HEL-171 部署合并：公司端工作台待办同步(bf5754e) + 登录限流运维开关(551909a)

确认成功后重拉 /api/company/workspace，去确认数字与本月待办共用同一口径；
新增公司端确认接口与 3→2→1→0 集成测试，失败/重复确认不误减。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

.gitignore

@@ -22,3 +22,7 @@ nul
 vendor_pkgs/
 node_modules/
 package-lock.json
+
+# local vendor for agent test env (not shipped)
+.vendor/
+vendor_wheels/

README.md

@@ -45,6 +45,8 @@ SHA-256 内容哈希不可变保存，重复上传返回 `duplicate` 状态并
   公司账号创建时生成随机一次性初始密码，只在创建响应中显示一次，
   首次登录强制改密（「重置密码」同样生成随机一次性密码并吊销会话）。
 - 会话有效期 8 小时；同一账号同一 IP 10 分钟内登录失败 5 次将被限流。
+  内网测试环境可设 `APP_LOGIN_RATE_LIMIT_DISABLED=1` 暂时关闭该锁定
+  （默认未设置 = 保持限流，正式环境不得开启该变量）。
 
 访问地址（服务默认监听 `0.0.0.0:4173`，同局域网设备把 `127.0.0.1` 换成本机局域网 IP 即可访问；可用环境变量 `APP_HOST` / `APP_PORT` 覆盖）：
 

docs/README.md

@@ -0,0 +1,21 @@
+# 总账项目手册
+
+最后核对：2026-08-23。核对依据是当前 `main` 最新代码（`5f21527`）、数据库迁移、接口、测试和近期提交记录。
+
+这是接手本项目的第一站。阅读顺序如下：
+
+1. [项目需求](项目需求.md)：先知道系统要解决什么问题，以及哪些规则绝不能碰。
+2. [最新进度](最新进度.md)：再确认哪些能力已经真实完成，哪些仍未完成。
+3. [任务清单](任务清单.md)：最后挑选下一项工作，避免重复做已经完成的事。
+4. 需要技术细节时，再查看 `decisions/` 中的技术决定和 `issues/` 中保留的历史任务规格。
+
+## 维护规矩
+
+- 每新增、开始、完成、取消一项任务，负责的智能体都要在同一次提交里更新 `最新进度.md` 和 `任务清单.md`。
+- 新功能改变产品规则时，同时更新 `项目需求.md`；技术方案有变化时，补充 `decisions/` 的决定记录。
+- 写进手册的“已完成”必须能在代码、测试或已合并提交中找到依据；只有计划、页面演示或口头讨论的内容，一律写为“未完成”。
+- 不删除历史文档。旧内容与当前代码不一致时，在旧文件开头加“已过时，仅留档备查”提示，并在本目录写新版说明。
+
+## 旧交接说明
+
+`HANDOFF.md` 是 2026-08-06 的历史交接稿，已经不反映当前实现，保留仅作对照。当前事实以本手册三份正文为准。

docs/decisions/003-auth.md

@@ -26,6 +26,9 @@
 - 计数来自 `login_attempts` 表，窗口为滚动 10 分钟；触发后返回 429，
   且在窗口内不再记录新尝试，行为确定、可测试。
 - 失败提示统一为「账号或密码不正确」，不泄露是哪一部分错误。
+- 运维开关：环境变量 `APP_LOGIN_RATE_LIMIT_DISABLED` 设为 `1/true/yes/on`
+  时完全跳过限流检查，仅限内网测试环境临时使用；默认未设置，保持
+  「5 次失败锁 10 分钟」的生产安全策略不变。
 
 ## 角色与公司绑定
 

docs/任务清单.md

@@ -0,0 +1,29 @@
+# 任务清单
+
+最后核对：2026-08-23。状态以当前代码和已合并提交为准。
+
+## 正在做
+
+- 当前没有已确认正在进行的业务功能开发。下一项工作开始前，先在此处写明负责人、范围和验收标准。
+
+## 已做完
+
+- 六类银行流水模板识别与解析。
+- 数据库迁移、不可变原始证据、导入批次和重复导入处理。
+- 管理员/公司用户登录、密码策略、会话、限流、服务端公司隔离和审计。
+- 动态公司、用户、银行账户、别名与账户审核流程。
+- 导入接口加固、逐工作表确认、失败诊断和导出。
+- 规范转账事件、双边匹配、同公司调拨排除与个人过账映射。
+- 登录页视觉融合改版。
+
+## 还没安排
+
+- 公司间余额和四类往来科目的正式计算，已批准手工记录入账，以及从余额逐层查回原始流水。
+- 起算日、期初余额、流水覆盖断档检测和无业务校准。
+- 月结、重开、调整/冲销审批与审计报告。
+- 服务端流水查询、筛选、分页和可追溯导出。
+- 站内提醒与状态流转；外部通知只预留扩展位置，不默认启用。
+- 前端全面接入真实接口，移除模拟金额、静态业务记录和 `localStorage` 业务状态。
+- 测试环境之外的运行保障，包括 HTTPS、备份、监控和正式部署方案。
+
+每完成或新增一项任务，必须在同一次提交里把它从本清单的相应栏目移走或补上，并同步更新 `最新进度.md`。

docs/最新进度.md

@@ -0,0 +1,24 @@
+# 最新进度
+
+最后核对：2026-08-23。以下“已完成”均以当前代码、数据库迁移、接口和自动化测试为依据，不把页面演示当作真实功能。
+
+## 已经真实完成
+
+- 支持中信、农行、工行、建行、河南农商行、郑州银行六类样本的 `.xls` / `.xlsx` 流水解析；能识别变动的表头位置和列顺序，并校验余额连续性。
+- 已有 SQLite 数据库和 5 次版本迁移。原始文件按内容哈希保存，导入批次、工作表、源行和异常都有记录；原始文件、工作表和源行被数据库规则保护，不能直接改或删。
+- 已实现管理员与公司用户登录、首次改密、会话失效、登录失败限流、服务端权限隔离和审计记录。
+- 已实现公司、用户、银行账户、别名等主数据管理；公司提交的银行账户需管理员审核后才能参与上传和识别。
+- 已实现导入、逐工作表确认或忽略、失败诊断、重复上传处理和 CSV 导出；未确认的工作表不进入后续处理。
+- 已实现规范转账事件和双边流水匹配。匹配决定保留历史，无法自动判断的记录进入人工审核；同公司调拨、外部流水和未锁定的单边记录不进入已确认的公司间往来。
+- 已有登录页、总账端和公司端页面，最近一次合并完成了登录页视觉改版。
+
+## 仍未完成或不能当成已完成
+
+- 公司间余额与会计科目的正式计算、已批准手工记录入账和逐层余额追溯尚未完成。
+- 全局起算日、期初余额、流水覆盖断档、无业务校准、月结、重开和调整审批尚未完成。
+- 提醒、完整的服务端查询导出，以及前端彻底移除演示数据和浏览器本地业务状态尚未完成。
+- 生产部署所需的 HTTPS、反向代理、备份、监控和正式运行保障尚未完成；本项目当前只允许测试环境部署。
+
+## 最近验证
+
+2026-08-23 已运行完整 Python 自动化测试：解析、持久化、认证与权限、导入接口、主数据和双边匹配相关测试均通过。后续修改功能时，必须再次运行完整测试并在本文件记录结果。

docs/项目需求.md

@@ -0,0 +1,26 @@
+# 项目需求
+
+## 这个系统做什么
+
+这是河南金牛实业集团有限公司内部各公司之间的资金往来管理系统。它把各公司的银行流水集中起来，识别同一笔公司间转账的两边记录，形成可以一路查回原始银行流水的往来结果。
+
+系统有两个独立入口：
+
+- 总账管理端：管理公司、公司账号、银行账户、导入记录、异常和公司间转账匹配。
+- 公司出纳端：只处理本公司的账户登记、流水上传、工作表确认和本公司相关异常。
+
+## 必须做到的业务规则
+
+- 银行原始文件和原始流水是证据，导入后不能直接修改或删除；修正必须通过可追溯的审核决定、冲销或调整完成。
+- 一笔公司间转账的收、付两边只能算作一个经济事件，不能因为有两条银行流水就重复计算。
+- 同一家公司不同银行账户之间调拨，不计入公司间往来。
+- 账号、金额、方向、日期和余额等可核对信息优先于户名；信息不完整或有歧义时进入异常审核，不能猜。
+- 已确认金额和待确认金额必须分开；所有余额都要说明统计截止日期和未决金额。
+- 公司用户只能查看、上传和导出本公司的数据。这个限制由服务端执行，页面上“看不见”不等于有权限限制。
+- 起算日前的流水必须保留，但不参与期内计算；期初余额、流水覆盖断档、无业务校准、月结和调整都要留痕。
+
+## 当前技术边界
+
+项目使用 Python 标准库服务、SQLite 数据库和浏览器页面。银行模板支持 `.xls` 与 `.xlsx`，按表头识别而非依赖固定行列。金额使用精确十进制，真实运行数据放在 `data/`，不进入代码仓库。
+
+系统目前仍是测试环境项目，不能当作已完成生产部署：正式上线前仍需补齐核算、期初与断档、月结、备份、监控和 HTTPS 等能力。

server.py

@@ -115,6 +115,9 @@ class AppHandler(SimpleHTTPRequestHandler):
         if path == "/api/company/match-exceptions":
             self._handle_company_match_exceptions(query)
             return
+        if path == "/api/company/workspace":
+            self._handle_company_workspace()
+            return
         company_event_match = re.fullmatch(r"/api/company/transfer-events/(\d+)", path)
         if company_event_match:
             self._handle_company_transfer_event_detail(int(company_event_match.group(1)))
@@ -277,6 +280,12 @@ class AppHandler(SimpleHTTPRequestHandler):
         if path == "/api/company/manual-records":
             self._handle_company_manual_records_submit()
             return
+        company_confirm = re.fullmatch(
+            r"/api/company/transfer-events/(\d+)/confirm", path
+        )
+        if company_confirm:
+            self._handle_company_transfer_confirm(int(company_confirm.group(1)))
+            return
         self._send_json(404, {"status": "error", "message": "接口不存在。"})
 
     # ------------------------------------------------------------------
@@ -2195,6 +2204,8 @@ class AppHandler(SimpleHTTPRequestHandler):
         )
         return {
             "event_id": row["event_id"],
+            "decision_id": row["decision_id"],
+            "revision": row["revision"],
             "classification": row["classification"],
             "pairing": row["pairing"],
             "status": matching.exposed_status(row),
@@ -2209,6 +2220,20 @@ class AppHandler(SimpleHTTPRequestHandler):
             "evidence_count": row["evidence_count"],
         }
 
+    def _handle_company_workspace(self) -> None:
+        connection = connect(DB_PATH)
+        try:
+            user = self._require_user(connection)
+            if user is None:
+                return
+            if user["role"] != "company":
+                self._send_json(403, {"status": "error", "message": "该操作仅限公司用户。"})
+                return
+            payload = matching.company_workspace_payload(connection, user["company_id"])
+            self._send_json(200, {"status": "ok", **payload})
+        finally:
+            connection.close()
+
     def _handle_company_match_exceptions(self, query: dict[str, list[str]]) -> None:
         connection = connect(DB_PATH)
         try:
@@ -2218,13 +2243,7 @@ class AppHandler(SimpleHTTPRequestHandler):
             if user["role"] != "company":
                 self._send_json(403, {"status": "error", "message": "该操作仅限公司用户。"})
                 return
-            params: list[object] = [user["company_id"], user["company_id"]]
-            rows = connection.execute(
-                self._event_base_sql(True)
-                + "AND d.classification IN ('unresolved', 'needs_review') "
-                "ORDER BY d.id DESC LIMIT 500",
-                params,
-            ).fetchall()
+            rows = matching.company_pending_unilaterals(connection, user["company_id"])
             items = [
                 self._company_event_list_item(row, user["company_id"]) for row in rows
             ]
@@ -2232,6 +2251,109 @@ class AppHandler(SimpleHTTPRequestHandler):
         finally:
             connection.close()
 
+    def _handle_company_transfer_confirm(self, event_id: int) -> None:
+        """Company confirms a pending unilateral using existing assign_participant rules."""
+        connection = connect(DB_PATH)
+        try:
+            user = self._require_user(connection)
+            if user is None:
+                return
+            if user["role"] != "company":
+                self._send_json(403, {"status": "error", "message": "该操作仅限公司用户。"})
+                return
+            company_id = int(user["company_id"])
+            data = self._read_json_body()
+            if data is None:
+                return
+            request_key = str(data.get("request_key") or "").strip() or None
+            # Idempotent replay: same request_key returns current workspace without re-decrement.
+            if request_key:
+                existing = connection.execute(
+                    """
+                    SELECT id, actor_username
+                    FROM transfer_match_decisions
+                    WHERE idempotency_key = ? AND event_id = ?
+                    """,
+                    (request_key, event_id),
+                ).fetchone()
+                if existing is not None:
+                    if existing["actor_username"] != user["username"]:
+                        self._send_json(404, {"status": "error", "message": "待确认单边流水不存在或已处理。"})
+                        return
+                    workspace = matching.company_workspace_payload(connection, company_id)
+                    payload = matching._decision_payload(connection, event_id, existing["id"])
+                    self._send_json(
+                        200,
+                        {"status": "ok", "decision": payload, "workspace": workspace},
+                    )
+                    return
+            pending = matching.company_pending_unilaterals(connection, company_id)
+            target = next((row for row in pending if int(row["event_id"]) == event_id), None)
+            if target is None:
+                self._send_json(404, {"status": "error", "message": "待确认单边流水不存在或已处理。"})
+                return
+            try:
+                expected_revision = (
+                    int(data["expected_revision"])
+                    if data.get("expected_revision") is not None
+                    else None
+                )
+            except (TypeError, ValueError):
+                self._send_json(400, {"status": "error", "message": "expected_revision 参数无效。"})
+                return
+            try:
+                counterparty_company_id = int(data["counterparty_company_id"])
+            except (KeyError, TypeError, ValueError):
+                self._send_json(
+                    400, {"status": "error", "message": "counterparty_company_id 必须是有效的公司 id。"}
+                )
+                return
+            if counterparty_company_id == company_id:
+                self._send_json(400, {"status": "error", "message": "对方公司不能是本公司。"})
+                return
+            # Own side is already on the decision; assign the opposite role.
+            own_is_payer = target["payer_company_id"] == company_id
+            role = "payee" if own_is_payer else "payer"
+            if target["payer_company_id"] is None and target["payee_company_id"] is None:
+                self._send_json(400, {"status": "error", "message": "单边流水缺少本方参与方，无法确认。"})
+                return
+            if not own_is_payer and target["payee_company_id"] != company_id:
+                self._send_json(404, {"status": "error", "message": "待确认单边流水不存在或已处理。"})
+                return
+            reason = str(data.get("reason") or "").strip() or "公司端确认单边流水"
+            try:
+                payload = matching.apply_manual_decision(
+                    connection,
+                    event_id,
+                    "assign_participant",
+                    reason=reason,
+                    expected_revision=expected_revision,
+                    request_key=request_key,
+                    actor=user,
+                    participant={
+                        "role": role,
+                        "company_id": counterparty_company_id,
+                    },
+                )
+            except matching.MatchConflictError as exc:
+                self._send_json(409, {"status": "error", "message": str(exc)})
+                return
+            except matching.MatchInputError as exc:
+                self._send_json(400, {"status": "error", "message": str(exc)})
+                return
+            try:
+                ledger_events.reconcile_bank_events(connection, actor=user)
+            except Exception as exc:
+                self._send_json(500, {"status": "error", "message": f"同步往来事件失败：{exc}"})
+                return
+            workspace = matching.company_workspace_payload(connection, company_id)
+            self._send_json(
+                200,
+                {"status": "ok", "decision": payload, "workspace": workspace},
+            )
+        finally:
+            connection.close()
+
     def _handle_company_transfer_event_detail(self, event_id: int) -> None:
         connection = connect(DB_PATH)
         try:

src/bank_importer/auth.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 from datetime import datetime, timedelta, timezone
 import hashlib
 import hmac
+import os
 import secrets
 import sqlite3
 import string
@@ -28,6 +29,17 @@ RATE_LIMIT_WINDOW_MINUTES = 10
 INITIAL_PASSWORD_LENGTH = 12
 
 
+def _env_flag(value: str | None) -> bool:
+    """Parse a yes/no style environment flag; blank/absent means False."""
+    return (value or "").strip().lower() in {"1", "true", "yes", "on"}
+
+
+# Ops switch for internal test environments: APP_LOGIN_RATE_LIMIT_DISABLED=1
+# turns off the login-failure lockout entirely. The default (unset) keeps the
+# production policy — 5 failures within 10 minutes lock the (账号, IP) pair.
+RATE_LIMIT_DISABLED = _env_flag(os.environ.get("APP_LOGIN_RATE_LIMIT_DISABLED"))
+
+
 def hash_password(password: str) -> str:
     """Hash ``password`` as ``pbkdf2_sha256$<iterations>$<salt_hex>$<hash_hex>``."""
     salt = secrets.token_bytes(16)
@@ -146,18 +158,19 @@ def authenticate(
     Every non-rate-limited attempt is recorded in ``login_attempts`` and
     ``audit_log``; the password itself is never stored anywhere.
     """
-    window_start = (
-        datetime.now(timezone.utc) - timedelta(minutes=RATE_LIMIT_WINDOW_MINUTES)
-    ).isoformat()
-    failures = connection.execute(
-        """
-        SELECT COUNT(*) AS n FROM login_attempts
-        WHERE username = ? AND ip = ? AND success = 0 AND created_at >= ?
-        """,
-        (username, ip, window_start),
-    ).fetchone()
-    if failures["n"] >= RATE_LIMIT_MAX_FAILURES:
-        return None, "rate_limited"
+    if not RATE_LIMIT_DISABLED:
+        window_start = (
+            datetime.now(timezone.utc) - timedelta(minutes=RATE_LIMIT_WINDOW_MINUTES)
+        ).isoformat()
+        failures = connection.execute(
+            """
+            SELECT COUNT(*) AS n FROM login_attempts
+            WHERE username = ? AND ip = ? AND success = 0 AND created_at >= ?
+            """,
+            (username, ip, window_start),
+        ).fetchone()
+        if failures["n"] >= RATE_LIMIT_MAX_FAILURES:
+            return None, "rate_limited"
 
     user = connection.execute(
         "SELECT * FROM users WHERE username = ?", (username,)

src/bank_importer/dashboard.py

@@ -42,8 +42,11 @@ def audit_counts(connection: sqlite3.Connection) -> dict[str, int]:
 
     Priority mapping (aligned with current admin audit UI semantics):
     - high: unresolved / needs_review match exceptions
-    - medium: pending bank-account registrations
+    - medium: pending bank-account registrations + pending manual records
     - low: reserved for future low-risk queues (currently always 0)
+
+    Homepage card, sidebar badge and audit-center heading must all read this
+    same payload (via ``/api/admin/dashboard`` → ``audit``).
     """
     high = connection.execute(
         """
@@ -55,9 +58,19 @@ def audit_counts(connection: sqlite3.Connection) -> dict[str, int]:
           AND d.classification IN ('unresolved', 'needs_review')
         """
     ).fetchone()["n"]
-    medium = connection.execute(
+    medium_accounts = connection.execute(
         "SELECT COUNT(*) AS n FROM bank_accounts WHERE status = 'pending'"
     ).fetchone()["n"]
+    medium_manuals = connection.execute(
+        """
+        SELECT COUNT(*) AS n
+        FROM manual_records m
+        JOIN current_manual_record_decisions c ON c.record_id = m.id
+        JOIN manual_record_decisions d ON d.id = c.decision_id
+        WHERE d.state = 'pending'
+        """
+    ).fetchone()["n"]
+    medium = int(medium_accounts) + int(medium_manuals)
     low = 0
     return {
         "total": int(high) + int(medium) + int(low),

src/bank_importer/matching.py

@@ -1563,6 +1563,87 @@ def exposed_status(decision: sqlite3.Row | dict) -> str:
     return "unresolved"
 
 
+def company_pending_unilaterals(
+    connection: sqlite3.Connection, company_id: int
+) -> list[sqlite3.Row]:
+    """Authoritative pending unilateral queue for a company workspace.
+
+    Same set as company match-exceptions: active events whose current decision
+    is ``unresolved`` / ``needs_review`` and the company participates.
+    Parentheses on the company filter avoid OR/AND precedence bugs.
+    """
+    return connection.execute(
+        """
+        SELECT c.event_id, d.id AS decision_id, d.revision, d.classification,
+               d.pairing, d.amount, d.currency, d.effective_at, d.mode,
+               d.locked, d.rule_version, d.created_at,
+               payer.company_id AS payer_company_id,
+               payee.company_id AS payee_company_id,
+               payer.bank_account_id AS payer_account_id,
+               payee.bank_account_id AS payee_account_id,
+               cpayer.name AS payer_company_name,
+               cpayee.name AS payee_company_name,
+               (SELECT COUNT(*) FROM transfer_decision_observations o
+                WHERE o.decision_id = d.id) AS evidence_count
+        FROM current_transfer_decisions c
+        JOIN transfer_match_decisions d ON d.id = c.decision_id
+        JOIN canonical_transfer_events e ON e.id = c.event_id
+        LEFT JOIN transfer_decision_participants payer
+             ON payer.decision_id = d.id AND payer.role = 'payer'
+        LEFT JOIN transfer_decision_participants payee
+             ON payee.decision_id = d.id AND payee.role = 'payee'
+        LEFT JOIN companies cpayer ON cpayer.id = payer.company_id
+        LEFT JOIN companies cpayee ON cpayee.id = payee.company_id
+        WHERE e.lifecycle = 'active'
+          AND d.classification IN ('unresolved', 'needs_review')
+          AND (payer.company_id = ? OR payee.company_id = ?)
+        ORDER BY d.id DESC
+        """,
+        (company_id, company_id),
+    ).fetchall()
+
+
+def company_workspace_payload(
+    connection: sqlite3.Connection, company_id: int
+) -> dict[str, object]:
+    """Workspace counts + list share one authoritative unilateral queue."""
+    rows = company_pending_unilaterals(connection, company_id)
+    events = [
+        {
+            "event_id": row["event_id"],
+            "decision_id": row["decision_id"],
+            "revision": row["revision"],
+            "classification": row["classification"],
+            "pairing": row["pairing"],
+            "status": exposed_status(row),
+            "amount": row["amount"],
+            "currency": row["currency"],
+            "effective_at": row["effective_at"],
+            "mode": row["mode"],
+            "locked": bool(row["locked"]),
+            "own_company_id": company_id,
+            "counterparty_company_id": (
+                row["payee_company_id"]
+                if row["payer_company_id"] == company_id
+                else row["payer_company_id"]
+            ),
+            "counterparty_company_name": (
+                row["payee_company_name"]
+                if row["payer_company_id"] == company_id
+                else row["payer_company_name"]
+            ),
+            "evidence_count": row["evidence_count"],
+        }
+        for row in rows
+    ]
+    count = len(events)
+    return {
+        "pending_unilateral": count,
+        "pending_total": count,
+        "unilateral_events": events,
+    }
+
+
 # ---------------------------------------------------------------------------
 # API payload helpers
 # ---------------------------------------------------------------------------

tests/test_auth.py

@@ -4,6 +4,7 @@ from datetime import datetime, timedelta, timezone
 import hashlib
 import sqlite3
 import unittest
+from unittest import mock
 
 from bank_importer import auth
 from bank_importer.db import connect, migrate, utc_now
@@ -167,6 +168,40 @@ class AuthenticateTests(AuthTestCase):
         self.assertIsNotNone(user)
         self.assertIsNone(reason)
 
+    def test_env_flag_parses_truthy_and_falsy_values(self) -> None:
+        cases = {
+            "1": True,
+            "true": True,
+            "YES": True,
+            " on ": True,
+            "": False,
+            "0": False,
+            "false": False,
+            "off": False,
+            None: False,
+        }
+        for value, expected in cases.items():
+            with self.subTest(value=value):
+                self.assertEqual(expected, auth._env_flag(value))
+
+    def test_rate_limit_enabled_by_default(self) -> None:
+        self.assertFalse(auth.RATE_LIMIT_DISABLED)
+
+    def test_env_switch_disables_rate_limit_but_not_credential_checks(self) -> None:
+        self.create_company_user()
+        with mock.patch.object(auth, "RATE_LIMIT_DISABLED", True):
+            for _ in range(auth.RATE_LIMIT_MAX_FAILURES + 2):
+                user, reason = auth.authenticate(
+                    self.connection, "cashier-a", "Wrong999", "10.0.0.1"
+                )
+                self.assertIsNone(user)
+                self.assertEqual("bad_credentials", reason)
+            user, reason = auth.authenticate(
+                self.connection, "cashier-a", "Init1234", "10.0.0.1"
+            )
+            self.assertIsNotNone(user)
+            self.assertIsNone(reason)
+
 
 class SessionTests(AuthTestCase):
     def test_create_and_resolve_roundtrip(self) -> None:

tests/test_company_workspace.py

@@ -0,0 +1,313 @@
+"""HEL-168: company workspace pending unilateral counts sync after confirm."""
+
+from __future__ import annotations
+
+import io
+import os
+from pathlib import Path
+import tempfile
+import threading
+import unittest
+
+from openpyxl import Workbook
+
+import server
+from test_server_auth import Client, as_json
+
+BOOTSTRAP_PASSWORD = "BootAdmin123"
+ADMIN_PASSWORD = "AdminPass123"
+CASHIER_PASSWORD = "Cashier123"
+
+CCB_HEADER = [
+    "客户账号", "账户名称", "交易时间", "借方发生额（支取）", "贷方发生额（收入）",
+    "余额", "币种", "对方户名", "对方账号", "对方开户机构", "摘要", "备注",
+]
+
+ACCOUNT_A = "6222000000001001"
+ACCOUNT_B = "6222000000001002"
+
+
+def workbook_bytes(rows) -> bytes:
+    workbook = Workbook()
+    sheet = workbook.active
+    sheet.title = "正常流水"
+    sheet.append(CCB_HEADER)
+    for row in rows:
+        sheet.append(row)
+    buffer = io.BytesIO()
+    workbook.save(buffer)
+    return buffer.getvalue()
+
+
+def outgoing(own: str, cp: str, amount: str, at: str) -> list:
+    return [own, "测试公司", at, amount, "", "50000.00", "RMB", "对方", cp, "某银行", "货款", ""]
+
+
+class CompanyWorkspaceTodoTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.temp_dir = tempfile.TemporaryDirectory()
+        root = Path(cls.temp_dir.name)
+        cls.db_path = root / "app.db"
+        cls.storage = root / "files"
+
+        cls._old_db_path = server.DB_PATH
+        cls._old_storage = server.STORAGE_DIR
+        server.DB_PATH = cls.db_path
+        server.STORAGE_DIR = cls.storage
+
+        os.environ["APP_BOOTSTRAP_ADMIN_PASSWORD"] = BOOTSTRAP_PASSWORD
+        from bank_importer.db import connect, migrate
+
+        connection = connect(cls.db_path)
+        migrate(connection)
+        assert server.ensure_bootstrap_admin(connection) is None
+        connection.close()
+
+        class QuietHandler(server.AppHandler):
+            def log_message(self, *args) -> None:
+                pass
+
+        cls.httpd = server.ThreadingHTTPServer(("127.0.0.1", 0), QuietHandler)
+        cls.port = cls.httpd.server_address[1]
+        cls.thread = threading.Thread(target=cls.httpd.serve_forever, daemon=True)
+        cls.thread.start()
+
+        cls.admin = Client("127.0.0.1", cls.port)
+        status, _, data = cls.admin.post_json(
+            "/api/login",
+            {"username": "group-admin", "password": BOOTSTRAP_PASSWORD, "portal": "admin"},
+        )
+        assert status == 200, data
+        status, _, data = cls.admin.post_json(
+            "/api/password/change",
+            {"old_password": BOOTSTRAP_PASSWORD, "new_password": ADMIN_PASSWORD},
+        )
+        assert status == 200, data
+
+        cls.initial_passwords: dict[str, str] = {}
+        cls.company_a = cls._create_company("甲公司", "ws-cashier-a")
+        cls.company_b = cls._create_company("乙公司", "ws-cashier-b")
+        cls.cashier_a = cls._login_company("ws-cashier-a")
+        cls.cashier_b = cls._login_company("ws-cashier-b")
+        cls._approve_account(cls.cashier_a, ACCOUNT_A)
+        cls._approve_account(cls.cashier_b, ACCOUNT_B)
+
+    @classmethod
+    def tearDownClass(cls) -> None:
+        cls.httpd.shutdown()
+        cls.httpd.server_close()
+        server.DB_PATH = cls._old_db_path
+        server.STORAGE_DIR = cls._old_storage
+        os.environ.pop("APP_BOOTSTRAP_ADMIN_PASSWORD", None)
+        cls.temp_dir.cleanup()
+
+    @classmethod
+    def _create_company(cls, name: str, username: str) -> int:
+        status, _, data = cls.admin.post_json(
+            "/api/admin/companies",
+            {"name": name, "username": username},
+        )
+        assert status == 200, data
+        payload = as_json(data)
+        cls.initial_passwords[username] = payload["initial_password"]
+        return payload["company_id"]
+
+    @classmethod
+    def _login_company(cls, username: str) -> Client:
+        client = Client("127.0.0.1", cls.port)
+        initial = cls.initial_passwords[username]
+        status, _, data = client.post_json(
+            "/api/login",
+            {"username": username, "password": initial, "portal": "company"},
+        )
+        assert status == 200, data
+        status, _, data = client.post_json(
+            "/api/password/change",
+            {"old_password": initial, "new_password": CASHIER_PASSWORD},
+        )
+        assert status == 200, data
+        return client
+
+    @classmethod
+    def _approve_account(cls, company_client: Client, number: str) -> int:
+        status, _, data = company_client.post_json(
+            "/api/company/accounts",
+            {
+                "bank_name": "中信银行",
+                "account_type": "基本户",
+                "account_number": number,
+                "start_date": "2026-01-01",
+            },
+        )
+        assert status == 200, data
+        account_id = as_json(data)["account"]["id"]
+        status, _, data = cls.admin.post_json(
+            f"/api/admin/accounts/{account_id}/review",
+            {"decision": "approve", "reason": "测试启用", "effective_from": "2026-01-01"},
+        )
+        assert status == 200, data
+        return account_id
+
+    def _seed_unilateral(self, amount: str, at: str, cp_account: str = "9999999999999999") -> dict:
+        status, _, data = self.admin.post_multipart(
+            "/api/parse",
+            {"company_id": str(self.company_a)},
+            f"单边-{amount}.xlsx",
+            workbook_bytes([outgoing(ACCOUNT_A, cp_account, amount, at)]),
+        )
+        self.assertEqual(200, status, data)
+        batch_id = as_json(data)["batch_id"]
+        status, _, data = self.cashier_a.get(f"/api/batches/{batch_id}/sheets")
+        self.assertEqual(200, status, data)
+        names = [s["sheet_name"] for s in as_json(data)["sheets"] if s["outcome"] == "parsed"]
+        status, _, data = self.cashier_a.post_json(
+            f"/api/batches/{batch_id}/confirm", {"sheets": names}
+        )
+        self.assertEqual(200, status, data)
+
+        status, _, data = self.cashier_a.get("/api/company/workspace")
+        self.assertEqual(200, status, data)
+        events = [
+            e for e in as_json(data)["unilateral_events"] if e["amount"] == amount
+        ]
+        self.assertEqual(1, len(events), data)
+        return events[0]
+
+    def _workspace(self, client: Client) -> dict:
+        status, _, data = client.get("/api/company/workspace")
+        self.assertEqual(200, status, data)
+        payload = as_json(data)
+        self.assertEqual("ok", payload["status"])
+        return payload
+
+    def test_seed_three_confirm_sync_and_isolation(self) -> None:
+        # Seed 3 pending unilaterals for company A.
+        e1 = self._seed_unilateral("11.00", "2026-03-01 10:00:00")
+        e2 = self._seed_unilateral("22.00", "2026-03-02 10:00:00")
+        e3 = self._seed_unilateral("33.00", "2026-03-03 10:00:00")
+        seeded_ids = {e1["event_id"], e2["event_id"], e3["event_id"]}
+
+        ws = self._workspace(self.cashier_a)
+        own = [e for e in ws["unilateral_events"] if e["event_id"] in seeded_ids]
+        self.assertEqual(3, len(own))
+        self.assertEqual(ws["pending_unilateral"], ws["pending_total"])
+        self.assertGreaterEqual(ws["pending_unilateral"], 3)
+        # 两处数字与列表同一权威口径
+        self.assertEqual(ws["pending_unilateral"], len(ws["unilateral_events"]))
+
+        # 另一公司看不到甲公司这 3 笔
+        ws_b = self._workspace(self.cashier_b)
+        self.assertEqual(
+            [],
+            [e for e in ws_b["unilateral_events"] if e["event_id"] in seeded_ids],
+        )
+
+        # match-exceptions 与 workspace 同集合
+        status, _, data = self.cashier_a.get("/api/company/match-exceptions")
+        self.assertEqual(200, status, data)
+        exceptions = as_json(data)["exceptions"]
+        exception_ids = {e["event_id"] for e in exceptions}
+        self.assertTrue(seeded_ids.issubset(exception_ids))
+
+        remaining = [e1, e2, e3]
+        for expected in (2, 1, 0):
+            event = remaining.pop(0)
+            status, _, data = self.cashier_a.post_json(
+                f"/api/company/transfer-events/{event['event_id']}/confirm",
+                {
+                    "expected_revision": event["revision"],
+                    "request_key": f"hel168-{event['event_id']}-ok",
+                    "counterparty_company_id": self.company_b,
+                    "reason": "公司端确认单边流水",
+                },
+            )
+            self.assertEqual(200, status, data)
+            body = as_json(data)
+            self.assertIn("workspace", body)
+            left = [
+                e
+                for e in body["workspace"]["unilateral_events"]
+                if e["event_id"] in seeded_ids
+            ]
+            self.assertEqual(expected, len(left))
+            self.assertEqual(body["workspace"]["pending_unilateral"], len(body["workspace"]["unilateral_events"]))
+
+            # 刷新等价：重新 GET 仍为同步后的数字
+            ws = self._workspace(self.cashier_a)
+            left = [e for e in ws["unilateral_events"] if e["event_id"] in seeded_ids]
+            self.assertEqual(expected, len(left))
+
+        # 重复确认：事件已离开待确认集合且 request_key 不同 → 404，数字不得误减
+        status, _, data = self.cashier_a.post_json(
+            f"/api/company/transfer-events/{e1['event_id']}/confirm",
+            {
+                "expected_revision": e1["revision"],
+                "request_key": f"hel168-{e1['event_id']}-again",
+                "counterparty_company_id": self.company_b,
+                "reason": "公司端确认单边流水",
+            },
+        )
+        self.assertEqual(404, status, data)
+        ws = self._workspace(self.cashier_a)
+        left = [e for e in ws["unilateral_events"] if e["event_id"] in seeded_ids]
+        self.assertEqual(0, len(left))
+
+        # 同一 request_key 重放：幂等成功，数字不误减
+        e4 = self._seed_unilateral("44.00", "2026-03-04 10:00:00")
+        key = f"hel168-{e4['event_id']}-replay"
+        status, _, data = self.cashier_a.post_json(
+            f"/api/company/transfer-events/{e4['event_id']}/confirm",
+            {
+                "expected_revision": e4["revision"],
+                "request_key": key,
+                "counterparty_company_id": self.company_b,
+                "reason": "公司端确认单边流水",
+            },
+        )
+        self.assertEqual(200, status, data)
+        after_first = self._workspace(self.cashier_a)["pending_unilateral"]
+        status, _, data = self.cashier_a.post_json(
+            f"/api/company/transfer-events/{e4['event_id']}/confirm",
+            {
+                "expected_revision": e4["revision"],
+                "request_key": key,
+                "counterparty_company_id": self.company_b,
+                "reason": "公司端确认单边流水",
+            },
+        )
+        self.assertEqual(200, status, data)
+        self.assertEqual(after_first, as_json(data)["workspace"]["pending_unilateral"])
+        self.assertEqual(after_first, self._workspace(self.cashier_a)["pending_unilateral"])
+
+        # 失败请求不得误减：用不存在的事件
+        before = self._workspace(self.cashier_a)["pending_unilateral"]
+        status, _, data = self.cashier_a.post_json(
+            "/api/company/transfer-events/999999/confirm",
+            {
+                "expected_revision": 1,
+                "request_key": "hel168-fail",
+                "counterparty_company_id": self.company_b,
+            },
+        )
+        self.assertEqual(404, status, data)
+        self.assertEqual(before, self._workspace(self.cashier_a)["pending_unilateral"])
+
+        # 乙公司不能确认甲公司事件（即使猜到 id）
+        status, _, data = self.cashier_b.post_json(
+            f"/api/company/transfer-events/{e2['event_id']}/confirm",
+            {
+                "expected_revision": e2["revision"],
+                "request_key": "hel168-cross",
+                "counterparty_company_id": self.company_a,
+            },
+        )
+        self.assertEqual(404, status, data)
+
+    def test_admin_forbidden_on_company_workspace(self) -> None:
+        status, _, data = self.admin.get("/api/company/workspace")
+        self.assertEqual(403, status, data)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_dashboard.py

@@ -57,6 +57,96 @@ class DashboardUnitTests(unittest.TestCase):
         self.assertEqual(0, counts["high"])
         self.assertEqual(1, counts["total"])
 
+    def test_pending_manual_counts_as_medium(self) -> None:
+        from bank_importer import auth, manual_records
+
+        now = master_data.utc_now()
+        a = self.connection.execute(
+            "INSERT INTO companies (name, credit_code, cashier_name, status, created_at, updated_at) "
+            "VALUES ('甲公司', NULL, NULL, 'active', ?, ?)",
+            (now, now),
+        ).lastrowid
+        b = self.connection.execute(
+            "INSERT INTO companies (name, credit_code, cashier_name, status, created_at, updated_at) "
+            "VALUES ('乙公司', NULL, NULL, 'active', ?, ?)",
+            (now, now),
+        ).lastrowid
+        self.connection.commit()
+        auth.create_user(
+            self.connection, "cashier-a", "CashierPass123", "company", company_id=int(a)
+        )
+        actor = self.connection.execute(
+            "SELECT * FROM users WHERE username = 'cashier-a'"
+        ).fetchone()
+        manual_records.submit(
+            self.connection,
+            company_id=int(a),
+            counterparty_company_id=int(b),
+            occurred_at="2026-02-01T09:00:00",
+            direction="incoming",
+            amount="100.00",
+            currency="CNY",
+            funding_source="other",
+            requested_subject="receivable",
+            request_key="hel157-manual-1",
+            actor=actor,
+        )
+        counts = dashboard.audit_counts(self.connection)
+        self.assertEqual(1, counts["medium"])
+        self.assertEqual(0, counts["high"])
+        self.assertEqual(1, counts["total"])
+
+    def test_audit_total_equals_queue_sum(self) -> None:
+        """Homepage / badge / audit heading must share one backend total."""
+        now = master_data.utc_now()
+        a = self.connection.execute(
+            "INSERT INTO companies (name, credit_code, cashier_name, status, created_at, updated_at) "
+            "VALUES ('甲公司', NULL, NULL, 'active', ?, ?)",
+            (now, now),
+        ).lastrowid
+        self.connection.commit()
+        master_data.submit_bank_account(
+            self.connection,
+            company_id=int(a),
+            bank_name="工行",
+            account_type="一般户",
+            account_number="6222020000000002",
+            start_date="2026-01-01",
+            actor=None,
+        )
+        event_id = self.connection.execute(
+            "INSERT INTO canonical_transfer_events (lifecycle, created_at) VALUES ('active', ?)",
+            (now,),
+        ).lastrowid
+        decision_id = self.connection.execute(
+            """
+            INSERT INTO transfer_match_decisions (
+              event_id, revision, effective_at, amount, currency, classification,
+              pairing, locked, mode, rule_version, created_at
+            ) VALUES (?, 1, '2026-07-05T10:00:00', '100000.00', 'CNY', 'unresolved',
+                      'single', 0, 'manual', 'test', ?)
+            """,
+            (event_id, now),
+        ).lastrowid
+        self.connection.execute(
+            "INSERT INTO current_transfer_decisions (event_id, decision_id) VALUES (?, ?)",
+            (event_id, decision_id),
+        )
+        self.connection.commit()
+
+        counts = dashboard.audit_counts(self.connection)
+        payload = dashboard.build_dashboard(
+            self.connection, from_date="2026-01-01", cutoff="2026-08-20"
+        )
+        self.assertEqual(counts, payload["audit"])
+        self.assertEqual(
+            counts["total"],
+            counts["high"] + counts["medium"] + counts["low"],
+        )
+        self.assertEqual(1, counts["high"])
+        self.assertEqual(1, counts["medium"])
+        self.assertEqual(2, counts["total"])
+
     def test_company_summaries_from_eligible_events(self) -> None:
         now = master_data.utc_now()
         a = self.connection.execute(
@@ -180,6 +270,210 @@ class DashboardApiTests(unittest.TestCase):
         self.assertEqual(1, len(data["companies"]))
         self.assertEqual("甲公司", data["companies"][0]["name"])
 
+    def test_audit_counts_sync_after_account_review(self) -> None:
+        """Pending account raises dashboard.audit; approve brings total back down."""
+        from bank_importer.db import connect as db_connect
+        from bank_importer import master_data as md
+
+        status, _, raw = self.admin.get("/api/admin/companies")
+        company_id = as_json(raw)["companies"][0]["id"]
+
+        connection = db_connect(self.db_path)
+        try:
+            account = md.submit_bank_account(
+                connection,
+                company_id=company_id,
+                bank_name="工行",
+                account_type="一般户",
+                account_number="6222020000000099",
+                start_date="2026-01-01",
+                actor=None,
+            )
+            account_id = account["id"]
+        finally:
+            connection.close()
+
+        status, _, raw = self.admin.get("/api/admin/dashboard")
+        before = as_json(raw)["audit"]
+        self.assertEqual(200, status)
+        self.assertGreaterEqual(before["medium"], 1)
+        self.assertGreaterEqual(before["total"], 1)
+
+        status, _, raw = self.admin.post_json(
+            f"/api/admin/accounts/{account_id}/review",
+            {"decision": "approve", "reason": "HEL-157 sync test"},
+        )
+        self.assertEqual(200, status, raw)
+
+        status, _, raw = self.admin.get("/api/admin/dashboard")
+        after = as_json(raw)["audit"]
+        self.assertEqual(after["medium"], before["medium"] - 1)
+        self.assertEqual(after["total"], before["total"] - 1)
+        self.assertEqual(
+            after["total"], after["high"] + after["medium"] + after["low"]
+        )
+
+    def test_three_queue_audit_parity_and_dispose_sync(self) -> None:
+        """Seed account+manual+exception: list sizes == dashboard.audit; dispose syncs -1."""
+        from bank_importer.db import connect as db_connect
+        from bank_importer import auth, manual_records, master_data as md
+
+        status, _, raw = self.admin.get("/api/admin/companies")
+        company_id = as_json(raw)["companies"][0]["id"]
+
+        # Second company for manual counterparty.
+        status, _, raw = self.admin.post_json(
+            "/api/admin/companies", {"name": "乙公司", "username": "cashier-b-hel157"}
+        )
+        self.assertEqual(200, status, raw)
+        company_b = as_json(raw).get("company_id") or as_json(raw).get("id")
+        self.assertIsNotNone(company_b)
+
+        connection = db_connect(self.db_path)
+        try:
+            account = md.submit_bank_account(
+                connection,
+                company_id=company_id,
+                bank_name="工行",
+                account_type="一般户",
+                account_number="6222020000000157",
+                start_date="2026-01-01",
+                actor=None,
+            )
+            account_id = account["id"]
+
+            cashier = connection.execute(
+                "SELECT * FROM users WHERE username = 'cashier-a'"
+            ).fetchone()
+            if cashier is None:
+                auth.create_user(
+                    connection,
+                    "cashier-a",
+                    "CashierPass123",
+                    "company",
+                    company_id=company_id,
+                )
+                cashier = connection.execute(
+                    "SELECT * FROM users WHERE username = 'cashier-a'"
+                ).fetchone()
+            manual = manual_records.submit(
+                connection,
+                company_id=company_id,
+                counterparty_company_id=int(company_b),
+                occurred_at="2026-02-01T09:00:00",
+                direction="incoming",
+                amount="100.00",
+                currency="CNY",
+                funding_source="other",
+                requested_subject="receivable",
+                request_key="hel157-queue-manual",
+                actor=cashier,
+            )
+
+            now = md.utc_now()
+            event_id = connection.execute(
+                "INSERT INTO canonical_transfer_events (lifecycle, created_at) VALUES ('active', ?)",
+                (now,),
+            ).lastrowid
+            decision_id = connection.execute(
+                """
+                INSERT INTO transfer_match_decisions (
+                  event_id, revision, effective_at, amount, currency, classification,
+                  pairing, locked, mode, rule_version, created_at
+                ) VALUES (?, 1, '2026-07-05T10:00:00', '100000.00', 'CNY', 'unresolved',
+                          'single', 0, 'manual', 'test', ?)
+                """,
+                (event_id, now),
+            ).lastrowid
+            connection.execute(
+                "INSERT INTO current_transfer_decisions (event_id, decision_id) VALUES (?, ?)",
+                (event_id, decision_id),
+            )
+            connection.commit()
+            manual_id = manual["id"]
+            manual_decision_id = manual["decision_id"]
+        finally:
+            connection.close()
+
+        def queue_sizes():
+            st, _, body = self.admin.get("/api/admin/accounts?status=pending")
+            self.assertEqual(200, st, body)
+            accounts_n = len(as_json(body)["accounts"])
+            st, _, body = self.admin.get("/api/admin/manual-records?state=pending")
+            self.assertEqual(200, st, body)
+            manuals_n = len(as_json(body)["records"])
+            st, _, body = self.admin.get("/api/admin/match-exceptions")
+            self.assertEqual(200, st, body)
+            exceptions_n = len(as_json(body)["exceptions"])
+            return accounts_n, manuals_n, exceptions_n, accounts_n + manuals_n + exceptions_n
+
+        def assert_parity(expected_total: int) -> dict:
+            st, _, body = self.admin.get("/api/admin/dashboard")
+            self.assertEqual(200, st, body)
+            audit = as_json(body)["audit"]
+            accounts_n, manuals_n, exceptions_n, list_total = queue_sizes()
+            self.assertEqual(expected_total, audit["total"])
+            self.assertEqual(expected_total, list_total)
+            self.assertEqual(
+                audit["total"], audit["high"] + audit["medium"] + audit["low"]
+            )
+            self.assertGreaterEqual(accounts_n, 1 if expected_total >= 3 else 0)
+            return {
+                "audit": audit,
+                "accounts": accounts_n,
+                "manuals": manuals_n,
+                "exceptions": exceptions_n,
+            }
+
+        before = assert_parity(3)
+        self.assertEqual(1, before["accounts"])
+        self.assertEqual(1, before["manuals"])
+        self.assertEqual(1, before["exceptions"])
+        self.assertEqual(1, before["audit"]["high"])
+        self.assertEqual(2, before["audit"]["medium"])
+
+        # Dispose account → total 2
+        st, _, body = self.admin.post_json(
+            f"/api/admin/accounts/{account_id}/review",
+            {"decision": "approve", "reason": "HEL-157 three-queue dispose account"},
+        )
+        self.assertEqual(200, st, body)
+        after_account = assert_parity(2)
+
+        # Dispose manual → total 1
+        st, _, body = self.admin.post_json(
+            f"/api/admin/manual-records/{manual_id}/decisions",
+            {
+                "action": "approve_new",
+                "reason": "HEL-157 three-queue dispose manual",
+                "expected_decision_id": manual_decision_id,
+                "request_key": "hel157-dispose-manual",
+            },
+        )
+        self.assertEqual(200, st, body)
+        after_manual = assert_parity(1)
+        self.assertEqual(0, after_manual["manuals"])
+
+        # Dispose match exception via reverse → total 0
+        st, _, body = self.admin.get("/api/admin/match-exceptions")
+        exceptions = as_json(body)["exceptions"]
+        self.assertEqual(1, len(exceptions))
+        target = exceptions[0]
+        st, _, body = self.admin.post_json(
+            f"/api/admin/transfer-events/{target['event_id']}/decisions",
+            {
+                "action": "reverse",
+                "reason": "HEL-157 three-queue dispose match",
+                "expected_revision": target["revision"],
+                "request_key": "hel157-dispose-match",
+            },
+        )
+        self.assertEqual(200, st, body)
+        after_match = assert_parity(0)
+        self.assertEqual(0, after_match["exceptions"])
+        self.assertEqual(after_account["audit"]["total"] - 1, after_manual["audit"]["total"])
+        self.assertEqual(after_manual["audit"]["total"] - 1, after_match["audit"]["total"])
+
     def test_company_detail_missing(self) -> None:
         status, _, raw = self.admin.get(
             "/api/admin/dashboard/companies/999999?from=2026-01-01&cutoff=2026-08-20"

tests/test_settings_reminders.py

@@ -211,6 +211,44 @@ class SettingsAndRemindersTests(unittest.TestCase):
             status, _ = cashier.get(path)
             self.assertEqual(403, status, path)
 
+        # Company session must get 403 on admin write endpoints (settings /
+        # reminders / review decisions), not just GETs.
+        write_calls = (
+            ("POST /api/admin/settings", lambda: cashier.post_json(
+                "/api/admin/settings",
+                {"closing_day": "10", "start_date": "2026-01-01", "auto_remind": "0", "remind_days": "3"},
+            )),
+            ("POST /api/admin/reminders/send", lambda: cashier.post_json(
+                "/api/admin/reminders/send", {"company_id": self.company_id}
+            )),
+            ("POST /api/admin/accounts/1/review", lambda: cashier.post_json(
+                "/api/admin/accounts/1/review", {"decision": "approve"}
+            )),
+            ("POST /api/admin/transfer-events/1/decisions", lambda: cashier.post_json(
+                "/api/admin/transfer-events/1/decisions",
+                {"action": "confirm_single", "reason": "越权"},
+            )),
+            ("POST /api/admin/manual-records/1/decisions", lambda: cashier.post_json(
+                "/api/admin/manual-records/1/decisions",
+                {"action": "approve_new", "reason": "越权"},
+            )),
+            ("POST /api/admin/intercompany/events/1/subject-decisions", lambda: cashier.post_json(
+                "/api/admin/intercompany/events/1/subject-decisions",
+                {"subject": "other_receivable", "reason": "越权"},
+            )),
+            ("POST /api/admin/intercompany/events/1/adjustments", lambda: cashier.post_json(
+                "/api/admin/intercompany/events/1/adjustments",
+                {"action": "reverse", "reason": "越权"},
+            )),
+        )
+        for label, call in write_calls:
+            status, data = call()
+            self.assertEqual(403, status, f"{label}: {data}")
+        # Settings must be unchanged after the forbidden write attempt.
+        status, data = self.admin.get("/api/admin/settings")
+        self.assertEqual(200, status)
+        self.assertEqual("5", as_json(data)["settings"]["closing_day"])
+
 
 class SettingsModuleTests(unittest.TestCase):
     """Unit tests for the settings module on a fresh in-memory database."""

web/admin.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="description" content="金牛集团管理端" />
     <title>管理端 · 金牛集团</title>
-    <link rel="stylesheet" href="design-system.css?v=5" />
+    <link rel="stylesheet" href="design-system.css?v=8" />
   </head>
   <body data-portal="admin">
     <a class="skip-link" href="#main-content">跳到主要内容</a>
@@ -20,7 +20,7 @@
           <div class="nav-group">日常</div>
           <a class="active" data-view="dashboard" href="#dashboard"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><rect x="3" y="3" width="8" height="8" rx="1.5"/><rect x="13" y="3" width="8" height="5" rx="1.5"/><rect x="13" y="10" width="8" height="11" rx="1.5"/><rect x="3" y="13" width="8" height="8" rx="1.5"/></svg><span class="nav-label">管理总览</span></a>
           <a data-view="pair" href="#pair"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><path d="M7 8h13l-3.5-3.5M17 16H4l3.5 3.5"/></svg><span class="nav-label">往来查询</span></a>
-          <a data-view="audit" href="#audit"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><path d="M9 11.5l2 2 4-4.5"/><rect x="4" y="3" width="16" height="18" rx="2"/></svg><span class="nav-label">审核中心</span><span class="nav-badge">6</span></a>
+          <a data-view="audit" href="#audit"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><path d="M9 11.5l2 2 4-4.5"/><rect x="4" y="3" width="16" height="18" rx="2"/></svg><span class="nav-label">审核中心</span><span class="nav-badge" id="auditNavBadge" style="display: none;">0</span></a>
           <a data-view="flows" href="#flows"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><path d="M4 6h16M4 12h16M4 18h10"/></svg><span class="nav-label">流水管理</span></a>
           <div class="nav-group">基础与结账</div>
           <a data-view="companies" href="#companies"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><path d="M4 21V8l8-5 8 5v13"/><path d="M9 21v-6h6v6"/></svg><span class="nav-label">公司与账号</span></a>
@@ -82,64 +82,74 @@
               </div>
             </div>
 
-            <div class="grid grid-2" style="margin-top: 14px;">
-              <div class="card">
-                <div class="card-head" style="margin-bottom: 10px;">
-                  <span class="card-title">各公司往来分布<span class="sub">期末净值 · 单位：万元</span></span>
+            <div class="card dash-master" id="companyMasterDetail">
+              <div class="card-head dash-master-head">
+                <span class="card-title" style="min-width: 0;">
+                  公司往来合计 · 往来明细
+                  <span class="sub" id="dashListSub">单位：万元 · 左侧选择公司，右侧查看其往来明细</span>
+                </span>
+                <div class="dash-master-head-actions">
+                  <span class="meta" id="dashMasterMeta">—</span>
+                  <input class="input" id="company-search" aria-label="搜索公司" placeholder="搜索公司…" />
                 </div>
-                <div id="dashBarChart" style="height: 220px; min-width: 0;" aria-label="各公司往来分布柱状图"></div>
               </div>
-              <div class="card">
-                <div class="card-head" style="margin-bottom: 10px;">
-                  <span class="card-title">本周资金流入流出<span class="sub">集团内往来 · 单位：万元</span></span>
-                </div>
-                <div id="dashLineChart" style="height: 220px; min-width: 0;" aria-label="本周资金流入流出折线图"></div>
-              </div>
-            </div>
-
-            <div class="card" id="companyMasterDetail" style="margin-top: 14px; padding: 0; overflow: hidden;">
-              <div class="grid grid-1-2" style="gap: 0; align-items: stretch; height: 492px;">
-                <div style="border-right: 1px solid var(--border); display: flex; flex-direction: column; min-width: 0; min-height: 0;">
-                  <div class="card-head" style="padding: 10px 14px 8px; margin-bottom: 0; gap: 8px;">
-                    <span class="card-title" style="min-width: 0;">公司往来合计<span class="sub" id="dashListSub" style="display: inline; margin-left: 6px;">单位：万元</span></span>
-                    <input class="input" id="company-search" aria-label="搜索公司" placeholder="搜索…" style="width: 120px; min-height: 28px; padding: 4px 8px; flex: none;" />
-                  </div>
-                  <div class="table-wrap" style="border: 0; border-radius: 0; flex: 1; min-height: 0; overflow: auto;">
-                    <table class="ds-table" id="dashCompanyTable" style="min-width: 0;">
-                      <thead>
-                        <tr>
-                          <th style="padding: 6px 12px;">公司</th>
-                          <th class="num-col" style="padding: 6px 12px;">明细笔数</th>
-                          <th class="num-col" style="padding: 6px 12px;">期末净值</th>
-                          <th id="dashStatusHead" style="padding: 6px 12px;">状态</th>
-                        </tr>
-                      </thead>
-                      <tbody id="dashCompanyRows">
-                        <tr class="loading-row"><td colspan="4">加载中…</td></tr>
-                      </tbody>
-                    </table>
+              <div class="grid grid-480-1 dash-master-split">
+                <div class="dash-master-pane dash-master-pane--list">
+                  <div class="dash-company-list" id="dashCompanyRows" role="listbox" aria-label="公司往来合计">
+                    <div class="dash-company-loading muted">加载中…</div>
                   </div>
                 </div>
-                <div style="display: flex; flex-direction: column; min-width: 0; min-height: 0;">
-                  <div class="card-head" style="padding: 10px 14px 8px; margin-bottom: 0;">
-                    <span class="card-title" id="dashDetailTitle">公司往来明细<span class="sub" id="dashDetailSub">选择左侧公司查看会计式分级明细</span></span>
+                <div class="dash-master-pane dash-master-pane--detail">
+                  <div class="dash-detail-toolbar">
+                    <div class="dash-detail-heading">
+                      <span class="dash-detail-name" id="dashDetailTitle">请选择左侧公司</span>
+                      <span class="meta" id="dashDetailSub">按对方公司分组 · 二级默认收起 · 已确认 / 待确认分列</span>
+                    </div>
                   </div>
-                  <div class="table-wrap" id="dashDetailWrap" style="border: 0; border-radius: 0; flex: 1; min-height: 0; overflow: auto;">
-                    <table class="ds-table" id="dashDetailTable" style="min-width: 0;">
-                      <thead>
-                        <tr>
-                          <th style="padding: 6px 12px;">对方 / 摘要</th>
-                          <th class="num-col" style="padding: 6px 12px;">笔数</th>
-                          <th class="num-col" style="padding: 6px 12px;">期初</th>
-                          <th class="num-col" style="padding: 6px 12px;">本期借方</th>
-                          <th class="num-col" style="padding: 6px 12px;">本期贷方</th>
-                          <th class="num-col" style="padding: 6px 12px;">期末</th>
-                        </tr>
-                      </thead>
-                      <tbody id="dashDetailRows">
-                        <tr><td colspan="6" class="muted">请选择左侧公司</td></tr>
-                      </tbody>
-                    </table>
+                  <div class="dash-detail-summary" id="dashDetailSummary" hidden>
+                    <div class="dash-summary-item">
+                      <span class="dash-summary-label">笔数</span>
+                      <span class="dash-summary-value num" id="dashSumCount">0</span>
+                    </div>
+                    <div class="dash-summary-item">
+                      <span class="dash-summary-label">期初</span>
+                      <span class="dash-summary-value num" id="dashSumOpening">—</span>
+                    </div>
+                    <div class="dash-summary-item">
+                      <span class="dash-summary-label">本期借方</span>
+                      <span class="dash-summary-value num" id="dashSumDebit">0.00</span>
+                    </div>
+                    <div class="dash-summary-item">
+                      <span class="dash-summary-label">本期贷方</span>
+                      <span class="dash-summary-value num" id="dashSumCredit">0.00</span>
+                    </div>
+                    <div class="dash-summary-item">
+                      <span class="dash-summary-label">期末</span>
+                      <span class="dash-summary-value num" id="dashSumEnding">0.00</span>
+                    </div>
+                  </div>
+                  <div class="dash-detail-body" id="dashDetailBody">
+                    <div class="table-wrap dash-master-scroll" id="dashDetailWrap">
+                      <table class="ds-table ds-table--compact" id="dashDetailTable">
+                        <thead>
+                          <tr>
+                            <th>对方 / 摘要</th>
+                            <th class="num-col">笔数</th>
+                            <th class="num-col">期初</th>
+                            <th class="num-col">本期借方</th>
+                            <th class="num-col">本期贷方</th>
+                            <th class="num-col">期末</th>
+                          </tr>
+                        </thead>
+                        <tbody id="dashDetailRows">
+                          <tr><td colspan="6" class="muted">请选择左侧公司</td></tr>
+                        </tbody>
+                      </table>
+                    </div>
+                    <div class="dash-detail-empty" id="dashDetailEmpty" hidden>
+                      <div class="e-title">该公司期间内暂无已归集往来</div>
+                      <div class="e-desc" id="dashDetailEmptyDesc">期初 — · 导入流水并归集后在此展示</div>
+                    </div>
                   </div>
                 </div>
               </div>
@@ -347,51 +357,6 @@
                   </tr>
                 </thead>
                 <tbody id="auditRows">
-                  <tr data-audit-type="断档" data-company="金牛置业">
-                    <td><span class="pill pill-danger">高</span></td>
-                    <td><span class="cell-main">金牛置业 · 中行尾号 8821</span><span class="cell-sub">07-06 至 07-16 无流水</span></td>
-                    <td>流水断档</td>
-                    <td>2026-07</td>
-                    <td class="wrap">11 天无流水，与金牛煤业 320 万煤炭采购款往来无法归集，阻断 7 月结账</td>
-                    <td><span class="pill pill-info">待审核</span></td>
-                    <td><div class="row" style="gap:6px;"><button type="button" class="btn btn-sm btn-primary" data-audit-action="approve">通过</button><button type="button" class="btn btn-sm btn-danger" data-audit-action="reject">驳回</button></div></td>
-                  </tr>
-                  <tr data-audit-type="单边" data-company="金牛新能源">
-                    <td><span class="pill pill-warn">中</span></td>
-                    <td><span class="cell-main">金牛新能源 ↔ 金牛贸易</span><span class="cell-sub">3 笔单边合计 486 万</span></td>
-                    <td>单边匹配</td>
-                    <td>2026-07</td>
-                    <td class="wrap">单边支付无对方对应流水，往来差异挂账，待对方选择流水佐证</td>
-                    <td><span class="pill pill-info">待审核</span></td>
-                    <td><div class="row" style="gap:6px;"><button type="button" class="btn btn-sm btn-primary" data-audit-action="approve">通过</button><button type="button" class="btn btn-sm btn-danger" data-audit-action="reject">驳回</button></div></td>
-                  </tr>
-                  <tr data-audit-type="科目" data-company="金牛煤业">
-                    <td><span class="pill pill-warn">中</span></td>
-                    <td><span class="cell-main">金牛煤业 · 手工记录</span><span class="cell-sub">场地押金 42 万</span></td>
-                    <td>科目确认</td>
-                    <td>2026-07</td>
-                    <td class="wrap">「应收 / 其他应收」科目待判定，影响科目汇总口径</td>
-                    <td><span class="pill pill-info">待审核</span></td>
-                    <td><div class="row" style="gap:6px;"><button type="button" class="btn btn-sm btn-primary" data-audit-action="approve">通过</button><button type="button" class="btn btn-sm btn-danger" data-audit-action="reject">驳回</button></div></td>
-                  </tr>
-                  <tr data-audit-type="起算" data-company="金牛物流">
-                    <td><span class="pill pill-danger">高</span></td>
-                    <td><span class="cell-main">金牛物流 · 工行基本户</span><span class="cell-sub">期初与上年结转差 28.6 万</span></td>
-                    <td>起算区间校准</td>
-                    <td>2026-01 起算</td>
-                    <td class="wrap">期初余额与上年结转不衔接，全年累计数失真，需校准起算区间</td>
-                    <td><span class="pill pill-info">待审核</span></td>
-                    <td><div class="row" style="gap:6px;"><button type="button" class="btn btn-sm btn-primary" data-audit-action="approve">通过</button><button type="button" class="btn btn-sm btn-danger" data-audit-action="reject">驳回</button></div></td>
-                  </tr>
-                  <tr data-audit-type="手工" data-company="金牛贸易">
-                    <td><span class="pill pill-warn">中</span></td>
-                    <td><span class="cell-main">金牛贸易 · 手工补录</span><span class="cell-sub">现金缴存 64 万</span></td>
-                    <td>公司手工记录</td>
-                    <td>2026-07</td>
-                    <td class="wrap">无银行回单附件，需人工核实后方可入账</td>
-                    <td><span class="pill pill-info">待审核</span></td>
-                    <td><div class="row" style="gap:6px;"><button type="button" class="btn btn-sm btn-primary" data-audit-action="approve">通过</button><button type="button" class="btn btn-sm btn-danger" data-audit-action="reject">驳回</button></div></td>
-                  </tr>
                 </tbody>
               </table>
               <div class="table-foot">
@@ -463,7 +428,7 @@
               </table>
               <div class="table-foot">
                 <span id="flowCount">共 0 笔</span>
-                <span class="meta" id="flowsRangeMeta">数据范围：2026-01-01 起算 · 每月 5 日结账（7 月顺延至 08-29）</span>
+                <span class="meta" id="flowsRangeMeta">数据范围：加载中…</span>
               </div>
             </div>
           </section>
@@ -553,7 +518,7 @@
                     <div class="field" style="margin-bottom: 14px;">
                       <label for="cs-day">每月结账日</label>
                       <input class="input num-input" type="number" name="closingDay" id="cs-day" min="1" max="28" value="5" />
-                      <span class="hint">每月几号执行上月结账 · 2026-07 因故顺延至 08-29</span>
+                      <span class="hint">每月几号执行上月结账</span>
                     </div>
                     <div class="field" style="margin-bottom: 16px;">
                       <label>自动提醒</label>
@@ -977,6 +942,6 @@
       </div>
     </div>
     <div class="toast-region" id="toastRegion" aria-live="polite"></div>
-    <script src="app.js?v=5"></script>
+    <script src="app.js?v=9"></script>
   </body>
 </html>

web/company.html

@@ -57,7 +57,7 @@
               </div>
               <div class="page-actions">
                 <button class="btn" data-open-upload>上传流水</button>
-                <button class="btn btn-primary" data-view-link="reconcile">去确认单边流水 (3)</button>
+                <button class="btn btn-primary" id="workspaceUnilateralCta" data-view-link="reconcile">去确认单边流水 (0)</button>
               </div>
             </div>
 
@@ -79,8 +79,8 @@
                 </a>
                 <a class="flow-step doing" data-view-link="reconcile" href="#reconcile">
                   <div class="fs-top"><span class="fs-idx">03</span><span class="fs-dot"></span><span class="fs-name">往来确认</span></div>
-                  <div class="fs-state" id="workspaceConfirmState">待处理 5 笔</div>
-                  <div class="fs-meta" id="workspaceConfirmMeta">单边流水 3 笔 · 科目确认 2 笔</div>
+                  <div class="fs-state" id="workspaceConfirmState">加载中…</div>
+                  <div class="fs-meta" id="workspaceConfirmMeta">正在读取待确认单边流水</div>
                 </a>
                 <div class="flow-step wait">
                   <div class="fs-top"><span class="fs-idx">04</span><span class="fs-dot"></span><span class="fs-name">管理复核</span></div>
@@ -99,43 +99,12 @@
               <div class="stack">
                 <div class="card" id="workspaceTodos">
                   <div class="card-head">
-                    <span class="card-title">本月待办<span class="sub">本月任务 13/18 · 按处理顺序排列，前 3 项阻断结账</span></span>
-                    <span class="pill pill-warn" id="workspacePendingStatus">4 项待处理</span>
+                    <span class="card-title">本月待办<span class="sub" id="workspaceTodoSub">按权威待确认单边流水同步</span></span>
+                    <span class="pill pill-warn" id="workspacePendingStatus">加载中</span>
                   </div>
-                  <div class="list-row" data-task-type="match" data-detail="task-match">
-                    <span class="pill pill-danger">阻断</span>
-                    <div class="lr-main">
-                      <div class="lr-title">处理 3 笔单边流水确认</div>
-                      <div class="lr-sub">选择对方银行流水作为证据后提交确认</div>
-                    </div>
-                    <button class="btn btn-sm" data-view-link="reconcile">去确认</button>
-                  </div>
-                  <div class="list-row" data-task-type="subject" data-detail="task-subject">
-                    <span class="pill pill-danger">阻断</span>
-                    <div class="lr-main">
-                      <div class="lr-title">确认 2 笔其他应收科目</div>
-                      <div class="lr-sub">核对后改判或维持原科目</div>
-                    </div>
-                    <button class="btn btn-sm" data-view-link="manual">去处理</button>
-                  </div>
-                  <div class="list-row" data-detail="task-upload">
-                    <span class="pill pill-danger">阻断</span>
-                    <div class="lr-main">
-                      <div class="lr-title">补传交行尾号 7710 账户 7 月流水</div>
-                      <div class="lr-sub">账户已登记，待总行审核通过后即可导入</div>
-                    </div>
-                    <button class="btn btn-sm" data-view-link="accounts">查看账户</button>
-                  </div>
-                  <div class="list-row" data-detail="task-reconcile">
-                    <span class="pill pill-muted">一般</span>
-                    <div class="lr-main">
-                      <div class="lr-title">核对与金牛置业 320 万往来</div>
-                      <div class="lr-sub">置业 8821 账户 7 月流水断档，需人工核对</div>
-                    </div>
-                    <button class="btn btn-sm" data-view-link="flows">去核对</button>
-                  </div>
-                  <div class="table-foot">
-                    <span>完成以上 4 项后，7 月账期即可提交集团结账</span>
+                  <div id="workspaceTodoList"></div>
+                  <div class="table-foot" id="workspaceTodoFoot">
+                    <span>正在读取待办…</span>
                   </div>
                 </div>
 
@@ -463,130 +432,18 @@
             <div class="notice warn" id="blocking-notice" style="margin-bottom: 16px;">
               <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" style="width: 18px; height: 18px; flex: none; margin-top: 1px;"><path d="M12 8v5M12 16.5v.01"/><path d="M10.3 4.1L2.8 17a2 2 0 0 0 1.7 3h15a2 2 0 0 0 1.7-3L13.7 4.1a2 2 0 0 0-3.4 0z"/></svg>
               <div>
-                <div class="n-title" id="notice-title">5 项待确认，是 7 月结账的阻断项</div>
-                <div class="n-body" id="notice-body">含单边流水匹配 3 项、科目确认 2 项。请于 2026-08-29（7 月顺延结账日）前处理完毕，否则集团无法对贵公司执行 7 月结账。</div>
+                <div class="n-title" id="notice-title">正在读取待确认单边流水…</div>
+                <div class="n-body" id="notice-body">工作台与往来确认共用同一权威待确认集合。</div>
               </div>
             </div>
 
             <div class="tabs">
-              <button type="button" class="active" id="tab-match" aria-pressed="true">单边流水匹配<span class="tab-count" id="count-match">3</span></button>
+              <button type="button" class="active" id="tab-match" aria-pressed="true">单边流水匹配<span class="tab-count" id="count-match">0</span></button>
               <button type="button" id="tab-subject" aria-pressed="false">科目确认<span class="tab-count" id="count-subject">2</span></button>
             </div>
 
             <section id="panel-match">
-              <div class="stack" id="match-stack">
-                <div class="card" data-match-card>
-                  <div class="card-head">
-                    <span class="card-title">2026-07-14 付 <span class="num amt-out">¥3,200,000.00</span> 给金牛置业<span class="sub">摘要：煤炭采购款</span></span>
-                    <span class="pill pill-danger">单边</span>
-                  </div>
-                  <div class="detail-box" style="margin-bottom: 12px;">
-                    <dl class="kv">
-                      <dt>本方流水号</dt><dd>MY-ICBC-3305-20260714-018</dd>
-                      <dt>本方账户</dt><dd>工商银行基本户 · 尾号 3305</dd>
-                      <dt>对方户名</dt><dd>河南金牛置业有限公司</dd>
-                    </dl>
-                  </div>
-                  <div class="field" style="margin-bottom: 14px;">
-                    <label>候选对方银行证据（选择 1 条进行匹配）</label>
-                    <label class="list-row" style="border: 1px solid var(--border); border-radius: var(--radius); padding: 10px 12px; margin-bottom: 8px; cursor: pointer;">
-                      <input type="radio" name="ev-1" style="width: auto;" />
-                      <div class="lr-main">
-                        <div class="lr-title">金牛置业 · 建设银行一般户 · 尾号 6642</div>
-                        <div class="lr-sub num">2026-07-14 收 ¥3,200,000.00 · 对方流水号 ZY-CCB-6642-20260714-006</div>
-                      </div>
-                      <span class="pill pill-success lr-side">匹配度 高</span>
-                    </label>
-                    <label class="list-row" style="border: 1px solid var(--border); border-radius: var(--radius); padding: 10px 12px; margin-bottom: 8px; cursor: pointer;">
-                      <input type="radio" name="ev-1" style="width: auto;" />
-                      <div class="lr-main">
-                        <div class="lr-title">金牛置业 · 中国银行基本户 · 尾号 8821</div>
-                        <div class="lr-sub num">2026-07-15 收 ¥3,200,000.00 · 对方流水号 ZY-BOC-8821-20260715-011</div>
-                      </div>
-                      <span class="pill pill-warn lr-side">匹配度 中</span>
-                    </label>
-                    <span class="hint">提示：置业中行尾号 8821 账户 07-06 至 07-16 流水断档，其 07-15 记录为对方后补手工记录，匹配度较低，请优先核对建行 6642。</span>
-                  </div>
-                  <div class="row">
-                    <button class="btn btn-primary" data-match-confirm disabled data-match-summary="2026-07-14 付 ¥3,200,000.00 给金牛置业 · 煤炭采购款 · 已匹配置业建行 6642 收款记录">确认匹配</button>
-                    <a class="btn btn-ghost" data-view-link="flows">查看本方流水</a>
-                  </div>
-                </div>
-
-                <div class="card" data-match-card>
-                  <div class="card-head">
-                    <span class="card-title">2026-07-22 付 <span class="num amt-out">¥950,000.00</span> 给金牛物流<span class="sub">摘要：7 月矿区运输费</span></span>
-                    <span class="pill pill-danger">单边</span>
-                  </div>
-                  <div class="detail-box" style="margin-bottom: 12px;">
-                    <dl class="kv">
-                      <dt>本方流水号</dt><dd>MY-ICBC-3305-20260722-031</dd>
-                      <dt>本方账户</dt><dd>工商银行基本户 · 尾号 3305</dd>
-                      <dt>对方户名</dt><dd>河南金牛物流有限公司</dd>
-                    </dl>
-                  </div>
-                  <div class="field" style="margin-bottom: 14px;">
-                    <label>候选对方银行证据（选择 1 条进行匹配）</label>
-                    <label class="list-row" style="border: 1px solid var(--border); border-radius: var(--radius); padding: 10px 12px; margin-bottom: 8px; cursor: pointer;">
-                      <input type="radio" name="ev-2" style="width: auto;" />
-                      <div class="lr-main">
-                        <div class="lr-title">金牛物流 · 农业银行基本户 · 尾号 5508</div>
-                        <div class="lr-sub num">2026-07-22 收 ¥950,000.00 · 对方流水号 WL-ABC-5508-20260722-014</div>
-                      </div>
-                      <span class="pill pill-success lr-side">匹配度 高</span>
-                    </label>
-                    <label class="list-row" style="border: 1px solid var(--border); border-radius: var(--radius); padding: 10px 12px; margin-bottom: 8px; cursor: pointer;">
-                      <input type="radio" name="ev-2" style="width: auto;" />
-                      <div class="lr-main">
-                        <div class="lr-title">金牛物流 · 工商银行一般户 · 尾号 2201</div>
-                        <div class="lr-sub num">2026-07-23 收 ¥950,000.00 · 对方流水号 WL-ICBC-2201-20260723-002</div>
-                      </div>
-                      <span class="pill pill-warn lr-side">匹配度 中</span>
-                    </label>
-                  </div>
-                  <div class="row">
-                    <button class="btn btn-primary" data-match-confirm disabled data-match-summary="2026-07-22 付 ¥950,000.00 给金牛物流 · 7 月矿区运输费 · 已匹配物流农行 5508 收款记录">确认匹配</button>
-                    <a class="btn btn-ghost" data-view-link="flows">查看本方流水</a>
-                  </div>
-                </div>
-
-                <div class="card" data-match-card>
-                  <div class="card-head">
-                    <span class="card-title">2026-07-09 收 <span class="num amt-in">¥1,860,000.00</span> 自金牛贸易<span class="sub">摘要：精煤销售款</span></span>
-                    <span class="pill pill-danger">单边</span>
-                  </div>
-                  <div class="detail-box" style="margin-bottom: 12px;">
-                    <dl class="kv">
-                      <dt>本方流水号</dt><dd>MY-BOC-9916-20260709-007</dd>
-                      <dt>本方账户</dt><dd>中国银行一般户 · 尾号 9916</dd>
-                      <dt>对方户名</dt><dd>河南金牛贸易有限公司</dd>
-                    </dl>
-                  </div>
-                  <div class="field" style="margin-bottom: 14px;">
-                    <label>候选对方银行证据（选择 1 条进行匹配）</label>
-                    <label class="list-row" style="border: 1px solid var(--border); border-radius: var(--radius); padding: 10px 12px; margin-bottom: 8px; cursor: pointer;">
-                      <input type="radio" name="ev-3" style="width: auto;" />
-                      <div class="lr-main">
-                        <div class="lr-title">金牛贸易 · 交通银行基本户 · 尾号 8077</div>
-                        <div class="lr-sub num">2026-07-09 付 ¥1,860,000.00 · 对方流水号 MY-BCM-8077-20260709-019</div>
-                      </div>
-                      <span class="pill pill-success lr-side">匹配度 高</span>
-                    </label>
-                    <label class="list-row" style="border: 1px solid var(--border); border-radius: var(--radius); padding: 10px 12px; margin-bottom: 8px; cursor: pointer;">
-                      <input type="radio" name="ev-3" style="width: auto;" />
-                      <div class="lr-main">
-                        <div class="lr-title">金牛贸易 · 中国银行一般户 · 尾号 3340</div>
-                        <div class="lr-sub num">2026-07-08 付 ¥1,860,000.00 · 对方流水号 MY-BOC-3340-20260708-021</div>
-                      </div>
-                      <span class="pill pill-warn lr-side">匹配度 中</span>
-                    </label>
-                  </div>
-                  <div class="row">
-                    <button class="btn btn-primary" data-match-confirm disabled data-match-summary="2026-07-09 收 ¥1,860,000.00 自金牛贸易 · 精煤销售款 · 已匹配贸易交行 8077 付款记录">确认匹配</button>
-                    <a class="btn btn-ghost" data-view-link="flows">查看本方流水</a>
-                  </div>
-                </div>
-              </div>
+              <div class="stack" id="match-stack"></div>
 
               <div class="card" style="margin-top: 14px; display: none;" id="matched-summary">
                 <div class="card-head">
@@ -957,6 +814,6 @@
       </div>
     </div>
     <div class="toast-region" id="toastRegion" aria-live="polite"></div>
-    <script src="app.js?v=5"></script>
+    <script src="app.js?v=10"></script>
   </body>
 </html>

web/design-system.css

@@ -213,6 +213,233 @@ p { margin: 0; }
 .grid-2-1 { grid-template-columns: minmax(0, 2fr) minmax(0, 1fr); align-items: start; }
 .grid-1-2 { grid-template-columns: minmax(0, 1fr) minmax(0, 2fr); align-items: start; }
 .grid-3-2 { grid-template-columns: minmax(0, 3fr) minmax(0, 2fr); align-items: start; }
+/* 管理端首页主从：左栏约 480px（定稿 HEL-153），右侧明细更宽 */
+.grid-480-1 { grid-template-columns: minmax(0, 480px) minmax(0, 1fr); align-items: stretch; }
+
+/* 方案 A：一体卡片 · 分栏主从（HEL-162） */
+.dash-master {
+  margin-top: 14px;
+  padding: 0;
+  overflow: hidden;
+}
+.dash-master-head {
+  padding: 12px 16px 10px;
+  margin-bottom: 0;
+  gap: 10px;
+  border-bottom: 1px solid var(--border);
+  flex-wrap: wrap;
+}
+.dash-master-head .card-title .sub {
+  display: inline;
+  margin-left: 6px;
+}
+.dash-master-head-actions {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex: none;
+  margin-left: auto;
+}
+.dash-master-head-actions .input {
+  width: 132px;
+  min-height: 28px;
+  padding: 4px 8px;
+  flex: none;
+}
+.dash-master-split {
+  gap: 0;
+  /* 少数据自适应；整卡（含共享头）目标约 340px；多数据模块内滚动 */
+  max-height: 300px;
+  /* max-height  alone 无法约束隐式行高；补可收缩行后 pane 内 overflow:auto 才会生效 */
+  grid-template-rows: minmax(0, 1fr);
+  overflow: hidden;
+}
+.dash-master-pane {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  min-height: 0;
+  overflow: hidden;
+}
+.dash-master-pane--list {
+  border-right: 1px solid var(--border);
+}
+.dash-company-list {
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+}
+.dash-company-loading,
+.dash-company-empty {
+  padding: 16px;
+  font-size: 13px;
+}
+.dash-company-item {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 8px 14px 8px 16px;
+  border-bottom: 1px solid var(--border);
+  cursor: pointer;
+  transition: background 0.12s ease;
+}
+.dash-company-item:last-child {
+  border-bottom: 0;
+}
+.dash-company-item:hover {
+  background: var(--fg-soft);
+}
+.dash-company-item.is-selected {
+  background: var(--accent-soft);
+  box-shadow: inset 3px 0 0 var(--accent);
+  padding-left: 13px;
+}
+.dash-company-item.is-selected:hover {
+  background: var(--accent-soft);
+}
+.dash-company-main {
+  min-width: 0;
+  flex: 1;
+}
+.dash-company-name {
+  display: block;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  font-size: 13.5px;
+  font-weight: 550;
+  color: var(--fg);
+  line-height: 1.35;
+}
+.dash-company-meta {
+  display: block;
+  margin-top: 2px;
+  font-size: 12px;
+  color: var(--muted);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.dash-company-net {
+  flex: none;
+  font-family: var(--font-mono);
+  font-variant-numeric: tabular-nums;
+  font-size: 13px;
+  font-weight: 600;
+  text-align: right;
+  min-width: 4.5em;
+}
+.dash-detail-toolbar {
+  padding: 10px 14px 0;
+  flex: none;
+}
+.dash-detail-heading {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 0;
+}
+.dash-detail-name {
+  font-size: 14px;
+  font-weight: 650;
+  color: var(--fg);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.dash-detail-summary {
+  display: grid;
+  grid-template-columns: repeat(5, minmax(0, 1fr));
+  gap: 0;
+  margin: 10px 14px 0;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--bg);
+  flex: none;
+}
+.dash-summary-item {
+  padding: 8px 10px;
+  border-right: 1px solid var(--border);
+  min-width: 0;
+}
+.dash-summary-item:last-child {
+  border-right: 0;
+}
+.dash-summary-label {
+  display: block;
+  font-family: var(--font-mono);
+  font-size: 11px;
+  letter-spacing: 0.04em;
+  color: var(--muted);
+  margin-bottom: 2px;
+}
+.dash-summary-value {
+  display: block;
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--fg);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.dash-detail-body {
+  flex: 1;
+  min-height: 0;
+  display: flex;
+  flex-direction: column;
+  position: relative;
+  margin-top: 8px;
+}
+.dash-master-scroll {
+  border: 0;
+  border-radius: 0;
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+}
+.dash-detail-empty {
+  flex: 1;
+  min-height: 120px;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  text-align: center;
+  padding: 20px 24px;
+  color: var(--muted);
+  font-size: 13px;
+}
+.dash-detail-empty .e-title {
+  font-weight: 600;
+  color: var(--fg);
+  margin-bottom: 6px;
+}
+.dash-detail-empty .e-desc {
+  max-width: 360px;
+  line-height: 1.55;
+}
+.dash-master-scroll[hidden],
+.dash-detail-empty[hidden],
+.dash-detail-summary[hidden] {
+  display: none !important;
+}
+.ds-table.ds-table--compact {
+  min-width: 0;
+}
+.ds-table.ds-table--compact th,
+.ds-table.ds-table--compact td {
+  padding: 6px 12px;
+}
+.ds-table.ds-table--compact th {
+  font-size: 11px;
+  white-space: nowrap;
+}
+.ds-table tbody tr.is-selected {
+  background: var(--accent-soft);
+}
+.ds-table tbody tr.is-selected:hover {
+  background: var(--accent-soft);
+}
 .row { display: flex; align-items: center; gap: 10px; }
 .row-between { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
 .stack { display: flex; flex-direction: column; gap: 14px; }
@@ -223,13 +450,56 @@ p { margin: 0; }
 
 @media (max-width: 1100px) {
   .grid-4, .grid-5 { grid-template-columns: repeat(2, minmax(0, 1fr)); }
-  .grid-3, .grid-2-1, .grid-1-2, .grid-3-2 { grid-template-columns: minmax(0, 1fr); }
+  .grid-3, .grid-2-1, .grid-1-2, .grid-3-2, .grid-480-1 { grid-template-columns: minmax(0, 1fr); }
+  .dash-master-split {
+    max-height: none;
+    grid-template-rows: none;
+    overflow: visible;
+  }
+  .dash-master-pane--list {
+    border-right: 0;
+    border-bottom: 1px solid var(--border);
+    max-height: 280px;
+  }
+  .dash-master-pane--detail {
+    max-height: 420px;
+  }
+  .dash-detail-summary {
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+  }
+  .dash-summary-item:nth-child(3) {
+    border-right: 0;
+  }
+  .dash-summary-item:nth-child(n+4) {
+    border-top: 1px solid var(--border);
+  }
 }
 @media (max-width: 860px) {
   .shell { grid-template-columns: 1fr; }
   .sidebar { position: static; height: auto; }
   .grid-2 { grid-template-columns: 1fr; }
   .content { padding: 16px 16px 48px; }
+  .dash-master-head-actions {
+    width: 100%;
+    margin-left: 0;
+    justify-content: space-between;
+  }
+  .dash-master-head-actions .input {
+    flex: 1;
+    width: auto;
+  }
+  .dash-detail-summary {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+  .dash-summary-item:nth-child(2n) {
+    border-right: 0;
+  }
+  .dash-summary-item:nth-child(3) {
+    border-right: 1px solid var(--border);
+  }
+  .dash-summary-item:nth-child(n+3) {
+    border-top: 1px solid var(--border);
+  }
 }
 
 /* ─── 数据表 ────────────────────────────────────────────────────── */