@musnows/scriverse 0.3.8 → 0.3.10

package/dist/store.js

@@ -4,8 +4,11 @@ import { AppError, notFound } from "./errors.js";
 import { accountReference, logger } from "./logger.js";
 import { paginated, paginationSql } from "./pagination.js";
 import { currentRequestActor } from "./request-context.js";
+import { classifyWorkModulePermissions, emptyWorkModulePermissions, fullWorkModulePermissions, storedWorkModulePermissions } from "./work-permissions.js";
 import { countWords, documentShortSearchTerms, id, json, normalizeDocumentSearchText, normalizeParagraphSpacing, now, splitDocumentParagraphs } from "./utils.js";
 export const versionedEntityTypes = [
+    "work",
+    "volume",
     "setting",
     "race",
     "organization",
@@ -36,7 +39,44 @@ export class Store {
         this.db = db;
         this.backfillEntityVersionBaselines();
     }
+    currentEntityVersionNo(type, entityId) {
+        const row = this.db.get("SELECT MAX(version_no) AS version_no FROM entity_versions WHERE entity_type = ? AND entity_id = ?", type, entityId);
+        return numberValue(row ?? {}, "version_no");
+    }
+    currentChapterVersionNo(chapterId) {
+        return numberValue(this.db.get("SELECT MAX(version_no) AS version_no FROM chapter_versions WHERE chapter_id = ?", chapterId) ?? {}, "version_no");
+    }
+    currentCharacterVersionNo(characterId) {
+        return numberValue(this.db.get("SELECT MAX(version_no) AS version_no FROM character_versions WHERE character_id = ?", characterId) ?? {}, "version_no");
+    }
+    currentCharacterSectionVersionNo(sectionId) {
+        return numberValue(this.db.get("SELECT MAX(version_no) AS version_no FROM character_profile_section_versions WHERE section_id = ?", sectionId) ?? {}, "version_no");
+    }
+    assertExpectedVersion(type, entityId, expectedVersionNo, entityName, currentVersionNo = this.currentEntityVersionNo(type, entityId)) {
+        if (expectedVersionNo === undefined || expectedVersionNo === currentVersionNo)
+            return;
+        throw new AppError(409, "VERSION_CONFLICT", `${entityName}已发生变化，请刷新后重试`, {
+            entityType: type,
+            entityId,
+            expectedVersionNo,
+            currentVersionNo
+        });
+    }
+    assertExpectedRevision(entityType, entityId, expectedVersionNo, entityName, currentVersionNo) {
+        if (expectedVersionNo === undefined || expectedVersionNo === currentVersionNo)
+            return;
+        throw new AppError(409, "VERSION_CONFLICT", `${entityName}已发生变化，请刷新后重试`, {
+            entityType,
+            entityId,
+            expectedVersionNo,
+            currentVersionNo
+        });
+    }
     versionedEntity(type, entityId) {
+        if (type === "work")
+            return this.getWork(entityId);
+        if (type === "volume")
+            return this.getVolume(entityId);
         if (type === "setting")
             return this.getSetting(entityId);
         if (type === "race")
@@ -68,6 +108,25 @@ export class Store {
         }
     }
     versionedEntitySnapshot(type, entity) {
+        if (type === "work")
+            return {
+                title: entity.title,
+                author: entity.author,
+                description: entity.description,
+                language: entity.language,
+                coverUrl: entity.coverUrl,
+                tags: entity.tags,
+                ownerUserId: entity.ownerUserId
+            };
+        if (type === "volume")
+            return {
+                title: entity.title,
+                kind: entity.kind,
+                source: entity.source,
+                description: entity.description,
+                keywords: entity.keywords,
+                sortOrder: entity.sortOrder
+            };
         if (type === "setting")
             return {
                 title: entity.title,
@@ -165,11 +224,13 @@ export class Store {
         }
         const versionNo = latest ? numberValue(latest, "version_no") + 1 : 1;
         this.db.run(`INSERT INTO entity_versions (id, work_id, entity_type, entity_id, version_no, snapshot_json, source, source_ref, change_note, created_at, created_by_user_id)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, id("entityVersion"), String(entity.workId), type, entityId, versionNo, snapshotJson, source, sourceRef, changeNote.trim(), timestamp ?? now(), currentRequestActor()?.userId ?? null);
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, id("entityVersion"), type === "work" ? entityId : String(entity.workId), type, entityId, versionNo, snapshotJson, source, sourceRef, changeNote.trim(), timestamp ?? now(), currentRequestActor()?.userId ?? null);
         return versionNo;
     }
     backfillEntityVersionBaselines() {
         const entities = [
+            ...this.db.all("SELECT id, updated_at FROM works").map((row) => ["work", requiredString(row, "id"), requiredString(row, "updated_at")]),
+            ...this.db.all("SELECT id, updated_at FROM volumes").map((row) => ["volume", requiredString(row, "id"), requiredString(row, "updated_at")]),
             ...this.db.all("SELECT id, updated_at FROM settings").map((row) => ["setting", requiredString(row, "id"), requiredString(row, "updated_at")]),
             ...this.db.all("SELECT id, updated_at FROM races").map((row) => ["race", requiredString(row, "id"), requiredString(row, "updated_at")]),
             ...this.db.all("SELECT id, updated_at FROM organizations").map((row) => ["organization", requiredString(row, "id"), requiredString(row, "updated_at")]),
@@ -228,7 +289,7 @@ export class Store {
             actor: optionalString(row, "actor_display_name") ?? optionalString(row, "actor_username") ?? "历史数据"
         })), pagination);
     }
-    restoreEntityVersion(type, entityId, versionNo) {
+    restoreEntityVersion(type, entityId, versionNo, expectedVersionNo) {
         const version = this.db.get("SELECT * FROM entity_versions WHERE entity_type = ? AND entity_id = ? AND version_no = ?", type, entityId, versionNo);
         if (!version)
             throw notFound("历史版本");
@@ -239,31 +300,57 @@ export class Store {
         const changeNote = `恢复至 v${versionNo}`;
         const workId = requiredString(version, "work_id");
         const existing = this.tryVersionedEntity(type, entityId);
+        const currentVersionNo = existing
+            ? type === "work" ? Number(existing.versionNo) : type === "volume" ? Number(existing.versionNo) : this.currentEntityVersionNo(type, entityId)
+            : this.currentEntityVersionNo(type, entityId);
+        this.assertExpectedVersion(type, entityId, expectedVersionNo, type === "work" ? "作品" : type === "volume" ? "分卷" : "创作资料", currentVersionNo);
         let restored;
         if (!existing) {
             restored = this.recreateEntityFromSnapshot(type, workId, entityId, snapshot, sourceRef, changeNote);
         }
+        else if (type === "work")
+            restored = this.updateWork(entityId, snapshot, expectedVersionNo, "restore", sourceRef, changeNote);
+        else if (type === "volume")
+            restored = this.updateVolume(entityId, snapshot, expectedVersionNo, "restore", sourceRef, changeNote);
         else if (type === "setting")
-            restored = this.updateSetting(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.updateSetting(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         else if (type === "race")
-            restored = this.updateRace(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.updateRace(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         else if (type === "organization")
-            restored = this.updateOrganization(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.updateOrganization(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         else if (type === "timeline-track")
-            restored = this.updateTimelineTrack(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.updateTimelineTrack(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         else if (type === "timeline-event")
-            restored = this.updateTimelineEvent(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.updateTimelineEvent(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         else if (type === "relationship")
-            restored = this.updateRelationship(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.updateRelationship(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         else if (type === "chapter-outline")
-            restored = this.upsertChapterOutline(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.upsertChapterOutline(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         else
-            restored = this.updateForeshadow(entityId, snapshot, "restore", sourceRef, changeNote);
+            restored = this.updateForeshadow(entityId, snapshot, "restore", sourceRef, changeNote, expectedVersionNo);
         const currentVersion = this.db.get("SELECT MAX(version_no) AS version_no FROM entity_versions WHERE entity_type = ? AND entity_id = ?", type, entityId);
         return { ...restored, versionNo: numberValue(currentVersion ?? {}, "version_no") };
     }
     recreateEntityFromSnapshot(type, workId, entityId, snapshot, sourceRef, changeNote) {
         this.getWork(workId);
+        if (type === "work") {
+            return this.db.transaction(() => {
+                const ownerUserId = typeof snapshot.ownerUserId === "string" ? snapshot.ownerUserId : null;
+                const timestamp = now();
+                this.db.run(`INSERT INTO works (id, title, author, description, language, cover_url, tags_json, version_no, created_at, updated_at, owner_user_id)
+           VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?)`, entityId, String(snapshot.title ?? "未命名作品"), String(snapshot.author ?? ""), String(snapshot.description ?? ""), String(snapshot.language ?? "zh-CN"), snapshot.coverUrl ?? null, JSON.stringify(Array.isArray(snapshot.tags) ? snapshot.tags : []), timestamp, timestamp, ownerUserId);
+                if (ownerUserId) {
+                    this.db.run("INSERT INTO work_memberships (work_id, user_id, role, invited_by_user_id, created_at) VALUES (?, ?, 'owner', ?, ?)", entityId, ownerUserId, ownerUserId, timestamp);
+                }
+                const versionNo = this.recordEntityVersion("work", entityId, "restore", sourceRef, changeNote, timestamp);
+                this.db.run("UPDATE works SET version_no = ? WHERE id = ?", versionNo, entityId);
+                this.audit(entityId, "work.restored", "work", entityId, { sourceRef });
+                return this.getWork(entityId);
+            });
+        }
+        if (type === "volume") {
+            return this.db.transaction(() => this.insertVolumeWithId(workId, entityId, snapshot, "restore", sourceRef, changeNote));
+        }
         if (type === "setting") {
             return this.insertSettingWithId(workId, entityId, snapshot, "restore", sourceRef, changeNote);
         }
@@ -310,6 +397,7 @@ export class Store {
             if (actor) {
                 this.db.run("INSERT INTO work_memberships (work_id, user_id, role, invited_by_user_id, created_at) VALUES (?, ?, 'owner', ?, ?)", workId, actor.userId, actor.userId, timestamp);
             }
+            this.recordEntityVersion("work", workId, "create", null, "建立作品", timestamp);
             this.audit(workId, "work.created", "work", workId);
         });
         return this.getWork(workId);
@@ -431,34 +519,45 @@ export class Store {
         });
         return this.getWorkAiSettings(workId);
     }
-    updateWork(workId, input) {
-        const current = this.getWork(workId);
-        const timestamp = now();
-        this.db.run(`UPDATE works SET title = ?, author = ?, description = ?, language = ?, cover_url = ?, tags_json = ?, updated_at = ?
-       WHERE id = ?`, input.title ?? String(current.title), input.author ?? String(current.author), input.description ?? String(current.description), input.language ?? String(current.language), input.coverUrl === undefined ? current.coverUrl : input.coverUrl, JSON.stringify(input.tags ?? current.tags), timestamp, workId);
-        this.audit(workId, "work.updated", "work", workId, { fields: Object.keys(input) });
+    updateWork(workId, input, expectedVersionNo, source = "manual", sourceRef = null, changeNote = "") {
+        this.db.transaction(() => {
+            const current = this.getWork(workId);
+            this.assertExpectedVersion("work", workId, expectedVersionNo, "作品", Number(current.versionNo));
+            const timestamp = now();
+            this.db.run(`UPDATE works SET title = ?, author = ?, description = ?, language = ?, cover_url = ?, tags_json = ?, version_no = version_no + 1, updated_at = ?
+         WHERE id = ?`, input.title ?? String(current.title), input.author ?? String(current.author), input.description ?? String(current.description), input.language ?? String(current.language), input.coverUrl === undefined ? current.coverUrl : input.coverUrl, JSON.stringify(input.tags ?? current.tags), timestamp, workId);
+            this.recordEntityVersion("work", workId, source, sourceRef, changeNote || "更新作品信息", timestamp);
+            this.audit(workId, "work.updated", "work", workId, { fields: Object.keys(input), versionNo: Number(current.versionNo) + 1, source, sourceRef, changeNote });
+        });
         return this.getWork(workId);
     }
-    deleteWork(workId) {
+    deleteWork(workId, expectedVersionNo) {
         const work = this.getWork(workId);
         const storageKeys = this.db.all("SELECT DISTINCT storage_key FROM attachments WHERE work_id = ?", workId)
             .map((row) => requiredString(row, "storage_key"));
         this.db.transaction(() => {
+            const current = this.getWork(workId);
+            this.assertExpectedVersion("work", workId, expectedVersionNo, "作品", Number(current.versionNo));
+            this.recordEntityVersion("work", workId, "delete", null, "删除作品");
             this.audit(null, "work.deleted", "work", workId, { title: work.title });
             this.db.run("DELETE FROM works WHERE id = ?", workId);
         });
         return storageKeys.filter((storageKey) => Number(this.db.get("SELECT COUNT(*) AS count FROM attachments WHERE storage_key = ?", storageKey)?.count ?? 0) === 0);
     }
-    setWorkCover(workId, mimeType, content) {
-        this.getWork(workId);
-        const timestamp = now();
+    setWorkCover(workId, mimeType, content, expectedVersionNo) {
         const sha256 = createHash("sha256").update(content).digest("hex");
-        this.db.run(`INSERT INTO work_covers (work_id, mime_type, content, byte_length, sha256, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?)
-       ON CONFLICT(work_id) DO UPDATE SET mime_type = excluded.mime_type, content = excluded.content,
-       byte_length = excluded.byte_length, sha256 = excluded.sha256, updated_at = excluded.updated_at`, workId, mimeType, content, content.byteLength, sha256, timestamp);
-        this.db.run("UPDATE works SET updated_at = ? WHERE id = ?", timestamp, workId);
-        this.audit(workId, "work.cover.updated", "work", workId, { mimeType, byteLength: content.byteLength, sha256 });
+        this.db.transaction(() => {
+            const current = this.getWork(workId);
+            this.assertExpectedVersion("work", workId, expectedVersionNo, "作品", Number(current.versionNo));
+            const timestamp = now();
+            this.db.run(`INSERT INTO work_covers (work_id, mime_type, content, byte_length, sha256, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(work_id) DO UPDATE SET mime_type = excluded.mime_type, content = excluded.content,
+         byte_length = excluded.byte_length, sha256 = excluded.sha256, updated_at = excluded.updated_at`, workId, mimeType, content, content.byteLength, sha256, timestamp);
+            this.db.run("UPDATE works SET version_no = version_no + 1, updated_at = ? WHERE id = ?", timestamp, workId);
+            this.recordEntityVersion("work", workId, "manual", null, "更新作品封面", timestamp);
+            this.audit(workId, "work.cover.updated", "work", workId, { mimeType, byteLength: content.byteLength, sha256 });
+        });
         return this.getWork(workId);
     }
     getWorkCover(workId) {
@@ -474,11 +573,16 @@ export class Store {
             updatedAt: requiredString(row, "updated_at")
         };
     }
-    deleteWorkCover(workId) {
-        this.getWork(workId);
-        this.db.run("DELETE FROM work_covers WHERE work_id = ?", workId);
-        this.db.run("UPDATE works SET updated_at = ? WHERE id = ?", now(), workId);
-        this.audit(workId, "work.cover.deleted", "work", workId);
+    deleteWorkCover(workId, expectedVersionNo) {
+        this.db.transaction(() => {
+            const current = this.getWork(workId);
+            this.assertExpectedVersion("work", workId, expectedVersionNo, "作品", Number(current.versionNo));
+            const timestamp = now();
+            this.db.run("DELETE FROM work_covers WHERE work_id = ?", workId);
+            this.db.run("UPDATE works SET version_no = version_no + 1, updated_at = ? WHERE id = ?", timestamp, workId);
+            this.recordEntityVersion("work", workId, "manual", null, "删除作品封面", timestamp);
+            this.audit(workId, "work.cover.deleted", "work", workId);
+        });
     }
     getWorkTree(workId) {
         const work = this.getWork(workId);
@@ -500,6 +604,9 @@ export class Store {
     }
     getWorkDirectory(workId) {
         const work = this.getWork(workId);
+        const permissions = work.modulePermissions;
+        if (permissions.prose === "none")
+            return { ...work, volumes: [] };
         const volumeRows = this.db.all("SELECT * FROM volumes WHERE work_id = ? ORDER BY sort_order, created_at", workId);
         const chapterRows = this.db.all(`SELECT id, work_id, volume_id, title, chapter_type, sort_order, word_count, version_no,
         analysis_status, excluded_from_analysis, created_at, updated_at
@@ -520,6 +627,9 @@ export class Store {
     }
     getWorkDirectoryPage(workId, pagination) {
         const work = this.getWork(workId);
+        const permissions = work.modulePermissions;
+        if (permissions.prose === "none")
+            return { ...work, volumes: [], directoryPage: paginated([], pagination) };
         const volumeRows = this.db.all("SELECT * FROM volumes WHERE work_id = ? ORDER BY sort_order, created_at", workId);
         const page = paginationSql(pagination);
         const chapterRows = this.db.all(`SELECT id, work_id, volume_id, title, chapter_type, sort_order, word_count, version_no,
@@ -577,7 +687,7 @@ export class Store {
             actor: optionalString(row, "actor_display_name") ?? optionalString(row, "actor_username") ?? "历史数据"
         })), pagination);
     }
-    restoreFileVersion(workId, fileVersionId) {
+    restoreFileVersion(workId, fileVersionId, expectedVersionNo) {
         this.getWork(workId);
         const version = this.db.get("SELECT * FROM file_versions WHERE id = ? AND work_id = ?", fileVersionId, workId);
         if (!version)
@@ -585,6 +695,8 @@ export class Store {
         const snapshot = json(requiredString(version, "snapshot_json"), {});
         const volumes = Array.isArray(snapshot.volumes) ? snapshot.volumes : [];
         return this.db.transaction(() => {
+            const current = this.getWork(workId);
+            this.assertExpectedVersion("work", workId, expectedVersionNo, "作品", Number(current.versionNo));
             const currentTree = this.getWorkTree(workId);
             const currentChapters = this.db.all("SELECT content FROM chapters WHERE work_id = ?", workId);
             const wordCount = currentChapters.reduce((sum, row) => sum + countWords(requiredString(row, "content")), 0);
@@ -596,12 +708,21 @@ export class Store {
             const timestamp = now();
             this.db.run(`INSERT INTO file_versions (id, work_id, file_name, file_type, word_count, paragraph_count, warnings_json, snapshot_json, created_at, created_by_user_id)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, restorePointId, workId, `before-restore:${requiredString(version, "file_name")}`, "snapshot", wordCount, paragraphCount, "[]", JSON.stringify(currentTree), timestamp, currentRequestActor()?.userId ?? null);
+            for (const row of this.db.all("SELECT id FROM volumes WHERE work_id = ?", workId)) {
+                this.recordEntityVersion("volume", requiredString(row, "id"), "delete", fileVersionId, "替换作品树前保存分卷历史");
+            }
             this.db.run("DELETE FROM volumes WHERE work_id = ?", workId);
             for (const volume of volumes) {
                 const volumeId = id("volume");
                 const chapters = Array.isArray(volume.chapters) ? volume.chapters : [];
-                this.db.run(`INSERT INTO volumes (id, work_id, title, kind, source, description, keywords_json, sort_order, created_at, updated_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, volumeId, workId, String(volume.title ?? "正文"), String(volume.kind ?? "main"), String(volume.source ?? "manual"), String(volume.description ?? ""), JSON.stringify(Array.isArray(volume.keywords) ? this.normalizeVolumeKeywords(volume.keywords) : []), Number(volume.sortOrder ?? 0), timestamp, timestamp);
+                this.insertVolumeWithId(workId, volumeId, {
+                    title: String(volume.title ?? "正文"),
+                    kind: String(volume.kind ?? "main"),
+                    source: String(volume.source ?? "manual"),
+                    description: String(volume.description ?? ""),
+                    keywords: Array.isArray(volume.keywords) ? volume.keywords : [],
+                    sortOrder: Number(volume.sortOrder ?? 0)
+                }, "restore", fileVersionId, `恢复文件版本 ${fileVersionId}`);
                 for (const chapter of chapters) {
                     const chapterType = (["正文", "设定", "作者的话", "其他"].includes(String(chapter.chapterType))
                         ? String(chapter.chapterType)
@@ -609,7 +730,8 @@ export class Store {
                     this.insertChapter(workId, volumeId, String(chapter.title ?? "未命名章节"), String(chapter.content ?? ""), Number(chapter.sortOrder ?? 0), "restore", fileVersionId, chapterType);
                 }
             }
-            this.db.run("UPDATE works SET updated_at = ? WHERE id = ?", timestamp, workId);
+            this.db.run("UPDATE works SET version_no = version_no + 1, updated_at = ? WHERE id = ?", timestamp, workId);
+            this.recordEntityVersion("work", workId, "restore", fileVersionId, `恢复文件版本 ${fileVersionId}`, timestamp);
             this.audit(workId, "file.restored", "file-version", fileVersionId, { restorePointId });
             return {
                 fileVersionId: restorePointId,
@@ -618,55 +740,84 @@ export class Store {
             };
         });
     }
-    importNovel(workId, fileName, fileType, parsed) {
+    importNovel(workId, fileName, fileType, parsed, mode = "overwrite", expectedVersionNo) {
         this.getWork(workId);
         let result = {};
-        this.db.transaction(() => { result = this.importNovelInTransaction(workId, fileName, fileType, parsed); });
+        this.db.transaction(() => { result = this.importNovelInTransaction(workId, fileName, fileType, parsed, mode, expectedVersionNo); });
         return { ...result, tree: this.getWorkDirectory(workId) };
     }
     createImportedWork(input, fileName, fileType, parsed) {
         return this.db.transaction(() => {
             const work = this.createWork(input);
-            const imported = this.importNovelInTransaction(String(work.id), fileName, fileType, parsed);
+            const imported = this.importNovelInTransaction(String(work.id), fileName, fileType, parsed, undefined, undefined, false);
             return { ...imported, work: this.getWork(String(work.id)) };
         });
     }
-    importNovelInTransaction(workId, fileName, fileType, parsed) {
+    importNovelInTransaction(workId, fileName, fileType, parsed, mode = "overwrite", expectedVersionNo, bumpWorkVersion = true) {
+        const current = this.getWork(workId);
+        this.assertExpectedVersion("work", workId, expectedVersionNo, "作品", Number(current.versionNo));
         const fileVersionId = id("file");
         const timestamp = now();
         const snapshot = this.getWorkTree(workId);
         this.db.run(`INSERT INTO file_versions (id, work_id, file_name, file_type, word_count, paragraph_count, warnings_json, snapshot_json, created_at, created_by_user_id)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, fileVersionId, workId, fileName, fileType, parsed.wordCount, parsed.paragraphCount, JSON.stringify(parsed.warnings), JSON.stringify(snapshot), timestamp, currentRequestActor()?.userId ?? null);
-        this.db.run("DELETE FROM volumes WHERE work_id = ?", workId);
+        let volumeOrderOffset = 0;
+        if (mode === "overwrite") {
+            for (const row of this.db.all("SELECT id FROM volumes WHERE work_id = ?", workId)) {
+                this.recordEntityVersion("volume", requiredString(row, "id"), "delete", fileVersionId, "导入前保存分卷历史");
+            }
+            this.db.run("DELETE FROM volumes WHERE work_id = ?", workId);
+        }
+        else {
+            const lastVolume = this.db.get("SELECT COALESCE(MAX(sort_order), -1) AS value FROM volumes WHERE work_id = ?", workId);
+            volumeOrderOffset = numberValue(lastVolume ?? {}, "value") + 1;
+        }
+        let firstImportedChapterId = null;
         for (const volume of parsed.volumes) {
             const volumeId = id("volume");
-            this.db.run(`INSERT INTO volumes (id, work_id, title, kind, source, sort_order, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, volumeId, workId, volume.title, volume.kind, volume.source, volume.order, timestamp, timestamp);
+            this.insertVolumeWithId(workId, volumeId, {
+                title: volume.title,
+                kind: volume.kind,
+                source: volume.source,
+                sortOrder: volumeOrderOffset + volume.order
+            }, "import", fileVersionId, "导入分卷");
             for (const chapter of volume.chapters) {
-                this.insertChapter(workId, volumeId, chapter.title, chapter.content, chapter.order, "import", fileVersionId, chapter.chapterType);
+                const chapterId = this.insertChapter(workId, volumeId, chapter.title, chapter.content, chapter.order, "import", fileVersionId, chapter.chapterType);
+                firstImportedChapterId ??= chapterId;
             }
         }
-        this.db.run("UPDATE works SET updated_at = ? WHERE id = ?", timestamp, workId);
+        if (bumpWorkVersion) {
+            this.db.run("UPDATE works SET version_no = version_no + 1, updated_at = ? WHERE id = ?", timestamp, workId);
+            this.recordEntityVersion("work", workId, "import", fileVersionId, "导入作品正文", timestamp);
+        }
         this.audit(workId, "work.imported", "file-version", fileVersionId, {
             fileName,
+            mode,
             volumeCount: parsed.volumes.length,
             chapterCount: parsed.volumes.reduce((sum, volume) => sum + volume.chapters.length, 0)
         });
         return {
             fileVersionId,
+            firstImportedChapterId,
+            mode,
             warnings: parsed.warnings,
             wordCount: parsed.wordCount,
             paragraphCount: parsed.paragraphCount
         };
     }
     createVolume(workId, input) {
+        return this.db.transaction(() => this.insertVolumeWithId(workId, id("volume"), input, "create", null, "建立分卷"));
+    }
+    insertVolumeWithId(workId, volumeId, input, source = "create", sourceRef = null, changeNote = "") {
         this.getWork(workId);
-        const volumeId = id("volume");
         const timestamp = now();
         const last = this.db.get("SELECT COALESCE(MAX(sort_order), -1) AS value FROM volumes WHERE work_id = ?", workId);
-        this.db.run(`INSERT INTO volumes (id, work_id, title, kind, source, description, keywords_json, sort_order, created_at, updated_at)
-       VALUES (?, ?, ?, ?, 'manual', ?, ?, ?, ?, ?)`, volumeId, workId, input.title, input.kind ?? "main", input.description?.trim() ?? "", JSON.stringify(this.normalizeVolumeKeywords(input.keywords ?? [])), numberValue(last ?? {}, "value") + 1, timestamp, timestamp);
-        this.audit(workId, "volume.created", "volume", volumeId);
+        this.db.run(`INSERT INTO volumes (id, work_id, title, kind, source, description, keywords_json, sort_order, version_no, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)`, volumeId, workId, input.title, input.kind ?? "main", input.source ?? "manual", input.description?.trim() ?? "", JSON.stringify(this.normalizeVolumeKeywords(input.keywords ?? [])), input.sortOrder ?? numberValue(last ?? {}, "value") + 1, timestamp, timestamp);
+        const versionNo = this.recordEntityVersion("volume", volumeId, source, sourceRef, changeNote || "建立分卷", timestamp);
+        if (versionNo !== 1)
+            this.db.run("UPDATE volumes SET version_no = ? WHERE id = ?", versionNo, volumeId);
+        this.audit(workId, source === "restore" ? "volume.restored" : "volume.created", "volume", volumeId, { source, sourceRef });
         return this.getVolume(volumeId);
     }
     getVolume(volumeId) {
@@ -675,20 +826,30 @@ export class Store {
             throw notFound("卷");
         return this.mapVolume(row);
     }
-    updateVolume(volumeId, input) {
-        const current = this.getVolume(volumeId);
-        this.db.run("UPDATE volumes SET title = ?, kind = ?, description = ?, keywords_json = ?, sort_order = ?, source = 'manual', updated_at = ? WHERE id = ?", input.title ?? String(current.title), input.kind ?? String(current.kind), input.description?.trim() ?? String(current.description), JSON.stringify(input.keywords === undefined ? current.keywords : this.normalizeVolumeKeywords(input.keywords)), input.sortOrder ?? Number(current.sortOrder), now(), volumeId);
-        this.audit(String(current.workId), "volume.updated", "volume", volumeId, input);
+    updateVolume(volumeId, input, expectedVersionNo, source = "manual", sourceRef = null, changeNote = "") {
+        this.db.transaction(() => {
+            const current = this.getVolume(volumeId);
+            this.assertExpectedVersion("volume", volumeId, expectedVersionNo, "分卷", Number(current.versionNo));
+            const timestamp = now();
+            this.db.run("UPDATE volumes SET title = ?, kind = ?, description = ?, keywords_json = ?, sort_order = ?, source = ?, version_no = version_no + 1, updated_at = ? WHERE id = ?", input.title ?? String(current.title), input.kind ?? String(current.kind), input.description?.trim() ?? String(current.description), JSON.stringify(input.keywords === undefined ? current.keywords : this.normalizeVolumeKeywords(input.keywords)), input.sortOrder ?? Number(current.sortOrder), source === "restore" ? String(current.source) : "manual", timestamp, volumeId);
+            this.recordEntityVersion("volume", volumeId, source, sourceRef, changeNote || "更新分卷信息", timestamp);
+            this.audit(String(current.workId), "volume.updated", "volume", volumeId, { ...input, versionNo: Number(current.versionNo) + 1, source, sourceRef, changeNote });
+        });
         return this.getVolume(volumeId);
     }
-    deleteVolume(volumeId) {
+    deleteVolume(volumeId, expectedVersionNo) {
         const volume = this.getVolume(volumeId);
         const count = this.db.get("SELECT COUNT(*) AS value FROM chapters WHERE volume_id = ?", volumeId);
         if (numberValue(count ?? {}, "value") > 0) {
             throw new AppError(409, "VOLUME_NOT_EMPTY", "卷内仍有章节，需先移动或删除章节");
         }
-        this.db.run("DELETE FROM volumes WHERE id = ?", volumeId);
-        this.audit(String(volume.workId), "volume.deleted", "volume", volumeId);
+        this.db.transaction(() => {
+            const current = this.getVolume(volumeId);
+            this.assertExpectedVersion("volume", volumeId, expectedVersionNo, "分卷", Number(current.versionNo));
+            this.recordEntityVersion("volume", volumeId, "delete", null, "删除分卷");
+            this.db.run("DELETE FROM volumes WHERE id = ?", volumeId);
+            this.audit(String(current.workId), "volume.deleted", "volume", volumeId, { versionNo: Number(current.versionNo) });
+        });
     }
     createChapter(workId, input) {
         this.getWork(workId);
@@ -812,8 +973,9 @@ export class Store {
             summary: requiredString(row, "summary")
         }));
     }
-    saveChapter(chapterId, input, source = "manual", sourceRef = null, changeNote = "") {
+    saveChapter(chapterId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getChapter(chapterId);
+        this.assertExpectedRevision("chapter", chapterId, expectedVersionNo, "章节", Number(current.versionNo));
         const nextTitle = input.title ?? String(current.title);
         const nextContent = input.content === undefined ? String(current.content) : normalizeParagraphSpacing(input.content);
         const nextExcluded = input.excludedFromAnalysis ?? Boolean(current.excludedFromAnalysis);
@@ -826,6 +988,8 @@ export class Store {
         const timestamp = now();
         const versionNo = Number(current.versionNo) + (hasTextChange ? 1 : 0);
         this.db.transaction(() => {
+            const lockedCurrent = this.getChapter(chapterId);
+            this.assertExpectedRevision("chapter", chapterId, expectedVersionNo, "章节", Number(lockedCurrent.versionNo));
             this.db.run(`UPDATE chapters SET title = ?, content = ?, chapter_type = ?, word_count = ?, version_no = ?, analysis_status = ?,
          excluded_from_analysis = ?, updated_at = ? WHERE id = ?`, nextTitle, nextContent, nextChapterType, countWords(nextContent), versionNo, hasTextChange || hasTypeChange ? "expired" : String(current.analysisStatus), nextExcluded ? 1 : 0, timestamp, chapterId);
             if (hasTextChange)
@@ -853,15 +1017,16 @@ export class Store {
         });
         return this.getChapter(chapterId);
     }
-    restoreChapter(chapterId, versionNo) {
+    restoreChapter(chapterId, versionNo, expectedVersionNo) {
         const version = this.db.get("SELECT * FROM chapter_versions WHERE chapter_id = ? AND version_no = ?", chapterId, versionNo);
         if (!version)
             throw notFound("章节版本");
         const existing = this.db.get("SELECT id FROM chapters WHERE id = ?", chapterId);
         if (!existing) {
+            this.assertExpectedRevision("chapter", chapterId, expectedVersionNo, "章节", this.currentChapterVersionNo(chapterId));
             return this.recreateChapterFromVersion(chapterId, version);
         }
-        return this.saveChapter(chapterId, { title: requiredString(version, "title"), content: requiredString(version, "content") }, "restore", requiredString(version, "id"), `恢复至 v${versionNo}`);
+        return this.saveChapter(chapterId, { title: requiredString(version, "title"), content: requiredString(version, "content") }, "restore", requiredString(version, "id"), `恢复至 v${versionNo}`, expectedVersionNo);
     }
     recreateChapterFromVersion(chapterId, version) {
         const workId = requiredString(version, "work_id");
@@ -902,12 +1067,15 @@ export class Store {
         });
         return this.getChapter(chapterId);
     }
-    moveChapter(chapterId, input) {
+    moveChapter(chapterId, input, expectedVersionNo) {
         const chapter = this.getChapter(chapterId);
+        this.assertExpectedRevision("chapter", chapterId, expectedVersionNo, "章节", Number(chapter.versionNo));
         const volume = this.getVolume(input.volumeId);
         if (volume.workId !== chapter.workId)
             throw new AppError(400, "VOLUME_WORK_MISMATCH", "卷不属于当前作品");
         this.db.transaction(() => {
+            const lockedChapter = this.getChapter(chapterId);
+            this.assertExpectedRevision("chapter", chapterId, expectedVersionNo, "章节", Number(lockedChapter.versionNo));
             this.db.run(`UPDATE analysis_tasks SET status = 'expired', updated_at = ?
          WHERE work_id = ? AND status IN ('pending', 'running', 'completed', 'partial', 'review')
          AND json_extract(scope_json, '$.type') = 'volume' AND json_extract(scope_json, '$.volumeId') = ?`, now(), String(chapter.workId), String(chapter.volumeId));
@@ -917,11 +1085,14 @@ export class Store {
         });
         return this.getChapter(chapterId);
     }
-    deleteChapter(chapterId) {
+    deleteChapter(chapterId, expectedVersionNo) {
         const chapter = this.getChapter(chapterId);
+        this.assertExpectedRevision("chapter", chapterId, expectedVersionNo, "章节", Number(chapter.versionNo));
         const timestamp = now();
         const versionNo = Number(chapter.versionNo) + 1;
         this.db.transaction(() => {
+            const lockedChapter = this.getChapter(chapterId);
+            this.assertExpectedRevision("chapter", chapterId, expectedVersionNo, "章节", Number(lockedChapter.versionNo));
             this.db.run("UPDATE chapters SET version_no = ?, updated_at = ? WHERE id = ?", versionNo, timestamp, chapterId);
             this.insertChapterVersionRow({
                 workId: String(chapter.workId),
@@ -1027,13 +1198,21 @@ export class Store {
         const actor = currentRequestActor();
         const ownerUserId = optionalString(row, "owner_user_id");
         const membership = actor
-            ? this.db.get("SELECT role FROM work_memberships WHERE work_id = ? AND user_id = ?", requiredString(row, "id"), actor.userId)
+            ? this.db.get("SELECT role, permissions_json FROM work_memberships WHERE work_id = ? AND user_id = ?", requiredString(row, "id"), actor.userId)
             : undefined;
+        const membershipRole = String(membership?.role ?? "");
+        const ownerAccess = ownerUserId === actor?.userId;
+        const adminAccess = actor?.role === "admin" && actor.authentication !== "api-key";
+        const modulePermissions = !actor || ownerAccess || adminAccess
+            ? fullWorkModulePermissions()
+            : membershipRole
+                ? storedWorkModulePermissions(membershipRole, optionalString(membership ?? {}, "permissions_json"))
+                : emptyWorkModulePermissions();
         const accessRole = ownerUserId === actor?.userId
             ? "owner"
-            : actor?.role === "admin"
+            : adminAccess
                 ? "admin"
-                : ["editor", "viewer"].includes(String(membership?.role ?? "")) ? String(membership?.role) : null;
+                : membershipRole ? classifyWorkModulePermissions(modulePermissions) : null;
         const count = this.db.get("SELECT COUNT(*) AS chapter_count, COALESCE(SUM(word_count), 0) AS word_count FROM chapters WHERE work_id = ?", requiredString(row, "id"));
         const cover = this.db.get("SELECT updated_at FROM work_covers WHERE work_id = ?", requiredString(row, "id"));
         return {
@@ -1046,10 +1225,12 @@ export class Store {
                 ? `/api/works/${encodeURIComponent(requiredString(row, "id"))}/cover?v=${encodeURIComponent(requiredString(cover, "updated_at"))}`
                 : optionalString(row, "cover_url"),
             tags: json(requiredString(row, "tags_json"), []),
+            versionNo: numberValue(row, "version_no") || this.currentEntityVersionNo("work", requiredString(row, "id")),
             ownerUserId,
             accessRole,
-            chapterCount: numberValue(count ?? {}, "chapter_count"),
-            wordCount: numberValue(count ?? {}, "word_count"),
+            modulePermissions,
+            chapterCount: modulePermissions.prose === "none" ? 0 : numberValue(count ?? {}, "chapter_count"),
+            wordCount: modulePermissions.prose === "none" ? 0 : numberValue(count ?? {}, "word_count"),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -1064,6 +1245,7 @@ export class Store {
             description: optionalString(row, "description") ?? "",
             keywords: json(optionalString(row, "keywords_json"), []),
             sortOrder: numberValue(row, "sort_order"),
+            versionNo: numberValue(row, "version_no") || this.currentEntityVersionNo("volume", requiredString(row, "id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -1157,11 +1339,13 @@ export class Store {
             updatedAt: optionalString(row, "updated_at")
         })), pagination);
     }
-    upsertChapterOutline(chapterId, input, source = "manual", sourceRef = null, changeNote = "") {
+    upsertChapterOutline(chapterId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const chapter = this.getChapter(chapterId);
         const current = this.getChapterOutline(chapterId);
         const timestamp = now();
         this.db.transaction(() => {
+            if (current)
+                this.assertExpectedVersion("chapter-outline", chapterId, expectedVersionNo, "章节大纲");
             this.db.run(`INSERT INTO chapter_outlines (chapter_id, goal, conflict, turning_point, notes, status, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT(chapter_id) DO UPDATE SET goal = excluded.goal, conflict = excluded.conflict,
@@ -1172,12 +1356,13 @@ export class Store {
         });
         return this.getChapterOutline(chapterId);
     }
-    deleteChapterOutline(chapterId) {
+    deleteChapterOutline(chapterId, expectedVersionNo) {
         const chapter = this.getChapter(chapterId);
         const outline = this.getChapterOutline(chapterId);
         if (!outline)
             return;
         this.db.transaction(() => {
+            this.assertExpectedVersion("chapter-outline", chapterId, expectedVersionNo, "章节大纲");
             this.recordEntityVersion("chapter-outline", chapterId, "delete", null, "删除章节大纲");
             this.db.run("DELETE FROM chapter_outlines WHERE chapter_id = ?", chapterId);
             this.audit(String(chapter.workId), "outline.deleted", "chapter-outline", chapterId);
@@ -1194,6 +1379,7 @@ export class Store {
             turningPoint: requiredString(row, "turning_point"),
             notes: requiredString(row, "notes"),
             status: requiredString(row, "status"),
+            versionNo: this.currentEntityVersionNo("chapter-outline", requiredString(row, "chapter_id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -1247,6 +1433,7 @@ export class Store {
             overdue: Boolean(currentChapterId && plannedPayoffChapterId && ["planned", "planted"].includes(status)
                 && this.chapterSequence(workId, plannedPayoffChapterId) < this.chapterSequence(workId, currentChapterId)),
             occurrences,
+            versionNo: this.currentEntityVersionNo("foreshadow", foreshadowId),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -1273,12 +1460,13 @@ export class Store {
        ORDER BY CASE importance WHEN 'high' THEN 0 WHEN 'medium' THEN 1 ELSE 2 END, created_at${page.sql}`, workId, ...page.params);
         return paginated(rows.map((row) => this.getForeshadow(requiredString(row, "id"), currentChapterId)), pagination);
     }
-    updateForeshadow(foreshadowId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateForeshadow(foreshadowId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getForeshadow(foreshadowId);
         const workId = String(current.workId);
         if (input.plannedPayoffChapterId)
             this.assertChapterInWork(input.plannedPayoffChapterId, workId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("foreshadow", foreshadowId, expectedVersionNo, "伏笔");
             this.db.run(`UPDATE foreshadows SET title = ?, description = ?, status = ?, importance = ?,
          planned_payoff_chapter_id = ?, resolution_note = ?, updated_at = ? WHERE id = ?`, input.title ?? String(current.title), input.description ?? String(current.description), input.status ?? String(current.status), input.importance ?? String(current.importance), input.plannedPayoffChapterId === undefined ? current.plannedPayoffChapterId : input.plannedPayoffChapterId, input.resolutionNote ?? String(current.resolutionNote), now(), foreshadowId);
             if (input.occurrences) {
@@ -1291,17 +1479,19 @@ export class Store {
         });
         return this.getForeshadow(foreshadowId);
     }
-    deleteForeshadow(foreshadowId) {
+    deleteForeshadow(foreshadowId, expectedVersionNo) {
         const current = this.getForeshadow(foreshadowId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("foreshadow", foreshadowId, expectedVersionNo, "伏笔");
             this.recordEntityVersion("foreshadow", foreshadowId, "delete", null, "删除伏笔");
             this.db.run("DELETE FROM foreshadows WHERE id = ?", foreshadowId);
             this.audit(String(current.workId), "foreshadow.deleted", "foreshadow", foreshadowId);
         });
     }
-    createForeshadowOccurrence(foreshadowId, input) {
+    createForeshadowOccurrence(foreshadowId, input, expectedVersionNo) {
         const foreshadow = this.getForeshadow(foreshadowId);
         const occurrenceId = this.db.transaction(() => {
+            this.assertExpectedVersion("foreshadow", foreshadowId, expectedVersionNo, "伏笔");
             const createdId = this.insertForeshadowOccurrence(foreshadowId, String(foreshadow.workId), input);
             this.recordEntityVersion("foreshadow", foreshadowId, "manual", createdId, "添加伏笔章节记录");
             this.audit(String(foreshadow.workId), "foreshadow.occurrence.created", "foreshadow-occurrence", createdId);
@@ -1309,20 +1499,22 @@ export class Store {
         });
         return this.getForeshadowOccurrence(occurrenceId);
     }
-    updateForeshadowOccurrence(occurrenceId, input) {
+    updateForeshadowOccurrence(occurrenceId, input, expectedVersionNo) {
         const current = this.getForeshadowOccurrence(occurrenceId);
         const foreshadow = this.getForeshadow(String(current.foreshadowId));
         const chapterId = input.chapterId ?? String(current.chapterId);
         this.assertChapterInWork(chapterId, String(foreshadow.workId));
         this.db.transaction(() => {
+            this.assertExpectedVersion("foreshadow", String(current.foreshadowId), expectedVersionNo, "伏笔");
             this.db.run(`UPDATE foreshadow_occurrences SET chapter_id = ?, role = ?, note = ?, evidence_json = ?, updated_at = ? WHERE id = ?`, chapterId, input.role ?? String(current.role), input.note ?? String(current.note), JSON.stringify(input.evidence ?? current.evidence), now(), occurrenceId);
             this.recordEntityVersion("foreshadow", String(current.foreshadowId), "manual", occurrenceId, "更新伏笔章节记录");
         });
         return this.getForeshadowOccurrence(occurrenceId);
     }
-    deleteForeshadowOccurrence(occurrenceId) {
+    deleteForeshadowOccurrence(occurrenceId, expectedVersionNo) {
         const current = this.getForeshadowOccurrence(occurrenceId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("foreshadow", String(current.foreshadowId), expectedVersionNo, "伏笔");
             this.db.run("DELETE FROM foreshadow_occurrences WHERE id = ?", occurrenceId);
             this.recordEntityVersion("foreshadow", String(current.foreshadowId), "manual", occurrenceId, "删除伏笔章节记录");
         });
@@ -1402,9 +1594,10 @@ export class Store {
             throw notFound("设定");
         return this.mapSetting(row);
     }
-    updateSetting(settingId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateSetting(settingId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getSetting(settingId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("setting", settingId, expectedVersionNo, "设定");
             this.db.run(`UPDATE settings SET title = ?, category = ?, content = ?, tags_json = ?, status = ?, locked = ?,
          evidence_json = ?, scope_json = ?, author_note = ?, updated_at = ? WHERE id = ?`, input.title ?? String(current.title), input.category ?? String(current.category), input.content ?? String(current.content), JSON.stringify(input.tags ?? current.tags), input.status ?? String(current.status), (input.locked ?? Boolean(current.locked)) ? 1 : 0, JSON.stringify(input.evidence ?? current.evidence), JSON.stringify(input.scope ?? current.scope), input.authorNote ?? String(current.authorNote), now(), settingId);
             this.recordEntityVersion("setting", settingId, source, sourceRef, changeNote || "更新世界观设定");
@@ -1412,9 +1605,10 @@ export class Store {
         });
         return this.getSetting(settingId);
     }
-    deleteSetting(settingId) {
+    deleteSetting(settingId, expectedVersionNo) {
         const current = this.getSetting(settingId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("setting", settingId, expectedVersionNo, "设定");
             this.recordEntityVersion("setting", settingId, "delete", null, "删除世界观设定");
             this.db.run("DELETE FROM settings WHERE id = ?", settingId);
             this.audit(String(current.workId), "setting.deleted", "setting", settingId);
@@ -1433,6 +1627,7 @@ export class Store {
             evidence: json(requiredString(row, "evidence_json"), []),
             scope: json(requiredString(row, "scope_json"), {}),
             authorNote: requiredString(row, "author_note"),
+            versionNo: this.currentEntityVersionNo("setting", requiredString(row, "id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -1479,7 +1674,7 @@ export class Store {
             throw notFound("种族");
         return this.mapRace(row);
     }
-    updateRace(raceId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateRace(raceId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getRace(raceId);
         const workId = String(current.workId);
         const name = input.name === undefined
@@ -1502,6 +1697,7 @@ export class Store {
             : [];
         const memberSnapshots = this.captureCharacterSnapshots(touchedMemberIds);
         this.db.transaction(() => {
+            this.assertExpectedVersion("race", raceId, expectedVersionNo, "种族");
             this.db.run(`UPDATE races SET parent_race_id = ?, name = ?, normalized_name = ?, description = ?, settings_json = ?, updated_at = ? WHERE id = ?`, parentRaceId, name, normalizedName, input.description ?? String(current.description), JSON.stringify(input.settings ?? current.settings), now(), raceId);
             if (nameChanged)
                 this.db.run("UPDATE characters SET species = ?, updated_at = ? WHERE race_id = ?", name, now(), raceId);
@@ -1513,7 +1709,7 @@ export class Store {
         });
         return this.getRace(raceId);
     }
-    deleteRace(raceId) {
+    deleteRace(raceId, expectedVersionNo) {
         const current = this.getRace(raceId);
         const child = this.db.get("SELECT id FROM races WHERE parent_race_id = ? LIMIT 1", raceId);
         if (child) {
@@ -1521,6 +1717,7 @@ export class Store {
         }
         const memberSnapshots = this.captureCharacterSnapshots(current.memberIds);
         this.db.transaction(() => {
+            this.assertExpectedVersion("race", raceId, expectedVersionNo, "种族");
             this.recordEntityVersion("race", raceId, "delete", null, "删除种族档案");
             this.db.run("UPDATE characters SET race_id = NULL, species = '', updated_at = ? WHERE race_id = ?", now(), raceId);
             this.db.run("DELETE FROM races WHERE id = ?", raceId);
@@ -1528,6 +1725,43 @@ export class Store {
             this.audit(String(current.workId), "race.deleted", "race", raceId);
         });
     }
+    mergeRaces(sourceRaceId, targetRaceId) {
+        if (sourceRaceId === targetRaceId)
+            throw new AppError(400, "RACE_MERGE_SELF", "不能把种族合并到自身");
+        const source = this.getRace(sourceRaceId);
+        const target = this.getRace(targetRaceId);
+        if (source.workId !== target.workId)
+            throw new AppError(400, "RACE_WORK_MISMATCH", "待合并种族不属于同一作品");
+        const workId = String(target.workId);
+        const mergeId = id("raceMerge");
+        const timestamp = now();
+        const memberIds = [...new Set([...target.memberIds, ...source.memberIds])];
+        const memberSnapshots = this.captureCharacterSnapshots(memberIds);
+        const sourceChildren = this.db.all("SELECT id FROM races WHERE parent_race_id = ? ORDER BY id", sourceRaceId)
+            .map((row) => requiredString(row, "id"))
+            .filter((childRaceId) => childRaceId !== targetRaceId);
+        const targetDescendsFromSource = target.lineage.some((race) => race.id === sourceRaceId);
+        const targetParentRaceId = targetDescendsFromSource
+            ? source.parentRaceId
+            : target.parentRaceId;
+        const descriptionParts = [String(target.description).trim(), String(source.description).trim()].filter(Boolean);
+        const description = [...new Set(descriptionParts)].join("\n\n");
+        const settings = [...new Set([...target.settings, ...source.settings])];
+        this.db.transaction(() => {
+            this.recordEntityVersion("race", sourceRaceId, "delete", mergeId, `合并至种族“${String(target.name)}”`, timestamp);
+            this.db.run("UPDATE races SET parent_race_id = ?, description = ?, settings_json = ?, updated_at = ? WHERE id = ?", targetParentRaceId, description, JSON.stringify(settings), timestamp, targetRaceId);
+            this.db.run("UPDATE characters SET race_id = ?, species = ?, updated_at = ? WHERE race_id = ?", targetRaceId, String(target.name), timestamp, sourceRaceId);
+            for (const childRaceId of sourceChildren) {
+                this.db.run("UPDATE races SET parent_race_id = ?, updated_at = ? WHERE id = ?", targetRaceId, timestamp, childRaceId);
+                this.recordEntityVersion("race", childRaceId, "merge", mergeId, `因种族“${String(source.name)}”合并而迁移父种族`, timestamp);
+            }
+            this.db.run("DELETE FROM races WHERE id = ?", sourceRaceId);
+            this.recordMembershipVersions(memberSnapshots, "race", targetRaceId, `合并种族“${String(source.name)}”`);
+            this.recordEntityVersion("race", targetRaceId, "merge", mergeId, `合并种族“${String(source.name)}”`, timestamp);
+            this.audit(workId, "race.merged", "race", targetRaceId, { mergeId, sourceRaceId });
+        });
+        return { mergeId, target: this.getRace(targetRaceId), source };
+    }
     resolveRaceReference(workId, value) {
         const normalizedName = normalizeCharacterName(value);
         if (!normalizedName)
@@ -1558,6 +1792,7 @@ export class Store {
             }))),
             memberIds: members.map((member) => member.characterId),
             members,
+            versionNo: this.currentEntityVersionNo("race", requiredString(row, "id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -1659,7 +1894,7 @@ export class Store {
             throw notFound("组织");
         return this.mapOrganization(row);
     }
-    updateOrganization(organizationId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateOrganization(organizationId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getOrganization(organizationId);
         const workId = String(current.workId);
         const name = input.name === undefined
@@ -1675,6 +1910,7 @@ export class Store {
         const touchedMemberIds = memberIds ? [...new Set([...current.memberIds, ...memberIds])] : [];
         const memberSnapshots = this.captureCharacterSnapshots(touchedMemberIds);
         this.db.transaction(() => {
+            this.assertExpectedVersion("organization", organizationId, expectedVersionNo, "组织");
             this.db.run(`UPDATE organizations SET name = ?, normalized_name = ?, description = ?, settings_json = ?, updated_at = ? WHERE id = ?`, name, normalizedName, input.description ?? String(current.description), JSON.stringify(input.settings ?? current.settings), now(), organizationId);
             if (memberIds) {
                 this.replaceOrganizationMembers(organizationId, memberIds);
@@ -1685,16 +1921,49 @@ export class Store {
         });
         return this.getOrganization(organizationId);
     }
-    deleteOrganization(organizationId) {
+    deleteOrganization(organizationId, expectedVersionNo) {
         const current = this.getOrganization(organizationId);
         const memberSnapshots = this.captureCharacterSnapshots(current.memberIds);
         this.db.transaction(() => {
+            this.assertExpectedVersion("organization", organizationId, expectedVersionNo, "组织");
             this.recordEntityVersion("organization", organizationId, "delete", null, "删除组织档案");
             this.db.run("DELETE FROM organizations WHERE id = ?", organizationId);
             this.recordMembershipVersions(memberSnapshots, "organization", organizationId, `组织“${String(current.name)}”已删除`);
             this.audit(String(current.workId), "organization.deleted", "organization", organizationId);
         });
     }
+    mergeOrganizations(sourceOrganizationId, targetOrganizationId) {
+        if (sourceOrganizationId === targetOrganizationId) {
+            throw new AppError(400, "ORGANIZATION_MERGE_SELF", "不能把组织合并到自身");
+        }
+        const source = this.getOrganization(sourceOrganizationId);
+        const target = this.getOrganization(targetOrganizationId);
+        if (source.workId !== target.workId) {
+            throw new AppError(400, "ORGANIZATION_WORK_MISMATCH", "待合并组织不属于同一作品");
+        }
+        const workId = String(target.workId);
+        const mergeId = id("organizationMerge");
+        const timestamp = now();
+        const memberIds = [...new Set([...target.memberIds, ...source.memberIds])];
+        const memberSnapshots = this.captureCharacterSnapshots(memberIds);
+        const descriptionParts = [String(target.description).trim(), String(source.description).trim()].filter(Boolean);
+        const description = [...new Set(descriptionParts)].join("\n\n");
+        const settings = [...new Set([...target.settings, ...source.settings])];
+        const sourceMemberships = this.db.all("SELECT character_id, role, note, created_at FROM character_organization_memberships WHERE organization_id = ?", sourceOrganizationId);
+        this.db.transaction(() => {
+            this.recordEntityVersion("organization", sourceOrganizationId, "delete", mergeId, `合并至组织“${String(target.name)}”`, timestamp);
+            this.db.run("UPDATE organizations SET description = ?, settings_json = ?, updated_at = ? WHERE id = ?", description, JSON.stringify(settings), timestamp, targetOrganizationId);
+            for (const membership of sourceMemberships) {
+                this.db.run(`INSERT INTO character_organization_memberships (character_id, organization_id, role, note, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT(character_id, organization_id) DO NOTHING`, requiredString(membership, "character_id"), targetOrganizationId, requiredString(membership, "role"), requiredString(membership, "note"), requiredString(membership, "created_at"), timestamp);
+            }
+            this.db.run("DELETE FROM organizations WHERE id = ?", sourceOrganizationId);
+            this.recordMembershipVersions(memberSnapshots, "organization", targetOrganizationId, `合并组织“${String(source.name)}”`);
+            this.recordEntityVersion("organization", targetOrganizationId, "merge", mergeId, `合并组织“${String(source.name)}”`, timestamp);
+            this.audit(workId, "organization.merged", "organization", targetOrganizationId, { mergeId, sourceOrganizationId });
+        });
+        return { mergeId, target: this.getOrganization(targetOrganizationId), source };
+    }
     mapOrganization(row) {
         const members = this.db.all(`SELECT c.id, c.name, m.role, m.note
        FROM character_organization_memberships m
@@ -1713,6 +1982,7 @@ export class Store {
             settings: json(requiredString(row, "settings_json"), []),
             memberIds: members.map((member) => member.characterId),
             members,
+            versionNo: this.currentEntityVersionNo("organization", requiredString(row, "id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -1940,10 +2210,13 @@ export class Store {
         });
         return this.getCharacterProfileSection(sectionId);
     }
-    updateCharacterProfileSection(sectionId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateCharacterProfileSection(sectionId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getCharacterProfileSection(sectionId);
+        this.assertExpectedRevision("character-section", sectionId, expectedVersionNo, "人物档案章节", Number(current.versionNo));
         const timestamp = now();
         this.db.transaction(() => {
+            const lockedCurrent = this.getCharacterProfileSection(sectionId);
+            this.assertExpectedRevision("character-section", sectionId, expectedVersionNo, "人物档案章节", Number(lockedCurrent.versionNo));
             this.db.run(`UPDATE character_profile_sections SET section_type = ?, title = ?, content_markdown = ?, summary = ?, sort_order = ?,
          source_path = ?, source_hash = ?, version_no = version_no + 1, updated_at = ? WHERE id = ?`, input.sectionType ?? String(current.sectionType), input.title ?? String(current.title), input.contentMarkdown ?? String(current.contentMarkdown), input.summary ?? String(current.summary), input.sortOrder ?? Number(current.sortOrder), input.sourcePath === undefined ? current.sourcePath : input.sourcePath, input.sourceHash === undefined ? current.sourceHash : input.sourceHash, timestamp, sectionId);
             const section = this.getCharacterProfileSection(sectionId);
@@ -1954,9 +2227,12 @@ export class Store {
         });
         return this.getCharacterProfileSection(sectionId);
     }
-    deleteCharacterProfileSection(sectionId) {
+    deleteCharacterProfileSection(sectionId, expectedVersionNo) {
         const current = this.getCharacterProfileSection(sectionId);
+        this.assertExpectedRevision("character-section", sectionId, expectedVersionNo, "人物档案章节", Number(current.versionNo));
         this.db.transaction(() => {
+            const lockedCurrent = this.getCharacterProfileSection(sectionId);
+            this.assertExpectedRevision("character-section", sectionId, expectedVersionNo, "人物档案章节", Number(lockedCurrent.versionNo));
             this.db.run("UPDATE character_profile_sections SET version_no = version_no + 1 WHERE id = ?", sectionId);
             const deleting = this.getCharacterProfileSection(sectionId);
             this.recordCharacterProfileSectionVersion(deleting, "delete", null, "删除人物 Markdown 章节");
@@ -2006,15 +2282,16 @@ export class Store {
             actor: optionalString(row, "actor_display_name") ?? optionalString(row, "actor_username") ?? "历史数据"
         })), pagination);
     }
-    restoreCharacterProfileSection(sectionId, versionNo) {
+    restoreCharacterProfileSection(sectionId, versionNo, expectedVersionNo) {
         const version = this.db.get("SELECT * FROM character_profile_section_versions WHERE section_id = ? AND version_no = ?", sectionId, versionNo);
         if (!version)
             throw notFound("人物档案章节版本");
         const snapshot = json(requiredString(version, "snapshot_json"), {});
         const existing = this.db.get("SELECT id FROM character_profile_sections WHERE id = ?", sectionId);
         if (existing) {
-            return this.updateCharacterProfileSection(sectionId, snapshot, "restore", requiredString(version, "id"), `恢复至 v${versionNo}`);
+            return this.updateCharacterProfileSection(sectionId, snapshot, "restore", requiredString(version, "id"), `恢复至 v${versionNo}`, expectedVersionNo);
         }
+        this.assertExpectedRevision("character-section", sectionId, expectedVersionNo, "人物档案章节", this.currentCharacterSectionVersionNo(sectionId));
         const characterId = requiredString(version, "character_id");
         const character = this.getCharacter(characterId);
         const timestamp = now();
@@ -2124,8 +2401,9 @@ export class Store {
             throw notFound("角色");
         return this.mapCharacter(row);
     }
-    updateCharacter(characterId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateCharacter(characterId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getCharacter(characterId);
+        this.assertExpectedRevision("character", characterId, expectedVersionNo, "人物", Number(current.versionNo));
         if (current.mergedIntoCharacterId)
             throw new AppError(409, "CHARACTER_ALREADY_MERGED", "已合并角色不能直接编辑");
         const before = this.characterSnapshot(current);
@@ -2146,6 +2424,8 @@ export class Store {
         if (organizationIds)
             this.assertOrganizationsInWork(workId, organizationIds);
         this.db.transaction(() => {
+            const lockedCurrent = this.getCharacter(characterId);
+            this.assertExpectedRevision("character", characterId, expectedVersionNo, "人物", Number(lockedCurrent.versionNo));
             this.db.run(`UPDATE characters SET name = ?, aliases_json = ?, species = ?, race_id = ?, attributes_json = ?, profile_json = ?, current_state_json = ?,
          locked_fields_json = ?, visibility = ?, first_chapter_id = ?, updated_at = ? WHERE id = ?`, names.name, JSON.stringify(names.aliases), species, raceId, JSON.stringify(attributes), JSON.stringify(input.profile ?? current.profile), JSON.stringify(input.currentState ?? current.currentState), JSON.stringify(input.lockedFields ?? current.lockedFields), input.visibility ?? String(current.visibility), input.firstChapterId === undefined ? current.firstChapterId : input.firstChapterId, now(), characterId);
             this.db.run("DELETE FROM character_names WHERE character_id = ?", characterId);
@@ -2204,7 +2484,7 @@ export class Store {
             actor: optionalString(row, "actor_display_name") ?? optionalString(row, "actor_username") ?? "历史数据"
         })), pagination);
     }
-    restoreCharacter(characterId, versionNo) {
+    restoreCharacter(characterId, versionNo, expectedVersionNo) {
         const version = this.db.get("SELECT * FROM character_versions WHERE character_id = ? AND version_no = ?", characterId, versionNo);
         if (!version)
             throw notFound("人物版本");
@@ -2213,9 +2493,10 @@ export class Store {
             throw new AppError(500, "CHARACTER_VERSION_INVALID", "人物版本快照无效");
         const existing = this.db.get("SELECT id FROM characters WHERE id = ?", characterId);
         if (!existing) {
+            this.assertExpectedRevision("character", characterId, expectedVersionNo, "人物", this.currentCharacterVersionNo(characterId));
             return this.recreateCharacterFromVersion(characterId, version, snapshot, versionNo);
         }
-        return this.updateCharacter(characterId, snapshot, "restore", requiredString(version, "id"), `恢复至 v${versionNo}`);
+        return this.updateCharacter(characterId, snapshot, "restore", requiredString(version, "id"), `恢复至 v${versionNo}`, expectedVersionNo);
     }
     recreateCharacterFromVersion(characterId, version, snapshot, versionNo) {
         const workId = requiredString(version, "work_id");
@@ -2242,11 +2523,24 @@ export class Store {
         });
         return this.getCharacter(characterId);
     }
-    deleteCharacter(characterId) {
+    deleteCharacter(characterId, expectedVersionNo) {
         const current = this.getCharacter(characterId);
+        this.assertExpectedRevision("character", characterId, expectedVersionNo, "人物", Number(current.versionNo));
         const timestamp = now();
         const versionNo = Number(current.versionNo) + 1;
+        const workId = String(current.workId);
+        const timelineEvents = this.listTimelineEvents(workId).filter((event) => event.participantIds.includes(characterId));
+        const relationships = this.listRelationships(workId).filter((relationship) => relationship.fromCharacterId === characterId || relationship.toCharacterId === characterId);
         this.db.transaction(() => {
+            const lockedCurrent = this.getCharacter(characterId);
+            this.assertExpectedRevision("character", characterId, expectedVersionNo, "人物", Number(lockedCurrent.versionNo));
+            for (const event of timelineEvents) {
+                this.updateTimelineEvent(String(event.id), {
+                    participantIds: event.participantIds.filter((participantId) => participantId !== characterId)
+                }, "manual", characterId, `删除角色“${String(current.name)}”后移除参与者引用`);
+            }
+            for (const relationship of relationships)
+                this.deleteRelationship(String(relationship.id));
             const sectionIds = this.db.all("SELECT id FROM character_profile_sections WHERE character_id = ?", characterId)
                 .map((row) => requiredString(row, "id"));
             for (const sectionId of sectionIds) {
@@ -2255,7 +2549,7 @@ export class Store {
             this.db.run("UPDATE characters SET version_no = ?, updated_at = ? WHERE id = ?", versionNo, timestamp, characterId);
             this.insertCharacterVersion(characterId, versionNo, "delete", null, "删除人物", timestamp);
             this.db.run("DELETE FROM characters WHERE id = ?", characterId);
-            this.audit(String(current.workId), "character.deleted", "character", characterId, { versionNo });
+            this.audit(workId, "character.deleted", "character", characterId, { versionNo });
         });
     }
     mapCharacter(row, includeProfileSections = true) {
@@ -2330,29 +2624,31 @@ export class Store {
         if (input.targetCharacterId === input.sourceCharacterId) {
             throw new AppError(400, "CHARACTER_MERGE_SELF", "不能把角色合并到自身");
         }
-        const review = this.getReviewItem(input.reviewId);
-        if (review.itemType !== "character-duplicate" || review.status !== "pending") {
-            throw new AppError(409, "CHARACTER_REVIEW_DECIDED", "该角色查重项已经处理");
-        }
-        const reviewCharacterIds = review.entityRefs.flatMap((reference) => {
-            if (!reference || typeof reference !== "object" || Array.isArray(reference))
-                return [];
-            const characterId = reference.id;
-            return typeof characterId === "string" ? [characterId] : [];
-        });
-        if (!reviewCharacterIds.includes(input.targetCharacterId) || !reviewCharacterIds.includes(input.sourceCharacterId)) {
-            throw new AppError(400, "CHARACTER_REVIEW_MISMATCH", "待合并角色与审核项不一致");
+        const review = input.reviewId ? this.getReviewItem(input.reviewId) : null;
+        if (review) {
+            if (review.itemType !== "character-duplicate" || review.status !== "pending") {
+                throw new AppError(409, "CHARACTER_REVIEW_DECIDED", "该角色查重项已经处理");
+            }
+            const reviewCharacterIds = review.entityRefs.flatMap((reference) => {
+                if (!reference || typeof reference !== "object" || Array.isArray(reference))
+                    return [];
+                const characterId = reference.id;
+                return typeof characterId === "string" ? [characterId] : [];
+            });
+            if (!reviewCharacterIds.includes(input.targetCharacterId) || !reviewCharacterIds.includes(input.sourceCharacterId)) {
+                throw new AppError(400, "CHARACTER_REVIEW_MISMATCH", "待合并角色与审核项不一致");
+            }
         }
         const target = this.getCharacter(input.targetCharacterId);
         const source = this.getCharacter(input.sourceCharacterId);
-        if (target.workId !== source.workId || target.workId !== review.workId) {
+        if (target.workId !== source.workId || (review && target.workId !== review.workId)) {
             throw new AppError(400, "CHARACTER_WORK_MISMATCH", "待合并角色不属于同一作品");
         }
         if (target.mergedIntoCharacterId || source.mergedIntoCharacterId) {
             throw new AppError(409, "CHARACTER_ALREADY_MERGED", "待合并角色中已有角色被合并");
         }
         if (Number(target.versionNo) !== input.expectedTargetVersionNo || Number(source.versionNo) !== input.expectedSourceVersionNo) {
-            throw new AppError(409, "CHARACTER_VERSION_CHANGED", "角色在审核后已发生变化，请重新运行查重");
+            throw new AppError(409, "CHARACTER_VERSION_CHANGED", "角色已发生变化，请刷新后重试");
         }
         const workId = String(target.workId);
         const targetId = String(target.id);
@@ -2364,6 +2660,10 @@ export class Store {
         const sourceMemberships = this.db.all("SELECT * FROM character_organization_memberships WHERE character_id = ? ORDER BY organization_id", sourceId);
         const referenceSnapshot = { relationships: sourceRelationships, timelineEvents, memberships: sourceMemberships };
         this.db.transaction(() => {
+            const lockedTarget = this.getCharacter(targetId);
+            const lockedSource = this.getCharacter(sourceId);
+            this.assertExpectedRevision("character", targetId, input.expectedTargetVersionNo, "目标角色", Number(lockedTarget.versionNo));
+            this.assertExpectedRevision("character", sourceId, input.expectedSourceVersionNo, "来源角色", Number(lockedSource.versionNo));
             this.db.run("DELETE FROM character_names WHERE character_id = ?", sourceId);
             const aliases = [...target.aliases, String(source.name), ...source.aliases];
             const uniqueAliases = [...new Map(aliases
@@ -2380,7 +2680,7 @@ export class Store {
                 currentState: { ...source.currentState, ...target.currentState },
                 lockedFields: [...new Set([...target.lockedFields, ...source.lockedFields])],
                 firstChapterId: target.firstChapterId ?? source.firstChapterId
-            }, "merge", mergeId, `合并角色“${String(source.name)}”`);
+            }, "merge", mergeId, `合并角色“${String(source.name)}”`, input.expectedTargetVersionNo);
             for (const event of timelineEvents) {
                 const participantIds = [...new Set(event.participantIds.map((characterId) => characterId === sourceId ? targetId : characterId))];
                 this.updateTimelineEvent(String(event.id), { participantIds }, "merge", mergeId, `合并角色“${String(source.name)}”`);
@@ -2422,13 +2722,18 @@ export class Store {
                 }
             }
             this.db.run("DELETE FROM character_organization_memberships WHERE character_id = ?", sourceId);
+            this.db.run("UPDATE character_profile_sections SET character_id = ?, updated_at = ? WHERE character_id = ?", targetId, timestamp, sourceId);
+            this.db.run("UPDATE character_profile_section_versions SET character_id = ? WHERE character_id = ?", targetId, sourceId);
+            this.db.run("UPDATE character_profile_section_search SET character_id = ? WHERE character_id = ?", targetId, sourceId);
             const sourceVersionNo = Number(source.versionNo) + 1;
             this.db.run("UPDATE characters SET merged_into_character_id = ?, merged_at = ?, version_no = ?, updated_at = ? WHERE id = ?", targetId, timestamp, sourceVersionNo, timestamp, sourceId);
             this.insertCharacterVersion(sourceId, sourceVersionNo, "merge", mergeId, `合并至角色“${String(target.name)}”`, timestamp);
             this.db.run(`INSERT INTO character_merges (id, work_id, source_character_id, target_character_id, review_id,
          source_snapshot_json, target_snapshot_json, reference_snapshot_json, created_at, created_by_user_id)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, mergeId, workId, sourceId, targetId, input.reviewId, JSON.stringify(source), JSON.stringify(target), JSON.stringify(referenceSnapshot), timestamp, currentRequestActor()?.userId ?? null);
-            this.db.run("UPDATE review_items SET status = 'fixed', resolution_note = ?, updated_at = ? WHERE id = ?", `已将“${String(source.name)}”合并到“${String(target.name)}”`, timestamp, input.reviewId);
+            if (input.reviewId) {
+                this.db.run("UPDATE review_items SET status = 'fixed', resolution_note = ?, updated_at = ? WHERE id = ?", `已将“${String(source.name)}”合并到“${String(target.name)}”`, timestamp, input.reviewId);
+            }
             this.audit(workId, "character.merged", "character", targetId, {
                 mergeId,
                 sourceCharacterId: sourceId,
@@ -2439,7 +2744,7 @@ export class Store {
             mergeId,
             target: this.getCharacter(targetId),
             source: this.getCharacter(sourceId),
-            review: this.getReviewItem(input.reviewId)
+            review: input.reviewId ? this.getReviewItem(input.reviewId) : null
         };
     }
     resolveCharacterDuplicateReview(reviewId) {
@@ -2522,18 +2827,20 @@ export class Store {
             throw notFound("独立时间轴");
         return this.mapTimelineTrack(row);
     }
-    updateTimelineTrack(trackId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateTimelineTrack(trackId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getTimelineTrack(trackId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("timeline-track", trackId, expectedVersionNo, "时间轴");
             this.db.run("UPDATE timeline_tracks SET name = ?, description = ?, sort_order = ?, updated_at = ? WHERE id = ?", input.name ?? String(current.name), input.description ?? String(current.description), input.sortOrder ?? Number(current.sortOrder), now(), trackId);
             this.recordEntityVersion("timeline-track", trackId, source, sourceRef, changeNote || "更新时间轴");
             this.audit(String(current.workId), "timeline-track.updated", "timeline-track", trackId, { fields: Object.keys(input), source, sourceRef });
         });
         return this.getTimelineTrack(trackId);
     }
-    deleteTimelineTrack(trackId) {
+    deleteTimelineTrack(trackId, expectedVersionNo) {
         const current = this.getTimelineTrack(trackId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("timeline-track", trackId, expectedVersionNo, "时间轴");
             this.recordEntityVersion("timeline-track", trackId, "delete", null, "删除时间轴");
             this.db.run("DELETE FROM timeline_tracks WHERE id = ?", trackId);
             this.audit(String(current.workId), "timeline-track.deleted", "timeline-track", trackId);
@@ -2582,7 +2889,7 @@ export class Store {
             throw notFound("时间线事件");
         return this.mapTimelineEvent(row);
     }
-    updateTimelineEvent(eventId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateTimelineEvent(eventId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getTimelineEvent(eventId);
         if (input.trackId) {
             const track = this.getTimelineTrack(input.trackId);
@@ -2590,6 +2897,7 @@ export class Store {
                 throw new AppError(400, "TIMELINE_TRACK_WORK_MISMATCH", "独立时间轴不属于当前作品");
         }
         this.db.transaction(() => {
+            this.assertExpectedVersion("timeline-event", eventId, expectedVersionNo, "时间事件");
             this.db.run(`UPDATE timeline_events SET track_id = ?, name = ?, description = ?, event_type = ?, time_label = ?, time_sort = ?,
          chapter_ids_json = ?, participant_ids_json = ?, location = ?, causes_json = ?, impact_scope = ?, evidence_json = ?,
          status = ?, updated_at = ? WHERE id = ?`, input.trackId === undefined ? current.trackId : input.trackId, input.name ?? String(current.name), input.description ?? String(current.description), input.eventType ?? String(current.eventType), input.timeLabel ?? String(current.timeLabel), input.timeSort === undefined ? current.timeSort : input.timeSort, JSON.stringify(input.chapterIds ?? current.chapterIds), JSON.stringify(input.participantIds ?? current.participantIds), input.location ?? String(current.location), JSON.stringify(input.causes ?? current.causes), input.impactScope ?? String(current.impactScope), JSON.stringify(input.evidence ?? current.evidence), input.status ?? String(current.status), now(), eventId);
@@ -2598,15 +2906,16 @@ export class Store {
         });
         return this.getTimelineEvent(eventId);
     }
-    deleteTimelineEvent(eventId) {
+    deleteTimelineEvent(eventId, expectedVersionNo) {
         const current = this.getTimelineEvent(eventId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("timeline-event", eventId, expectedVersionNo, "时间事件");
             this.recordEntityVersion("timeline-event", eventId, "delete", null, "删除时间事件");
             this.db.run("DELETE FROM timeline_events WHERE id = ?", eventId);
             this.audit(String(current.workId), "timeline.deleted", "timeline-event", eventId);
         });
     }
-    mergeTimelineEvents(workId, eventIds, input) {
+    mergeTimelineEvents(workId, eventIds, input, expectedVersionNos) {
         this.getWork(workId);
         const uniqueIds = [...new Set(eventIds)];
         if (uniqueIds.length < 2)
@@ -2620,6 +2929,9 @@ export class Store {
         };
         const knownSorts = events.map((event) => event.timeSort).filter((value) => typeof value === "number");
         return this.db.transaction(() => {
+            for (const event of events) {
+                this.assertExpectedVersion("timeline-event", String(event.id), expectedVersionNos?.[String(event.id)], "时间事件", Number(event.versionNo));
+            }
             const merged = this.createTimelineEvent(workId, {
                 name: input.name,
                 trackId: events.every((event) => event.trackId === events[0]?.trackId) ? events[0]?.trackId : null,
@@ -2643,11 +2955,14 @@ export class Store {
             return merged;
         });
     }
-    splitTimelineEvent(eventId, parts) {
+    splitTimelineEvent(eventId, parts, expectedVersionNo) {
         const source = this.getTimelineEvent(eventId);
+        this.assertExpectedVersion("timeline-event", eventId, expectedVersionNo, "时间事件", Number(source.versionNo));
         if (parts.length < 2)
             throw new AppError(400, "EVENT_PARTS_REQUIRED", "拆分时间事件至少需要两项");
         return this.db.transaction(() => {
+            const lockedSource = this.getTimelineEvent(eventId);
+            this.assertExpectedVersion("timeline-event", eventId, expectedVersionNo, "时间事件", Number(lockedSource.versionNo));
             const created = parts.map((part, index) => this.createTimelineEvent(String(source.workId), {
                 name: part.name,
                 trackId: source.trackId,
@@ -2688,6 +3003,7 @@ export class Store {
             impactScope: requiredString(row, "impact_scope"),
             evidence: json(requiredString(row, "evidence_json"), []),
             status: requiredString(row, "status"),
+            versionNo: this.currentEntityVersionNo("timeline-event", requiredString(row, "id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -2699,6 +3015,7 @@ export class Store {
             name: requiredString(row, "name"),
             description: requiredString(row, "description"),
             sortOrder: numberValue(row, "sort_order"),
+            versionNo: this.currentEntityVersionNo("timeline-track", requiredString(row, "id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };
@@ -2750,7 +3067,7 @@ export class Store {
             throw notFound("人物关系");
         return this.mapRelationship(row);
     }
-    updateRelationship(relationshipId, input, source = "manual", sourceRef = null, changeNote = "") {
+    updateRelationship(relationshipId, input, source = "manual", sourceRef = null, changeNote = "", expectedVersionNo) {
         const current = this.getRelationship(relationshipId);
         let fromCharacterId = input.fromCharacterId ?? String(current.fromCharacterId);
         let toCharacterId = input.toCharacterId ?? String(current.toCharacterId);
@@ -2767,6 +3084,7 @@ export class Store {
             [fromCharacterId, toCharacterId] = [toCharacterId, fromCharacterId];
         this.assertRelationshipUnique(String(current.workId), fromCharacterId, toCharacterId, input.category ?? String(current.category), input.subtype ?? String(current.subtype), directed, relationshipId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("relationship", relationshipId, expectedVersionNo, "人物关系");
             this.db.run(`UPDATE relationships SET from_character_id = ?, to_character_id = ?, category = ?, subtype = ?, keywords_json = ?, directed = ?,
          current_status = ?, time_range_json = ?, confidence = ?, evidence_json = ?, confirmation_status = ?, locked = ?, updated_at = ?
          WHERE id = ?`, fromCharacterId, toCharacterId, input.category ?? String(current.category), input.subtype ?? String(current.subtype), JSON.stringify(this.normalizeRelationshipKeywords(input.keywords ?? current.keywords)), directed ? 1 : 0, input.currentStatus ?? String(current.currentStatus), JSON.stringify(input.timeRange ?? current.timeRange), input.confidence ?? Number(current.confidence), JSON.stringify(input.evidence ?? current.evidence), input.confirmationStatus ?? String(current.confirmationStatus), (input.locked ?? Boolean(current.locked)) ? 1 : 0, now(), relationshipId);
@@ -2775,9 +3093,10 @@ export class Store {
         });
         return this.getRelationship(relationshipId);
     }
-    deleteRelationship(relationshipId) {
+    deleteRelationship(relationshipId, expectedVersionNo) {
         const current = this.getRelationship(relationshipId);
         this.db.transaction(() => {
+            this.assertExpectedVersion("relationship", relationshipId, expectedVersionNo, "人物关系");
             this.recordEntityVersion("relationship", relationshipId, "delete", null, "删除人物关系");
             this.db.run("DELETE FROM relationships WHERE id = ?", relationshipId);
             this.audit(String(current.workId), "relationship.deleted", "relationship", relationshipId);
@@ -2799,6 +3118,7 @@ export class Store {
             evidence: json(requiredString(row, "evidence_json"), []),
             confirmationStatus: requiredString(row, "confirmation_status"),
             locked: booleanValue(row, "locked"),
+            versionNo: this.currentEntityVersionNo("relationship", requiredString(row, "id")),
             createdAt: requiredString(row, "created_at"),
             updatedAt: requiredString(row, "updated_at")
         };