diff --git a/AGENTS.md b/AGENTS.md
index 1b76e99..69acc99 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -47,6 +47,7 @@
 | 其余库内、换标与现场查询待接前端 | `src/data/overseas-workbench.js` 中对应 `available: false` 入口 | Backend 已有 `pda/stocktake/`、`pda/move/`、`pda/warehouse/`、`relabel/pda/` 与 `overseas-pda-operations-v1.yaml`；本应用新增专用 API/状态恢复和测试前不得启用 |
 | 扫码设备与诊断 | `src/utils/scan-broadcast.js`、`src/pages/scanner-test/scanner-test.vue` | `src/components/ScanTargetInput.vue`、声音反馈工具；广播 Action/Extra 见本文件服务边界 |
 | 作业记录与人员 | `src/pages/history/history.vue`、`src/pages/profile/profile.vue` | 会话隔离、退出清理和后续真实作业历史契约 |
+| 业务标识与内部 ID 隔离 | `tests/business-identifiers-ui.test.mjs`；页面入口 `src/pages/`、`src/components/`，会话映射 `src/stores/session.js` | 页面只展示集装箱号、入仓码、箱码、托盘码、库位码、仓库名称等业务值；不得以 orderId、inboundId、planId、warehouseId、palletId、locationId、user.id 等内部 ID 或截断值回退，错误诊断保留 code、requestId、traceId |
 | 本地契约测试 | `tests/project-contract.test.mjs`、`navigation.test.mjs`、`scan-broadcast.test.mjs`、`audio-feedback.test.mjs` | 运行 `npm test`；不代表真实海外 API 或真机验收 |
 
 ## 海外业务接口边界
diff --git a/src/api/auth.js b/src/api/auth.js
index 236f548..966d4e7 100644
--- a/src/api/auth.js
+++ b/src/api/auth.js
@@ -35,8 +35,8 @@ function authRequest(path, data) {
 	})
 }
 
-export function login(username, password) {
-	return authRequest('/auth/login', { username, password })
+export function login(loginId, password) {
+	return authRequest('/auth/login', { loginId, password })
 }
 
 export function refresh(refreshToken) {
diff --git a/tests/project-contract.test.mjs b/tests/project-contract.test.mjs
index 9d914e9..7ce5f84 100644
--- a/tests/project-contract.test.mjs
+++ b/tests/project-contract.test.mjs
@@ -35,13 +35,15 @@ test('overseas workbench contains confirmed warehouse and phase-five outbound do
 })
 
 test('login has no committed demo credentials and inbound operation implements the locked container flow', async () => {
-	const [login, runtime, operation, inbound, adapter, overseas] = await Promise.all([
-		read('../src/pages/login/login.vue'), read('../src/config/runtime.js'),
+	const [login, auth, runtime, operation, inbound, adapter, overseas] = await Promise.all([
+		read('../src/pages/login/login.vue'), read('../src/api/auth.js'), read('../src/config/runtime.js'),
 		read('../src/pages/operation/operation.vue'), read('../src/api/inbound.js'), read('../src/api/receiving-adapter.js'), read('../src/api/overseas.js')
 	])
 	assert.match(login, /柏悦物流海外版/)
 	assert.doesNotMatch(login, /ChangeMe|platform_admin/)
 	assert.match(login, /DEV_LOGIN\.username|DEV_LOGIN\.password/)
+	assert.match(auth, /authRequest\('\/auth\/login', \{ loginId, password \}\)/)
+	assert.doesNotMatch(auth, /authRequest\('\/auth\/login', \{ username, password \}\)/)
 	assert.match(runtime, /runtimeEnvironment\.DEV|VITE_PDA_DEV_USERNAME|VITE_PDA_DEV_PASSWORD/)
 	assert.match(runtime, /'\/overseas-api'/)
 	assert.match(runtime, /#ifdef H5[\s\S]*?VITE_H5_AUTH_API_BASE_URL/)