
    background-color: $surface;
    border: 0;
    border-top: 1px solid $line;
@@ -115,7 +177,7 @@ QDialog[businessDialog="true"] QDialogButtonBox QPushButton,
 QMessageBox QDialogButtonBox QPushButton,
 QInputDialog QDialogButtonBox QPushButton {
    min-width: 88px;
-    min-height: 38px;
+    min-height: $h_cta;
 }
 QMessageBox[businessDialog="true"],
 QInputDialog[businessDialog="true"] {
@@ -125,7 +187,7 @@ QMessageBox QLabel#qt_msgbox_label {
    min-width: 300px;
    padding: 8px 2px;
    color: $text_soft;
-    font-size: 14px;
+    font-size: $fs_strong;
 }
 QMessageBox QLabel#qt_msgboxex_icon_label {
    min-width: 44px;
@@ -138,7 +200,7 @@ QMessageBox[messageKind="critical"] QLabel#qt_msgbox_label {
 }
 QInputDialog QLabel {
    color: $text_soft;
-    font-size: 14px;
+    font-size: $fs_strong;
 }
 QWidget#AppCanvas {
    background-color: qlineargradient(
@@ -155,33 +217,33 @@ QWidget#ShellWorkspace, QStackedWidget#ShellPageStack {

 QLabel[role="muted"] { color: $muted; }
 QLabel[role="danger"] { color: $danger; }
-QLabel[role="breadcrumb"] { color: $muted; font-size: 12px; }
-QLabel[role="breadcrumbSeparator"] { color: #ADB5C9; font-size: 14px; }
-QLabel[role="breadcrumbCurrent"] { color: $text_soft; font-size: 12px; font-weight: 600; }
+QLabel[role="breadcrumb"] { color: $muted; font-size: $fs_caption; }
+QLabel[role="breadcrumbSeparator"] { color: #ADB5C9; font-size: $fs_strong; }
+QLabel[role="breadcrumbCurrent"] { color: $text_soft; font-size: $fs_caption; font-weight: 600; }
 QLabel[role="eyebrow"] {
    color: $indigo_hover;
-    font-size: 11px;
+    font-size: $fs_caption;
    font-weight: 700;
    letter-spacing: 0.04em;
 }
 QLabel[role="pageTitle"] {
    color: $text;
-    font-size: 22px;
+    font-size: $fs_title;
    font-weight: 700;
 }
 QLabel[role="sectionTitle"] {
    color: $text;
-    font-size: 16px;
+    font-size: $fs_section;
    font-weight: 700;
 }
 QLabel[role="display"] {
    color: $text;
-    font-size: 30px;
+    font-size: $fs_display;
    font-weight: 700;
 }
 QLabel[role="metric"] {
    color: $text;
-    font-size: 22px;
+    font-size: $fs_title;
    font-weight: 700;
 }

@@ -203,9 +265,9 @@ QFrame#MetricCard {
    border-radius: 11px;
 }
 QFrame#MetricCard:hover { border-color: $line_soft; background-color: $surface_alt; }
-QFrame#MetricCard QLabel[role="metricTitle"] { color: $muted; font-size: 12px; }
-QFrame#MetricCard QLabel[role="metricValue"] { color: $text; font-size: 21px; font-weight: 700; }
-QFrame#MetricCard QLabel[role="metricHint"] { color: $muted; font-size: 11px; }
+QFrame#MetricCard QLabel[role="metricTitle"] { color: $muted; font-size: $fs_caption; }
+QFrame#MetricCard QLabel[role="metricValue"] { color: $text; font-size: $fs_title; font-weight: 700; }
+QFrame#MetricCard QLabel[role="metricHint"] { color: $muted; font-size: $fs_caption; }
 QFrame#ReceptionDetailPanel { background-color: transparent; border: 0; }
 QFrame#ReceptionAiCard {
    min-height: 132px;
@@ -215,20 +277,20 @@ QFrame#ReceptionAiCard {
 }
 QLabel#ReceptionAiTitle {
    color: $indigo_pressed;
-    font-size: 14px;
+    font-size: $fs_strong;
    font-weight: 700;
 }
 QFrame#ReceptionAiCard QPushButton[variant="secondary"] {
-    min-height: 30px;
+    min-height: $h_compact;
    padding: 0 9px;
-    font-size: 11px;
+    font-size: $fs_caption;
 }
 QLabel#MetricGlyph {
    color: $indigo;
    background-color: $indigo_pale;
    border: 1px solid $line_soft;
    border-radius: 11px;
-    font-size: 16px;
+    font-size: $fs_section;
    font-weight: 700;
 }
 QLabel#MetricGlyph[kind="success"] { color: $success; background-color: $success_pale; }
@@ -255,10 +317,10 @@ QGroupBox::title {
 }

 QPushButton {
-    min-height: 36px;
-    padding: 0 16px;
+    min-height: $h_default;
+    padding: 0 $pad_control;
    border: 1px solid $line;
-    border-radius: 9px;
+    border-radius: $r_md;
    background-color: $surface;
    color: $text;
    font-weight: 600;
@@ -328,6 +390,50 @@ QPushButton[variant="secondary"]:checked {
    border-color: $indigo_pressed;
 }

+/* Inline table row actions: quiet links that only gain a surface on hover, so
+   a column of them reads as text rather than as a wall of buttons. */
+QWidget#RowActions QPushButton[rowAction="true"] {
+    min-height: $h_compact;
+    padding: 0 $pad_compact;
+    color: $info;
+    background-color: transparent;
+    border: 1px solid transparent;
+    border-radius: $r_sm;
+    font-weight: 600;
+}
+QWidget#RowActions QPushButton[rowAction="true"]:hover {
+    color: $indigo_pressed;
+    background-color: $indigo_pale;
+    border-color: $line_soft;
+}
+QWidget#RowActions QPushButton[rowAction="true"]:pressed {
+    color: #FFFFFF;
+    background-color: $indigo_pressed;
+    border-color: $indigo_pressed;
+}
+QWidget#RowActions QPushButton[rowAction="true"][variant="dangerGhost"] { color: $danger; }
+QWidget#RowActions QPushButton[rowAction="true"][variant="dangerGhost"]:hover {
+    color: $danger;
+    background-color: $danger_pale;
+    border-color: rgba(240, 120, 134, 96);
+}
+QToolButton#RowActionsMore {
+    min-width: 0;
+    min-height: $h_compact;
+    padding: 0 $pad_compact;
+    color: $muted;
+    background-color: transparent;
+    border: 1px solid transparent;
+    border-radius: $r_sm;
+    font-weight: 600;
+}
+QToolButton#RowActionsMore:hover {
+    color: $text;
+    background-color: $surface_alt;
+    border-color: $line;
+}
+QToolButton#RowActionsMore::menu-indicator { width: 0; height: 0; image: none; }
+
 QFrame#NoteAttachmentTile {
    background-color: $surface;
    border: 1px solid $line;
@@ -352,7 +458,7 @@ QPushButton#NoteAttachmentPreview[loadState="failed"] {
 }
 QLabel#NoteAttachmentName {
    color: $text_soft;
-    font-size: 12px;
+    font-size: $fs_caption;
 }

 QPushButton[variant="danger"] {
@@ -413,8 +519,8 @@ QPushButton[variant="ghost"]:checked {
    border-color: $indigo_pressed;
 }
 QPushButton[variant="link"] {
-    min-height: 28px;
-    padding: 0 6px;
+    min-height: $h_compact;
+    padding: 0 $pad_compact;
    color: $info;
    background-color: transparent;
    border-color: transparent;
@@ -422,8 +528,8 @@ QPushButton[variant="link"] {
 QPushButton[variant="link"]:hover { color: $focus; background-color: $indigo_pale; }
 QPushButton[variant="link"]:pressed { color: $indigo_hover; background-color: $surface_alt; }
 QPushButton[variant="chip"] {
-    min-height: 30px;
-    padding: 0 12px;
+    min-height: $h_compact;
+    padding: 0 $pad_compact;
    color: $text_soft;
    background-color: $surface_alt;
    border-color: $line;
@@ -440,10 +546,10 @@ QPushButton[variant="chip"]:checked {
    border-color: $indigo_hover;
 }
 QPushButton[variant="nav"] {
-    min-height: 44px;
-    padding: 0 15px;
+    min-height: $h_cta;
+    padding: 0 12px;
    border: 0;
-    border-radius: 10px;
+    border-radius: $r_md;
    background-color: transparent;
    color: $muted;
    text-align: left;
@@ -454,10 +560,10 @@ QPushButton[variant="nav"]:pressed { background-color: $indigo_pale; }
 QPushButton[variant="nav"]:checked { background-color: $indigo_pressed; color: #FFFFFF; }

 QToolButton {
-    min-width: 32px;
-    min-height: 32px;
+    min-width: $h_default;
+    min-height: $h_default;
    border: 1px solid transparent;
-    border-radius: 8px;
+    border-radius: $r_md;
    color: $text_soft;
    background-color: transparent;
 }
@@ -483,16 +589,16 @@ QToolButton[diagnosisChip="true"][semantic="warning"] { color: $warning; backgro

 QLineEdit, QTextEdit, QPlainTextEdit, QComboBox, QDateEdit, QDateTimeEdit,
 QTimeEdit, QSpinBox, QDoubleSpinBox, QKeySequenceEdit {
-    min-height: 36px;
-    padding: 0 12px;
+    min-height: $h_default;
+    padding: 0 $pad_control;
    border: 1px solid $line;
-    border-radius: 9px;
+    border-radius: $r_md;
    background-color: $surface;
    color: $text;
    selection-background-color: $indigo;
    selection-color: #FFFFFF;
 }
-QTextEdit, QPlainTextEdit { padding: 9px 12px; }
+QTextEdit, QPlainTextEdit { padding: 7px $pad_control; }
 QLineEdit:hover, QTextEdit:hover, QPlainTextEdit:hover, QComboBox:hover,
 QDateEdit:hover, QDateTimeEdit:hover, QTimeEdit:hover, QSpinBox:hover,
 QDoubleSpinBox:hover, QKeySequenceEdit:hover { border-color: $indigo_hover; }
@@ -569,7 +675,7 @@ QAbstractItemView, QTableWidget, QTableView, QListWidget, QListView, QTreeWidget
 }
 QAbstractItemView:focus { border: 1px solid $indigo_hover; }
 QTableWidget::item, QTableView::item {
-    padding: 8px 8px;
+    padding: 6px 8px;
    border-bottom: 1px solid $line;
 }
 QTableWidget::item:hover, QTableView::item:hover { background-color: $surface_alt; }
@@ -583,16 +689,16 @@ QHeaderView::section {
    border: 0;
    border-right: 1px solid $line;
    border-bottom: 1px solid $line;
-    padding: 9px 8px;
-    font-size: 12px;
+    padding: 7px 8px;
+    font-size: $fs_caption;
    font-weight: 700;
 }
 QHeaderView::section:hover { color: $text; background-color: $raised; }
 QTableCornerButton::section { background-color: $surface_alt; border: 0; }
 QListWidget::item, QListView::item, QTreeWidget::item, QTreeView::item {
    border: 0;
-    padding: 7px 9px;
-    margin: 2px 0;
+    padding: 6px $pad_compact;
+    margin: 1px 0;
 }
 QListWidget::item:selected, QListView::item:selected,
 QTreeWidget::item:selected, QTreeView::item:selected {
@@ -612,9 +718,9 @@ QTabWidget::pane {
    background-color: $glass;
 }
 QTabBar::tab {
-    min-height: 36px;
-    padding: 0 16px;
-    margin-right: 4px;
+    min-height: $h_default;
+    padding: 0 14px;
+    margin-right: 2px;
    color: $muted;
    background-color: transparent;
    border: 1px solid transparent;
@@ -634,7 +740,7 @@ QTabBar#ReceptionDetailTabs {
    border-bottom: 1px solid $line;
 }
 QTabBar#ReceptionDetailTabs::tab {
-    min-height: 38px;
+    min-height: $h_cta;
    padding: 0 14px;
    margin: 0 4px 0 0;
    color: $muted;
@@ -665,10 +771,10 @@ QMenu {
    padding: 6px;
 }
 QMenu::item {
-    min-width: 112px;
-    min-height: 32px;
-    padding: 0 12px 0 30px;
-    border-radius: 7px;
+    min-width: 128px;
+    min-height: $h_default;
+    padding: 0 14px 0 30px;
+    border-radius: $r_sm;
    background-color: transparent;
 }
 QMenu::item:selected { color: #FFFFFF; background-color: $indigo_pressed; }
@@ -721,7 +827,7 @@ QScrollBar:vertical {
 }
 QScrollBar::handle:vertical {
    background: $line;
-    min-height: 30px;
+    min-height: $h_compact;
    border-radius: 4px;
 }
 QScrollBar::handle:vertical:hover { background: $indigo_pressed; }
@@ -764,10 +870,10 @@ QSlider::handle:horizontal {
 QSlider::handle:horizontal:hover { border-color: $focus; }

 QLabel#StatusBadge {
-    padding: 4px 9px;
+    padding: 2px 8px;
    border: 1px solid transparent;
-    border-radius: 9px;
-    font-size: 11px;
+    border-radius: $r_sm;
+    font-size: $fs_caption;
    font-weight: 700;
 }
 QLabel#StatusBadge[kind="neutral"] { color: $muted; background-color: $surface_alt; border-color: $line; }
@@ -778,18 +884,18 @@ QLabel#StatusBadge[kind="info"] { color: $info; background-color: $info_pale; bo
 QLabel#StatusBadge[kind="accent"] { color: $indigo_hover; background-color: $indigo_pale; border-color: $line_soft; }

 QWidget#Pager QLabel#PagerActive {
-    min-width: 42px;
-    min-height: 30px;
+    min-width: 32px;
+    min-height: $h_compact;
    color: #FFFFFF;
    background-color: $indigo;
    border: 1px solid $indigo;
    border-radius: 8px;
-    font-size: 12px;
+    font-size: $fs_caption;
    font-weight: 700;
 }
 QWidget#Pager QPushButton {
-    min-height: 30px;
-    padding: 0 10px;
+    min-height: $h_compact;
+    padding: 0 $pad_compact;
    border: 1px solid $line;
    background-color: $surface;
 }
@@ -800,7 +906,7 @@ QLabel#EmptyStateGlyph {
    background-color: $indigo_pale;
    border: 1px solid $line_soft;
    border-radius: 22px;
-    font-size: 28px;
+    font-size: $fs_display;
    font-weight: 500;
 }

@@ -854,13 +960,13 @@ QFrame#TopBar, QFrame#MultipleTabs {
 QLabel#UserAvatar {
    min-width: 36px;
    max-width: 36px;
-    min-height: 36px;
-    max-height: 36px;
+    min-height: $h_default;
+    max-height: $h_default;
    color: #FFFFFF;
    background-color: $indigo_pressed;
    border: 1px solid $line_soft;
    border-radius: 18px;
-    font-size: 15px;
+    font-size: $fs_strong;
    font-weight: 700;
 }
 QWidget#LoginBrandPanel {
@@ -888,7 +994,7 @@ QToolTip {
    padding: 6px 8px;
 }
 """
-).substitute(COLORS)
+).substitute(_QSS_TOKENS)


 def _apply_group(
@@ -1107,4 +1213,12 @@ def apply_theme(app: QApplication) -> None:
    _install_business_dialog_styling(app)


-__all__ = ["COLORS", "GLOBAL_QSS", "apply_theme", "mark_business_dialog"]
+__all__ = [
+    "COLORS",
+    "GLOBAL_QSS",
+    "METRICS",
+    "TYPE",
+    "apply_theme",
+    "crisp_pixmap",
+    "mark_business_dialog",
+]
@@ -3,6 +3,7 @@
 from __future__ import annotations

 import inspect
+import re
 import traceback
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from dataclasses import dataclass
@@ -16,10 +17,12 @@ from PySide6.QtWidgets import (
    QFrame,
    QHBoxLayout,
    QLabel,
+    QMenu,
    QPushButton,
    QSizePolicy,
    QTableWidget,
    QTableWidgetItem,
+    QToolButton,
    QVBoxLayout,
    QWidget,
 )
@@ -91,6 +94,43 @@ def display_text(value: Any, default: str = "—") -> str:
    return str(value)


+_UNIX_TIMESTAMP_RE = re.compile(r"\d{10,13}(?:\.\d+)?")
+_RECORD_TIME_FORMAT = "%Y-%m-%d %H:%M"
+
+
+def format_record_time(value: Any, default: str = "—") -> str:
+    """Format a record timestamp that may arrive as Unix seconds, milliseconds, or ISO text.
+
+    The desktop pages used to render raw ``str(int)`` for fields like
+    ``create_time`` whenever the server returned a numeric epoch.  This
+    helper keeps the legacy strings (already formatted dates) untouched
+    while normalising the numeric and ISO variants to ``YYYY-MM-DD HH:MM``
+    so the column reads as a real creation date.
+    """
+
+    if value is None or value == "":
+        return default
+    if isinstance(value, datetime):
+        return value.strftime(_RECORD_TIME_FORMAT)
+    if isinstance(value, date):
+        return value.strftime("%Y-%m-%d")
+    raw = str(value).strip()
+    if not raw:
+        return default
+    if _UNIX_TIMESTAMP_RE.fullmatch(raw):
+        stamp = float(raw)
+        if stamp >= 10_000_000_000:
+            stamp /= 1000.0
+        try:
+            return datetime.fromtimestamp(stamp).strftime(_RECORD_TIME_FORMAT)
+        except (OSError, OverflowError, ValueError):
+            return raw
+    normalized = raw.replace("T", " ").replace("Z", "")
+    if len(normalized) >= 16:
+        return normalized[:16]
+    return raw
+
+
 def gender_text(value: Any, default: str = "—") -> str:
    """Format the legacy gender codes without exposing numeric API values."""

@@ -312,9 +352,14 @@ def run_async(
    on_error: Callable[[Exception], None] | None = None,
    on_finished: Callable[[], None] | None = None,
    pool: QThreadPool | None = None,
+    priority: int = 0,
    **kwargs: Any,
 ) -> Worker:
-    """Run ``function`` off the GUI thread and return its Worker handle."""
+    """Run ``function`` off the GUI thread and return its Worker handle.
+
+    Higher-priority queued work starts first when a pool thread becomes free.
+    Running work is never interrupted.
+    """

    worker = Worker(function, *args, **kwargs)
    _RUNNING_WORKERS.add(worker)
@@ -324,7 +369,7 @@ def run_async(
    if on_finished is not None:
        worker.signals.finished.connect(on_finished)
    worker.signals.finished.connect(lambda: _RUNNING_WORKERS.discard(worker))
-    (pool or QThreadPool.globalInstance()).start(worker)
+    (pool or QThreadPool.globalInstance()).start(worker, priority)
    return worker


@@ -370,6 +415,11 @@ def friendly_error(error: Any) -> str:
        return "当前账号无权执行此操作。"
    if "not found" in lowered:
        return "未找到所需数据。"
+    # 友好的 Dify / AI 上游错误映射。原文来自服务端 DifyChatService 的 error_code 分支，
+    # 当上游拒绝、超时或 quota 受限时，原文对医生不友好，按场景给出可执行引导。
+    upstream_hint = _ai_upstream_hint(text)
+    if upstream_hint is not None:
+        return upstream_hint
    if any("\u4e00" <= character <= "\u9fff" for character in text):
        return text
    if isinstance(error, TypeError):
@@ -377,6 +427,38 @@ def friendly_error(error: Any) -> str:
    return "操作未完成，请稍后重试。"


+_AI_UPSTREAM_HINTS: tuple[tuple[str, str], ...] = (
+    ("模型未能处理本次请求", "AI 助手暂时无法处理本次请求，请稍后重试；若多次出现请联系管理员检查 AI 服务配置。"),
+    ("模型响应超时", "AI 助手响应超时，请稍后重试。"),
+    ("暂时无法连接 AI 服务", "无法连接 AI 助手服务，请检查网络或稍后重试。"),
+    ("模型服务繁忙", "AI 助手服务繁忙，请稍后重试。"),
+    ("AI 助手未返回内容", "AI 助手未返回内容，请稍后重试。"),
+    ("AI 助手暂时不可用", "AI 助手暂时不可用，请稍后重试。"),
+    ("病例数据编码失败", "病例数据无法发送到 AI 助手，请联系管理员。"),
+    ("无法初始化 AI 请求", "无法初始化 AI 助手请求，请联系管理员。"),
+    ("AI 服务凭据无效或无权限", "AI 助手服务凭据无效或无权限，请联系管理员。"),
+    ("AI 服务配置无效", "AI 助手服务配置无效，请联系管理员。"),
+    ("该模型服务尚未完整配置", "AI 助手服务尚未完整配置，请联系管理员。"),
+    ("AI 报告功能未启用", "AI 助手功能尚未启用，请联系管理员。"),
+    ("不支持的 AI 模型", "AI 助手模型不受支持，请联系管理员。"),
+)
+
+
+_AI_UPSTREAM_CODE = re.compile(r"[（(]([A-Z][A-Z0-9_]{2,39})[)）]")
+
+
+def _ai_upstream_hint(text: str) -> str | None:
+    for marker, hint in _AI_UPSTREAM_HINTS:
+        if marker in text:
+            # 服务端会在消息尾部附带上游错误码。保留它，医生截图反馈时管理员
+            # 能直接区分是配置问题、资料体积超限还是上游拒绝。
+            match = _AI_UPSTREAM_CODE.search(text)
+            if match is not None:
+                return f"{hint}（{match.group(1)}）"
+            return hint
+    return None
+
+
 class PageHeader(QWidget):
    """Reference-design page heading with breadcrumb, copy and actions."""

@@ -716,6 +798,9 @@ class SortableTable(QTableWidget):
        self.setSelectionBehavior(QAbstractItemView.SelectionBehavior.SelectRows)
        self.setSelectionMode(QAbstractItemView.SelectionMode.SingleSelection)
        self.setEditTriggers(QAbstractItemView.EditTrigger.NoEditTriggers)
+        self.setHorizontalScrollMode(QAbstractItemView.ScrollMode.ScrollPerPixel)
+        self.setVerticalScrollMode(QAbstractItemView.ScrollMode.ScrollPerPixel)
+        self.setMinimumHeight(0)
        self.setSortingEnabled(True)
        self.verticalHeader().setVisible(False)
        self.horizontalHeader().setStretchLastSection(True)
@@ -754,34 +839,141 @@ class SortableTable(QTableWidget):
        return item.data(Qt.ItemDataRole.UserRole) if item is not None else None


-class Pager(QWidget):
+@dataclass(frozen=True)
+class RowAction:
+    """One entry in a table row's action cell."""
+
+    label: str
+    callback: Callable[[], None]
+    danger: bool = False
+    #: Keep this action inline even when it would otherwise overflow.
+    pinned: bool = False
+
+
+class RowActions(QWidget):
+    """Row action cell that shows a couple of buttons and hides the rest.
+
+    List rows used to render every permitted action as its own small button —
+    up to seven on the diagnosis list.  That widened the action column, pushed
+    the data columns into ellipsis, and left each row a different width, which
+    is what made the tables feel heavy and misaligned.  Only the first
+    ``max_visible`` non-destructive actions stay inline now; everything else,
+    destructive actions included, moves into a single 更多 menu.
+    """
+
+    def __init__(
+        self,
+        actions: Sequence[RowAction],
+        parent: QWidget | None = None,
+        *,
+        max_visible: int = 2,
+    ) -> None:
+        super().__init__(parent)
+        self.setObjectName("RowActions")
+        layout = QHBoxLayout(self)
+        layout.setContentsMargins(4, 2, 4, 2)
+        layout.setSpacing(2)
+
+        inline: list[RowAction] = []
+        overflow: list[RowAction] = []
+        for action in actions:
+            room_left = len(inline) < max_visible
+            if action.pinned or (room_left and not action.danger):
+                inline.append(action)
+            else:
+                overflow.append(action)
+
+        self.buttons: list[QPushButton] = []
+        for action in inline:
+            button = QPushButton(action.label, self)
+            button.setProperty("rowAction", True)
+            if action.danger:
+                button.setProperty("variant", "dangerGhost")
+            button.setCursor(Qt.CursorShape.PointingHandCursor)
+            button.clicked.connect(lambda _checked=False, run=action.callback: run())
+            layout.addWidget(button)
+            self.buttons.append(button)
+
+        self.more_button: QToolButton | None = None
+        if overflow:
+            more = QToolButton(self)
+            more.setObjectName("RowActionsMore")
+            more.setText("更多")
+            more.setPopupMode(QToolButton.ToolButtonPopupMode.InstantPopup)
+            more.setCursor(Qt.CursorShape.PointingHandCursor)
+            menu = QMenu(more)
+            for action in overflow:
+                entry = menu.addAction(action.label)
+                if action.danger:
+                    entry.setProperty("danger", True)
+                entry.triggered.connect(lambda _checked=False, run=action.callback: run())
+            more.setMenu(menu)
+            layout.addWidget(more)
+            self.more_button = more
+            self.menu = menu
+
+        layout.addStretch(1)
+
+    @property
+    def visible_labels(self) -> list[str]:
+        return [button.text() for button in self.buttons]
+
+    @property
+    def overflow_labels(self) -> list[str]:
+        if self.more_button is None:
+            return []
+        return [entry.text() for entry in self.more_button.menu().actions()]
+
+
+class BusinessPager(QWidget):
+    """Compact numbered pager shared by dense business-list pages."""
+
    page_changed = Signal(int)

-    def __init__(self, page_size: int = 20, parent: QWidget | None = None) -> None:
+    def __init__(self, page_size: int = 15, parent: QWidget | None = None) -> None:
        super().__init__(parent)
-        self.setObjectName("Pager")
+        self.setObjectName("BusinessPager")
+        self.setFixedHeight(42)
+        self.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Fixed)
        self.page = 1
        self.page_size = page_size
        self.total = 0
+
        layout = QHBoxLayout(self)
-        layout.setContentsMargins(0, 4, 0, 0)
-        self.summary = QLabel("共 0 条")
+        layout.setContentsMargins(16, 4, 16, 4)
+        layout.setSpacing(7)
+        self.summary = QLabel("共 0 条", self)
        self.summary.setProperty("role", "muted")
        layout.addWidget(self.summary)
        layout.addStretch(1)
-        self.previous = QPushButton("上一页")
+
+        self.previous = QPushButton("‹", self)
        self.previous.setProperty("variant", "ghost")
+        self.previous.setAccessibleName("上一页")
        self.previous.clicked.connect(lambda: self._request(self.page - 1))
        layout.addWidget(self.previous)
-        self.page_label = QLabel("1 / 1")
-        self.page_label.setObjectName("PagerActive")
-        self.page_label.setMinimumWidth(58)
-        self.page_label.setAlignment(Qt.AlignmentFlag.AlignCenter)
-        layout.addWidget(self.page_label)
-        self.next = QPushButton("下一页")
+
+        self.pages_host = QWidget(self)
+        self.pages_layout = QHBoxLayout(self.pages_host)
+        self.pages_layout.setContentsMargins(0, 0, 0, 0)
+        self.pages_layout.setSpacing(5)
+        layout.addWidget(self.pages_host)
+
+        self.next = QPushButton("›", self)
        self.next.setProperty("variant", "ghost")
+        self.next.setAccessibleName("下一页")
        self.next.clicked.connect(lambda: self._request(self.page + 1))
        layout.addWidget(self.next)
+
+        # The business contract fixes this list to one page size.  A label is
+        # intentionally used instead of a one-option combo box so the control
+        # does not advertise an interaction that cannot change anything.
+        self.page_size_label = QLabel(f"{page_size} 条/页", self)
+        self.page_size_label.setProperty("pagerSize", True)
+        self.page_size_label.setAlignment(Qt.AlignmentFlag.AlignCenter)
+        layout.addWidget(self.page_size_label)
+
+        self.page_label: QPushButton | None = None
        self.update_state(1, 0)

    @property
@@ -789,18 +981,64 @@ class Pager(QWidget):
        return max(1, (self.total + self.page_size - 1) // self.page_size)

    def update_state(self, page: int, total: int) -> None:
-        self.page = max(1, page)
        self.total = max(0, total)
+        self.page = min(max(1, page), self.page_count)
        self.summary.setText(f"共 {self.total} 条")
-        self.page_label.setText(f"{self.page} / {self.page_count}")
+        while self.pages_layout.count():
+            item = self.pages_layout.takeAt(0)
+            widget = item.widget()
+            if widget is not None:
+                widget.deleteLater()
+
+        count = self.page_count
+        if count <= 4:
+            pages: list[int | None] = list(range(1, count + 1))
+        elif self.page <= 3:
+            pages = [1, 2, 3, None, count]
+        elif self.page >= count - 2:
+            pages = [1, None, count - 2, count - 1, count]
+        else:
+            pages = [1, None, self.page, None, count]
+
+        self.page_label = None
+        for number in pages:
+            if number is None:
+                ellipsis = QLabel("…", self.pages_host)
+                ellipsis.setAlignment(Qt.AlignmentFlag.AlignCenter)
+                ellipsis.setFixedWidth(24)
+                self.pages_layout.addWidget(ellipsis)
+                continue
+            button = QPushButton(str(number), self.pages_host)
+            button.setProperty("pagerPage", True)
+            button.setProperty("active", number == self.page)
+            button.setCursor(Qt.CursorShape.PointingHandCursor)
+            button.clicked.connect(lambda _checked=False, value=number: self._request(value))
+            self.pages_layout.addWidget(button)
+            if number == self.page:
+                self.page_label = button
        self.previous.setEnabled(self.page > 1)
-        self.next.setEnabled(self.page < self.page_count)
+        self.next.setEnabled(self.page < count)

    def _request(self, page: int) -> None:
        if 1 <= page <= self.page_count and page != self.page:
            self.page_changed.emit(page)


+class Pager(BusinessPager):
+    """Numbered pager for the appointment/patient lists.
+
+    This used to be a separate ``上一页 / 1 / 1 / 下一页`` control, so the
+    workstation shipped three different pagination footers depending on which
+    list you opened.  It now reuses :class:`BusinessPager` verbatim and only
+    keeps its own object name and default page size, giving every list the same
+    footer while leaving the ``page_changed`` / ``update_state`` API unchanged.
+    """
+
+    def __init__(self, page_size: int = 20, parent: QWidget | None = None) -> None:
+        super().__init__(page_size, parent)
+        self.setObjectName("Pager")
+
+
 def card_layout(card: QFrame, margins: int = 18, spacing: int = 12) -> QVBoxLayout:
    layout = QVBoxLayout(card)
    layout.setContentsMargins(margins, margins, margins, margins)
@@ -833,6 +1071,7 @@ def clear_layout(layout: QVBoxLayout | QHBoxLayout) -> None:


 __all__ = [
+    "BusinessPager",
    "BusyOverlay",
    "EmptyState",
    "MessageBanner",
@@ -849,6 +1088,7 @@ __all__ = [
    "clear_layout",
    "display_text",
    "first_value",
+    "format_record_time",
    "friendly_error",
    "get_value",
    "has_permission",
@@ -15,6 +15,7 @@ import threading
 from collections.abc import Callable, Mapping
 from concurrent.futures import Future
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Any, TypeVar

 from .launcher import VideoCallRequest
@@ -110,6 +111,29 @@ def _extract_call_record_id(result: Any) -> int | str | None:
    return None


+def _extract_cloud_recording_outcome(result: Any) -> tuple[bool, str] | None:
+    """Read the cloud mixed-video recording outcome returned by room binding."""
+
+    pending = [result]
+    visited: set[int] = set()
+    while pending:
+        candidate = pending.pop(0)
+        mapping = _mapping_candidate(candidate)
+        if mapping is None or id(mapping) in visited:
+            continue
+        visited.add(id(mapping))
+        recording = mapping.get("cloud_recording", mapping.get("cloudRecording"))
+        if isinstance(recording, Mapping):
+            started = bool(recording.get("started"))
+            message = str(recording.get("message") or "").strip()[:200]
+            return started, message
+        for key in ("data", "result"):
+            nested = mapping.get(key)
+            if isinstance(nested, Mapping):
+                pending.append(nested)
+    return None
+
+
 def _clean_transcript_segment(segment: Mapping[str, Any], session_id: str) -> dict[str, Any]:
    segment_id = str(segment.get("segment_id", segment.get("segmentId", ""))).strip()
    text = str(segment.get("text", segment.get("sourceText", ""))).strip()
@@ -239,6 +263,7 @@ class OrderedCallLifecycle:
        self._claimed_room_id: str | None = None
        self._start_future: Future[bool] | None = None
        self._bind_future: Future[bool] | None = None
+        self._local_recording_future: Future[bool] | None = None
        self._end_future: Future[bool] | None = None
        self._transcription_start_future: Future[bool] | None = None
        self._transcription_finish_future: Future[bool] | None = None
@@ -256,6 +281,13 @@ class OrderedCallLifecycle:
    def transcription_session_id(self) -> str | None:
        return self._transcription_session_id

+    @property
+    def current_room_id(self) -> str | None:
+        """Return the room observed for this call cycle, including an active bind."""
+
+        with self._lock:
+            return self.bound_room_id or self._claimed_room_id
+
    def start(self) -> Future[bool]:
        with self._lock:
            if self._start_future is not None:
@@ -318,18 +350,31 @@ class OrderedCallLifecycle:
            def operation() -> bool:
                with self._lock:
                    started = self.started
+                    record_id = self.call_record_id
                if not started:
                    return False
+                if record_id is None:
+                    raise ValueError("server did not return the current call_record_id")
                if not callable(method):
                    self.logger.warning(
                        "video repository does not implement bind_call_room",
                        extra={"video_call": self.request.safe_log_context()},
                    )
                    return False
-                _call_repository_method(
+                result = _call_repository_method(
                    method,
-                    {"diagnosis_id": self.request.diagnosis_id, "room_id": cleaned},
+                    {
+                        "diagnosis_id": self.request.diagnosis_id,
+                        "room_id": cleaned,
+                        "call_record_id": record_id,
+                    },
                )
+                recording_outcome = _extract_cloud_recording_outcome(result)
+                if recording_outcome is not None and not recording_outcome[0]:
+                    raise RuntimeError(
+                        recording_outcome[1]
+                        or "automatic Tencent cloud mixed-video recording did not start"
+                    )
                with self._lock:
                    self.bound_room_id = cleaned
                self.logger.info(
@@ -338,8 +383,85 @@ class OrderedCallLifecycle:
                )
                return True

-            self._bind_future = self._worker.submit("bind", operation)
-            return self._bind_future
+            future = self._worker.submit("bind", operation)
+            self._bind_future = future
+
+            def release_failed_claim(completed: Future[bool]) -> None:
+                try:
+                    succeeded = bool(completed.result())
+                except Exception:
+                    succeeded = False
+                if succeeded:
+                    return
+                # A transient bridge/API failure must not permanently pin the
+                # room to a failed Future.  The companion retries the exact
+                # same room after the host acknowledgement, so release only
+                # this failed claim while preserving successful bindings.
+                with self._lock:
+                    if self._bind_future is completed and self.bound_room_id is None:
+                        self._bind_future = None
+                        self._claimed_room_id = None
+
+            future.add_done_callback(release_failed_claim)
+            return future
+
+    def save_local_audio_recording(
+        self,
+        path: str | Path,
+        *,
+        mime_type: str = "audio/webm",
+    ) -> Future[bool]:
+        """Upload one locally mixed audio file to this exact call record.
+
+        The operation shares the lifecycle FIFO, so a caller that queues this
+        before :meth:`end` is guaranteed to attach the COS object before the
+        call record is marked ended.
+        """
+
+        recording_path = Path(path).expanduser().resolve()
+        clean_mime = str(mime_type or "audio/webm").strip()[:120] or "audio/webm"
+        if not recording_path.is_file() or recording_path.stat().st_size <= 0:
+            raise ValueError("local audio recording is empty or missing")
+        with self._lock:
+            if self._end_future is not None:
+                raise RuntimeError("video call has already ended")
+            if self._local_recording_future is not None:
+                return self._local_recording_future
+            if self._start_future is None:
+                self.start()
+            method = getattr(self.repository, "upload_call_recording", None)
+            if not callable(method):
+                raise ValueError("video repository does not implement local recording upload")
+
+            def operation() -> bool:
+                with self._lock:
+                    started = self.started
+                    record_id = self.call_record_id
+                if not started:
+                    return False
+                if record_id is None:
+                    raise ValueError("server did not return the current call_record_id")
+                result = _call_repository_method(
+                    method,
+                    {
+                        "path": recording_path,
+                        "diagnosis_id": self.request.diagnosis_id,
+                        "call_record_id": record_id,
+                        "mime_type": clean_mime,
+                    },
+                )
+                if result is False:
+                    raise RuntimeError("local audio recording upload failed")
+                self.logger.info(
+                    "local call audio uploaded and attached",
+                    extra={"video_call": self.request.safe_log_context()},
+                )
+                return True
+
+            self._local_recording_future = self._worker.submit(
+                "local-audio-upload", operation
+            )
+            return self._local_recording_future

    def save_screenshot(self, content: bytes, filename: str) -> Future[str]:
        """Upload one video frame and append it to the diagnosis doctor notes."""
@@ -554,15 +676,21 @@ class OrderedCallLifecycle:
            def operation() -> bool:
                with self._lock:
                    started = self.started
+                    record_id = self.call_record_id
                if not started:
                    with self._lock:
                        self.ended = True
                    return False
                if not callable(method):
                    raise ValueError("video repository does not implement end_call")
+                if record_id is None:
+                    raise ValueError("server did not return the current call_record_id")
                _call_repository_method(
                    method,
-                    {"diagnosis_id": self.request.diagnosis_id},
+                    {
+                        "diagnosis_id": self.request.diagnosis_id,
+                        "call_record_id": record_id,
+                    },
                )
                with self._lock:
                    self.ended = True
@@ -11,6 +11,9 @@ import base64
 import binascii
 import json
 import logging
+import os
+import re
+import sqlite3
 import sys
 from collections.abc import Callable, Mapping
 from concurrent.futures import Future
@@ -20,6 +23,11 @@ from pathlib import Path
 from typing import Any
 from urllib.parse import parse_qsl, urlsplit

+from ..services.local_audio_queue import (
+    LocalAudioQueueStore,
+    LocalAudioUploadManager,
+    get_local_audio_upload_manager,
+)
 from .launcher import (
    VideoCallRequest,
    VideoTicketError,
@@ -29,7 +37,7 @@ from .lifecycle import OrderedCallLifecycle
 from .security import TrustedDocumentError, TrustedDocumentPolicy

 try:  # Optional by design: core-only builds must still import this module.
-    from PySide6.QtCore import QObject, Qt, QUrl, Signal, Slot
+    from PySide6.QtCore import QObject, Qt, QTimer, QUrl, Signal, Slot
    from PySide6.QtWebChannel import QWebChannel
    from PySide6.QtWebEngineCore import (
        QWebEnginePage,
@@ -39,7 +47,7 @@ try:  # Optional by design: core-only builds must still import this module.
    from PySide6.QtWebEngineWidgets import QWebEngineView
    from PySide6.QtWidgets import QApplication, QMainWindow
 except (ImportError, OSError) as _qt_import_error:  # pragma: no cover - no Qt runtime.
-    QObject = Qt = QUrl = Signal = Slot = None  # type: ignore[assignment]
+    QObject = QTimer = Qt = QUrl = Signal = Slot = None  # type: ignore[assignment]
    QWebChannel = QWebEnginePage = QWebEngineProfile = None  # type: ignore[assignment]
    QWebEngineSettings = QWebEngineView = None  # type: ignore[assignment]
    QApplication = QMainWindow = None  # type: ignore[assignment]
@@ -63,6 +71,18 @@ class CompanionLocation:
    is_local: bool


+@dataclass(slots=True)
+class _LocalAudioCapture:
+    record_id: int
+    session_id: str
+    mime_type: str
+    path: Path
+    handle: Any
+    lifecycle: OrderedCallLifecycle
+    next_sequence: int = 0
+    bytes_written: int = 0
+
+
 def _validate_remote_url(value: str) -> str:
    parsed = urlsplit(value)
    if parsed.scheme.lower() != "https" or not parsed.hostname:
@@ -204,13 +224,67 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
                }
            )

+        @Slot(str, str)  # type: ignore[misc]
+        def startLocalAudioRecording(  # noqa: N802 - Qt bridge API
+            self, session_id: str, mime_type: str
+        ) -> None:
+            self._callback(
+                {
+                    "source": "doctor-call",
+                    "event": "local-audio-start",
+                    "sessionId": session_id,
+                    "mimeType": mime_type,
+                }
+            )
+
+        @Slot(str, int, str)  # type: ignore[misc]
+        def appendLocalAudioChunk(  # noqa: N802 - Qt bridge API
+            self, session_id: str, sequence: int, encoded: str
+        ) -> None:
+            self._callback(
+                {
+                    "source": "doctor-call",
+                    "event": "local-audio-chunk",
+                    "sessionId": session_id,
+                    "sequence": sequence,
+                    "data": encoded,
+                }
+            )
+
+        @Slot(str, int)  # type: ignore[misc]
+        def finishLocalAudioRecording(  # noqa: N802 - Qt bridge API
+            self, session_id: str, total_bytes: int
+        ) -> None:
+            self._callback(
+                {
+                    "source": "doctor-call",
+                    "event": "local-audio-finish",
+                    "sessionId": session_id,
+                    "totalBytes": total_bytes,
+                }
+            )
+
+        @Slot(str)  # type: ignore[misc]
+        def abortLocalAudioRecording(self, session_id: str) -> None:  # noqa: N802
+            self._callback(
+                {
+                    "source": "doctor-call",
+                    "event": "local-audio-abort",
+                    "sessionId": session_id,
+                }
+            )
+
    class _EmbeddedVideoWindow(QMainWindow):  # type: ignore[misc, valid-type]
        status_changed = Signal(str)  # type: ignore[misc]
        call_ended = Signal(str)  # type: ignore[misc]
        call_error = Signal(str)  # type: ignore[misc]
        _start_completed = Signal(bool)  # type: ignore[misc]
+        _room_completed = Signal(str, bool, str)  # type: ignore[misc]
        _screenshot_completed = Signal(bool, str)  # type: ignore[misc]
        _transcription_completed = Signal(str, str, str, bool, str)  # type: ignore[misc]
+        _local_recording_completed = Signal(  # type: ignore[misc]
+            str, str, int, bool, str
+        )

        def __init__(
            self,
@@ -247,8 +321,15 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
            self._close_reason = "window-closed"
            self._call_cycle_closed = False
            self._start_requested = False
+            self._shutdown_requested = False
+            self._local_audio_capture: _LocalAudioCapture | None = None
+            self._local_audio_store: LocalAudioQueueStore | None = None
+            self._local_audio_uploads: LocalAudioUploadManager | None = None
            self._legacy_grants: list[tuple[Any, Any]] = []
            self._permission_grants: list[Any] = []
+            self._shutdown_timer = QTimer(self)
+            self._shutdown_timer.setSingleShot(True)
+            self._shutdown_timer.timeout.connect(self._force_requested_shutdown)

            self.setWindowTitle(
                f"与 {self.patient_name} IM 问诊" if self.open_im else "视频面诊"
@@ -284,8 +365,10 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
            self._connect_permissions()

            self._start_completed.connect(self._on_lifecycle_started)
+            self._room_completed.connect(self._on_room_completed)
            self._screenshot_completed.connect(self._on_screenshot_completed)
            self._transcription_completed.connect(self._on_transcription_completed)
+            self._local_recording_completed.connect(self._on_local_recording_completed)
            self.web_view.loadFinished.connect(self._on_load_finished)
            self.web_view.setUrl(QUrl(self.location.url))

@@ -428,6 +511,28 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
                    str(message.get("message") or "截屏图片无效。")[:200],
                )
                return
+            if event == "local-audio-start":
+                self._start_local_audio_recording(
+                    str(message.get("sessionId") or ""),
+                    str(message.get("mimeType") or "audio/webm"),
+                )
+                return
+            if event == "local-audio-chunk":
+                self._append_local_audio_chunk(
+                    str(message.get("sessionId") or ""),
+                    message.get("sequence"),
+                    str(message.get("data") or ""),
+                )
+                return
+            if event == "local-audio-finish":
+                self._finish_local_audio_recording(
+                    str(message.get("sessionId") or ""),
+                    message.get("totalBytes"),
+                )
+                return
+            if event == "local-audio-abort":
+                self._abort_local_audio_recording(str(message.get("sessionId") or ""))
+                return
            if event == "transcription-start-request":
                self._start_transcription(
                    str(message.get("sessionId") or ""),
@@ -445,7 +550,13 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
                return
            room_id = message.get("roomId", message.get("room_id"))
            if room_id not in (None, ""):
-                self.lifecycle.bind_room(room_id)
+                clean_room_id = str(room_id).strip()
+                future = self.lifecycle.bind_room(clean_room_id)
+                future.add_done_callback(
+                    lambda completed, current_room_id=clean_room_id: (
+                        self._notify_room_completed(current_room_id, completed)
+                    )
+                )
            if event == "room":
                return
            if event == "status":
@@ -457,7 +568,7 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
                self.lifecycle.end(f"companion-{status}")
                self._call_cycle_closed = True
                self._start_requested = False
-                if not self.open_im:
+                if not self.open_im or self._shutdown_requested:
                    self._close_from_companion("companion-hangup")
            elif event == "error":
                message_text = str(message.get("message", "视频通话错误"))[:400]
@@ -466,9 +577,343 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
                    self.lifecycle.end("companion-error")
                    self._call_cycle_closed = True
                    self._start_requested = False
-                if not self.open_im:
+                if not self.open_im or self._shutdown_requested:
                    self._close_from_companion("companion-error")

+        def _notify_room_completed(self, room_id: str, future: Future[bool]) -> None:
+            try:
+                succeeded = bool(future.result())
+            except Exception as error:
+                succeeded = False
+                message = str(error)[:200] or "腾讯云混流视频录制未启动。"
+            else:
+                message = (
+                    "腾讯云混流视频已启动；本机录音将在结束后另行上传 COS。"
+                    if succeeded
+                    else "通话房间尚未绑定，云端视频和本机录音无法关联通话记录。"
+                )
+            with suppress(RuntimeError):
+                self._room_completed.emit(room_id, succeeded, message)
+
+        def _on_room_completed(
+            self,
+            room_id: str,
+            succeeded: bool,
+            message: str,
+        ) -> None:
+            if self._closing:
+                return
+            room_payload = json.dumps(str(room_id)[:160], ensure_ascii=True)
+            payload = json.dumps(str(message)[:200], ensure_ascii=True)
+            state = "true" if succeeded else "false"
+            self._page.runJavaScript(
+                "window.doctorConsultation?.roomBindingResult?.("
+                f"{room_payload}, {state}, {payload});"
+            )
+
+        def _emit_local_recording_result(
+            self,
+            operation: str,
+            session_id: str,
+            sequence: int,
+            succeeded: bool,
+            message: str,
+        ) -> None:
+            with suppress(RuntimeError):
+                self._local_recording_completed.emit(
+                    operation,
+                    session_id,
+                    sequence,
+                    succeeded,
+                    str(message)[:200],
+                )
+
+        def _on_local_recording_completed(
+            self,
+            operation: str,
+            session_id: str,
+            sequence: int,
+            succeeded: bool,
+            message: str,
+        ) -> None:
+            if self._closing or self._released:
+                return
+            self._page.runJavaScript(
+                "window.doctorConsultation?.localRecordingResult?.("
+                f"{json.dumps(operation)}, {json.dumps(session_id)}, {sequence}, "
+                f"{'true' if succeeded else 'false'}, "
+                f"{json.dumps(str(message)[:200], ensure_ascii=True)});"
+            )
+
+        def _start_local_audio_recording(self, session_id: str, mime_type: str) -> None:
+            cleaned = str(session_id or "").strip()
+            clean_mime = str(mime_type or "audio/webm").strip().lower()[:120]
+            if not re.fullmatch(r"[A-Za-z0-9_-]{12,64}", cleaned):
+                self._emit_local_recording_result(
+                    "start", cleaned, -1, False, "本地录音会话标识无效。"
+                )
+                return
+            if not clean_mime.startswith(("audio/webm", "audio/ogg")):
+                self._emit_local_recording_result(
+                    "start", cleaned, -1, False, "当前浏览器录音格式不受支持。"
+                )
+                return
+            if self._local_audio_capture is not None:
+                existing = self._local_audio_capture.session_id == cleaned
+                self._emit_local_recording_result(
+                    "start",
+                    cleaned,
+                    -1,
+                    existing,
+                    "本地录音已启动。" if existing else "已有另一条本地录音正在进行。",
+                )
+                return
+            try:
+                lifecycle = self.lifecycle
+                raw_call_record_id = lifecycle.call_record_id
+                call_record_id = (
+                    int(raw_call_record_id) if raw_call_record_id not in (None, "") else None
+                )
+                store, uploads = get_local_audio_upload_manager(
+                    lifecycle.repository,
+                    self._local_audio_store,
+                )
+                self._local_audio_store = store
+                self._local_audio_uploads = uploads
+                record = store.begin_recording(
+                    session_id=cleaned,
+                    diagnosis_id=self.request.diagnosis_id,
+                    mime_type=clean_mime,
+                    call_record_id=call_record_id,
+                    room_id=lifecycle.current_room_id or "",
+                )
+                # The handle intentionally remains open across WebChannel chunks.
+                handle = record.file_path.open("w+b")
+            except (OSError, RuntimeError, sqlite3.Error) as error:
+                self._emit_local_recording_result(
+                    "start", cleaned, -1, False, str(error)[:200]
+                )
+                return
+            self._local_audio_capture = _LocalAudioCapture(
+                record_id=record.id,
+                session_id=cleaned,
+                mime_type=clean_mime,
+                path=record.file_path,
+                handle=handle,
+                lifecycle=lifecycle,
+            )
+            self._emit_local_recording_result(
+                "start", cleaned, -1, True, "本机语音录音已启动。"
+            )
+
+        def _append_local_audio_chunk(
+            self,
+            session_id: str,
+            sequence_value: Any,
+            encoded: str,
+        ) -> None:
+            capture = self._local_audio_capture
+            try:
+                sequence = int(sequence_value)
+            except (TypeError, ValueError):
+                sequence = -1
+            if capture is None or session_id != capture.session_id:
+                self._emit_local_recording_result(
+                    "chunk", session_id, sequence, False, "本地录音会话标识不匹配。"
+                )
+                return
+            if sequence != capture.next_sequence:
+                self._emit_local_recording_result(
+                    "chunk", session_id, sequence, False, "本地录音分片顺序不连续。"
+                )
+                return
+            if not encoded or len(encoded) > 16_384:
+                self._emit_local_recording_result(
+                    "chunk", session_id, sequence, False, "本地录音分片过大或为空。"
+                )
+                return
+            try:
+                content = base64.b64decode(encoded, validate=True)
+            except (ValueError, binascii.Error):
+                self._emit_local_recording_result(
+                    "chunk", session_id, sequence, False, "本地录音分片解析失败。"
+                )
+                return
+            if not content or len(content) > 12 * 1024:
+                self._emit_local_recording_result(
+                    "chunk", session_id, sequence, False, "本地录音分片大小无效。"
+                )
+                return
+            if capture.bytes_written + len(content) > 512 * 1024 * 1024:
+                self._emit_local_recording_result(
+                    "chunk", session_id, sequence, False, "本地录音超过 512 MB 限制。"
+                )
+                self._abort_local_audio_recording(session_id)
+                return
+            try:
+                capture.handle.write(content)
+            except OSError as error:
+                self._emit_local_recording_result(
+                    "chunk", session_id, sequence, False, str(error)[:200]
+                )
+                self._abort_local_audio_recording(session_id)
+                return
+            capture.bytes_written += len(content)
+            capture.next_sequence += 1
+
+        def _finish_local_audio_recording(
+            self, session_id: str, total_bytes_value: Any
+        ) -> None:
+            capture = self._local_audio_capture
+            try:
+                total_bytes = int(total_bytes_value)
+            except (TypeError, ValueError):
+                total_bytes = -1
+            if capture is None or session_id != capture.session_id:
+                self._emit_local_recording_result(
+                    "finish", session_id, -1, False, "本地录音会话标识不匹配。"
+                )
+                return
+            self._local_audio_capture = None
+            try:
+                capture.handle.flush()
+                os.fsync(capture.handle.fileno())
+                capture.handle.close()
+            except OSError as error:
+                self._mark_local_audio_invalid(capture.record_id, str(error))
+                self._emit_local_recording_result(
+                    "finish", session_id, -1, False, str(error)[:200]
+                )
+                return
+            if total_bytes != capture.bytes_written or total_bytes <= 0:
+                self._mark_local_audio_invalid(
+                    capture.record_id, "本地录音文件不完整。"
+                )
+                self._emit_local_recording_result(
+                    "finish", session_id, -1, False, "本地录音文件不完整。"
+                )
+                return
+            if capture.bytes_written < 1024:
+                self._mark_local_audio_invalid(
+                    capture.record_id, "本地录音文件为空或只有容器信息。"
+                )
+                self._emit_local_recording_result(
+                    "finish",
+                    session_id,
+                    -1,
+                    False,
+                    "本地录音文件为空或只有容器信息，已阻止上传。",
+                )
+                return
+            try:
+                with capture.path.open("rb") as recording:
+                    signature = recording.read(4)
+            except OSError as error:
+                self._mark_local_audio_invalid(capture.record_id, str(error))
+                self._emit_local_recording_result(
+                    "finish", session_id, -1, False, str(error)[:200]
+                )
+                return
+            valid_signature = (
+                capture.mime_type.startswith("audio/webm")
+                and signature == b"\x1aE\xdf\xa3"
+            ) or (
+                capture.mime_type.startswith("audio/ogg") and signature == b"OggS"
+            )
+            if not valid_signature:
+                self._mark_local_audio_invalid(
+                    capture.record_id, "本地录音格式校验失败。"
+                )
+                self._emit_local_recording_result(
+                    "finish",
+                    session_id,
+                    -1,
+                    False,
+                    "本地录音格式校验失败，已阻止上传无效文件。",
+                )
+                return
+            store = self._local_audio_store
+            uploads = self._local_audio_uploads
+            if store is None or uploads is None:
+                self._emit_local_recording_result(
+                    "finish", session_id, -1, False, "本机录音队列尚未初始化。"
+                )
+                return
+            try:
+                store.finalize_recording(
+                    capture.record_id,
+                    size_bytes=capture.bytes_written,
+                )
+            except (OSError, RuntimeError, sqlite3.Error) as error:
+                self._mark_local_audio_invalid(capture.record_id, str(error))
+                self._emit_local_recording_result(
+                    "finish", session_id, -1, False, str(error)[:200]
+                )
+                return
+
+            lifecycle = capture.lifecycle
+
+            def enqueue_upload(start_result: Future[bool] | None = None) -> None:
+                try:
+                    if start_result is not None and not bool(start_result.result()):
+                        raise RuntimeError("通话记录创建失败，录音已保存在本机，可稍后重试。")
+                    raw_call_record_id = lifecycle.call_record_id
+                    call_record_id = int(raw_call_record_id or 0)
+                    if call_record_id <= 0:
+                        raise RuntimeError("未取得通话记录编号，录音已保存在本机，可稍后重试。")
+                    store.bind_identity(
+                        capture.record_id,
+                        call_record_id=call_record_id,
+                        room_id=lifecycle.current_room_id or "",
+                    )
+                    uploads.submit(capture.record_id)
+                except Exception as error:
+                    with suppress(Exception):
+                        store.update_status(
+                            capture.record_id,
+                            "failed",
+                            str(error)[:1000],
+                        )
+
+            if lifecycle.call_record_id:
+                enqueue_upload()
+            else:
+                try:
+                    lifecycle.start().add_done_callback(enqueue_upload)
+                except Exception as error:
+                    store.update_status(
+                        capture.record_id,
+                        "failed",
+                        str(error)[:1000] or "通话记录创建失败。",
+                    )
+            self._emit_local_recording_result(
+                "finish",
+                session_id,
+                -1,
+                True,
+                "本地录音已保存，正在后台上传 COS。",
+            )
+
+        def _mark_local_audio_invalid(self, record_id: int, message: str) -> None:
+            store = self._local_audio_store
+            if store is None:
+                return
+            with suppress(Exception):
+                store.mark_invalid(record_id, message)
+
+        def _abort_local_audio_recording(self, session_id: str) -> None:
+            capture = self._local_audio_capture
+            if capture is None or (session_id and capture.session_id != session_id):
+                return
+            self._local_audio_capture = None
+            with suppress(OSError):
+                capture.handle.flush()
+                capture.handle.close()
+            self._mark_local_audio_invalid(
+                capture.record_id,
+                "本次本地录音未正常结束，文件已保留以便排查。",
+            )
+
        def _start_call_cycle(self) -> None:
            if self._closing or self._start_requested:
                return
@@ -633,7 +1078,49 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
            self.close()

        def hangup(self) -> None:
-            self._close_reason = "desktop-hangup"
+            self._request_companion_shutdown("desktop-hangup")
+
+        def _request_companion_shutdown(self, reason: str) -> None:
+            """Let MediaRecorder finish and upload before WebEngine is destroyed."""
+
+            self._close_reason = reason
+            if self._closing or self._released:
+                return
+            should_wait_for_companion = (
+                self._injected
+                and self._start_requested
+                and not self._call_cycle_closed
+                and not self._companion_ended
+            )
+            if not should_wait_for_companion:
+                self.close()
+                return
+            if self._shutdown_requested:
+                return
+            self._shutdown_requested = True
+            # doctorConsultation.close() stops MediaRecorder, drains every queued
+            # WebChannel chunk, waits for the Qt/COS finish acknowledgement, and
+            # only then emits hangup.  Keeping _closing false here is essential:
+            # bridge callbacks are deliberately rejected once final destruction
+            # begins.
+            self._page.runJavaScript(
+                "void window.doctorConsultation?.close?.().catch(() => undefined)"
+            )
+            self._shutdown_timer.start(190_000)
+
+        def _force_requested_shutdown(self) -> None:
+            """Bound a failed companion shutdown without racing queued uploads."""
+
+            if not self._shutdown_requested or self._closing or self._released:
+                return
+            if self._start_requested and not self._call_cycle_closed:
+                # OrderedCallLifecycle places end after any upload that already
+                # reached the Qt bridge.
+                self.lifecycle.end(f"{self._close_reason}-timeout")
+                self._call_cycle_closed = True
+                self._start_requested = False
+            self._abort_local_audio_recording("")
+            self._companion_ended = True
            self.close()

        def _begin_shutdown(self) -> None:
@@ -641,12 +1128,10 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
                return
            self._closing = True
            self._media_active = False
-            if self._injected and not self._companion_ended and not self._released:
-                self._page.runJavaScript(
-                    "void window.doctorConsultation?.close?.().catch(() => undefined)"
-                )
+            self._shutdown_timer.stop()
            if self._start_requested and not self._call_cycle_closed:
                self.lifecycle.end(self._close_reason)
+            self._abort_local_audio_recording("")
            self._release_webengine()

        def wait_for_lifecycles(self, timeout: float) -> bool:
@@ -698,6 +1183,15 @@ if WEBENGINE_AVAILABLE:  # pragma: no cover - GUI behavior needs an integration
            self._profile.deleteLater()

        def closeEvent(self, event: Any) -> None:
+            if (
+                self._injected
+                and self._start_requested
+                and not self._call_cycle_closed
+                and not self._companion_ended
+            ):
+                event.ignore()
+                self._request_companion_shutdown(self._close_reason)
+                return
            self._begin_shutdown()
            event.accept()

@@ -0,0 +1,260 @@
+from __future__ import annotations
+
+import os
+from types import SimpleNamespace
+from typing import Any
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+import pytest
+from PySide6.QtWidgets import QApplication, QDialog
+
+from doctor_workstation.core import PermissionSet
+from doctor_workstation.ui.dialogs import ai_consult_picker as picker_module
+from doctor_workstation.ui.dialogs.ai_consult_picker import (
+    AiConsultTarget,
+    AiConsultTargetDialog,
+    select_and_present_ai_consult,
+)
+
+
+@pytest.fixture(scope="module")
+def application() -> QApplication:
+    return QApplication.instance() or QApplication([])
+
+
+@pytest.fixture
+def immediate_async(monkeypatch: pytest.MonkeyPatch) -> None:
+    def run_immediately(
+        function: Any,
+        *args: Any,
+        on_success: Any = None,
+        on_error: Any = None,
+        on_finished: Any = None,
+        **kwargs: Any,
+    ) -> object:
+        try:
+            result = function(*args, **kwargs)
+        except Exception as error:
+            if on_error:
+                on_error(error)
+        else:
+            if on_success:
+                on_success(result)
+        finally:
+            if on_finished:
+                on_finished()
+        return object()
+
+    monkeypatch.setattr(picker_module, "run_async", run_immediately)
+
+
+def _row(**changes: Any) -> dict[str, Any]:
+    row = {
+        "id": 501,
+        "diagnosis_id": 501,
+        "source_patient_id": 301,
+        "patient_name": "张三",
+        "gender": 1,
+        "age": 52,
+        "phone": "13800138000",
+        "phone_masked": "138****8000",
+        "id_card": "110101199001011234",
+        "diagnosis_date": "2026-08-20",
+        "diagnosis_summary": "2型糖尿病",
+        "last_visit_at": "2026-08-19 09:30",
+        "next_appointment_at": "2026-08-25 10:00",
+    }
+    row.update(changes)
+    return row
+
+
+def test_target_keeps_diagnosis_and_patient_ids_distinct_and_sanitizes_seed() -> None:
+    target = AiConsultTarget.from_row(_row())
+
+    assert target is not None
+    assert target.diagnosis_id == 501
+    assert target.patient_id == 301
+    assert target.phone_masked == "138****8000"
+    assert target.seed["diagnosis_id"] == 501
+    assert target.seed["source_patient_id"] == 301
+    assert "phone" not in target.seed
+    assert "id_card" not in target.seed
+
+    without_patient = AiConsultTarget.from_row(
+        {"id": 502, "patient_name": "仅有诊单号"}
+    )
+    assert without_patient is not None
+    assert without_patient.diagnosis_id == 502
+    assert without_patient.patient_id == 0
+
+
+def test_picker_loads_masked_rows_without_auto_selecting(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    calls: list[dict[str, Any]] = []
+
+    class Repository:
+        def list_ai_patient_options(self, **kwargs: Any) -> dict[str, Any]:
+            calls.append(kwargs)
+            return {"lists": [_row()], "count": 1}
+
+    dialog = AiConsultTargetDialog(
+        Repository(),
+        PermissionSet(["tcm.diagnosis/aiAssistant"]),
+        initial_query="  张三  ",
+    )
+    dialog.show()
+    application.processEvents()
+
+    assert calls == [{"page_no": 1, "page_size": 20, "keyword": "张三"}]
+    assert dialog.table.rowCount() == 1
+    assert dialog.table.currentRow() == -1
+    assert not dialog.start_button.isEnabled()
+    assert dialog.table.item(0, 2).text() == "138****8000"
+    assert "13800138000" not in " ".join(
+        dialog.table.item(0, column).text() for column in range(dialog.table.columnCount())
+    )
+
+    dialog.table.selectRow(0)
+    application.processEvents()
+    assert dialog.start_button.isEnabled()
+    dialog.accept()
+    assert dialog.result() == QDialog.DialogCode.Accepted
+    assert dialog.selected_target() is not None
+    assert dialog.selected_target().diagnosis_id == 501
+    assert dialog.selected_target().patient_id == 301
+
+
+def test_search_return_reloads_but_never_accepts_old_selection(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    calls: list[str] = []
+
+    class Repository:
+        def list_ai_patient_options(self, **kwargs: Any) -> dict[str, Any]:
+            calls.append(str(kwargs["keyword"]))
+            return {"lists": [_row(patient_name=str(kwargs["keyword"]) or "最近患者")], "count": 1}
+
+    dialog = AiConsultTargetDialog(
+        Repository(), PermissionSet(["tcm.diagnosis/aiAssistant"])
+    )
+    dialog.show()
+    application.processEvents()
+    dialog.table.selectRow(0)
+    dialog.search_edit.setText("李四")
+    dialog.search_edit.returnPressed.emit()
+    application.processEvents()
+
+    assert calls == ["", "李四"]
+    assert dialog.result() == 0
+    assert dialog.table.currentRow() == -1
+    assert not dialog.start_button.isEnabled()
+    dialog.reject()
+
+
+def test_picker_ignores_late_success_and_error(
+    application: QApplication,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    callbacks: list[dict[str, Any]] = []
+
+    def queue_async(_function: Any, **options: Any) -> object:
+        callbacks.append(options)
+        return object()
+
+    monkeypatch.setattr(picker_module, "run_async", queue_async)
+    repository = SimpleNamespace(list_ai_patient_options=lambda **_kwargs: None)
+    dialog = AiConsultTargetDialog(
+        repository, PermissionSet(["tcm.diagnosis/aiAssistant"])
+    )
+    dialog.show()
+    application.processEvents()
+    assert len(callbacks) == 1
+
+    dialog.search_edit.setText("新患者")
+    dialog.search_now()
+    assert len(callbacks) == 2
+    callbacks[1]["on_success"](
+        {"lists": [_row(diagnosis_id=700, id=700, patient_name="新患者")], "count": 1}
+    )
+    callbacks[0]["on_success"]({"lists": [_row(patient_name="旧患者")], "count": 1})
+    callbacks[0]["on_error"](RuntimeError("旧请求失败"))
+    application.processEvents()
+
+    assert dialog.table.rowCount() == 1
+    assert dialog.table.item(0, 0).text() == "新患者"
+    assert not dialog.banner.isVisible()
+
+    dialog.reject()
+    callbacks[1]["on_error"](RuntimeError("关闭后的错误"))
+    application.processEvents()
+    assert not dialog.isVisible()
+
+
+def test_picker_error_has_retry_and_no_confirm(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    class Repository:
+        def list_ai_patient_options(self, **_kwargs: Any) -> dict[str, Any]:
+            raise RuntimeError("服务暂不可用")
+
+    dialog = AiConsultTargetDialog(
+        Repository(), PermissionSet(["tcm.diagnosis/aiAssistant"])
+    )
+    dialog.show()
+    application.processEvents()
+
+    assert dialog.banner.isVisible()
+    assert "加载失败" in dialog.banner.label.text()
+    assert dialog.empty_state.isVisible()
+    assert not dialog.start_button.isEnabled()
+    dialog.reject()
+
+
+def test_selector_orchestrator_opens_ai_only_after_accept(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    target = AiConsultTarget.from_row(_row())
+    assert target is not None
+    opened: list[dict[str, Any]] = []
+
+    class AcceptedDialog:
+        def __init__(self, *_args: Any, **_kwargs: Any) -> None:
+            pass
+
+        def exec(self) -> QDialog.DialogCode:
+            return QDialog.DialogCode.Accepted
+
+        def selected_target(self) -> AiConsultTarget:
+            return target
+
+    monkeypatch.setattr(picker_module, "AiConsultTargetDialog", AcceptedDialog)
+    monkeypatch.setattr(
+        picker_module,
+        "present_ai_consult",
+        lambda *_args, **kwargs: opened.append(kwargs),
+    )
+    allowed = PermissionSet(["tcm.diagnosis/aiAssistant"])
+
+    assert select_and_present_ai_consult(object(), allowed, None, initial_query="张三")
+    assert opened == [
+        {
+            "diagnosis_id": 501,
+            "patient_id": 301,
+            "seed": target.seed,
+            "source_title": "AI 助手",
+        }
+    ]
+
+    class RejectedDialog(AcceptedDialog):
+        def exec(self) -> QDialog.DialogCode:
+            return QDialog.DialogCode.Rejected
+
+    monkeypatch.setattr(picker_module, "AiConsultTargetDialog", RejectedDialog)
+    assert not select_and_present_ai_consult(object(), allowed, None)
+    assert len(opened) == 1
+
@@ -0,0 +1,896 @@
+from __future__ import annotations
+
+import os
+from collections.abc import Callable
+from typing import Any
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+import pytest
+from PySide6.QtWidgets import (
+    QApplication,
+    QLabel,
+    QLineEdit,
+    QPushButton,
+    QScrollArea,
+    QTextBrowser,
+    QTextEdit,
+    QWidget,
+)
+
+from doctor_workstation.core import PermissionSet
+from doctor_workstation.ui.dialogs import ai_consult as ai_consult_module
+from doctor_workstation.ui.dialogs import prescription as prescription_module
+from doctor_workstation.ui.dialogs.ai_consult import AiConsultDialog
+
+
+@pytest.fixture(scope="module")
+def application() -> QApplication:
+    return QApplication.instance() or QApplication([])
+
+
+@pytest.fixture
+def immediate_async(monkeypatch: pytest.MonkeyPatch) -> None:
+    def run_immediately(
+        function: Callable[..., Any],
+        *args: Any,
+        on_success: Callable[[Any], Any] | None = None,
+        on_error: Callable[[Exception], Any] | None = None,
+        on_finished: Callable[[], Any] | None = None,
+        **_kwargs: Any,
+    ) -> object:
+        try:
+            result = function(*args)
+        except Exception as error:
+            if on_error:
+                on_error(error)
+        else:
+            if on_success:
+                on_success(result)
+        finally:
+            if on_finished:
+                on_finished()
+        return object()
+
+    monkeypatch.setattr(ai_consult_module, "run_async", run_immediately)
+
+
+class DeferredAsync:
+    def __init__(self) -> None:
+        self.pending: list[dict[str, Any]] = []
+
+    def __call__(
+        self,
+        function: Callable[..., Any],
+        *args: Any,
+        on_success: Callable[[Any], Any] | None = None,
+        on_error: Callable[[Exception], Any] | None = None,
+        on_finished: Callable[[], Any] | None = None,
+        **_kwargs: Any,
+    ) -> object:
+        self.pending.append(
+            {
+                "function": function,
+                "args": args,
+                "on_success": on_success,
+                "on_error": on_error,
+                "on_finished": on_finished,
+            }
+        )
+        return object()
+
+    def complete(self, index: int) -> None:
+        pending = self.pending[index]
+        try:
+            result = pending["function"](*pending["args"])
+        except Exception as error:
+            if pending["on_error"]:
+                pending["on_error"](error)
+        else:
+            if pending["on_success"]:
+                pending["on_success"](result)
+        finally:
+            if pending["on_finished"]:
+                pending["on_finished"]()
+
+
+def _detail(diagnosis_id: int, marker: str) -> dict[str, Any]:
+    diagnosis = {
+        "id": diagnosis_id,
+        "patient_id": diagnosis_id + 1000,
+        "patient_name": f"{marker}患者",
+        "phone": "13800138000",
+        "id_card": "110105199203071234",
+        "gender": 0,
+        "age": 34,
+        "region": f"{marker}杭州",
+        "address": f"{marker}健康路 8 号",
+        "height": 162,
+        "weight": 54.5,
+        "bmi": 20.8,
+        "systolic_pressure": 146,
+        "diastolic_pressure": 92,
+        "fasting_blood_sugar": 8.2,
+        "chief_complaint": f"{marker}主诉口渴乏力",
+        "present_illness": f"{marker}现病史半年血糖波动",
+        "past_history": f"{marker}既往高血压五年",
+        "allergy_history": f"{marker}青霉素过敏",
+        "family_history": f"{marker}父亲糖尿病",
+        "clinical_diagnosis": f"{marker}气阴两虚",
+        "diabetes_discovery_year": 6,
+        "current_medications": [f"{marker}二甲双胍", "阿卡波糖"],
+        "smoking": "不吸烟",
+        "sleep_condition": [f"{marker}易醒", "多梦"],
+        "local_hospital_diagnosis": [f"{marker}2 型糖尿病", "高血压"],
+        "diet_condition": [f"{marker}偏甜", "夜宵"],
+        "body_feeling": [f"{marker}乏力", "四肢沉重"],
+        "tongue": f"{marker}舌淡红",
+        "tongue_coating": f"{marker}苔薄白",
+        "pulse": f"{marker}脉细",
+        "remark": f"{marker}继续监测",
+        "latest_prescription_order": {
+            "id": f"{marker}-RX-09",
+            "status_text": "待配药",
+        },
+    }
+    for index in range(12):
+        diagnosis[f"custom_field_{index}"] = f"{marker}扩展病历字段 {index}"
+    return {
+        "diagnosis": diagnosis,
+        "patient": {
+            "id": diagnosis_id + 1000,
+            "patient_name": f"{marker}患者",
+            "phone": "13800138000",
+            "id_card": "110105199203071234",
+            "gender": 0,
+            "age": 34,
+            "region": f"{marker}杭州",
+            "address": f"{marker}健康路 8 号",
+        },
+        "appointment": {"doctor_name": f"{marker}陈医生"},
+    }
+
+
+class WorkspaceRepository:
+    def __init__(self, *, include_foreign_rows: bool = True) -> None:
+        self.details = {501: _detail(501, "甲"), 502: _detail(502, "乙")}
+        self.include_foreign_rows = include_foreign_rows
+        self.failures: set[tuple[str, int]] = set()
+        self.calls: list[tuple[str, int]] = []
+        self.prescription_detail_calls: list[int] = []
+        self.prescription_overrides: dict[int, dict[str, Any]] = {}
+        self.report_payload: Any = []
+
+    def _check(self, name: str, diagnosis_id: int) -> None:
+        self.calls.append((name, diagnosis_id))
+        if (name, diagnosis_id) in self.failures:
+            raise RuntimeError(f"{name} 暂时不可用")
+
+    def get_diagnosis_detail(
+        self,
+        diagnosis_id: int,
+        *,
+        readonly: bool = False,
+    ) -> dict[str, Any]:
+        del readonly
+        self._check("get_diagnosis_detail", diagnosis_id)
+        return self.details[diagnosis_id]
+
+    def list_im_chat_messages(
+        self,
+        diagnosis_id: int,
+        *,
+        only_archived: bool = True,
+    ) -> list[dict[str, Any]]:
+        del only_archived
+        self._check("list_im_chat_messages", diagnosis_id)
+        return []
+
+    def list_patient_ai_reports(self, patient_id: int) -> Any:
+        self.calls.append(("list_patient_ai_reports", patient_id))
+        return self.report_payload
+
+    def get_doctor_notes(self, diagnosis_id: int) -> list[dict[str, Any]]:
+        self._check("get_doctor_notes", diagnosis_id)
+        marker = "甲" if diagnosis_id == 501 else "乙"
+        rows = [
+            {
+                "id": diagnosis_id * 10 + 1,
+                "diagnosis_id": diagnosis_id,
+                "create_time": "2026-08-18 09:20",
+                "content": f"{marker}医生检查记录",
+                "tongue_images": [
+                    {
+                        "name": f"{marker}舌苔照片.jpg",
+                        "url": f"https://media.example.invalid/{marker}/tongue.jpg",
+                    }
+                ],
+                "report_files": [
+                    {
+                        "name": f"{marker}血糖报告.pdf",
+                        "url": f"https://media.example.invalid/{marker}/report.pdf",
+                    },
+                    {
+                        "name": f"{marker}本地危险附件.pdf",
+                        "url": "file:///C:/private/unsafe.pdf",
+                    },
+                ],
+            }
+        ]
+        if self.include_foreign_rows:
+            rows.append(
+                {
+                    "id": 99901,
+                    "diagnosis_id": 999,
+                    "content": "错误诊单附件哨兵",
+                    "tongue_images": [
+                        {
+                            "name": "错误诊单舌苔.jpg",
+                            "url": "https://media.example.invalid/wrong.jpg",
+                        }
+                    ],
+                }
+            )
+        return rows
+
+    def get_tracking_window(self, diagnosis_id: int) -> dict[str, Any]:
+        self._check("get_tracking_window", diagnosis_id)
+        marker = "甲" if diagnosis_id == 501 else "乙"
+        blood_records = [
+            {
+                "id": diagnosis_id * 10 + 2,
+                "diagnosis_id": diagnosis_id,
+                "record_date": "2026-08-18",
+                "fasting_blood_sugar": f"{marker}8.2",
+                "postprandial_blood_sugar": f"{marker}12.4",
+                "systolic_pressure": f"{marker}146",
+                "diastolic_pressure": f"{marker}92",
+            }
+        ]
+        if self.include_foreign_rows:
+            blood_records.append(
+                {
+                    "id": 99902,
+                    "diagnosis_id": 999,
+                    "record_date": "2026-08-18",
+                    "fasting_blood_sugar": "错误诊单血糖 19.9",
+                }
+            )
+        return {
+            "diagnosis_id": diagnosis_id,
+            "blood_records": blood_records,
+            "diet_records": [
+                {
+                    "id": diagnosis_id * 10 + 3,
+                    "diagnosis_id": diagnosis_id,
+                    "record_date": "2026-08-18",
+                    "breakfast_foods": f"{marker}燕麦鸡蛋",
+                    "lunch_foods": f"{marker}杂粮饭",
+                }
+            ],
+            "exercise_records": [
+                {
+                    "id": diagnosis_id * 10 + 4,
+                    "diagnosis_id": diagnosis_id,
+                    "record_date": "2026-08-17",
+                    "exercise_type": f"{marker}散步",
+                    "duration": 35,
+                }
+            ],
+        }
+
+    def list_prescriptions_by_diagnosis(
+        self,
+        diagnosis_id: int,
+    ) -> list[dict[str, Any]]:
+        self._check("list_prescriptions_by_diagnosis", diagnosis_id)
+        marker = "甲" if diagnosis_id == 501 else "乙"
+        return [
+            {
+                "id": diagnosis_id * 10 + index,
+                "diagnosis_id": diagnosis_id,
+                "sn": f"{marker}-RX-{index}",
+                "prescription_date": f"2026-08-{10 + index}",
+                "prescription_summary": f"{marker}方剂 {index}",
+                "doctor_name": f"{marker}陈医生",
+                "status_text": "已审核",
+                "herbs": [{"name": f"{marker}黄芪", "dosage": index * 5, "unit": "g"}],
+            }
+            for index in range(1, 4)
+        ]
+
+    def get_prescription(self, prescription_id: int) -> dict[str, Any]:
+        self.prescription_detail_calls.append(prescription_id)
+        if prescription_id in self.prescription_overrides:
+            return self.prescription_overrides[prescription_id]
+        diagnosis_id = prescription_id // 10
+        return {
+            "id": prescription_id,
+            "diagnosis_id": diagnosis_id,
+            "sn": f"FULL-{prescription_id}",
+            "clinical_diagnosis": "气阴两虚",
+            "herbs": [{"name": "黄芪", "dosage": 15, "unit": "g"}],
+        }
+
+
+def _permissions() -> PermissionSet:
+    return PermissionSet(["tcm.diagnosis/aiAssistant", "cf.prescription/read"])
+
+
+def _pane_text(widget: QWidget) -> str:
+    parts = [child.text() for child in widget.findChildren(QLabel)]
+    parts.extend(child.text() for child in widget.findChildren(QPushButton))
+    parts.extend(child.text() for child in widget.findChildren(QLineEdit))
+    parts.extend(child.toPlainText() for child in widget.findChildren(QTextBrowser))
+    parts.extend(child.toPlainText() for child in widget.findChildren(QTextEdit))
+    return "\n".join(part for part in parts if part)
+
+
+def _open_dialog(
+    application: QApplication,
+    repository: WorkspaceRepository,
+    diagnosis_id: int = 501,
+) -> AiConsultDialog:
+    dialog = AiConsultDialog(repository, _permissions())
+    dialog.open_for(diagnosis_id=diagnosis_id, patient_id=diagnosis_id + 1000)
+    dialog.show()
+    application.processEvents()
+    return dialog
+
+
+def test_case_tab_renders_complete_owned_detail_as_readable_chinese(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    dialog = _open_dialog(application, WorkspaceRepository())
+    pane = dialog.records["病历资料"]
+    dialog.tabs.setCurrentIndex(1)
+    application.processEvents()
+
+    assert pane.findChild(QWidget, "AiConsultCaseGrid") is not None
+    text = _pane_text(pane)
+    for sentinel in (
+        "甲主诉口渴乏力",
+        "甲现病史半年血糖波动",
+        "甲既往高血压五年",
+        "甲青霉素过敏",
+        "甲父亲糖尿病",
+        "甲气阴两虚",
+        "甲2 型糖尿病",
+        "高血压",
+        "甲偏甜",
+        "夜宵",
+        "甲-RX-09",
+        "待配药",
+    ):
+        assert sentinel in text
+    assert "['" not in text
+    assert "{'" not in text
+
+    scroll = pane.findChild(QScrollArea)
+    assert scroll is not None and scroll.widgetResizable()
+    assert pane.geometry().isValid() and scroll.viewport().geometry().isValid()
+    assert scroll.verticalScrollBar().maximum() > 0
+    dialog.close()
+
+
+def test_all_four_record_tabs_use_the_selected_diagnosis_id(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    repository = WorkspaceRepository(include_foreign_rows=False)
+    dialog = _open_dialog(application, repository, diagnosis_id=501)
+
+    for method in (
+        "get_diagnosis_detail",
+        "get_doctor_notes",
+        "get_tracking_window",
+        "list_prescriptions_by_diagnosis",
+    ):
+        assert (method, 501) in repository.calls
+        assert all(
+            called_id == 501
+            for called_method, called_id in repository.calls
+            if called_method == method
+        )
+    assert ("list_patient_ai_reports", 1501) in repository.calls
+    dialog.close()
+
+
+def test_seed_cannot_replace_the_authoritative_patient_id(
+    application: QApplication,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    deferred = DeferredAsync()
+    monkeypatch.setattr(ai_consult_module, "run_async", deferred)
+    repository = WorkspaceRepository(include_foreign_rows=False)
+    dialog = AiConsultDialog(repository, _permissions())
+
+    dialog.open_for(
+        diagnosis_id=501,
+        patient_id=1501,
+        seed={"patient_id": 501, "patient_name": "错误种子"},
+    )
+
+    assert dialog.patient_id == 1501
+    deferred.complete(0)
+    application.processEvents()
+    assert dialog.patient_id == 1501
+    assert ("list_patient_ai_reports", 1501) in repository.calls
+    dialog.close()
+
+
+def test_detail_failure_or_wrong_owner_never_requests_patient_reports(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    failed_repository = WorkspaceRepository(include_foreign_rows=False)
+    failed_repository.failures.add(("get_diagnosis_detail", 501))
+    failed = _open_dialog(application, failed_repository)
+    assert all(
+        method != "list_patient_ai_reports"
+        for method, _owner in failed_repository.calls
+    )
+    failed.close()
+
+    wrong_repository = WorkspaceRepository(include_foreign_rows=False)
+    wrong_repository.details[501] = _detail(999, "越权")
+    wrong = _open_dialog(application, wrong_repository)
+    assert all(
+        method != "list_patient_ai_reports"
+        for method, _owner in wrong_repository.calls
+    )
+    wrong.close()
+
+
+def test_patient_report_response_owner_must_match_exactly(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    repository = WorkspaceRepository(include_foreign_rows=False)
+    repository.report_payload = {
+        "patient_id": "1501",
+        "reports": [
+            {
+                "patient_id": 1501,
+                "report": {"diagnosis": "不应显示的越权报告"},
+            }
+        ],
+    }
+    dialog = _open_dialog(application, repository)
+
+    assert ("list_patient_ai_reports", 1501) in repository.calls
+    assert "不应显示的越权报告" not in _pane_text(dialog)
+    assert not ai_consult_module._report_response_matches_patient(
+        repository.report_payload,
+        1501,
+    )
+    dialog.close()
+
+
+def test_exam_tab_filters_foreign_attachments_and_blocks_file_urls(
+    application: QApplication,
+    immediate_async: None,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    opened: list[str] = []
+    monkeypatch.setattr(
+        ai_consult_module,
+        "open_safe_http_url",
+        lambda target: opened.append(target) or True,
+    )
+    dialog = _open_dialog(application, WorkspaceRepository())
+    pane = dialog.records["检查检验"]
+    dialog.tabs.setCurrentIndex(2)
+    application.processEvents()
+
+    assert pane.findChild(QWidget, "AiConsultExamTimeline") is not None
+    text = _pane_text(pane)
+    assert "甲舌苔照片.jpg" in text
+    assert "甲血糖报告.pdf" in text
+    assert "甲本地危险附件.pdf" in text
+    assert "错误诊单附件哨兵" not in text
+    assert "错误诊单舌苔.jpg" not in text
+
+    buttons = pane.findChildren(QPushButton, "AiConsultMediaOpen")
+    assert len(buttons) == 3
+    thumbnails = pane.findChildren(QPushButton, "AiConsultTongueThumb")
+    assert len(thumbnails) == 1
+    assert thumbnails[0].isEnabled()
+    assert thumbnails[0].accessibleName() == "舌苔图片点击查看"
+    assert thumbnails[0].property("loadState") == "blocked"
+    assert pane.state_label.property("state") == "warning"  # type: ignore[attr-defined]
+    assert pane.retry_button.isHidden()  # type: ignore[attr-defined]
+    unsafe = next(button for button in buttons if "本地危险附件" in button.text())
+    assert not unsafe.isEnabled()
+    for button in buttons:
+        button.click()
+    assert len(opened) == 2
+    assert all(target.startswith(("http://", "https://")) for target in opened)
+    assert all(not target.startswith("file:") for target in opened)
+    dialog.close()
+
+
+def test_tongue_thumbnail_auto_get_requires_configured_https_origin(
+    application: QApplication,
+    immediate_async: None,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    requested: list[str] = []
+
+    class RecordingRemoteImageButton(QPushButton):
+        def __init__(self, source: str, **kwargs: Any) -> None:
+            super().__init__(kwargs.get("parent"))
+            requested.append(source)
+            self.setObjectName(str(kwargs.get("object_name") or ""))
+            self.setAccessibleName(
+                str(kwargs.get("fallback_text") or "").replace("\n", "")
+            )
+
+    monkeypatch.setattr(
+        ai_consult_module,
+        "_RemoteImageButton",
+        RecordingRemoteImageButton,
+    )
+
+    untrusted = _open_dialog(application, WorkspaceRepository())
+    assert requested == []
+    untrusted.close()
+
+    trusted_repository = WorkspaceRepository()
+    trusted_repository.trusted_media_domains = ["media.example.invalid"]
+    assert not ai_consult_module._trusted_thumbnail_url(
+        trusted_repository,
+        "http://media.example.invalid/甲/tongue.jpg",
+    )
+    assert not ai_consult_module._trusted_thumbnail_url(
+        trusted_repository,
+        "https://sub.media.example.invalid/甲/tongue.jpg",
+    )
+    trusted = _open_dialog(application, trusted_repository)
+    assert requested == ["https://media.example.invalid/甲/tongue.jpg"]
+    trusted.close()
+
+
+def test_three_prescription_cards_open_exact_details_and_reject_wrong_or_late_ids(
+    application: QApplication,
+    immediate_async: None,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    repository = WorkspaceRepository(include_foreign_rows=False)
+    opened: list[int] = []
+
+    class FakePrescriptionDetailDialog:
+        def __init__(self, prescription: Any, **_kwargs: Any) -> None:
+            self.prescription = prescription
+
+        def exec(self) -> None:
+            opened.append(int(self.prescription["id"]))
+
+    monkeypatch.setattr(
+        prescription_module,
+        "PrescriptionDetailDialog",
+        FakePrescriptionDetailDialog,
+    )
+    dialog = _open_dialog(application, repository)
+    pane = dialog.records["处方记录"]
+    dialog.tabs.setCurrentIndex(3)
+    application.processEvents()
+
+    cards = pane.findChildren(QWidget, "AiConsultPrescriptionCard")
+    buttons = sorted(
+        pane.findChildren(QPushButton, "AiConsultPrescriptionOpen"),
+        key=lambda button: int(button.property("prescriptionId")),
+    )
+    expected_ids = [5011, 5012, 5013]
+    assert len(cards) == len(buttons) == 3
+    assert [int(button.property("prescriptionId")) for button in buttons] == expected_ids
+    assert all(button.text() == "查看详情" for button in buttons)
+    for button in buttons:
+        button.click()
+    assert repository.prescription_detail_calls == expected_ids
+    assert opened == expected_ids
+
+    repository.prescription_overrides[5011] = {
+        "id": 9999,
+        "diagnosis_id": 501,
+    }
+    buttons[0].click()
+    assert repository.prescription_detail_calls[-1] == 5011
+    assert opened == expected_ids
+    repository.prescription_overrides.pop(5011)
+
+    repository.prescription_overrides[5011] = {"id": 5011}
+    buttons[0].click()
+    assert repository.prescription_detail_calls[-1] == 5011
+    assert opened == expected_ids
+    repository.prescription_overrides.pop(5011)
+
+    calls_before_unowned_source = list(repository.prescription_detail_calls)
+    dialog._open_prescription_detail({"id": 5011})
+    assert repository.prescription_detail_calls == calls_before_unowned_source
+
+    deferred = DeferredAsync()
+    monkeypatch.setattr(ai_consult_module, "run_async", deferred)
+    buttons[0].click()
+    buttons[1].click()
+    assert len(deferred.pending) == 2
+    deferred.complete(1)
+    application.processEvents()
+    deferred.complete(0)
+    application.processEvents()
+    assert repository.prescription_detail_calls[-2:] == [5012, 5011]
+    assert opened == [*expected_ids, 5012]
+    dialog.close()
+
+
+def test_health_tab_masks_sensitive_patient_data_and_renders_tracking_window(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    dialog = _open_dialog(application, WorkspaceRepository())
+    pane = dialog.records["健康档案"]
+    dialog.tabs.setCurrentIndex(4)
+    application.processEvents()
+
+    assert pane.findChild(QWidget, "AiConsultHealthGrid") is not None
+    text = _pane_text(pane)
+    for sentinel in (
+        "甲患者",
+        "甲杭州",
+        "甲健康路 8 号",
+        "138****8000",
+        "110***********1234",
+        "甲8.2",
+        "甲12.4",
+        "甲146",
+        "甲92",
+        "甲燕麦鸡蛋",
+        "甲杂粮饭",
+        "甲散步",
+        "35",
+        "甲气阴两虚",
+        "甲二甲双胍",
+        "阿卡波糖",
+        "不吸烟",
+        "甲易醒",
+        "多梦",
+    ):
+        assert sentinel in text
+    assert pane.findChild(QWidget, "AiConsultDiagnosisHealthSummary") is not None
+    assert "13800138000" not in text
+    assert "110105199203071234" not in text
+    assert "错误诊单血糖 19.9" not in text
+    assert pane.state_label.property("state") == "warning"  # type: ignore[attr-defined]
+    assert pane.retry_button.isHidden()  # type: ignore[attr-defined]
+    dialog.close()
+
+
+def test_ownerless_notes_prescriptions_and_tracking_rows_fail_closed_as_warning(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    class OwnerlessRepository(WorkspaceRepository):
+        def get_doctor_notes(self, diagnosis_id: int) -> list[dict[str, Any]]:
+            rows = super().get_doctor_notes(diagnosis_id)
+            for row in rows:
+                row.pop("diagnosis_id", None)
+            return rows
+
+        def list_prescriptions_by_diagnosis(
+            self,
+            diagnosis_id: int,
+        ) -> list[dict[str, Any]]:
+            rows = super().list_prescriptions_by_diagnosis(diagnosis_id)
+            for row in rows:
+                row.pop("diagnosis_id", None)
+            return rows
+
+        def get_tracking_window(self, diagnosis_id: int) -> dict[str, Any]:
+            result = super().get_tracking_window(diagnosis_id)
+            for key in ("blood_records", "diet_records", "exercise_records"):
+                for row in result[key]:
+                    row.pop("diagnosis_id", None)
+            return result
+
+    dialog = _open_dialog(
+        application,
+        OwnerlessRepository(include_foreign_rows=False),
+    )
+    exam = dialog.records["检查检验"]
+    prescriptions = dialog.records["处方记录"]
+    health = dialog.records["健康档案"]
+
+    assert "甲医生检查记录" not in _pane_text(exam)
+    assert not prescriptions.findChildren(QWidget, "AiConsultPrescriptionCard")
+    assert "甲燕麦鸡蛋" not in _pane_text(health)
+    for pane in (exam, prescriptions, health):
+        assert pane.state_label.property("state") == "warning"  # type: ignore[attr-defined]
+        assert pane.retry_button.isHidden()  # type: ignore[attr-defined]
+    dialog.close()
+
+
+def test_ownerless_im_messages_fail_closed_before_chat_rendering(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    class OwnerlessMessageRepository(WorkspaceRepository):
+        def list_im_chat_messages(
+            self,
+            diagnosis_id: int,
+            *,
+            only_archived: bool = True,
+        ) -> list[dict[str, Any]]:
+            del diagnosis_id, only_archived
+            return [
+                {
+                    "msg_id": "ownerless-message",
+                    "msg_type": "text",
+                    "text": "不应展示的无归属会话",
+                    "is_from_doctor": False,
+                }
+            ]
+
+    dialog = _open_dialog(application, OwnerlessMessageRepository())
+    chat_text = "\n".join(
+        label.text() for label in dialog.chat_host.findChildren(QLabel)
+    )
+
+    assert "不应展示的无归属会话" not in chat_text
+    dialog.close()
+
+
+def test_tracking_response_without_diagnosis_owner_is_filtered_without_retry(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    class OwnerlessTrackingRepository(WorkspaceRepository):
+        def get_tracking_window(self, diagnosis_id: int) -> dict[str, Any]:
+            result = super().get_tracking_window(diagnosis_id)
+            result.pop("diagnosis_id", None)
+            return result
+
+    dialog = _open_dialog(
+        application,
+        OwnerlessTrackingRepository(include_foreign_rows=False),
+    )
+    pane = dialog.records["健康档案"]
+
+    assert "甲燕麦鸡蛋" not in _pane_text(pane)
+    assert pane.state_label.property("state") == "warning"  # type: ignore[attr-defined]
+    assert pane.retry_button.isHidden()  # type: ignore[attr-defined]
+    dialog.close()
+
+
+def test_late_workspace_a_response_cannot_pollute_selected_workspace_b(
+    application: QApplication,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    repository = WorkspaceRepository(include_foreign_rows=False)
+    deferred = DeferredAsync()
+    monkeypatch.setattr(ai_consult_module, "run_async", deferred)
+    dialog = AiConsultDialog(repository, _permissions())
+    dialog.open_for(diagnosis_id=501, patient_id=1501)
+    dialog.open_for(diagnosis_id=502, patient_id=1502)
+    dialog.show()
+    assert len(deferred.pending) == 2
+
+    deferred.complete(1)
+    application.processEvents()
+    deferred.complete(0)
+    application.processEvents()
+    for title in ("病历资料", "检查检验", "处方记录", "健康档案"):
+        text = _pane_text(dialog.records[title])
+        assert "乙" in text
+        assert "甲主诉口渴乏力" not in text
+        assert "甲医生检查记录" not in text
+        assert "甲-RX-1" not in text
+        assert "甲燕麦鸡蛋" not in text
+    assert dialog.diagnosis_id == 502
+    assert dialog._detail["diagnosis"]["id"] == 502
+    dialog.close()
+
+
+def test_mismatched_detail_owner_fails_closed_across_all_record_tabs(
+    application: QApplication,
+    immediate_async: None,
+) -> None:
+    repository = WorkspaceRepository()
+    repository.details[501] = _detail(999, "越权")
+    dialog = _open_dialog(application, repository)
+
+    forbidden = (
+        "越权主诉口渴乏力",
+        "甲医生检查记录",
+        "甲舌苔照片.jpg",
+        "甲-RX-1",
+        "甲燕麦鸡蛋",
+    )
+    for title in ("病历资料", "检查检验", "处方记录", "健康档案"):
+        pane = dialog.records[title]
+        text = _pane_text(pane)
+        assert all(sentinel not in text for sentinel in forbidden)
+        state = pane.state_label  # type: ignore[attr-defined]
+        retry = pane.retry_button  # type: ignore[attr-defined]
+        assert state.objectName() == "AiConsultRecordState"
+        assert retry.objectName() == "AiConsultRecordRetry"
+        assert state is not None and state.property("state") == "warning"
+        assert retry is not None and retry.isHidden()
+    assert all(
+        method != "list_patient_ai_reports" for method, _owner in repository.calls
+    )
+    dialog.close()
+
+
+@pytest.mark.parametrize(
+    ("method", "error_tabs", "success_sentinels"),
+    [
+        (
+            "get_diagnosis_detail",
+            {"病历资料", "健康档案"},
+            {"检查检验": "甲医生检查记录", "处方记录": "甲-RX-1"},
+        ),
+        (
+            "get_doctor_notes",
+            {"检查检验"},
+            {
+                "病历资料": "甲主诉口渴乏力",
+                "处方记录": "甲-RX-1",
+                "健康档案": "甲燕麦鸡蛋",
+            },
+        ),
+        (
+            "get_tracking_window",
+            {"健康档案"},
+            {
+                "病历资料": "甲主诉口渴乏力",
+                "检查检验": "甲医生检查记录",
+                "处方记录": "甲-RX-1",
+            },
+        ),
+        (
+            "list_prescriptions_by_diagnosis",
+            {"处方记录"},
+            {
+                "病历资料": "甲主诉口渴乏力",
+                "检查检验": "甲医生检查记录",
+                "健康档案": "甲燕麦鸡蛋",
+            },
+        ),
+    ],
+)
+def test_one_failed_source_has_local_error_retry_and_preserves_other_sections(
+    application: QApplication,
+    immediate_async: None,
+    method: str,
+    error_tabs: set[str],
+    success_sentinels: dict[str, str],
+) -> None:
+    repository = WorkspaceRepository(include_foreign_rows=False)
+    repository.failures.add((method, 501))
+    dialog = _open_dialog(application, repository)
+
+    for title in error_tabs:
+        pane = dialog.records[title]
+        state = pane.state_label  # type: ignore[attr-defined]
+        retry = pane.retry_button  # type: ignore[attr-defined]
+        assert state.objectName() == "AiConsultRecordState"
+        assert retry.objectName() == "AiConsultRecordRetry"
+        assert state is not None and state.property("state") == "error"
+        assert retry is not None and not retry.isHidden() and retry.isEnabled()
+    for title, sentinel in success_sentinels.items():
+        assert sentinel in _pane_text(dialog.records[title])
+        state = dialog.records[title].state_label  # type: ignore[attr-defined]
+        assert state is not None and state.property("state") != "error", (
+            title,
+            state.text(),
+            state.property("state"),
+        )
+
+    repository.failures.clear()
+    dialog.records[next(iter(error_tabs))].retry_button.click()  # type: ignore[attr-defined]
+    application.processEvents()
+    for pane in dialog.records.values():
+        state = pane.state_label  # type: ignore[attr-defined]
+        assert state is not None and state.property("state") != "error"
+    dialog.close()
@@ -0,0 +1,128 @@
+"""Repository contracts for privacy-safe AI patient diagnosis options."""
+
+from __future__ import annotations
+
+from datetime import date
+from inspect import signature
+from typing import Any
+
+import pytest
+
+from doctor_workstation.services.mock_repository import DemoDoctorRepository
+from doctor_workstation.services.repository import DoctorRepository, RemoteDoctorRepository
+
+
+class AiPatientOptionsClient:
+    """Record the exact AI option request and return deliberately unsafe extras."""
+
+    def __init__(self) -> None:
+        self.calls: list[tuple[str, dict[str, Any]]] = []
+
+    def get(self, endpoint: str, params: dict[str, Any] | None = None) -> Any:
+        self.calls.append((endpoint, dict(params or {})))
+        return {
+            "lists": [
+                {
+                    "diagnosis_id": 9001,
+                    "source_patient_id": 42,
+                    "patient_name": "测试患者",
+                    "phone_masked": "13800138000",
+                    "phone": "13800138000",
+                    "id_card": "110101199001011234",
+                    "gender": 2,
+                    "age": 36,
+                    "diagnosis_date": "2026-08-19",
+                    "diagnosis_summary": "随访诊单",
+                    "last_visit_at": "2026-08-19 09:30:00",
+                    "next_appointment_at": "2026-08-26 09:30:00",
+                }
+            ],
+            "count": 1,
+        }
+
+
+def test_protocol_exposes_ai_patient_option_page_defaults() -> None:
+    method = signature(DoctorRepository.list_ai_patient_options)
+
+    assert method.parameters["page_no"].default == 1
+    assert method.parameters["page_size"].default == 20
+    assert method.parameters["keyword"].default == ""
+
+
+def test_remote_ai_patient_options_use_exact_endpoint_params_and_safe_dto() -> None:
+    client = AiPatientOptionsClient()
+    repository = RemoteDoctorRepository(client)  # type: ignore[arg-type]
+
+    page = repository.list_ai_patient_options(
+        page_no=3,
+        page_size=7,
+        keyword="  测试  ",
+    )
+
+    assert client.calls == [
+        (
+            "tcm.diagnosis/aiPatientOptions",
+            {"keyword": "测试", "page_no": 3, "page_size": 7},
+        )
+    ]
+    assert page.total == 1
+    assert page.page_no == 3
+    assert page.page_size == 7
+    assert page.items == [
+        {
+            "diagnosis_id": 9001,
+            "source_patient_id": 42,
+            "patient_name": "测试患者",
+            "phone_masked": "138****8000",
+            "gender": 2,
+            "age": 36,
+            "diagnosis_date": "2026-08-19",
+            "diagnosis_summary": "随访诊单",
+            "last_visit_at": "2026-08-19 09:30:00",
+            "next_appointment_at": "2026-08-26 09:30:00",
+        }
+    ]
+    assert page.items[0]["diagnosis_id"] != page.items[0]["source_patient_id"]
+    assert "phone" not in page.items[0]
+    assert "id_card" not in page.items[0]
+
+
+@pytest.mark.parametrize(("page_no", "page_size"), [(0, 20), (1, 0)])
+def test_remote_ai_patient_options_reject_invalid_pagination_before_get(
+    page_no: int,
+    page_size: int,
+) -> None:
+    client = AiPatientOptionsClient()
+    repository = RemoteDoctorRepository(client)  # type: ignore[arg-type]
+
+    with pytest.raises(ValueError, match="must be positive"):
+        repository.list_ai_patient_options(page_no=page_no, page_size=page_size)
+
+    assert client.calls == []
+
+
+def test_demo_ai_patient_options_are_stable_searchable_paginated_and_private() -> None:
+    repository = DemoDoctorRepository(today=date(2026, 8, 20))
+
+    first = repository.list_ai_patient_options(page_no=1, page_size=2)
+    second = repository.list_ai_patient_options(page_no=2, page_size=2)
+    repeated = repository.list_ai_patient_options(page_no=1, page_size=2)
+
+    assert first.total == 4
+    assert first.pages == 2
+    assert [row["diagnosis_id"] for row in first.items] == [504, 503]
+    assert [row["diagnosis_id"] for row in second.items] == [502, 501]
+    assert repeated.items == first.items
+    assert all(row["diagnosis_id"] != row["source_patient_id"] for row in first.items)
+    assert all("****" in row["phone_masked"] for row in first.items)
+    assert all("phone" not in row and "id_card" not in row for row in first.items)
+    assert "13700006618" not in repr(first.items)
+
+    by_diagnosis = repository.list_ai_patient_options(keyword="  503  ")
+    by_plain_phone = repository.list_ai_patient_options(keyword="15900007732")
+
+    assert [row["diagnosis_id"] for row in by_diagnosis.items] == [503]
+    assert [row["diagnosis_id"] for row in by_plain_phone.items] == [503]
+    assert by_plain_phone.items[0]["phone_masked"] == "159****7732"
+    assert "15900007732" not in repr(by_plain_phone.items)
+
@@ -3,7 +3,10 @@
 from __future__ import annotations

 import json
+from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
+from threading import Barrier, get_ident
+from typing import Any

 import httpx
 import pytest
@@ -17,6 +20,7 @@ from doctor_workstation.core.errors import (
    OpenPageRequiredError,
    WorkWechatBindingRequiredError,
 )
+from doctor_workstation.services import api_client as api_client_module
 from doctor_workstation.services.api_client import ApiClient
 from doctor_workstation.services.token_store import TokenStore

@@ -48,6 +52,41 @@ def test_get_normalises_adminapi_and_sends_contract_headers() -> None:
    )


+def test_default_client_allows_parallel_requests_with_independent_transports(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Production workers must not queue behind one process-wide HTTP lock."""
+
+    rendezvous = Barrier(2, timeout=2)
+    created: list[Any] = []
+    request_threads: set[int] = set()
+
+    class PooledClient:
+        def __init__(self, **_options: Any) -> None:
+            self.closed = False
+            created.append(self)
+
+        def request(self, _method: str, url: str, **_options: Any) -> httpx.Response:
+            request_threads.add(get_ident())
+            rendezvous.wait()
+            return httpx.Response(200, json={"code": 1, "data": url.rsplit("/", 1)[-1]})
+
+        def close(self) -> None:
+            self.closed = True
+
+    monkeypatch.setattr(api_client_module.httpx, "Client", PooledClient)
+    client = ApiClient("https://example.test", max_retries=0)
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        first = executor.submit(client.get, "patient/first")
+        second = executor.submit(client.get, "patient/second")
+        assert {first.result(timeout=3), second.result(timeout=3)} == {"first", "second"}
+    client.close()
+
+    assert len(created) == 2
+    assert len(request_threads) == 2
+    assert all(item.closed for item in created)
+
+
 def test_post_uses_json_and_never_retries_timeout() -> None:
    """Writes use JSON and a timeout never causes an automatic duplicate POST."""

@@ -74,6 +113,52 @@ def test_post_uses_json_and_never_retries_timeout() -> None:
    assert caught.value.data["attempts"] == 1


+def test_post_event_stream_sends_exact_contract_and_preserves_event_order() -> None:
+    requests: list[httpx.Request] = []
+    content = (
+        'event: start\ndata: {"model_key":"qwen"}\n\n'
+        'event: delta\ndata: {"content":"辨"}\n\n'
+        'event: delta\ndata: {"content":"证"}\n\n'
+        'event: done\ndata: {"model_label":"千问"}\n\n'
+    )
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(
+            200,
+            headers={"content-type": "text/event-stream; charset=utf-8"},
+            text=content,
+        )
+
+    client = ApiClient(
+        "https://example.test",
+        token="stream-token",
+        transport=httpx.MockTransport(handler),
+    )
+    events = list(
+        client.post_event_stream(
+            "tcm.diagnosis/aiAssistantStream",
+            {"id": 501, "task": "custom", "prompt": "如何辨证？"},
+        )
+    )
+    client.close()
+
+    assert [event["event"] for event in events] == ["start", "delta", "delta", "done"]
+    assert [event["data"] for event in events[1:3]] == [
+        {"content": "辨"},
+        {"content": "证"},
+    ]
+    request = requests[0]
+    assert request.headers["accept"] == "text/event-stream"
+    assert request.headers["token"] == "stream-token"
+    assert str(request.url).endswith("/adminapi/tcm.diagnosis/aiAssistantStream")
+    assert json.loads(request.content) == {
+        "id": 501,
+        "task": "custom",
+        "prompt": "如何辨证？",
+    }
+
+
 def test_multipart_post_lets_httpx_set_boundary_and_sends_form_fields(
    tmp_path: Path,
 ) -> None:
@@ -0,0 +1,425 @@
+"""Desktop auto-update check, download and payload discovery."""
+
+from __future__ import annotations
+
+import hashlib
+import zipfile
+from pathlib import Path
+
+import httpx
+import pytest
+
+from doctor_workstation.services import app_update
+from doctor_workstation.services.api_client import ApiClient
+from doctor_workstation.services.app_update import (
+    PACKAGE_TYPE_ARCHIVE,
+    PACKAGE_TYPE_INNO_SETUP,
+    AppUpdateError,
+    UpdatePackage,
+    apply_extracted_update,
+    apply_inno_setup_update,
+    compare_version,
+    discover_payload,
+    download_package,
+    fetch_update_offer,
+    normalize_version,
+    package_filename,
+    parse_update_offer,
+    safe_extract_zip,
+    validate_installer_download_policy,
+    validate_windows_installer,
+)
+
+
+def test_normalize_and_compare_versions() -> None:
+    assert normalize_version("0.2") == "0.2.0"
+    assert normalize_version("1.2.3.4") == "1.2.3"
+    assert normalize_version("nope") == ""
+    assert compare_version("0.1.0", "0.2.0") < 0
+    assert compare_version("0.2.0", "0.2.0") == 0
+    assert compare_version("1.0.0", "0.9.9") > 0
+
+
+def test_parse_offer_requires_hash_before_install() -> None:
+    offer = parse_update_offer(
+        {
+            "has_update": True,
+            "force": True,
+            "enabled": True,
+            "latest_version": "0.2.0",
+            "package": {
+                "url": "https://cdn.example.com/app.zip",
+                "sha256": "",
+                "size": 12,
+                "filename": "app.zip",
+            },
+            "can_install": True,
+        },
+        current_version="0.1.0",
+    )
+    assert offer.has_update is True
+    assert offer.can_install is False
+    assert offer.force is False
+    assert offer.package is None
+
+
+def test_parse_offer_accepts_explicit_inno_setup_type() -> None:
+    offer = parse_update_offer(
+        {
+            "has_update": True,
+            "enabled": True,
+            "latest_version": "0.2.0",
+            "platform": "windows",
+            "arch": "x64",
+            "package": {
+                "url": "https://cdn.example.com/DoctorWorkstation-Setup.exe",
+                "sha256": "a" * 64,
+                "size": 123,
+                "filename": "DoctorWorkstation-Setup.exe",
+                "type": "inno_setup",
+            },
+            "can_install": True,
+        },
+        current_version="0.1.0",
+        platform_name="windows",
+        arch="x64",
+    )
+    assert offer.can_install is True
+    assert offer.package is not None
+    assert offer.package.type == PACKAGE_TYPE_INNO_SETUP
+
+
+def test_parse_offer_disables_insecure_inno_setup_transport() -> None:
+    offer = parse_update_offer(
+        {
+            "has_update": True,
+            "force": True,
+            "enabled": True,
+            "latest_version": "0.2.0",
+            "platform": "windows",
+            "arch": "x64",
+            "package": {
+                "url": "http://cdn.example.com/DoctorWorkstation-Setup.exe",
+                "sha256": "a" * 64,
+                "type": "inno_setup",
+            },
+            "can_install": True,
+        },
+        current_version="0.1.0",
+        platform_name="windows",
+        arch="x64",
+    )
+    assert offer.has_update is True
+    assert offer.can_install is False
+    assert offer.force is False
+    assert offer.package is None
+
+
+@pytest.mark.parametrize("package_type", ["msi", "script", "unknown"])
+def test_parse_offer_rejects_unknown_package_type(package_type: str) -> None:
+    offer = parse_update_offer(
+        {
+            "has_update": True,
+            "latest_version": "0.2.0",
+            "platform": "windows",
+            "arch": "x64",
+            "package": {
+                "url": "https://cdn.example.com/update.bin",
+                "sha256": "a" * 64,
+                "type": package_type,
+            },
+            "can_install": True,
+        },
+        current_version="0.1.0",
+        platform_name="windows",
+        arch="x64",
+    )
+    assert offer.can_install is False
+    assert offer.force is False
+    assert offer.package is None
+
+
+def test_parse_offer_rejects_stale_or_wrong_platform_response() -> None:
+    base = {
+        "has_update": True,
+        "latest_version": "0.1.0",
+        "platform": "windows",
+        "arch": "x64",
+        "can_install": False,
+    }
+    stale = parse_update_offer(
+        base,
+        current_version="0.1.0",
+        platform_name="windows",
+        arch="x64",
+    )
+    wrong_platform = parse_update_offer(
+        {**base, "latest_version": "0.2.0", "platform": "macos"},
+        current_version="0.1.0",
+        platform_name="windows",
+        arch="x64",
+    )
+    assert stale.has_update is False
+    assert wrong_platform.has_update is False
+
+
+def test_fetch_update_offer_uses_check_endpoint() -> None:
+    requests: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(
+            200,
+            json={
+                "code": 1,
+                "data": {
+                    "has_update": True,
+                    "force": True,
+                    "enabled": True,
+                    "latest_version": "0.2.0",
+                    "title": "医生工作站 0.2.0",
+                    "notes": "修复登录",
+                    "package": {
+                        "url": "https://cdn.example.com/DoctorWorkstation.zip",
+                        "sha256": "a" * 64,
+                        "size": 2048,
+                        "filename": "DoctorWorkstation.zip",
+                    },
+                    "can_install": True,
+                },
+            },
+        )
+
+    with ApiClient("https://example.test", transport=httpx.MockTransport(handler)) as client:
+        offer = fetch_update_offer(
+            client,
+            current_version="0.1.0",
+            platform_name="windows",
+            arch="x64",
+        )
+
+    assert offer.has_update is True
+    assert offer.force is True
+    assert offer.can_install is True
+    assert offer.package is not None
+    assert "setting.desktop_workstation/check" in str(requests[0].url)
+    assert "current_version=0.1.0" in str(requests[0].url)
+    assert "platform=windows" in str(requests[0].url)
+
+
+def test_safe_extract_rejects_zip_slip(tmp_path: Path) -> None:
+    archive = tmp_path / "evil.zip"
+    with zipfile.ZipFile(archive, "w") as bundle:
+        bundle.writestr("../outside.txt", "nope")
+    with pytest.raises(AppUpdateError, match="非法路径"):
+        safe_extract_zip(archive, tmp_path / "out")
+
+
+def test_discover_windows_payload_prefers_internal_onedir(tmp_path: Path) -> None:
+    wrapped = tmp_path / "DoctorWorkstation"
+    wrapped.mkdir()
+    (wrapped / "_internal").mkdir()
+    (wrapped / "DoctorWorkstation.exe").write_bytes(b"mz")
+    (tmp_path / "Start_DoctorWorkstation.bat").write_text("start", encoding="utf-8")
+    assert discover_payload(tmp_path, platform_name="windows") == wrapped
+
+
+def test_discover_macos_payload_finds_app_bundle(tmp_path: Path) -> None:
+    app = tmp_path / "DoctorWorkstation.app"
+    macos = app / "Contents" / "MacOS"
+    macos.mkdir(parents=True)
+    (macos / "DoctorWorkstation").write_text("bin", encoding="utf-8")
+    assert discover_payload(tmp_path, platform_name="macos") == app
+
+
+def test_download_package_verifies_sha256_and_reports_progress(tmp_path: Path) -> None:
+    payload = b"doctor-workstation-zip"
+    digest = hashlib.sha256(payload).hexdigest()
+    progress: list[tuple[int, int]] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        del request
+        return httpx.Response(
+            200,
+            content=payload,
+            headers={"content-length": str(len(payload))},
+        )
+
+    destination = tmp_path / "pkg.zip"
+    download_package(
+        "https://cdn.example.com/pkg.zip",
+        destination,
+        sha256=digest,
+        progress=lambda received, total: progress.append((received, total)),
+        transport=httpx.MockTransport(handler),
+    )
+    assert destination.read_bytes() == payload
+    assert progress[-1][0] == len(payload)
+
+
+def test_download_package_rejects_hash_mismatch(tmp_path: Path) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        del request
+        return httpx.Response(200, content=b"tampered")
+
+    destination = tmp_path / "pkg.zip"
+    with pytest.raises(AppUpdateError, match="校验失败"):
+        download_package(
+            "https://cdn.example.com/pkg.zip",
+            destination,
+            sha256="b" * 64,
+            transport=httpx.MockTransport(handler),
+        )
+    assert not destination.exists()
+
+
+def test_download_package_rejects_declared_size_mismatch(tmp_path: Path) -> None:
+    payload = b"short"
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        del request
+        return httpx.Response(200, content=payload)
+
+    destination = tmp_path / "pkg.exe"
+    with pytest.raises(AppUpdateError, match="文件大小"):
+        download_package(
+            "https://cdn.example.com/pkg.exe",
+            destination,
+            sha256=hashlib.sha256(payload).hexdigest(),
+            expected_size=len(payload) + 1,
+            transport=httpx.MockTransport(handler),
+        )
+    assert not destination.exists()
+    assert not (tmp_path / "pkg.exe.part").exists()
+
+
+def test_windows_installer_download_policy_requires_verified_https() -> None:
+    with pytest.raises(AppUpdateError, match="HTTPS"):
+        validate_installer_download_policy(
+            "http://cdn.example.com/setup.exe",
+            verify_ssl=True,
+        )
+    with pytest.raises(AppUpdateError, match="证书校验"):
+        validate_installer_download_policy(
+            "https://cdn.example.com/setup.exe",
+            verify_ssl=False,
+        )
+    validate_installer_download_policy(
+        "http://127.0.0.1/setup.exe",
+        verify_ssl=True,
+    )
+
+
+def test_validate_windows_installer_requires_exe_and_pe_header(tmp_path: Path) -> None:
+    installer = tmp_path / "Setup.exe"
+    installer.write_bytes(b"MZ" + b"\0" * 32)
+    assert validate_windows_installer(installer) == installer.resolve()
+
+    invalid = tmp_path / "invalid.exe"
+    invalid.write_bytes(b"PK")
+    with pytest.raises(AppUpdateError, match="PE"):
+        validate_windows_installer(invalid)
+
+
+def test_inno_setup_applier_waits_installs_and_restarts_installed_exe(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    install_root = tmp_path / "installed"
+    install_root.mkdir()
+    installed_exe = install_root / "DoctorWorkstation.exe"
+    installed_exe.write_bytes(b"MZ")
+    installer = tmp_path / "DoctorWorkstation-Setup.exe"
+    installer.write_bytes(b"MZ" + b"\0" * 32)
+    spawned: dict[str, Path] = {}
+
+    monkeypatch.setattr(app_update.sys, "platform", "win32")
+
+    def capture_spawn(
+        script: Path,
+        *,
+        installer: Path,
+        restart_exe: Path,
+        helper_log_file: Path,
+        installer_log_file: Path,
+    ) -> None:
+        spawned.update(
+            script=script,
+            installer=installer,
+            restart_exe=restart_exe,
+            helper_log_file=helper_log_file,
+            installer_log_file=installer_log_file,
+        )
+
+    monkeypatch.setattr(app_update, "_spawn_inno_setup_applier", capture_spawn)
+    apply_inno_setup_update(installer, install_root=install_root)
+
+    script_text = spawned["script"].read_text(encoding="utf-8-sig")
+    assert spawned["installer"] == installer.resolve()
+    assert spawned["restart_exe"] == installed_exe
+    assert "/VERYSILENT" in script_text
+    assert "/RESTARTEXITCODE=3010" in script_text
+    assert "/NOFORCECLOSEAPPLICATIONS" in script_text
+    assert "$HelperLogFile" in script_text
+    assert "$InstallerLogFile" in script_text
+    assert "Restart-Application" in script_text
+
+
+def test_archive_applier_restarts_from_install_root(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    payload = tmp_path / "payload"
+    payload.mkdir()
+    (payload / "DoctorWorkstation.exe").write_bytes(b"MZ")
+    install_root = tmp_path / "installed"
+    install_root.mkdir()
+    installed_exe = install_root / "DoctorWorkstation.exe"
+    installed_exe.write_bytes(b"MZ")
+    captured: dict[str, Path] = {}
+    script = tmp_path / "apply.ps1"
+    script.write_text("", encoding="utf-8")
+
+    def capture_script(**kwargs: Path) -> Path:
+        captured.update(kwargs)
+        return script
+
+    monkeypatch.setattr(app_update, "_write_apply_script", capture_script)
+    monkeypatch.setattr(app_update, "_spawn_applier", lambda *args, **kwargs: None)
+    apply_extracted_update(payload, install_root=install_root)
+    assert captured["restart_exe"] == installed_exe
+
+
+def test_inno_setup_applier_reports_helper_start_failure(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    install_root = tmp_path / "installed"
+    install_root.mkdir()
+    (install_root / "DoctorWorkstation.exe").write_bytes(b"MZ")
+    installer = tmp_path / "Setup.exe"
+    installer.write_bytes(b"MZ")
+    monkeypatch.setattr(app_update.sys, "platform", "win32")
+
+    def fail_spawn(*args: object, **kwargs: object) -> None:
+        del args, kwargs
+        raise OSError("blocked")
+
+    monkeypatch.setattr(app_update, "_spawn_inno_setup_applier", fail_spawn)
+
+    with pytest.raises(AppUpdateError, match="无法启动 Windows 更新助手"):
+        apply_inno_setup_update(installer, install_root=install_root)
+
+
+def test_package_filename_defaults_match_package_type() -> None:
+    archive = UpdatePackage("https://cdn.example.com/", "a" * 64, 0, "")
+    installer = UpdatePackage(
+        "https://cdn.example.com/",
+        "a" * 64,
+        0,
+        "",
+        type=PACKAGE_TYPE_INNO_SETUP,
+    )
+    assert package_filename(archive, "0.2.0").endswith(".zip")
+    assert package_filename(installer, "0.2.0").endswith(".exe")
+    assert archive.type == PACKAGE_TYPE_ARCHIVE
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Your Name	562fe0ea0e	更新	2026-08-24 16:56:37 +08:00
Your Name	d9bb94cd3f	更新	2026-08-22 10:50:20 +08:00
Your Name	9646ccd3f6	gengxin	2026-08-22 10:49:34 +08:00
Your Name	43e5411b6a	更新	2026-08-22 10:46:13 +08:00
Your Name	c06d293424	更新	2026-08-22 08:51:35 +08:00
Your Name	6c444a4a04	更新	2026-08-20 18:01:36 +08:00
Your Name	cc6173e5b0	更新	2026-08-20 17:56:08 +08:00
Your Name	5794f60c5d	更新bug	2026-08-20 17:47:14 +08:00
Your Name	35f91ee37a	更新	2026-08-18 14:14:43 +08:00
Your Name	bc1228a310	geng	2026-08-18 14:08:38 +08:00