fix(web): 收口三至五期复审问题

web/evidence/accessibility-matrix.json

@@ -1,15 +1,15 @@
 {
   "schema_version": 1,
-  "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
-  "generated_at": "2026-07-28T21:19:41Z",
+  "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+  "generated_at": "2026-07-29T00:11:19Z",
   "rows": [
     {
       "id": "linux-chromium-automated",
       "mode": "automated",
       "status": "PASS",
       "operator": "Codex automated runner",
-      "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
-      "executed_at": "2026-07-28T21:19:41Z",
+      "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+      "executed_at": "2026-07-29T00:10:23Z",
       "environment": {
         "os_name": "Ubuntu",
         "os_version": "24.04 Playwright Noble image",
@@ -42,7 +42,7 @@
       "artifacts": [
         {
           "path": "evidence/artifacts/visual-runner-functional-chromium.json",
-          "sha256": "a77f3d4ef31dcc06d5a15bbf429e83a4f467ac0d1a80ad80ee70c741f88158b7"
+          "sha256": "f515f1984759303eaad6a773413c49bc82eed8a8757c8b3907a8fe2777a195ec"
         }
       ],
       "notes": "Automated DOM, keyboard, geometry, focus, and live-region assertions only; this is not human assistive-technology evidence."
@@ -52,8 +52,8 @@
       "mode": "automated",
       "status": "PASS",
       "operator": "Codex automated runner",
-      "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
-      "executed_at": "2026-07-28T21:19:41Z",
+      "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+      "executed_at": "2026-07-29T00:11:19Z",
       "environment": {
         "os_name": "Ubuntu",
         "os_version": "24.04 Playwright Noble image",
@@ -86,7 +86,7 @@
       "artifacts": [
         {
           "path": "evidence/artifacts/visual-runner-functional-webkit.json",
-          "sha256": "994abdd803ca6a343936df2254227f1a224982efa8622e91d5de64128d21b1e9"
+          "sha256": "6553863d44af9bb41504789f554d19f5653cc66a6b3dffb1ced97eff05c5d775"
         }
       ],
       "notes": "Automated DOM, keyboard, geometry, focus, and live-region assertions only; this is not Safari or VoiceOver evidence."
@@ -96,7 +96,7 @@
       "mode": "manual-geometry-functional",
       "status": "NOT RUN",
       "operator": "NOT RUN",
-      "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
+      "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
       "executed_at": null,
       "environment": {
         "os_name": "macOS",
@@ -124,7 +124,7 @@
       "mode": "manual-geometry-functional",
       "status": "NOT RUN",
       "operator": "NOT RUN",
-      "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
+      "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
       "executed_at": null,
       "environment": {
         "os_name": "macOS",
@@ -152,7 +152,7 @@
       "mode": "manual-at",
       "status": "NOT RUN",
       "operator": "NOT RUN",
-      "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
+      "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
       "executed_at": null,
       "environment": {
         "os_name": "macOS",
@@ -182,7 +182,7 @@
       "mode": "external-at",
       "status": "EXTERNAL",
       "operator": "EXTERNAL",
-      "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
+      "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
       "executed_at": null,
       "environment": {
         "os_name": "Windows",

web/evidence/accessibility-matrix.md

@@ -1,6 +1,6 @@
 # GPT-Load 2.0 accessibility evidence matrix
 
-This matrix separates reproducible automated checks from genuine human browser and assistive-technology evidence. It is bound to source commit `c28dc80a725d2254f82898357a87a7dbe4b2d8d0`.
+This matrix separates reproducible automated checks from genuine human browser and assistive-technology evidence. It is bound to the exact local merge commit `06ec29fddee966828bde604d9a989e31b98ffdb8`.
 
 | Environment           | Mode                      |   Result | Version                                         | Evidence                                                            |
 | --------------------- | ------------------------- | -------: | ----------------------------------------------- | ------------------------------------------------------------------- |

web/evidence/artifacts/visual-runner-functional-chromium.json

@@ -2,7 +2,7 @@
   "schema_version": 1,
   "mode": "functional",
   "status": "PASS",
-  "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
+  "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
   "source_dirty": false,
   "lock_sha256": "1057d8cb6a6ab7a3a1f4c8a371a1c4cf6c0fd9723938e42026e8ec7beb68a68a",
   "image": "mcr.microsoft.com/playwright:v1.61.1-noble@sha256:5b8f294aff9041b7191c34a4bab3ac270157a28774d4b0660e9743297b697e48",
@@ -36,8 +36,8 @@
   "accessibility": {
     "status": "PASS",
     "result_count": 7,
-    "json_sha256": "859e7d190445329f8a084b55145c6e7100f6d1d8dab4b09473d2f71350ded91e",
-    "markdown_sha256": "9b1b5a596d4d1c9093adb3bc5f295cd40fc3e992fe7f0d70ec1d25bc9e3e541d"
+    "json_sha256": "27f0979aa40c9ed095510b298cd9ec9df5da9b89d8323d770e49b38e26d32b30",
+    "markdown_sha256": "414aef15249e7eba804b2a41e12376a0e23af2339ea70b22cdaad3b4b8d71016"
   },
-  "evidence_sha256": "2cccac0f678688388e8427667dce53d8ee350007cdb5f02e520387bb57079703"
+  "evidence_sha256": "ab4ca40cc5932b761c1302283de50f191aabfcfd228129ebebbe5b343cca71f7"
 }

web/evidence/artifacts/visual-runner-functional-webkit.json

@@ -2,7 +2,7 @@
   "schema_version": 1,
   "mode": "functional",
   "status": "PASS",
-  "source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
+  "source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
   "source_dirty": false,
   "lock_sha256": "1057d8cb6a6ab7a3a1f4c8a371a1c4cf6c0fd9723938e42026e8ec7beb68a68a",
   "image": "mcr.microsoft.com/playwright:v1.61.1-noble@sha256:5b8f294aff9041b7191c34a4bab3ac270157a28774d4b0660e9743297b697e48",
@@ -36,8 +36,8 @@
   "accessibility": {
     "status": "PASS",
     "result_count": 7,
-    "json_sha256": "0f1b3795c3b66563dab27f8bb4b34ff16c99fcf5f8952cbb769a60b50f9e2236",
-    "markdown_sha256": "7b2318de378ecda3dfa6c5c2264739f50eae669e945b6db75f545a6fae1c3958"
+    "json_sha256": "c87f331755998bc0a659e8e3d2d3cd41e8aa7ebd109bafd6cff09e32b2f3e7be",
+    "markdown_sha256": "6439adaff1286148699f0df185cd83ad57b0e0d499adf39488bdc1dae1768204"
   },
-  "evidence_sha256": "72fe95f9482066ac3f6819168dbadb80f325b413574e6431a64e3f48de6f928a"
+  "evidence_sha256": "5a9393bfc129c7673225fb8c5f1e62cacc1580409c286778751a3fabe48ff484"
 }

web/evidence/external-gates.json

@@ -1,7 +1,17 @@
 {
   "schema_version": 1,
-  "generated_at": "2026-07-28T21:46:48Z",
+  "generated_at": "2026-07-29T00:15:10Z",
   "audit_source_sha": "3d7496579d373589da3265395f35af096f75d97e",
+  "phase5_delivery_head": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+  "audit_refresh": {
+    "checked_at": "2026-07-29T00:15:10Z",
+    "feature_head": "c1874b80e0792d47bb04194348d144777077b0a7",
+    "local_merge_head": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+    "remote_v2_sha": "3744cd5a4ebe8ec06f9c9a8f550f74737829a562",
+    "feature_visible_on_github": false,
+    "local_merge_visible_on_github": false,
+    "notes": "The original external audit remains bound to 3d74965. A read-only GitHub API refresh confirmed that neither final local SHA is public and origin/v2 is unchanged."
+  },
   "repository": {
     "name": "tbphp/gpt-load",
     "url": "https://github.com/tbphp/gpt-load",
@@ -21,16 +31,23 @@
     {
       "id": "feature-head-visible-on-github",
       "status": "NOT RUN",
-      "expected_sha": "3d7496579d373589da3265395f35af096f75d97e",
+      "expected_sha": "c1874b80e0792d47bb04194348d144777077b0a7",
       "evidence": "The GitHub commits API did not find the local feature head.",
       "reason": "The feature branch has intentionally not been pushed."
     },
     {
       "id": "exact-feature-sha-ci",
       "status": "NOT RUN",
-      "expected_sha": "3d7496579d373589da3265395f35af096f75d97e",
+      "expected_sha": "c1874b80e0792d47bb04194348d144777077b0a7",
       "reason": "An unpushed SHA cannot have GitHub Actions runs or checks."
     },
+    {
+      "id": "exact-local-merge-sha-ci",
+      "status": "NOT RUN",
+      "expected_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+      "evidence": "The GitHub commits API did not find the local merge head.",
+      "reason": "The local v2 merge has intentionally not been pushed."
+    },
     {
       "id": "remote-v2-ci",
       "status": "FAIL",

web/evidence/external-gates.md

@@ -1,14 +1,19 @@
 # GPT-Load 2.0 Phase 5 外部门禁审计
 
-审计时间：2026-07-28 21:46:48 UTC
+审计时间：2026-07-28 21:46:48 UTC；交付 SHA 只读刷新：2026-07-29 00:15:10 UTC
 
 本地审计 SHA：`3d7496579d373589da3265395f35af096f75d97e`
 
+最终 feature SHA：`c1874b80e0792d47bb04194348d144777077b0a7`
+
+本地 `v2` merge SHA：`06ec29fddee966828bde604d9a989e31b98ffdb8`
+
 远端 `v2` SHA：`3744cd5a4ebe8ec06f9c9a8f550f74737829a562`
 
 ## 结论
 
-- 本地 Phase 3–5 分支没有 push，GitHub 无法识别该 SHA，因此精确 SHA CI 为 `NOT RUN`。
+- 本地 Phase 3–5 feature 与 merge 均没有 push；只读 GitHub API 刷新确认两个最终 SHA
+  均不存在，远端 `v2` 仍为 `3744cd5`，因此两者的精确 SHA CI 都是 `NOT RUN`。
 - 远端 `v2` 的 [V2 CI run 30382845830](https://github.com/tbphp/gpt-load/actions/runs/30382845830) 整体为 `FAIL`：Linux `test` job 通过，`windows-encryption-acl` job 失败。
 - Windows 失败是 `TestAutoMigrateUpgradesV1AccessKeyWithBackups` 在 Windows 上得到文件 mode `0666`，却仍按 POSIX 语义要求 `0600`。更早的 [run 30329551379](https://github.com/tbphp/gpt-load/actions/runs/30329551379) 在 `6ec83da` 上通过，但已不是当前 SHA 证据。
 - 本地 `3d74965` 已将迁移备份断言拆成 Unix `0600` 与 Windows protected current-user DACL；macOS 定向测试通过，Windows 测试二进制交叉编译通过，但尚无 Windows runner 执行，因此仍为 `EXTERNAL`，不能标记 `PASS`。
@@ -24,7 +29,8 @@
 
 | 门禁                          | 状态     | 证据/原因                               |
 | ----------------------------- | -------- | --------------------------------------- |
-| 本地 feature 精确 SHA CI      | NOT RUN  | SHA 未 push，GitHub API 不存在该 commit |
+| 本地 feature 精确 SHA CI      | NOT RUN  | `c1874b8` 未 push，GitHub API 不存在    |
+| 本地 merge 精确 SHA CI        | NOT RUN  | `06ec29f` 未 push，GitHub API 不存在    |
 | 当前远端 v2 CI                | FAIL     | Linux job PASS；Windows job FAIL        |
 | 2.x tag / GitHub Release      | NOT RUN  | 当前公开 release 最新为 v1.4.9          |
 | 五平台公开原生制品            | NOT RUN  | 无 2.x Release                          |

web/evidence/local-gates.json

@@ -1,7 +1,14 @@
 {
   "schema_version": 1,
-  "generated_at": "2026-07-28T21:39:11Z",
-  "evidence_head": "7196b1bf50be8550ec78b4a743a1032b0c3a5c3d",
+  "generated_at": "2026-07-29T00:11:19Z",
+  "evidence_head": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+  "delivery_lineage": {
+    "feature_head": "c1874b80e0792d47bb04194348d144777077b0a7",
+    "local_merge_head": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+    "feature_tree": "41fae9c4358e83f46e4dc61ecc81c06ce019640f",
+    "merge_tree": "41fae9c4358e83f46e4dc61ecc81c06ce019640f",
+    "feature_to_merge_diff": "empty"
+  },
   "environment": {
     "os": "macOS 26.6 build 25G72",
     "architecture": "arm64",
@@ -17,6 +24,64 @@
     }
   },
   "gates": [
+    {
+      "id": "phase5-feature-head-verification",
+      "status": "PASS",
+      "tested_sha": "c1874b80e0792d47bb04194348d144777077b0a7",
+      "commands": [
+        "formatted_files=\"$(gofmt -l .)\" && test -z \"${formatted_files}\"",
+        "go mod tidy -diff",
+        "go vet ./...",
+        "make web-check",
+        "go build -o gpt-load .",
+        "corepack pnpm --dir web run test:e2e",
+        "go test -race -count=1 . ./internal/...",
+        "corepack pnpm --dir web run check:bundle",
+        "corepack pnpm --dir web run check:visual",
+        "corepack pnpm --dir web run visual:run -- --verify",
+        "git diff --check"
+      ],
+      "result": {
+        "web_unit": "142 files, 1033 tests passed",
+        "browser_e2e": "26 tests passed",
+        "go_race": "all root and internal packages passed",
+        "production_build": "passed",
+        "bundle_failures": [],
+        "runner_execution_verified": true
+      },
+      "notes": "Fresh output was retained before the local merge. Release-smoke and container gates remain bound to 7196b1b because c1874b8 does not modify their scripts, container contract, or runtime implementation."
+    },
+    {
+      "id": "phase5-local-merge-verification",
+      "status": "PASS",
+      "tested_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
+      "commands": [
+        "formatted_files=\"$(gofmt -l .)\" && test -z \"${formatted_files}\"",
+        "go mod tidy -diff",
+        "go vet ./...",
+        "make web-check",
+        "go build -o gpt-load .",
+        "corepack pnpm --dir web run test:e2e",
+        "go test -race -count=1 . ./internal/...",
+        "corepack pnpm --dir web run check:bundle",
+        "corepack pnpm --dir web run check:visual",
+        "corepack pnpm --dir web run visual:run -- --verify",
+        "corepack pnpm --dir web run visual:run -- --browser=chromium --functional",
+        "corepack pnpm --dir web run visual:run -- --browser=webkit --functional",
+        "git diff --check"
+      ],
+      "result": {
+        "web_unit": "142 files, 1033 tests passed",
+        "browser_e2e": "26 tests passed",
+        "go_race": "all root and internal packages passed",
+        "production_build": "passed",
+        "bundle_failures": [],
+        "runner_execution_verified": true,
+        "pinned_chromium_functional": "8 tests passed",
+        "pinned_webkit_functional": "8 tests passed"
+      },
+      "notes": "The feature and merge commits have identical Git trees. Chromium and WebKit functional evidence was regenerated on the clean exact merge SHA during review remediation."
+    },
     {
       "id": "full-repository-gates",
       "status": "PASS",
@@ -61,26 +126,49 @@
     {
       "id": "bundle-budget",
       "status": "PASS",
-      "tested_sha": "7196b1bf50be8550ec78b4a743a1032b0c3a5c3d",
+      "tested_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
       "command": "corepack pnpm --dir web run check:bundle",
       "result": {
         "failures": [],
         "home_initial_javascript": {
-          "raw": 412713,
-          "gzip": 143313,
-          "brotli": 127166
+          "raw": 412732,
+          "gzip": 143296,
+          "brotli": 127173
         },
         "home_initial_css": {
           "raw": 40436,
           "gzip": 10136,
           "brotli": 8695
         }
+      },
+      "regression_approval": {
+        "status": "ACCEPTED_WITHIN_APPROVED_PHASE_3_SCOPE",
+        "comparison_sha": "f27b4a4d1174b52ef143123e2b08ab8431f56702",
+        "home_initial_javascript_gzip": {
+          "before": 131738,
+          "after": 143296,
+          "delta_bytes": 11558,
+          "delta_ratio": 0.08773474623874661
+        },
+        "home_initial_javascript_brotli": {
+          "before": 117017,
+          "after": 127173,
+          "delta_bytes": 10156,
+          "delta_ratio": 0.08679080817317142
+        },
+        "home_initial_css_gzip": {
+          "before": 8178,
+          "after": 10136,
+          "delta_bytes": 1958,
+          "delta_ratio": 0.23942284177060405
+        },
+        "reason": "The increase comes from the approved Phase 3 Home native-protocol snippets, operational overview, semantic presenters, and responsive first-view composition. These are immediately visible Home content; splitting them would add a first-view network waterfall. All compressed values remain below the frozen absolute ceilings, so the measured regression is accepted and locked as the go-forward baseline."
       }
     },
     {
       "id": "pinned-visual-runner",
       "status": "PASS",
-      "tested_sha": "7196b1bf50be8550ec78b4a743a1032b0c3a5c3d",
+      "tested_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
       "commands": [
         "corepack pnpm --dir web run check:visual",
         "corepack pnpm --dir web run visual:run -- --verify"
@@ -97,10 +185,10 @@
     {
       "id": "accessibility-evidence-validator",
       "status": "PASS",
-      "tested_sha": "7196b1bf50be8550ec78b4a743a1032b0c3a5c3d",
+      "tested_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
       "command": "corepack pnpm --dir web run check:a11y-evidence",
       "result": {
-        "matrix_source_sha": "c28dc80a725d2254f82898357a87a7dbe4b2d8d0",
+        "matrix_source_sha": "06ec29fddee966828bde604d9a989e31b98ffdb8",
         "rows": 6,
         "automated_pass": ["linux-chromium-automated", "linux-webkit-automated"]
       }

web/src/app/resources/invalidation.test.ts

@@ -30,11 +30,11 @@ describe('resource mutation invalidation graph', () => {
       exact: [controlQueryKeys.groups.list(), controlQueryKeys.health()],
       prefixes: [],
     })
-    expect(mutationInvalidationPlans.group.update(7, true)).toEqual({
+    expect(mutationInvalidationPlans.group.update(true)).toEqual({
       exact: [controlQueryKeys.groups.list(), controlQueryKeys.health()],
       prefixes: [],
     })
-    expect(mutationInvalidationPlans.group.update(7, false)).toEqual({
+    expect(mutationInvalidationPlans.group.update(false)).toEqual({
       exact: [controlQueryKeys.groups.list()],
       prefixes: [],
     })
@@ -52,7 +52,7 @@ describe('resource mutation invalidation graph', () => {
     )
     for (const plan of [
       mutationInvalidationPlans.group.create,
-      mutationInvalidationPlans.group.update(7, true),
+      mutationInvalidationPlans.group.update(true),
       mutationInvalidationPlans.group.importKeys(7),
     ]) {
       expect([...plan.exact, ...plan.prefixes]).not.toContainEqual(controlQueryKeys.all)
@@ -83,7 +83,7 @@ describe('resource mutation invalidation graph', () => {
     })
     await applyInvalidationPlan(
       queryClient,
-      mutationInvalidationPlans.group.update(7, true),
+      mutationInvalidationPlans.group.update(true),
       () => current,
     )
     expect(invalidate).toHaveBeenCalledTimes(1)

web/src/app/resources/invalidation.ts

@@ -28,7 +28,7 @@ export const mutationInvalidationPlans = {
   },
   group: {
     create: plan([controlQueryKeys.groups.list(), controlQueryKeys.health()]),
-    update: (groupID: number, healthAffected: boolean) =>
+    update: (healthAffected: boolean) =>
       plan([
         controlQueryKeys.groups.list(),
         ...(healthAffected ? [controlQueryKeys.health()] : []),

web/src/features/groups/settings/GroupSettingsTab.vue

@@ -194,7 +194,7 @@ async function runSave(confirmUpstreamURLChange = false): Promise<void> {
     queryClient.setQueryData(controlQueryKeys.groups.detail(props.groupId), result.group)
     await applyInvalidationPlan(
       queryClient,
-      mutationInvalidationPlans.group.update(props.groupId, healthAffected(normalizedPatch)),
+      mutationInvalidationPlans.group.update(healthAffected(normalizedPatch)),
       () => controller === activeController,
     )
   } catch (error: unknown) {

web/visual-baselines/candidates/43c05ceaf1709212f0930e05f0273408f7996d3f/inspection.md

@@ -37,3 +37,18 @@ Two defects found in earlier candidates were fixed before this candidate was gen
 
 The final implementation resets capture scroll deterministically and limits non-shrinking,
 single-line badge behavior to AccessKey mobile cards. No candidate was activated automatically.
+
+## Post-capture delta review
+
+The candidate remains bound to `43c05ceaf1709212f0930e05f0273408f7996d3f`. The reviewed range
+through local merge `06ec29fddee966828bde604d9a989e31b98ffdb8` contains no later
+pixel-affecting implementation change:
+
+- `8a3a022078128820a3a54556fb72bf315051038a` adds only `id` and
+  `aria-describedby` relationships to the AccessKey RPM field;
+- `c1874b80e0792d47bb04194348d144777077b0a7` hardens response projection and
+  controlled select event handling without changing rendered text, structure, or style;
+- the other intervening commits change tests, evidence, release scripts, or Go platform tests.
+
+The candidate was therefore not regenerated or relabeled. Human baseline approval remains
+`NOT RUN`, and activation remains disabled.