优化

scripts/client-test-env-acceptance.mjs

@@ -99,11 +99,12 @@ let temporaryOwnerPassword
 try {
   await reuseFixedClient()
   await platformReviewerLogin()
+  await fixedClientReadOnlyModule()
   for (const module of ['registration', 'qualification-review', 'profile-management', 'login-identifiers',
     'rbac-members', 'isolation', 'order-submission-balance', 'order-mutation-evidence',
     'order-submission-channel', 'notification-inbox', 'account-security']) {
-    recordSkipped(module, '固定客户模式排除生命周期或共享配置写入',
-      '不注册客户、不修改固定账号资料或余额、不发布通知；跨客户场景需第二个固定客户')
+    recordSkipped(module, '固定客户模式排除写入生命周期或尚未实现的边界',
+      '企业资料、资质和角色成员查询单独只读核验；注册、配置修改、账号安全及隔离边界仍未验收')
   }
   await orderLifecycleModule()
   await orderExcelImportModule()
@@ -126,6 +127,8 @@ try {
     if (!logout) report.success = false
   }
   report.completedAt = new Date().toISOString()
+  report.fullCoverage = report.success && !report.steps.some(step => step.skipped)
+  report.coverageStatus = !report.success ? 'FAILED' : report.fullCoverage ? 'FULL' : 'PARTIAL'
   await mkdir(reportDir, { recursive: true })
   await writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8')
   printSummary()
@@ -151,6 +154,29 @@ async function reuseFixedClient() {
   report.testAccount = { username, reused: true }
 }
 
+async function fixedClientReadOnlyModule() {
+  await apiStep('profile-management', '固定客户企业资料只读核验', {
+    method: 'GET', path: '/api/merchant/v1/iam/tenant/profile', token: merchantToken,
+  }, ({ json }) => {
+    requireSuccess(json)
+    assertEqual(String(json.data?.id), fixedCustomerId, 'fixed customer read-only identity')
+    assertEqual(json.data?.status, 'ACTIVE', 'fixed customer read-only status')
+  })
+  for (const [module, name, path] of [
+    ['qualification-review', '既有企业资质', '/api/merchant/v1/iam/tenant/qualifications'],
+    ['profile-management', '既有企业地址', '/api/merchant/v1/iam/tenant/addresses'],
+    ['rbac-members', '既有客户角色', '/api/merchant/v1/iam/roles'],
+    ['rbac-members', '既有客户成员', '/api/merchant/v1/iam/members'],
+    ['rbac-members', '既有有效权限', '/api/merchant/v1/iam/authorization/permissions'],
+  ]) {
+    await apiStep(module, `${name}只读核验`, { method: 'GET', path, token: merchantToken }, ({ json }) => {
+      requireSuccess(json)
+      assertTrue(Array.isArray(json.data), `${name} must be an array`)
+    }, ({ json }) => ({ count: json.data.length, coverageMode: 'READ_ONLY' }))
+  }
+  report.readOnlyCoverage = ['qualification-review', 'profile-management', 'rbac-members']
+}
+
 async function registrationModule() {
   const registrationBody = {
     username,