fix(m3): code-review 15 项修复（13 项落地，2 项依赖分摊语义记待办）

- 审批：删 _flush_order 撞键内部重试（rollback 会回掉同事务业务行造成
  静默丢数据，异常改由 create 外层重试整体重来/update 路径审计收敛）；
  act() 出参固化前置到 commit 之前（commit 后查询失败会把已通过的审批
  记成失败审计）；驳回/撤回清空方案生效行（防被否决方案进 M3 快照）；
  keyword 改 contains(autoescape=True) 对齐全库转义口径；撤单抽
  withdraw_pending_orders 供编辑清空方案时显式调用
- 业务：删业务遇在途审批单禁删 400、终态审批单随 _hard_delete 清理；
  编辑清空方案同步撤回在途单；历史离职参与人编辑放行（冗余姓名固化
  语义，仅新增参与人做在职校验）
- 迁移：business_secondary_allocations 补 uk(business_id, personnel_id)
  （模型/迁移 py/导出 SQL/init-dev 四方同步，开发库往返重放验证）
- 设置：upload_logo 改同步 def（阻塞操作不卡事件循环）+ file.size 先拦；
  company_name schema 剥空白防全空白入库；logo 旧文件清理移到 commit
  成功后（防库指旧路径而文件已删断链）；uploadLogo 走 request() 解包
  （原直发 service.post 不解包信封，logoUrl 会被置 undefined）
- 备份：restore_drill --drop-exec 先清全部历史 drill 库再演练并即删本轮
  （原语义永远删错对象，每轮净增一份整库拷贝）
- 测试：conftest 清理补 system_settings 种子行与 uploads/logo 文件；
  新增 5 例（驳回清方案/清空撤单/在途禁删终态随删/离职放行/BOOL 边界）；
  全量回归 701 passed
- 遗留 2 项记 AI_CONTEXT（方案版本承载、审批单快照，依赖 ④ 分摊语义）

Co-Authored-By: Claude Code <noreply@anthropic.com>

backend/app/api/v1/system/settings.py

@@ -12,6 +12,7 @@ from fastapi import APIRouter, Response, UploadFile
 from fastapi.responses import FileResponse
 
 from app.api.deps import AdminUser, DbSession, RequestMetaDep
+from app.core.exceptions import BadRequestError
 from app.core.response import ApiResponse, ok
 from app.schemas.setting import SettingOut, SettingPublicOut, SettingUpdateIn
 from app.services import system_setting_service as service
@@ -42,14 +43,21 @@ def update_settings(
 
 
 @router.post("/logo", response_model=ApiResponse[SettingOut], summary="上传 logo")
-async def upload_logo(
+def upload_logo(
     file: UploadFile,
     session: DbSession,
     current_user: AdminUser,
     meta: RequestMetaDep,
 ) -> ApiResponse[SettingOut]:
-    """上传公司 logo（png/jpg ≤2MB；固定名覆盖，旧扩展名文件清理）。"""
-    content = await file.read()
+    """上传公司 logo（png/jpg ≤2MB；固定名覆盖，旧扩展名文件清理）。
+
+    同步 `def`：读文件、磁盘写与审计提交都是阻塞操作，async 路由里会让
+    它们卡死事件循环（项目红线：全栈同步路由，FastAPI 自动进线程池）。
+    大小先用 `file.size` 拦截，避免超限文件整体读进内存。
+    """
+    if file.size is not None and file.size > service.LOGO_MAX_BYTES:
+        raise BadRequestError("logo 文件不能超过 2MB")
+    content = file.file.read()
     ext = (file.filename or "").rsplit(".", 1)[-1]
     return ok(
         service.save_logo(session, content, ext, operator=current_user, meta=meta),

backend/app/models/business.py

@@ -15,7 +15,7 @@
 from datetime import date, datetime
 from decimal import Decimal
 
-from sqlalchemy import Date, DateTime, ForeignKey, Index, Numeric, String, text
+from sqlalchemy import Date, DateTime, ForeignKey, Index, Numeric, String, UniqueConstraint, text
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.models.base import (
@@ -56,6 +56,11 @@ class SecondaryAllocation(Base, TimestampMixin):
         # 表/列注释避开「%」字符：SHOW CREATE TABLE 经驱动参数化转义为「%%」，
         # 会与 ORM 侧 comment 字面断言失配（全库既有注释同此惯例）
         "业务二次分配方案明细表（合同建立时录入；比例不要求合计满额，余额归属待澄清）",
+        UniqueConstraint(
+            "business_id",
+            "personnel_id",
+            name="uk_business_secondary_allocations_business_personnel",
+        ),
         Index("idx_business_secondary_allocations_business_id", "business_id"),
         Index("idx_business_secondary_allocations_personnel_id", "personnel_id"),
     )

backend/app/repositories/business_repository.py

@@ -228,6 +228,18 @@ def replace_allocations(
     session.flush()
 
 
+def delete_allocations(session: Session, business_id: int) -> None:
+    """清空业务的二次分配方案（审批驳回/撤回时由 approval_service 调用）。
+
+    被否决的方案不得以「当前生效行」身份留在表里（M3 核算快照会取到）；
+    方案事实由审批单留痕与操作日志 request_data 承载。
+    """
+    session.execute(
+        delete(SecondaryAllocation).where(SecondaryAllocation.business_id == business_id)
+    )
+    session.flush()
+
+
 def add_status_log(session: Session, log: BusinessStatusLog) -> None:
     """追加状态留痕（不 commit）。"""
     session.add(log)

backend/app/schemas/setting.py

@@ -5,7 +5,7 @@
 顺着复用链泄漏到匿名端点。
 """
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 
 class SettingOut(BaseModel):
@@ -23,6 +23,12 @@ class SettingPublicOut(BaseModel):
 
 
 class SettingUpdateIn(BaseModel):
-    """公司信息更新。"""
+    """公司信息更新。
+
+    str_strip_whitespace：全空白名称先剥再校验——否则 `"   "` 过 min_length=1
+    后由服务层 strip 成空串入库（200 成功但 public 端点返回空公司名）。
+    """
+
+    model_config = ConfigDict(str_strip_whitespace=True)
 
     company_name: str = Field(min_length=1, max_length=64, description="公司名称")

backend/app/services/approval_service.py

@@ -22,7 +22,6 @@ import logging
 from datetime import date
 
 from sqlalchemy import func, select
-from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
 from app.core.constants import (
@@ -33,13 +32,13 @@ from app.core.constants import (
     ROLE_FINANCE,
     ROLE_LEADER,
 )
-from app.core.db_errors import is_duplicate_entry
 from app.core.exceptions import BadRequestError, ForbiddenError, NotFoundError
 from app.core.response import PageResult
 from app.models import ApprovalOrder, ApprovalStep, User
 from app.models.approval import (
     APPROVAL_ACTION_APPROVE,
     APPROVAL_ACTION_AUTO_APPROVE,
+    APPROVAL_ACTION_REJECT,
     APPROVAL_ACTION_WITHDRAW,
     APPROVAL_NODE_FINANCE,
     APPROVAL_NODE_LEADER,
@@ -71,8 +70,6 @@ ENABLE_CODE_BY_TYPE: dict[int, str] = {
     2: "approval.monthly_settlement.enabled",
 }
 
-_NO_RETRY = 1  # AP 单号唯一键冲突重试（next_no 的 MAX+FOR UPDATE 之外的兜底）
-
 # 在途状态集合（同一引用对象至多一张在途单）
 _PENDING_STATUSES = (APPROVAL_STATUS_PENDING_FINANCE, APPROVAL_STATUS_PENDING_LEADER)
 
@@ -100,19 +97,15 @@ def submit_order(
     ref_id: int,
     refer_no: str,
     submitter: User,
-    retry_on_conflict: bool,
 ) -> ApprovalOrder:
     """提单（业务写路径内部调用；不 commit、不嵌套 audit）。
 
     同一引用对象的在途单先撤回留痕再建新单；开关关闭时生成即自动通过
-    （全节点 action=3 留痕）。
-
-    :param retry_on_conflict: AP 编号撞唯一键时是否允许本函数内部
-        rollback 后重取。**仅 create 传 True**——它外层有编号重试循环，
-        rollback 后整体重来；update 路径必须传 False：内部 rollback 会把
-        同事务的业务行修改一并回滚，静默继续会「返回 200 库里没改」。
-        False 时 IntegrityError 直接抛出 → 审计上下文回滚并记失败 →
-        全局 handler 收敛 400，用户重试即可。
+    （全节点 action=3 留痕）。AP 编号撞唯一键时 IntegrityError 直接穿透：
+    create 路径由外层编号重试循环整体重来（rollback 后业务/方案/审批单
+    一并重做），update 路径由审计上下文回滚并经全局 handler 收敛 400——
+    **任何情况下都不允许本函数内部 rollback 后部分重试**，那会把同事务
+    的业务主行/明细/方案回滚掉而审批单单表重插，静默丢业务数据。
     """
     _withdraw_pending(session, order_type=order_type, ref_id=ref_id, operator=submitter)
 
@@ -133,13 +126,13 @@ def submit_order(
 
     if is_enabled(session, order_type):
         order.status = APPROVAL_STATUS_PENDING_FINANCE
-        _flush_order(session, order, retry_on_conflict=retry_on_conflict)
+        session.flush()
         logger.info("审批单待审 | order=%s", order.order_no)
         return order
 
     # 开关关闭=直接生效：两级节点各记一条「自动通过」，留痕不断链
     order.status = APPROVAL_STATUS_APPROVED
-    _flush_order(session, order, retry_on_conflict=retry_on_conflict)
+    session.flush()
     session.add_all(
         [
             ApprovalStep(
@@ -156,6 +149,29 @@ def submit_order(
     return order
 
 
+def withdraw_pending_orders(
+    session: Session, *, order_type: int, ref_id: int, operator: User
+) -> int:
+    """撤回引用对象的全部在途单（供业务清空方案等场景显式调用；不 commit）。
+
+    返回撤回张数（0 = 本就无在途单）。
+    """
+    before = len(
+        session.execute(
+            select(ApprovalOrder.id).where(
+                ApprovalOrder.order_type == order_type,
+                ApprovalOrder.ref_id == ref_id,
+                ApprovalOrder.status.in_(_PENDING_STATUSES),
+            )
+        )
+        .scalars()
+        .all()
+    )
+    if before:
+        _withdraw_pending(session, order_type=order_type, ref_id=ref_id, operator=operator)
+    return before
+
+
 def act(
     session: Session,
     order_id: int,
@@ -194,14 +210,15 @@ def act(
             raise ForbiddenError(f"当前节点须{_ROLE_LABEL[required_role]}角色操作")
 
         node_now = APPROVAL_NODES[order.status]
-        if payload.action == APPROVAL_ACTION_APPROVE:
+        rejected = payload.action == APPROVAL_ACTION_REJECT
+        if rejected:
+            order.status = APPROVAL_STATUS_REJECTED
+        else:
             order.status = (
                 APPROVAL_STATUS_PENDING_LEADER
                 if order.status == APPROVAL_STATUS_PENDING_FINANCE
                 else APPROVAL_STATUS_APPROVED
             )
-        else:
-            order.status = APPROVAL_STATUS_REJECTED
 
         session.add(
             ApprovalStep(
@@ -213,8 +230,23 @@ def act(
                 operator_name=operator.username,
             )
         )
+        # 驳回=方案未获批准：清空该业务的二次分配行，防止被否决的方案以
+        # 「当前生效行」身份留在表里、被 M3 核算快照算进工资；方案事实由
+        # 审批单留痕与操作日志 request_data 承载（分摊语义落定后如需保留
+        # 历史版本，在 ④ 设计时演进）。审批单的清理由调用方（act 内联）
+        # 委托 business_repository 完成 —— service 层互调、不触 commit。
+        if rejected and order.order_type == 1:
+            from app.repositories import business_repository
+
+            business_repository.delete_allocations(session, order.ref_id)
+
+        # 出参（含 steps）在 **commit 之前** 固化：audit 禁止 commit 后再碰
+        # ORM/查询——commit 后的任何 SELECT 失败都会让「已通过的审批」被记
+        # 成失败审计，与库中事实相反（全 services 层唯一例外不许再犯）
+        session.flush()
+        detail = _detail_of(session, order)
         session.commit()
-        return _detail_of(session, order)
+        return detail
 
 
 def list_orders(session: Session, query: ApprovalQuery) -> PageResult[ApprovalOrderOut]:
@@ -279,33 +311,8 @@ def _withdraw_pending(session: Session, *, order_type: int, ref_id: int, operato
         logger.info("撤回在途审批单 %s 张 | ref=%s", len(pending), ref_id)
 
 
-def _flush_order(session: Session, order: ApprovalOrder, *, retry_on_conflict: bool) -> None:
-    """flush 提单；撞 AP 单号唯一键时按 retry_on_conflict 决定重取或抛出。
-
-    rollback 会连业务写路径的未提交变更一并回滚 —— 见 submit_order 的
-    retry_on_conflict 说明（create 才允许内部重取）。
-    """
-    for attempt in range(_NO_RETRY + 1):
-        try:
-            session.flush()
-            return
-        except IntegrityError as exc:
-            session.rollback()
-            if is_duplicate_entry(exc) and retry_on_conflict and attempt < _NO_RETRY:
-                order.id = None  # rollback 后实例回 transient，主键重新分配
-                order.order_no = next_no(
-                    session,
-                    model=ApprovalOrder,
-                    column_name="order_no",
-                    prefix=NO_PREFIX_APPROVAL,
-                )
-                session.add(order)
-                continue
-            raise
-
-
 def _detail_of(session: Session, order: ApprovalOrder) -> ApprovalOrderDetailOut:
-    """出参组装（含 steps 时间线）。"""
+    """出参组装（含 steps 时间线）。调用方须保证处于 commit 之前。"""
     steps = (
         session.execute(
             select(ApprovalStep).where(ApprovalStep.order_id == order.id).order_by(ApprovalStep.id)
@@ -321,8 +328,13 @@ def _detail_of(session: Session, order: ApprovalOrder) -> ApprovalOrderDetailOut
 def _order_filters(query: ApprovalQuery) -> tuple:
     filters = []
     if query.keyword:
-        like = f"%{query.keyword}%"
-        filters.append(ApprovalOrder.order_no.like(like) | ApprovalOrder.refer_no.like(like))
+        # autoescape：用户输入里的 %/_ 按 URL 片段字面匹配（全库统一口径，
+        # 见 customer_repository.contains 用法）——否则 "AP2026_10" 会把
+        # 下划线当单字符通配，搜出无关单据
+        filters.append(
+            ApprovalOrder.order_no.contains(query.keyword, autoescape=True)
+            | ApprovalOrder.refer_no.contains(query.keyword, autoescape=True)
+        )
     if query.status is not None:
         filters.append(ApprovalOrder.status == query.status)
     if query.order_type is not None:

backend/app/services/business_service.py

@@ -34,6 +34,7 @@ from app.core.db_errors import is_duplicate_entry
 from app.core.exceptions import BadRequestError, NotFoundError
 from app.core.response import PageQuery, PageResult
 from app.models import (
+    ApprovalOrder,
     Business,
     BusinessItem,
     BusinessStatusLog,
@@ -51,7 +52,7 @@ from app.models.business import (
     BUSINESS_STATUS_DONE,
 )
 from app.models.customer import OWNER_TYPE_BUSINESS
-from app.repositories import business_repository, customer_repository
+from app.repositories import business_repository, customer_repository, personnel_repository
 from app.schemas.business import (
     BusinessCreateIn,
     BusinessDetailOut,
@@ -284,15 +285,29 @@ def get_detail(session: Session, business_id: int) -> BusinessDetailOut:
 
 
 def _build_allocation_rows(
-    session: Session, business_id: int, items: list[SecondaryAllocationIn]
+    session: Session,
+    business_id: int,
+    items: list[SecondaryAllocationIn],
+    *,
+    old_ids: set[int],
 ) -> list[SecondaryAllocation]:
-    """构造二次分配明细行：人员在职校验 + 姓名冗余固化 + 比例转 Decimal。
+    """构造二次分配明细行：人员校验 + 姓名冗余固化 + 比例转 Decimal。
 
-    :raises BadRequestError: 参与人员不存在或已离职
+    :param old_ids: 编辑前已参与的人员 ID 集合（create 传空集）。这些人的
+        行是**历史事实**——personnel_name 冗余固化的设计本就允许离职后回显，
+        编辑业务（哪怕只改备注）不应被历史参与人的离职状态卡死；仅对
+        **新加入**的参与人做在职校验。
+
+    :raises BadRequestError: 新增参与人员不存在或已离职
     """
     rows: list[SecondaryAllocation] = []
     for item in items:
-        person = _ensure_personnel_active(session, item.personnel_id, "分摊参与")
+        if item.personnel_id in old_ids:
+            person = personnel_repository.get_by_id(session, item.personnel_id)
+            if person is None:
+                raise BadRequestError("分摊参与人员不存在")
+        else:
+            person = _ensure_personnel_active(session, item.personnel_id, "分摊参与")
         rows.append(
             SecondaryAllocation(
                 business_id=business_id,
@@ -388,11 +403,13 @@ def create_business(
                 business_repository.replace_allocations(
                     session,
                     business.id,
-                    _build_allocation_rows(session, business.id, payload.secondary_allocations),
+                    _build_allocation_rows(
+                        session, business.id, payload.secondary_allocations, old_ids=set()
+                    ),
                 )
                 # 方案非空才提单：开关关闭=自动通过留痕，开启=待财务复核。
-                # retry_on_conflict=True：AP 编号撞键可内部重取（外层编号
-                # 重试循环兜底整体重来）
+                # AP 编号撞键时 IntegrityError 穿透 → 外层编号重试循环把
+                # 业务/方案/审批单整体重来
                 if payload.secondary_allocations:
                     approval_service.submit_order(
                         session,
@@ -400,7 +417,6 @@ def create_business(
                         ref_id=business.id,
                         refer_no=business.business_no,
                         submitter=operator,
-                        retry_on_conflict=True,
                     )
                 customer = customer_repository.get_by_id(session, business.customer_id)
                 out = _to_out((business, customer.company_name if customer else None, None, None))
@@ -477,13 +493,18 @@ def update_business(
         )
         # 方案全量替换（空数组=清空）；终态门槛已挡「修改影响已结算月份」的
         # 前置场景（月结在 ④，快照固化后按同一哲学隔离）
+        old_ids = {
+            a.personnel_id for a in business_repository.list_allocations(session, business_id)
+        }
         business_repository.replace_allocations(
             session,
             business_id,
-            _build_allocation_rows(session, business_id, payload.secondary_allocations),
+            _build_allocation_rows(
+                session, business_id, payload.secondary_allocations, old_ids=old_ids
+            ),
         )
-        # 方案非空提单（自动撤回旧在途单）；retry_on_conflict=False：
-        # 本路径无外层重试，内部 rollback 会回掉业务行修改造成静默丢失
+        # 提单/撤单与方案同步生命周期：非空=提单（内含撤旧建新）；空=仅撤回
+        # 在途单 —— 否则旧在途单挂着已不存在的方案继续走审批
         if payload.secondary_allocations:
             approval_service.submit_order(
                 session,
@@ -491,7 +512,13 @@ def update_business(
                 ref_id=business_id,
                 refer_no=business.business_no,
                 submitter=operator,
-                retry_on_conflict=False,
+            )
+        else:
+            approval_service.withdraw_pending_orders(
+                session,
+                order_type=APPROVAL_TYPE_SECONDARY_ALLOCATION,
+                ref_id=business_id,
+                operator=operator,
             )
         _recalc_totals(session, business)
         # 锁定行上已赋值，同一身份映射实例的 _to_out 即反映新值；名称字段
@@ -515,7 +542,7 @@ def delete_business(
     与业务维度的归属留痕（无外键固化表，须手动清）。
 
     :raises NotFoundError: 业务不存在
-    :raises BadRequestError: 存在发货或回款记录
+    :raises BadRequestError: 存在发货或回款记录 / 存在在途审批单
     """
     business = business_repository.get_by_id(session, business_id, for_update=True)
     with audit_service.audit(
@@ -532,6 +559,10 @@ def delete_business(
             raise NotFoundError("业务不存在")
         if business_repository.has_docs(session, business_id):
             raise BadRequestError("业务已有发货或回款记录，请改为已终止而非删除")
+        # 在途审批单（ref_id 固化无外键，业务删了单还挂着且可被继续审批）：
+        # 禁删引导先完成/撤回审批，而不是静默留下指向已删业务的活单
+        if _count_pending_approvals(session, business_id):
+            raise BadRequestError("该业务有在途审批单，请先完成或撤回审批后再删除")
 
         business_no = business.business_no
         _hard_delete(session, business_id)
@@ -539,11 +570,46 @@ def delete_business(
         logger.info("删除业务 | business_id=%s | no=%s", business_id, business_no)
 
 
+def _count_pending_approvals(session: Session, business_id: int) -> int:
+    """该业务的在途审批单数（status 1/2；终态单随业务删除一并清理）。"""
+    from sqlalchemy import func, select
+
+    from app.models import ApprovalOrder
+    from app.models.approval import (
+        APPROVAL_STATUS_PENDING_FINANCE,
+        APPROVAL_STATUS_PENDING_LEADER,
+    )
+
+    return int(
+        session.execute(
+            select(func.count())
+            .select_from(ApprovalOrder)
+            .where(
+                ApprovalOrder.order_type == APPROVAL_TYPE_SECONDARY_ALLOCATION,
+                ApprovalOrder.ref_id == business_id,
+                ApprovalOrder.status.in_(
+                    (APPROVAL_STATUS_PENDING_FINANCE, APPROVAL_STATUS_PENDING_LEADER)
+                ),
+            )
+        ).scalar_one()
+    )
+
+
 def _hard_delete(session: Session, business_id: int) -> None:
-    """按依赖序删除：明细 → 状态留痕 → 业务维度归属留痕 → 主表。"""
+    """按依赖序删除：明细 → 二次分配方案 → 审批单（steps 随 CASCADE）→
+    状态留痕 → 业务维度归属留痕 → 主表。"""
     from sqlalchemy import delete
 
     session.execute(delete(BusinessItem).where(BusinessItem.business_id == business_id))
+    session.execute(
+        delete(SecondaryAllocation).where(SecondaryAllocation.business_id == business_id)
+    )
+    session.execute(
+        delete(ApprovalOrder).where(
+            ApprovalOrder.order_type == APPROVAL_TYPE_SECONDARY_ALLOCATION,
+            ApprovalOrder.ref_id == business_id,
+        )
+    )
     session.execute(delete(BusinessStatusLog).where(BusinessStatusLog.business_id == business_id))
     session.execute(
         delete(OwnershipChangeLog).where(

backend/app/services/system_setting_service.py

@@ -126,17 +126,18 @@ def save_logo(
         setting = get_setting(session)
         old_path = setting.logo_path
 
-        # 旧扩展名清理必须在写新文件**之前**：同扩展名覆盖时先写后删会把
-        # 刚落盘的新文件一并删掉（回读 404）
-        old_ext = Path(old_path).suffix.lstrip(".") if old_path else None
-        if old_ext and old_ext != ext:
-            _cleanup_old_logo(old_ext)
-
+        # 先写新文件、commit 成功后再清旧扩展名（若把清理放在 commit 之前，
+        # commit 失败会让库指旧路径而旧文件已删——断链无补偿）；同扩展名
+        # 由写入覆盖，无需也不会误删新文件
         target = _logo_dir() / f"logo.{ext}"
         target.write_bytes(content)
 
         setting.logo_path = f"logo/logo.{ext}"
         session.commit()
+
+        old_ext = Path(old_path).suffix.lstrip(".") if old_path else None
+        if old_ext and old_ext != ext:
+            _cleanup_old_logo(old_ext)
         logger.info("更新公司 logo | size=%s ext=%s", len(content), ext)
         return to_out(setting)