@qingflow-tech/qingflow-app-user-mcp 1.0.10 → 1.0.12

package/src/qingflow_mcp/tools/record_tools.py

@@ -14,7 +14,7 @@ from datetime import UTC, datetime, timedelta
 from decimal import Decimal, InvalidOperation
 from io import BytesIO
 from pathlib import Path
-from typing import Any, cast
+from typing import Any, Callable, cast
 from urllib.parse import parse_qs, unquote, urlsplit
 from uuid import uuid4
 from xml.etree import ElementTree
@@ -22,7 +22,7 @@ from xml.etree import ElementTree
 from mcp.server.fastmcp import FastMCP
 
 from ..config import DEFAULT_PROFILE, DEFAULT_RECORD_LIST_TYPE, DEFAULT_USER_AGENT, get_mcp_home
-from ..errors import QingflowApiError, raise_tool_error
+from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
 from ..id_utils import normalize_positive_id_int, stringify_backend_id
 from ..json_types import JSONObject, JSONScalar, JSONValue
 from ..list_type_labels import (
@@ -45,6 +45,11 @@ RECORD_ACCESS_UNBOUNDED_ROW_THRESHOLD = 50_000
 RECORD_ACCESS_TIME_BUDGET_SECONDS = 55.0
 RECORD_ACCESS_MIN_REMAINING_SECONDS = 8.0
 RECORD_GET_DETAIL_LOG_PAGE_SIZE = 10
+RECORD_LOGS_PAGE_SIZE = 200
+RECORD_LOGS_PREVIEW_LIMIT = 10
+RECORD_LOGS_MAX_ITEMS = 20_000
+RECORD_LOGS_TIME_BUDGET_SECONDS = 55.0
+RECORD_LOGS_MIN_REMAINING_SECONDS = 8.0
 RECORD_GET_MEDIA_MAX_IMAGES = 30
 RECORD_GET_MEDIA_MAX_IMAGE_BYTES = 20 * 1024 * 1024
 RECORD_GET_MEDIA_MAX_TOTAL_BYTES = 100 * 1024 * 1024
@@ -126,6 +131,27 @@ SCHEMA_LINKAGE_REFERENCE_SOURCE_MESSAGE = "updating this field may auto-fill or
 SCHEMA_LINKAGE_REFERENCE_TARGET_MESSAGE = "this field is usually filled from an upstream reference selection or default matching logic"
 SCHEMA_LINKAGE_REFERENCE_BOTH_MESSAGE = "this field participates in reference-driven auto-fill logic"
 SCHEMA_LINKAGE_FORMULA_MESSAGE = "this field is usually derived by formula or default auto-fill logic"
+OPTIONAL_SCHEMA_PERMISSION_CODES = {40002, 40027, 404}
+RECORD_PERMISSION_DENIED_CODES = {40002, 40027}
+SYSTEM_VIEW_LIST_TYPES = {int(list_type) for _view_id, list_type, _name in SYSTEM_VIEW_DEFINITIONS}
+
+
+def _is_optional_schema_permission_error(error: QingflowApiError) -> bool:
+    if is_auth_like_error(error):
+        return False
+    return backend_code_int(error) in OPTIONAL_SCHEMA_PERMISSION_CODES or error.http_status == 404
+
+
+def _is_record_permission_denied_error(error: QingflowApiError) -> bool:
+    if is_auth_like_error(error):
+        return False
+    return backend_code_int(error) in RECORD_PERMISSION_DENIED_CODES
+
+
+def _is_optional_record_auxiliary_lookup_error(error: QingflowApiError) -> bool:
+    if is_auth_like_error(error):
+        return False
+    return backend_code_int(error) in {40002, 40027, 404} or error.http_status == 404
 
 
 @dataclass(slots=True)
@@ -210,6 +236,13 @@ class AccessibleViewRoute:
     view_type: str | None = None
 
 
+def _prefer_custom_update_routes(routes: list[AccessibleViewRoute]) -> list[AccessibleViewRoute]:
+    return [
+        *[route for route in routes if route.kind == "custom"],
+        *[route for route in routes if route.kind != "custom"],
+    ]
+
+
 @dataclass(slots=True)
 class RecordContextRouteProbe:
     route: AccessibleViewRoute
@@ -269,6 +302,30 @@ GENERIC_FIELD_ALIAS_OVERRIDES: dict[str, list[str]] = {
 FIELD_LOOKUP_STRIP_RE = re.compile(r"[\s_()（）\[\]【】{}<>·/\\:：-]+")
 
 
+def _pick_route_payload(payload: JSONObject) -> JSONObject:
+    return {
+        key: payload[key]
+        for key in (
+            "route_type",
+            "endpoint_kind",
+            "status",
+            "role",
+            "task_id",
+            "workflow_node_id",
+            "view_id",
+            "view_key",
+            "view_name",
+            "error_code",
+            "backend_code",
+            "http_status",
+            "request_id",
+            "message",
+            "reason",
+        )
+        if key in payload and payload[key] not in (None, "", [], {})
+    }
+
+
 class RecordTools(ToolBase):
     """记录工具（中文名：记录读写与分析）。
 
@@ -442,6 +499,20 @@ class RecordTools(ToolBase):
                 output_profile=output_profile,
             )
 
+        @mcp.tool(description="Read all visible data logs and workflow logs for one Qingflow record into local JSONL files. Requires the same view_id as the frontend record context. This tool hides pagination and returns file paths plus completeness metadata.")
+        def record_logs_get(
+            profile: str = DEFAULT_PROFILE,
+            app_key: str = "",
+            record_id: str = "",
+            view_id: str | None = None,
+        ) -> JSONObject:
+            return self.record_logs_get(
+                profile=profile,
+                app_key=app_key,
+                record_id=record_id,
+                view_id=view_id,
+            )
+
         @mcp.tool()
         def record_browse_schema_get(
             app_key: str = "",
@@ -459,12 +530,14 @@ class RecordTools(ToolBase):
         def record_update_schema_get(
             app_key: str = "",
             record_id: str = "",
+            view_id: str | None = None,
             output_profile: str = "normal",
         ) -> JSONObject:
             return self.record_update_schema_get_public(
                 profile=DEFAULT_PROFILE,
                 app_key=app_key,
                 record_id=record_id,
+                view_id=view_id,
                 output_profile=output_profile,
             )
 
@@ -493,8 +566,10 @@ class RecordTools(ToolBase):
         @mcp.tool(
             description=(
                 "Update one Qingflow record using a field map. "
-                "Use record_update_schema_get first. "
-                "This tool automatically probes accessible views in order and uses the first safe match."
+                "For simple field changes, call this tool directly after the target record is clear. "
+                "Pass view_id when the frontend detail view is known; the tool will try that view first. "
+                "It first tries the data-manager direct route, then falls back to the frontend custom-view edit route when available. "
+                "Use record_update_schema_get for diagnostics or complex field-scope inspection."
             )
         )
         def record_update(
@@ -502,6 +577,7 @@ class RecordTools(ToolBase):
             record_id: str | None = None,
             fields: JSONObject | None = None,
             items: list[JSONObject] | None = None,
+            view_id: str | None = None,
             dry_run: bool = False,
             verify_write: bool = True,
             output_profile: str = "normal",
@@ -512,6 +588,7 @@ class RecordTools(ToolBase):
                 record_id=record_id,
                 fields=fields,
                 items=items,
+                view_id=view_id,
                 dry_run=dry_run,
                 verify_write=verify_write,
                 output_profile=output_profile,
@@ -520,13 +597,14 @@ class RecordTools(ToolBase):
         @mcp.tool(
             description=(
                 "Delete Qingflow records by record_id or record_ids. "
-                "This tool does not accept view selectors; resolve target record ids first, then delete by id."
+                "Pass view_id when deleting from a known system list route; custom view deletion is not supported by this backend route."
             )
         )
         def record_delete(
             app_key: str = "",
             record_id: str | None = None,
             record_ids: list[str] | None = None,
+            view_id: str | None = None,
             output_profile: str = "normal",
         ) -> JSONObject:
             return self.record_delete_public(
@@ -534,6 +612,7 @@ class RecordTools(ToolBase):
                 app_key=app_key,
                 record_id=record_id,
                 record_ids=record_ids or [],
+                view_id=view_id,
                 output_profile=output_profile,
             )
 
@@ -805,6 +884,7 @@ class RecordTools(ToolBase):
         profile: str = DEFAULT_PROFILE,
         app_key: str,
         record_id: Any,
+        view_id: str | None = None,
         output_profile: str = "normal",
     ) -> JSONObject:
         """执行记录相关逻辑。"""
@@ -816,21 +896,44 @@ class RecordTools(ToolBase):
         def runner(session_profile, context):
             request_route = self._request_route_payload(context)
             self._clear_record_schema_caches(profile=profile, app_key=app_key, clear_view_caches=True)
-            app_schema = self._get_form_schema(profile, context, app_key, force_refresh=True)
-            question_relations = _collect_question_relations(app_schema)
-            app_index = _build_applicant_top_level_field_index(app_schema)
-            linked_field_ids = _collect_linked_required_field_ids(question_relations)
-            linked_field_ids.update(_collect_option_linked_field_ids(app_index))
-            linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
-                app_schema,
-                linked_field_ids=linked_field_ids,
-            )
-            app_index = _merge_field_indexes(app_index, linked_hidden_index)
-            linkage_payloads_by_field_id = _build_static_schema_linkage_payloads(
-                index=app_index,
-                question_relations=question_relations,
-            )
+            linkage_payloads_by_field_id: dict[str, JSONObject] = {}
+            try:
+                app_schema = self._get_form_schema(profile, context, app_key, force_refresh=True)
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+            else:
+                question_relations = _collect_question_relations(app_schema)
+                app_index = _build_applicant_top_level_field_index(app_schema)
+                linked_field_ids = _collect_linked_required_field_ids(question_relations)
+                linked_field_ids.update(_collect_option_linked_field_ids(app_index))
+                linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
+                    app_schema,
+                    linked_field_ids=linked_field_ids,
+                )
+                app_index = _merge_field_indexes(app_index, linked_hidden_index)
+                linkage_payloads_by_field_id = _build_static_schema_linkage_payloads(
+                    index=app_index,
+                    question_relations=question_relations,
+                )
+            preferred_view_id = _normalize_optional_text(view_id)
             candidate_routes = self._candidate_update_views(profile, context, app_key)
+            if preferred_view_id:
+                preferred_route = next(
+                    (
+                        route
+                        for route in candidate_routes
+                        if route.view_id == preferred_view_id
+                    ),
+                    None,
+                )
+                if preferred_route is None:
+                    raise_tool_error(
+                        QingflowApiError.config_error(
+                            f"view_id '{preferred_view_id}' is not an accessible update candidate"
+                        )
+                    )
+                candidate_routes = [preferred_route]
             probes = self._probe_candidate_record_contexts(
                 context,
                 app_key=app_key,
@@ -932,6 +1035,7 @@ class RecordTools(ToolBase):
                     output_profile=normalized_output_profile,
                     view_probe_summary=probe_summary,
                     ambiguous_fields=[],
+                    preferred_view_id=preferred_view_id,
                 )
 
             ambiguous_field_ids: set[int] = set()
@@ -978,6 +1082,7 @@ class RecordTools(ToolBase):
                     output_profile=normalized_output_profile,
                     view_probe_summary=probe_summary,
                     ambiguous_fields=ambiguous_fields,
+                    preferred_view_id=preferred_view_id,
                 )
 
             response: JSONObject = {
@@ -995,15 +1100,61 @@ class RecordTools(ToolBase):
                     item["title"]: self._ready_schema_template_value(item)
                     for item in writable_fields
                 },
+                "available_update_routes": self._record_update_schema_available_routes(matched_probes),
+                "recommended_update_route": {
+                    "route_type": "auto",
+                    "order": ["admin_direct", "view_edit", "task_save_only"],
+                    "message": "record_update will try data-manager direct edit first, then a matching custom-view edit route, then a unique current-user todo save-only route when the target fields are editable on that workflow node.",
+                },
             }
+            if preferred_view_id:
+                response["preferred_view_id"] = preferred_view_id
             if normalized_output_profile == "verbose":
                 response["view_probe_summary"] = probe_summary
                 response["record_context_probe"] = probe_summary
                 response["ambiguous_fields"] = ambiguous_fields
+                response["route_probe_summary"] = probe_summary
             return response
 
         return self._run_record_tool(profile, runner)
 
+    def _record_update_schema_available_routes(self, matched_probes: list[RecordContextRouteProbe]) -> list[JSONObject]:
+        routes: list[JSONObject] = [
+            {
+                "route_type": "admin_direct",
+                "endpoint_kind": "app_apply_update",
+                "role": 1,
+                "availability": "attempted_on_update",
+                "message": "Requires data-manager edit permission; record_update safely falls back if backend returns permission denied.",
+            }
+        ]
+        for probe in matched_probes:
+            if probe.route.kind != "custom":
+                continue
+            view_key = self._route_view_key(probe.route)
+            if not view_key:
+                continue
+            routes.append(
+                {
+                    "route_type": "view_edit",
+                    "endpoint_kind": "view_apply_update",
+                    "view_id": probe.route.view_id,
+                    "view_key": view_key,
+                    "view_name": probe.route.name,
+                    "availability": "candidate",
+                    "message": "Uses the same custom-view detail edit route as the frontend.",
+                }
+            )
+        routes.append(
+            {
+                "route_type": "task_save_only",
+                "endpoint_kind": "workflow_node_save_only",
+                "availability": "auto_probe_on_update",
+                "message": "record_update probes the current user's todo list and uses save-only only when exactly one matching task exists and the requested fields are editable on that workflow node.",
+            }
+        )
+        return routes
+
     def _record_update_schema_blocked_response(
         self,
         *,
@@ -1018,6 +1169,7 @@ class RecordTools(ToolBase):
         output_profile: str,
         view_probe_summary: list[JSONObject],
         ambiguous_fields: list[JSONObject],
+        preferred_view_id: str | None = None,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
         response: JSONObject = {
@@ -1035,6 +1187,8 @@ class RecordTools(ToolBase):
             "payload_template": {},
             "recommended_next_actions": recommended_next_actions,
         }
+        if preferred_view_id:
+            response["preferred_view_id"] = preferred_view_id
         if output_profile == "verbose":
             response["view_probe_summary"] = view_probe_summary
             response["ambiguous_fields"] = ambiguous_fields
@@ -1352,24 +1506,58 @@ class RecordTools(ToolBase):
             )
             warnings: list[JSONObject] = []
             scope_source = "static_applicant_scope"
-            if runtime_lookup:
-                state = self._build_candidate_lookup_state(
-                    profile,
-                    context,
+            try:
+                if runtime_lookup:
+                    state = self._build_candidate_lookup_state(
+                        profile,
+                        context,
+                        app_key=app_key,
+                        record_id=record_id_int,
+                        workflow_node_id=workflow_node_id,
+                        fields=normalized_fields,
+                    )
+                    items = self._resolve_member_candidates_backend(context, field, keyword=keyword, state=state)
+                    scope_source = "backend_runtime_scope"
+                else:
+                    items: list[JSONObject] | None = None
+                    if self._member_candidate_static_preview_should_use_backend(field):
+                        state = self._build_candidate_lookup_state(
+                            profile,
+                            context,
+                            app_key=app_key,
+                            record_id=None,
+                            workflow_node_id=None,
+                            fields={},
+                        )
+                        items = self._resolve_member_candidates_backend(context, field, keyword=keyword, state=state)
+                        scope_source = "backend_applicant_scope"
+                    if items is None:
+                        items = self._resolve_member_candidates(context, field, keyword=keyword)
+                    warnings.append(
+                        {
+                            "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
+                            "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
+                        }
+                    )
+            except (RecordInputError, QingflowApiError) as error:
+                record_error = (
+                    error
+                    if isinstance(error, RecordInputError)
+                    else self._candidate_lookup_error(kind="member", field=field, value=keyword, error=error)
+                )
+                return self._candidate_lookup_failed_response(
+                    profile=profile,
+                    session_profile=session_profile,
+                    context=context,
+                    kind="member",
+                    error=record_error,
+                    field=field,
                     app_key=app_key,
-                    record_id=record_id_int,
+                    record_id_text=record_id_text,
                     workflow_node_id=workflow_node_id,
-                    fields=normalized_fields,
-                )
-                items = self._resolve_member_candidates_backend(context, field, keyword=keyword, state=state)
-                scope_source = "backend_runtime_scope"
-            else:
-                items = self._resolve_member_candidates(context, field, keyword=keyword)
-                warnings.append(
-                    {
-                        "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
-                        "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
-                    }
+                    fields_present=bool(normalized_fields),
+                    keyword=keyword,
+                    scope_source=scope_source,
                 )
             total = len(items)
             start = (page_num - 1) * page_size
@@ -1462,41 +1650,75 @@ class RecordTools(ToolBase):
             )
             warnings: list[JSONObject] = []
             scope_source = "static_applicant_scope"
-            if runtime_lookup:
-                state = self._build_candidate_lookup_state(
-                    profile,
-                    context,
-                    app_key=app_key,
-                    record_id=record_id_int,
-                    workflow_node_id=workflow_node_id,
-                    fields=normalized_fields,
-                )
-                items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
-                scope_source = "backend_runtime_scope"
-            else:
-                items = self._resolve_department_candidates(context, field, keyword=keyword)
-                scope = field.dept_select_scope if isinstance(field.dept_select_scope, dict) else {}
-                if (
-                    not items
-                    and field.dept_select_scope_type == 2
-                    and not _scope_has_dynamic_or_external(scope)
-                    and not list(scope.get("depart") or [])
-                ):
+            try:
+                if runtime_lookup:
                     state = self._build_candidate_lookup_state(
                         profile,
                         context,
                         app_key=app_key,
-                        record_id=None,
-                        workflow_node_id=None,
-                        fields={},
+                        record_id=record_id_int,
+                        workflow_node_id=workflow_node_id,
+                        fields=normalized_fields,
                     )
                     items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
                     scope_source = "backend_runtime_scope"
-                warnings.append(
-                    {
-                        "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
-                        "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
-                    }
+                else:
+                    items: list[JSONObject] | None = None
+                    if self._department_candidate_static_preview_should_use_backend(field):
+                        state = self._build_candidate_lookup_state(
+                            profile,
+                            context,
+                            app_key=app_key,
+                            record_id=None,
+                            workflow_node_id=None,
+                            fields={},
+                        )
+                        items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
+                        scope_source = "backend_applicant_scope"
+                    if items is None:
+                        items = self._resolve_department_candidates(context, field, keyword=keyword)
+                        scope = field.dept_select_scope if isinstance(field.dept_select_scope, dict) else {}
+                        if (
+                            not items
+                            and field.dept_select_scope_type == 2
+                            and not _scope_has_dynamic_or_external(scope)
+                            and not list(scope.get("depart") or [])
+                        ):
+                            state = self._build_candidate_lookup_state(
+                                profile,
+                                context,
+                                app_key=app_key,
+                                record_id=None,
+                                workflow_node_id=None,
+                                fields={},
+                            )
+                            items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
+                            scope_source = "backend_applicant_scope"
+                    warnings.append(
+                        {
+                            "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
+                            "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
+                        }
+                    )
+            except (RecordInputError, QingflowApiError) as error:
+                record_error = (
+                    error
+                    if isinstance(error, RecordInputError)
+                    else self._candidate_lookup_error(kind="department", field=field, value=keyword, error=error)
+                )
+                return self._candidate_lookup_failed_response(
+                    profile=profile,
+                    session_profile=session_profile,
+                    context=context,
+                    kind="department",
+                    error=record_error,
+                    field=field,
+                    app_key=app_key,
+                    record_id_text=record_id_text,
+                    workflow_node_id=workflow_node_id,
+                    fields_present=bool(normalized_fields),
+                    keyword=keyword,
+                    scope_source=scope_source,
                 )
             total = len(items)
             start = (page_num - 1) * page_size
@@ -1558,6 +1780,21 @@ class RecordTools(ToolBase):
             raise_tool_error(QingflowApiError.config_error("app_key is required"))
         if limit <= 0:
             raise_tool_error(QingflowApiError.config_error("limit must be positive"))
+        if not (
+            _normalize_optional_text(view_id)
+            or list_type is not None
+            or _normalize_optional_text(view_key)
+            or _normalize_optional_text(view_name)
+        ):
+            raise_tool_error(
+                QingflowApiError.config_error(
+                    "record_analyze requires view_id. Call app_get first and pass accessible_views[].view_id.",
+                    details={
+                        "error_code": "RECORD_ANALYZE_VIEW_REQUIRED",
+                        "fix_hint": "Call app_get first and choose one accessible_views[].view_id, then retry record_analyze with view_id.",
+                    },
+                )
+            )
         legacy_warnings = _detect_analyze_legacy_warnings(
             dimensions=dimensions,
             metrics=metrics,
@@ -1574,7 +1811,7 @@ class RecordTools(ToolBase):
                 list_type=list_type,
                 view_key=view_key,
                 view_name=view_name,
-                allow_default=True,
+                allow_default=False,
             )
             if not _view_type_supports_analysis(resolved_view.view_type):
                 raise_tool_error(
@@ -1655,6 +1892,21 @@ class RecordTools(ToolBase):
             raise_tool_error(QingflowApiError.config_error("limit must be positive"))
         if page <= 0:
             raise_tool_error(QingflowApiError.config_error("page must be positive"))
+        if not (
+            _normalize_optional_text(view_id)
+            or list_type is not None
+            or _normalize_optional_text(view_key)
+            or _normalize_optional_text(view_name)
+        ):
+            raise_tool_error(
+                QingflowApiError.config_error(
+                    "record_list requires view_id. Call app_get first and pass accessible_views[].view_id.",
+                    details={
+                        "error_code": "RECORD_LIST_VIEW_REQUIRED",
+                        "fix_hint": "Call app_get first and choose one accessible_views[].view_id, then retry record_list with view_id.",
+                    },
+                )
+            )
         view_route, compatibility_warnings = self._resolve_accessible_view_route_for_public(
             profile=profile,
             app_key=app_key,
@@ -1662,7 +1914,7 @@ class RecordTools(ToolBase):
             list_type=list_type,
             view_key=view_key,
             view_name=view_name,
-            allow_default=True,
+            allow_default=False,
         )
         if not _view_type_supports_analysis(view_route.view_type):
             raise_tool_error(
@@ -2136,6 +2388,7 @@ class RecordTools(ToolBase):
         requested_output_profile = _normalize_record_get_detail_output_profile(output_profile)
         record_id_int = normalize_positive_id_int(record_id, field_name="record_id")
         normalized_columns = _normalize_public_column_selectors(columns)
+        explicit_view_id = _normalize_optional_text(view_id)
 
         def runner(session_profile, context):
             resolved_view, compatibility_warnings = self._resolve_accessible_view_route(
@@ -2161,89 +2414,323 @@ class RecordTools(ToolBase):
                     "code": "OUTPUT_PROFILE_DEPRECATED_FOR_DETAIL_CONTEXT",
                     "message": f"output_profile={requested_output_profile!r} is deprecated for record_get; detail_context is always returned.",
                 })
-            return self._record_get_detail_context(
-                profile=profile,
-                session_profile=session_profile,
-                context=context,
-                app_key=app_key,
-                record_id_int=record_id_int,
-                resolved_view=resolved_view,
-                requested_focus_field_ids=normalized_columns,
-                workflow_node_id=workflow_node_id,
-                warnings=warnings,
-            )
+            def get_detail_for_route(route: AccessibleViewRoute, route_warnings: list[JSONObject]) -> JSONObject:
+                return self._record_get_detail_context(
+                    profile=profile,
+                    session_profile=session_profile,
+                    context=context,
+                    app_key=app_key,
+                    record_id_int=record_id_int,
+                    resolved_view=route,
+                    requested_focus_field_ids=normalized_columns,
+                    workflow_node_id=workflow_node_id,
+                    warnings=route_warnings,
+                )
+
+            try:
+                return get_detail_for_route(resolved_view, warnings)
+            except QingflowApiError as exc:
+                if explicit_view_id is not None:
+                    raise
+                if not self._is_record_context_route_miss(exc):
+                    raise
+                fallback_warnings = list(warnings)
+                fallback_warnings.append(
+                    {
+                        "code": "DEFAULT_DETAIL_ROUTE_DENIED",
+                        "message": "record_get default system:all route was not readable; trying accessible views that match the frontend route model.",
+                        "backend_code": exc.backend_code,
+                    }
+                )
+                last_error = exc
+                for candidate in self._candidate_update_views(profile, context, app_key):
+                    if candidate.view_id == resolved_view.view_id:
+                        continue
+                    try:
+                        return get_detail_for_route(candidate, fallback_warnings)
+                    except QingflowApiError as candidate_exc:
+                        if not self._is_record_context_route_miss(candidate_exc):
+                            raise
+                        last_error = candidate_exc
+                raise last_error
 
         return self._run_record_tool(profile, runner)
 
-    def _record_get_detail_context(
+    @tool_cn_name("记录全量日志")
+    def record_logs_get(
         self,
         *,
         profile: str,
-        session_profile,  # type: ignore[no-untyped-def]
-        context,  # type: ignore[no-untyped-def]
         app_key: str,
-        record_id_int: int,
-        resolved_view: AccessibleViewRoute,
-        requested_focus_field_ids: list[int],
-        workflow_node_id: int | None,
-        warnings: list[JSONObject],
+        record_id: Any,
+        view_id: str | None = None,
     ) -> JSONObject:
-        """执行内部辅助逻辑。"""
-        schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=False)
-        index = _build_top_level_field_index(schema)
-        audit_info = self._record_get_audit_info(
-            context,
-            app_key=app_key,
-            record_id=record_id_int,
-            resolved_view=resolved_view,
-        )
-        audit_context = _record_detail_audit_context(audit_info, workflow_node_id=workflow_node_id)
-        detail_result, used_list_type, used_role = self._record_get_apply_detail(
-            context,
-            app_key=app_key,
-            record_id=record_id_int,
-            resolved_view=resolved_view,
-            audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
-        )
-        answer_list = _record_detail_answers(detail_result)
-        selected_fields = list(index.by_id.values())
-        row = _build_flat_row(cast(list[JSONValue], answer_list), selected_fields, apply_id=record_id_int)
-        normalized_record, _normalized_ambiguous_fields = _build_normalized_row_from_answers(
-            cast(list[JSONValue], answer_list),
-            selected_fields,
-        )
-        if self._record_get_needs_schema_refresh(
-            answer_list=cast(list[JSONValue], answer_list),
-            selected_fields=selected_fields,
-            record=row,
-            normalized_record=normalized_record,
-        ):
-            self._clear_record_schema_caches(
-                profile=profile,
-                app_key=app_key,
-                resolved_view=resolved_view,
-                clear_view_caches=True,
+        """读取单条记录可见的全量数据日志和流程日志，写入本地 JSONL。"""
+        record_id_int = normalize_positive_id_int(record_id, field_name="record_id")
+        if not _normalize_optional_text(view_id):
+            raise_tool_error(
+                QingflowApiError.config_error(
+                    "record_logs_get requires view_id. Call app_get first and pass accessible_views[].view_id.",
+                    details={
+                        "error_code": "RECORD_LOGS_VIEW_REQUIRED",
+                        "fix_hint": "Call app_get first and choose one accessible_views[].view_id, then retry record_logs_get with view_id.",
+                    },
+                )
             )
-            schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=True)
-            index = _build_top_level_field_index(schema)
-            selected_fields = list(index.by_id.values())
 
-        unavailable_context: list[JSONObject] = []
-        dynamic_reference_answers, dynamic_reference_unavailable = self._record_get_dynamic_reference_answers(
-            context,
-            app_key=app_key,
-            record_id=record_id_int,
-            resolved_view=resolved_view,
-            role=used_role,
-            audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
-            answer_list=cast(list[JSONValue], answer_list),
-            selected_fields=selected_fields,
-        )
-        unavailable_context.extend(dynamic_reference_unavailable)
-        if dynamic_reference_answers:
-            answer_list = _merge_record_detail_answers(
-                cast(list[JSONValue], answer_list),
-                dynamic_reference_answers,
+        def runner(session_profile, context):
+            resolved_view, compatibility_warnings = self._resolve_accessible_view_route(
+                profile,
+                context,
+                app_key,
+                view_id=view_id,
+                list_type=None,
+                view_key=None,
+                view_name=None,
+                allow_default=False,
+            )
+            warnings: list[JSONObject] = []
+            warnings.extend(compatibility_warnings)
+            warnings.extend(_view_filter_trust_warnings(resolved_view))
+            unavailable_context: list[JSONObject] = []
+
+            schema: JSONObject = {}
+            try:
+                schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=False)
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+                unavailable_context.append(
+                    _record_detail_unavailable_context(
+                        "detail_schema",
+                        "记录日志字段结构辅助信息获取失败，已尝试使用详情主数据中的字段信息继续。",
+                        exc,
+                    )
+                )
+            index = _build_top_level_field_index(schema)
+            try:
+                audit_info = self._record_get_audit_info(
+                    context,
+                    app_key=app_key,
+                    record_id=record_id_int,
+                    resolved_view=resolved_view,
+                )
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+                audit_info = {}
+                unavailable_context.append(
+                    _record_detail_unavailable_context(
+                        "audit_info",
+                        "记录审批节点辅助信息获取失败，已继续读取详情主数据和日志。",
+                        exc,
+                    )
+                )
+            audit_context = _record_detail_audit_context(audit_info, workflow_node_id=None)
+            detail_result, used_list_type, used_role = self._record_get_apply_detail(
+                context,
+                app_key=app_key,
+                record_id=record_id_int,
+                resolved_view=resolved_view,
+                audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
+            )
+            answer_list = _record_detail_answers(detail_result)
+            if not index.by_id:
+                answer_index = _build_answer_backed_field_index(cast(list[JSONObject], answer_list))
+                if answer_index.by_id:
+                    index = answer_index
+                    unavailable_context.append(
+                        {
+                            "section": "detail_schema",
+                            "message": "字段结构由详情 answers 回退构造；候选范围、只读状态、选项和联动信息可能不完整。",
+                            "category": "partial_context",
+                        }
+                    )
+            selected_fields = list(index.by_id.values())
+            fields = [
+                _record_detail_field_payload(field, _find_answer_for_field(cast(list[JSONValue], answer_list), field), focus_id_set=set())
+                for field in selected_fields
+            ]
+            app_name = self._record_get_detail_app_name(
+                profile,
+                context,
+                app_key=app_key,
+                schema=schema,
+                used_list_type=used_list_type,
+            )
+            view_payload = _accessible_view_payload(resolved_view)
+            record_payload = _record_detail_record_payload(
+                app_key=app_key,
+                record_id=record_id_int,
+                detail=detail_result,
+                answer_list=cast(list[JSONValue], answer_list),
+                fields=fields,
+            )
+            log_visibility = self._record_get_log_visibility_context(
+                context,
+                app_key=app_key,
+                record_id=record_id_int,
+                resolved_view=resolved_view,
+                role=used_role,
+                audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
+                unavailable_context=unavailable_context,
+            )
+            run_dir = _record_logs_run_dir()
+            run_dir.mkdir(parents=True, exist_ok=True)
+            deadline = time.monotonic() + RECORD_LOGS_TIME_BUDGET_SECONDS
+            data_logs = self._record_get_full_data_logs_context(
+                context,
+                app_key=app_key,
+                record_id=record_id_int,
+                role=used_role,
+                log_visibility=log_visibility,
+                unavailable_context=unavailable_context,
+                run_dir=run_dir,
+                deadline=deadline,
+            )
+            workflow_logs = self._record_get_full_workflow_logs_context(
+                context,
+                app_key=app_key,
+                record_id=record_id_int,
+                resolved_view=resolved_view,
+                role=used_role,
+                audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
+                log_visibility=log_visibility,
+                unavailable_context=unavailable_context,
+                run_dir=run_dir,
+                deadline=deadline,
+            )
+            status = _record_logs_overall_status(data_logs=data_logs, workflow_logs=workflow_logs)
+            context_integrity = _record_logs_context_integrity(data_logs=data_logs, workflow_logs=workflow_logs)
+            payload: JSONObject = {
+                "ok": True,
+                "status": status,
+                "output_profile": "record_logs",
+                "app": {"app_key": app_key, "app_name": app_name},
+                "view": view_payload,
+                "record": record_payload,
+                "local_dir": str(run_dir),
+                "data_logs": data_logs,
+                "workflow_logs": workflow_logs,
+                "warnings": warnings,
+                "unavailable_context": unavailable_context,
+                "context_integrity": context_integrity,
+            }
+            summary_path = run_dir / "summary.json"
+            summary_payload = deepcopy(payload)
+            summary_payload.pop("request_route", None)
+            summary_path.write_text(json.dumps(summary_payload, ensure_ascii=False, indent=2), encoding="utf-8")
+            payload["summary_path"] = str(summary_path)
+            return payload
+
+        return self._run_record_tool(profile, runner)
+
+    def _record_get_detail_context(
+        self,
+        *,
+        profile: str,
+        session_profile,  # type: ignore[no-untyped-def]
+        context,  # type: ignore[no-untyped-def]
+        app_key: str,
+        record_id_int: int,
+        resolved_view: AccessibleViewRoute,
+        requested_focus_field_ids: list[int],
+        workflow_node_id: int | None,
+        warnings: list[JSONObject],
+    ) -> JSONObject:
+        """执行内部辅助逻辑。"""
+        unavailable_context: list[JSONObject] = []
+        schema: JSONObject = {}
+        schema_available = True
+        try:
+            schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=False)
+        except QingflowApiError as exc:
+            if not _is_optional_schema_permission_error(exc):
+                raise
+            schema_available = False
+            unavailable_context.append(
+                _record_detail_unavailable_context(
+                    "detail_schema",
+                    "记录详情字段结构辅助信息获取失败，已尝试使用详情主数据中的字段信息继续。",
+                    exc,
+                )
+            )
+        index = _build_top_level_field_index(schema)
+        try:
+            audit_info = self._record_get_audit_info(
+                context,
+                app_key=app_key,
+                record_id=record_id_int,
+                resolved_view=resolved_view,
+            )
+        except QingflowApiError as exc:
+            if not _is_optional_schema_permission_error(exc):
+                raise
+            audit_info = {}
+            unavailable_context.append(
+                _record_detail_unavailable_context(
+                    "audit_info",
+                    "记录审批节点辅助信息获取失败，已继续读取详情主数据。",
+                    exc,
+                )
+            )
+        audit_context = _record_detail_audit_context(audit_info, workflow_node_id=workflow_node_id)
+        detail_result, used_list_type, used_role = self._record_get_apply_detail(
+            context,
+            app_key=app_key,
+            record_id=record_id_int,
+            resolved_view=resolved_view,
+            audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
+        )
+        answer_list = _record_detail_answers(detail_result)
+        if not index.by_id:
+            answer_index = _build_answer_backed_field_index(cast(list[JSONObject], answer_list))
+            if answer_index.by_id:
+                index = answer_index
+                unavailable_context.append(
+                    {
+                        "section": "detail_schema",
+                        "message": "字段结构由详情 answers 回退构造；候选范围、只读状态、选项和联动信息可能不完整。",
+                        "category": "partial_context",
+                    }
+                )
+        selected_fields = list(index.by_id.values())
+        row = _build_flat_row(cast(list[JSONValue], answer_list), selected_fields, apply_id=record_id_int)
+        normalized_record, _normalized_ambiguous_fields = _build_normalized_row_from_answers(
+            cast(list[JSONValue], answer_list),
+            selected_fields,
+        )
+        if schema_available and self._record_get_needs_schema_refresh(
+            answer_list=cast(list[JSONValue], answer_list),
+            selected_fields=selected_fields,
+            record=row,
+            normalized_record=normalized_record,
+        ):
+            self._clear_record_schema_caches(
+                profile=profile,
+                app_key=app_key,
+                resolved_view=resolved_view,
+                clear_view_caches=True,
+            )
+            schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=True)
+            index = _build_top_level_field_index(schema)
+            selected_fields = list(index.by_id.values())
+
+        dynamic_reference_answers, dynamic_reference_unavailable = self._record_get_dynamic_reference_answers(
+            context,
+            app_key=app_key,
+            record_id=record_id_int,
+            resolved_view=resolved_view,
+            role=used_role,
+            audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
+            answer_list=cast(list[JSONValue], answer_list),
+            selected_fields=selected_fields,
+        )
+        unavailable_context.extend(dynamic_reference_unavailable)
+        if dynamic_reference_answers:
+            answer_list = _merge_record_detail_answers(
+                cast(list[JSONValue], answer_list),
+                dynamic_reference_answers,
             )
 
         app_name = self._record_get_detail_app_name(
@@ -2387,7 +2874,20 @@ class RecordTools(ToolBase):
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
         if resolved_view.kind == "custom" and resolved_view.view_selection is not None:
-            return self._get_view_form_schema(profile, context, resolved_view.view_selection.view_key, force_refresh=force_refresh)
+            return self._get_custom_view_browse_schema(
+                profile,
+                context,
+                resolved_view.view_selection.view_key,
+                force_refresh=force_refresh,
+            )
+        if resolved_view.kind == "system" and resolved_view.list_type is not None:
+            return self._get_system_browse_schema(
+                profile,
+                context,
+                app_key,
+                list_type=resolved_view.list_type,
+                force_refresh=force_refresh,
+            )
         return self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
 
     def _record_get_audit_info(
@@ -2448,7 +2948,7 @@ class RecordTools(ToolBase):
             )
             return result if isinstance(result, dict) else {"value": result}, list_type, role
         except QingflowApiError as exc:
-            if resolved_view.list_type is not None or exc.backend_code != 40002:
+            if resolved_view.list_type is not None or not _is_record_permission_denied_error(exc):
                 raise
             last_error: QingflowApiError = exc
             for fallback_list_type in (14, 1, 2, 12):
@@ -2466,7 +2966,7 @@ class RecordTools(ToolBase):
                     return result if isinstance(result, dict) else {"value": result}, fallback_list_type, role
                 except QingflowApiError as fallback_exc:
                     last_error = fallback_exc
-                    if fallback_exc.backend_code == 40002:
+                    if _is_record_permission_denied_error(fallback_exc):
                         continue
                     raise
             raise last_error
@@ -2564,6 +3064,8 @@ class RecordTools(ToolBase):
                     if target_app_key == app_key and str(target_record_id) == str(source_record_id):
                         reference_payload["self_reference"] = True
                 except QingflowApiError as exc:
+                    if is_auth_like_error(exc):
+                        raise
                     unavailable = _record_detail_unavailable_context(
                         "reference_detail",
                         f"引用字段「{field.que_title}」的目标记录详情获取失败。",
@@ -2661,6 +3163,8 @@ class RecordTools(ToolBase):
                     json_body=body,
                 )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable = _record_detail_unavailable_context(
                 "reference_runtime_match",
                 "动态引用字段匹配数据获取失败。",
@@ -2715,6 +3219,8 @@ class RecordTools(ToolBase):
                 },
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("log_visibility", "侧边栏日志可见性获取失败。", exc))
             return {"status": "unavailable", "channel": channel, "data_log_visible": None, "workflow_log_visible": None}
         payload = visibility if isinstance(visibility, dict) else {}
@@ -2768,6 +3274,8 @@ class RecordTools(ToolBase):
                 source="data_logs",
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("data_logs", "最近数据日志获取失败。", exc))
             return _record_detail_log_unavailable_payload("data_logs", "fetch_unavailable")
 
@@ -2821,9 +3329,117 @@ class RecordTools(ToolBase):
                 source="workflow_logs",
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("workflow_logs", "流程日志本次获取失败。", exc))
             return _record_detail_log_unavailable_payload("workflow_logs", "fetch_unavailable")
 
+    def _record_get_full_data_logs_context(
+        self,
+        context,  # type: ignore[no-untyped-def]
+        *,
+        app_key: str,
+        record_id: int,
+        role: int,
+        log_visibility: JSONObject,
+        unavailable_context: list[JSONObject],
+        run_dir: Path,
+        deadline: float,
+    ) -> JSONObject:
+        """读取全量数据日志并写入 JSONL。"""
+        if log_visibility.get("status") == "unavailable":
+            return _record_logs_unavailable_payload("data_logs", "visibility_unavailable")
+        if log_visibility.get("data_log_visible") is False:
+            return _record_logs_hidden_payload("data_logs")
+
+        def fetch_page(page_num: int) -> JSONValue:
+            return self.backend.request(
+                "POST",
+                context,
+                f"/worksheet/data/log/{app_key}/{record_id}/page",
+                json_body={
+                    "viewChannel": log_visibility.get("channel"),
+                    "role": role,
+                    "pageNum": page_num,
+                    "pageSize": RECORD_LOGS_PAGE_SIZE,
+                },
+            )
+
+        try:
+            return _record_logs_fetch_all_to_jsonl(
+                fetch_page=fetch_page,
+                normalizer=_record_detail_data_log_item,
+                source="data_logs",
+                file_path=run_dir / "data-logs.jsonl",
+                deadline=deadline,
+            )
+        except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
+            unavailable_context.append(_record_detail_unavailable_context("data_logs", "全量数据日志获取失败。", exc))
+            return _record_logs_unavailable_payload("data_logs", "fetch_unavailable")
+
+    def _record_get_full_workflow_logs_context(
+        self,
+        context,  # type: ignore[no-untyped-def]
+        *,
+        app_key: str,
+        record_id: int,
+        resolved_view: AccessibleViewRoute,
+        role: int,
+        audit_node_id: int | None,
+        log_visibility: JSONObject,
+        unavailable_context: list[JSONObject],
+        run_dir: Path,
+        deadline: float,
+    ) -> JSONObject:
+        """读取全量流程日志并写入 JSONL。"""
+        if log_visibility.get("status") == "unavailable":
+            return _record_logs_unavailable_payload("workflow_logs", "visibility_unavailable")
+        if log_visibility.get("workflow_log_visible") is False:
+            return _record_logs_hidden_payload("workflow_logs")
+
+        def fetch_page(page_num: int) -> JSONValue:
+            if resolved_view.kind == "custom" and resolved_view.view_selection is not None:
+                return self.backend.request(
+                    "POST",
+                    context,
+                    f"/viewGraph/{resolved_view.view_selection.view_key}/workflow/node/record",
+                    json_body={
+                        "key": resolved_view.view_selection.view_key,
+                        "rowRecordId": str(record_id),
+                        "pageNum": page_num,
+                        "pageSize": RECORD_LOGS_PAGE_SIZE,
+                    },
+                )
+            return self.backend.request(
+                "POST",
+                context,
+                "/application/workflow/node/record",
+                json_body={
+                    "key": app_key,
+                    "rowRecordId": str(record_id),
+                    "nodeId": audit_node_id,
+                    "role": role,
+                    "pageNum": page_num,
+                    "pageSize": RECORD_LOGS_PAGE_SIZE,
+                },
+            )
+
+        try:
+            return _record_logs_fetch_all_to_jsonl(
+                fetch_page=fetch_page,
+                normalizer=_record_detail_workflow_log_item,
+                source="workflow_logs",
+                file_path=run_dir / "workflow-logs.jsonl",
+                deadline=deadline,
+            )
+        except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
+            unavailable_context.append(_record_detail_unavailable_context("workflow_logs", "全量流程日志获取失败。", exc))
+            return _record_logs_unavailable_payload("workflow_logs", "fetch_unavailable")
+
     def _record_get_associated_resources(
         self,
         context,  # type: ignore[no-untyped-def]
@@ -2853,6 +3469,8 @@ class RecordTools(ToolBase):
                     params["auditNodeId"] = audit_node_id
                 payload = self.backend.request("GET", context, f"/app/{app_key}/asosChart", params=params)
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("associated_resources", "关联资源获取失败。", exc))
             return []
         return [_record_detail_associated_resource(item) for item in _record_detail_associated_resource_items(payload)]
@@ -2890,16 +3508,17 @@ class RecordTools(ToolBase):
                 refresh_source_url=refresh_source_url,
             )
         except Exception as exc:  # defensive: media should never break the core record detail.
+            warning: JSONObject = {
+                "code": "MEDIA_ASSETS_UNAVAILABLE",
+                "message": f"record_get could not collect media assets: {exc}",
+            }
+            if isinstance(exc, QingflowApiError):
+                warning.update(_record_detail_error_warning_fields(exc))
             return {
                 "status": "unavailable",
                 "local_dir": None,
                 "items": [],
-                "warnings": [
-                    {
-                        "code": "MEDIA_ASSETS_UNAVAILABLE",
-                        "message": f"record_get could not collect media assets: {exc}",
-                    }
-                ],
+                "warnings": [warning],
             }
 
     def _record_get_file_assets(
@@ -2937,16 +3556,17 @@ class RecordTools(ToolBase):
                 refresh_source_url=refresh_source_url,
             )
         except Exception as exc:  # defensive: file assets should never break the core record detail.
+            warning = {
+                "code": "FILE_ASSETS_UNAVAILABLE",
+                "message": f"record_get could not collect file assets: {exc}",
+            }
+            if isinstance(exc, QingflowApiError):
+                warning.update(_record_detail_error_warning_fields(exc))
             return {
                 "status": "unavailable",
                 "local_dir": None,
                 "items": [],
-                "warnings": [
-                    {
-                        "code": "FILE_ASSETS_UNAVAILABLE",
-                        "message": f"record_get could not collect file assets: {exc}",
-                    }
-                ],
+                "warnings": [warning],
             }
 
     def _record_get_refreshed_media_source_url(
@@ -2958,7 +3578,7 @@ class RecordTools(ToolBase):
         resolved_view: AccessibleViewRoute,
         audit_node_id: int | None,
         candidate: JSONObject,
-    ) -> str | None:
+    ) -> JSONValue | None:
         """Refresh the detail payload once to recover an expired attachment storage signature."""
         if candidate.get("source") not in {"attachment", "image_field", "subtable"}:
             return None
@@ -2974,8 +3594,15 @@ class RecordTools(ToolBase):
                 resolved_view=resolved_view,
                 audit_node_id=audit_node_id,
             )
-        except QingflowApiError:
-            return None
+        except QingflowApiError as exc:
+            return {
+                "source_url": None,
+                "warning": _record_detail_unavailable_context(
+                    "asset_url_refresh",
+                    "record_get could not refresh the record detail before downloading a private asset.",
+                    exc,
+                ),
+            }
         for answer in _record_detail_answers(detail_result):
             if not isinstance(answer, dict) or _coerce_count(answer.get("queId")) != field_id:
                 continue
@@ -3490,6 +4117,7 @@ class RecordTools(ToolBase):
         record_id: Any | None,
         fields: JSONObject | None = None,
         items: list[JSONObject] | None = None,
+        view_id: str | None = None,
         dry_run: bool = False,
         verify_write: bool = True,
         output_profile: str = "normal",
@@ -3510,91 +4138,793 @@ class RecordTools(ToolBase):
                 profile=profile,
                 app_key=app_key,
                 items=normalized_items,
+                view_id=view_id,
                 dry_run=dry_run,
                 verify_write=verify_write,
                 output_profile=normalized_output_profile,
             )
-        if dry_run:
-            raise_tool_error(QingflowApiError.config_error("dry_run currently requires items"))
-        if record_id is None:
-            raise_tool_error(QingflowApiError.config_error("record_id is required"))
-        record_id_int = normalize_positive_id_int(record_id, field_name="record_id")
-        if fields is not None and not isinstance(fields, dict):
-            raise_tool_error(QingflowApiError.config_error("fields must be an object map keyed by field title"))
-        return self._record_update_public_single(
-            profile=profile,
-            app_key=app_key,
-            record_id=record_id_int,
-            fields=cast(JSONObject, fields or {}),
-            verify_write=verify_write,
-            output_profile=normalized_output_profile,
-        )
+        if dry_run:
+            raise_tool_error(QingflowApiError.config_error("dry_run currently requires items"))
+        if record_id is None:
+            raise_tool_error(QingflowApiError.config_error("record_id is required"))
+        record_id_int = normalize_positive_id_int(record_id, field_name="record_id")
+        if fields is not None and not isinstance(fields, dict):
+            raise_tool_error(QingflowApiError.config_error("fields must be an object map keyed by field title"))
+        return self._record_update_public_single(
+            profile=profile,
+            app_key=app_key,
+            record_id=record_id_int,
+            fields=cast(JSONObject, fields or {}),
+            view_id=view_id,
+            verify_write=verify_write,
+            output_profile=normalized_output_profile,
+        )
+
+    def _record_update_public_single(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        record_id: int,
+        fields: JSONObject,
+        view_id: str | None,
+        verify_write: bool,
+        output_profile: str,
+        capture_exceptions: bool = False,
+    ) -> JSONObject:
+        """执行内部辅助逻辑。"""
+        write_state = {"attempted": False}
+        try:
+            return self._record_update_public_single_impl(
+                profile=profile,
+                app_key=app_key,
+                record_id=record_id,
+                fields=fields,
+                view_id=view_id,
+                verify_write=verify_write,
+                output_profile=output_profile,
+                write_attempted_ref=lambda value: write_state.__setitem__("attempted", value),
+            )
+        except (QingflowApiError, RuntimeError) as exc:
+            if not capture_exceptions:
+                raise
+            return self._record_write_exception_response(
+                exc,
+                operation="update",
+                profile=profile,
+                app_key=app_key,
+                record_id=record_id,
+                output_profile=output_profile,
+                human_review=True,
+                write_executed=write_state["attempted"],
+            )
+
+    def _record_update_public_single_impl(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        record_id: int,
+        fields: JSONObject,
+        view_id: str | None,
+        verify_write: bool,
+        output_profile: str,
+        write_attempted_ref: Callable[[bool], None],
+    ) -> JSONObject:
+        """执行内部辅助逻辑。"""
+        preflight_kwargs: dict[str, Any] = {
+            "profile": profile,
+            "app_key": app_key,
+            "record_id": record_id,
+            "fields": fields,
+            "force_refresh_form": False,
+        }
+        if view_id is not None:
+            preflight_kwargs["preferred_view_id"] = view_id
+        raw_preflight = self._preflight_record_update_with_auto_view(**preflight_kwargs)
+        preflight_used_force_refresh = self._record_preflight_used_force_refresh(raw_preflight)
+        preflight_data = cast(JSONObject, raw_preflight.get("data", {}))
+        normalized_payload = self._record_write_normalized_payload(
+            operation="update",
+            record_id=record_id,
+            record_ids=[],
+            normalized_answers=cast(list[JSONObject], preflight_data.get("normalized_answers", [])),
+            submit_type=1,
+            selection=cast(JSONObject | None, preflight_data.get("selection") if isinstance(preflight_data.get("selection"), dict) else None),
+        )
+        if preflight_data.get("blockers"):
+            return self._record_write_blocked_response(
+                raw_preflight,
+                operation="update",
+                normalized_payload=normalized_payload,
+                output_profile=output_profile,
+                human_review=True,
+                target_resource={"type": "record", "app_key": app_key, "record_id": record_id, "record_ids": []},
+            )
+        write_attempted_ref(True)
+        route_apply, tried_routes, route_blocker = self._record_update_apply_with_auto_route(
+            profile=profile,
+            app_key=app_key,
+            record_id=record_id,
+            normalized_answers=cast(list[JSONObject], preflight_data.get("normalized_answers", [])),
+            preflight_data=preflight_data,
+            verify_write=verify_write,
+            force_refresh_form=preflight_used_force_refresh,
+        )
+        if route_blocker is not None:
+            return self._record_update_route_blocked_response(
+                raw_preflight=raw_preflight,
+                operation="update",
+                normalized_payload=normalized_payload,
+                output_profile=output_profile,
+                human_review=True,
+                app_key=app_key,
+                record_id=record_id,
+                tried_routes=tried_routes,
+                route_blocker=route_blocker,
+            )
+        raw_apply = cast(JSONObject, route_apply)
+        return self._record_write_apply_response(
+            raw_apply,
+            operation="update",
+            normalized_payload=normalized_payload,
+            output_profile=output_profile,
+            human_review=True,
+            preflight=raw_preflight,
+        )
+
+    def _record_update_apply_with_auto_route(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        record_id: int,
+        normalized_answers: list[JSONObject],
+        preflight_data: JSONObject,
+        verify_write: bool,
+        force_refresh_form: bool,
+    ) -> tuple[JSONObject | None, list[JSONObject], JSONObject | None]:
+        """Try record update routes in the same order a frontend user would expect."""
+        tried_routes: list[JSONObject] = []
+        admin_attempt = self._record_update_route_attempt(
+            route_type="admin_direct",
+            endpoint_kind="app_apply_update",
+            role=1,
+            reason="try data-manager direct edit first",
+        )
+        try:
+            raw_apply = self.record_update(
+                profile=profile,
+                app_key=app_key,
+                apply_id=record_id,
+                answers=normalized_answers,
+                fields={},
+                role=1,
+                verify_write=verify_write,
+                force_refresh_form=force_refresh_form,
+            )
+            admin_attempt["status"] = "success"
+            raw_apply["update_route"] = self._record_update_route_public(admin_attempt)
+            raw_apply["tried_routes"] = [admin_attempt]
+            return raw_apply, [admin_attempt], None
+        except (QingflowApiError, RuntimeError) as exc:
+            api_error = self._record_update_extract_api_error(exc)
+            if api_error is None or not self._record_update_route_permission_denied(api_error):
+                raise
+            admin_attempt.update(self._record_update_route_error_payload(
+                api_error,
+                status="denied",
+                error_code="ADMIN_UPDATE_PERMISSION_DENIED",
+            ))
+            tried_routes.append(admin_attempt)
+
+        view_route = self._record_update_selected_custom_view_route(preflight_data)
+        if view_route is None:
+            tried_routes.append(
+                self._record_update_route_attempt(
+                    route_type="view_edit",
+                    endpoint_kind="view_apply_update",
+                    status="skipped",
+                    error_code="VIEW_UPDATE_ROUTE_NOT_AVAILABLE",
+                    reason="preflight did not select a single custom view route for this payload",
+                )
+            )
+        else:
+            view_attempt = self._record_update_route_attempt(
+                route_type="view_edit",
+                endpoint_kind="view_apply_update",
+                view_id=cast(str, view_route.get("view_id")),
+                view_key=cast(str, view_route.get("view_key")),
+                view_name=_normalize_optional_text(view_route.get("name")),
+                reason="fallback to frontend custom-view detail edit route",
+            )
+            try:
+                raw_apply = self._record_update_via_custom_view(
+                    profile=profile,
+                    app_key=app_key,
+                    apply_id=record_id,
+                    view_key=cast(str, view_route["view_key"]),
+                    answers=normalized_answers,
+                    verify_write=verify_write,
+                    force_refresh_form=force_refresh_form,
+                )
+                view_attempt["status"] = "success"
+                tried_routes.append(view_attempt)
+                raw_apply["update_route"] = self._record_update_route_public(view_attempt)
+                raw_apply["tried_routes"] = tried_routes
+                return raw_apply, tried_routes, None
+            except (QingflowApiError, RuntimeError) as exc:
+                api_error = self._record_update_extract_api_error(exc)
+                if api_error is None or not self._record_update_route_permission_denied(api_error):
+                    raise
+                view_attempt.update(self._record_update_route_error_payload(
+                    api_error,
+                    status="denied",
+                    error_code="VIEW_UPDATE_PERMISSION_DENIED",
+                ))
+                tried_routes.append(view_attempt)
+
+        task_route = self._record_update_task_save_only_candidate(
+            profile=profile,
+            app_key=app_key,
+            record_id=record_id,
+            normalized_answers=normalized_answers,
+        )
+        task_attempt = cast(JSONObject, task_route.get("attempt") if isinstance(task_route.get("attempt"), dict) else {})
+        if not task_route.get("available"):
+            tried_routes.append(task_attempt or self._record_update_route_attempt(
+                route_type="task_save_only",
+                endpoint_kind="workflow_node_save_only",
+                status="skipped",
+                error_code="TASK_UPDATE_ROUTE_NOT_AVAILABLE",
+                reason="no unique current-user todo task can edit the requested fields",
+            ))
+        else:
+            task_attempt = self._record_update_route_attempt(
+                route_type="task_save_only",
+                endpoint_kind="workflow_node_save_only",
+                role=3,
+                task_id=_normalize_optional_text(task_route.get("task_id")),
+                workflow_node_id=_coerce_count(task_route.get("workflow_node_id")),
+                reason="fallback to current-user workflow todo save-only route",
+            )
+            try:
+                raw_apply = self._record_update_via_task_save_only(
+                    profile=profile,
+                    app_key=app_key,
+                    apply_id=record_id,
+                    workflow_node_id=cast(int, task_route["workflow_node_id"]),
+                    answers=normalized_answers,
+                    verify_write=verify_write,
+                    force_refresh_form=force_refresh_form,
+                )
+                task_attempt["status"] = "success"
+                tried_routes.append(task_attempt)
+                raw_apply["update_route"] = self._record_update_route_public(task_attempt)
+                raw_apply["tried_routes"] = tried_routes
+                return raw_apply, tried_routes, None
+            except (QingflowApiError, RuntimeError) as exc:
+                api_error = self._record_update_extract_api_error(exc)
+                if api_error is None or not self._record_update_route_permission_denied(api_error):
+                    raise
+                task_attempt.update(self._record_update_route_error_payload(
+                    api_error,
+                    status="denied",
+                    error_code="TASK_UPDATE_PERMISSION_DENIED",
+                ))
+                tried_routes.append(task_attempt)
+        return None, tried_routes, {
+            "error_code": "NO_AVAILABLE_UPDATE_ROUTE",
+            "message": "No available record update route could execute this payload for the current user.",
+            "recommended_next_actions": [
+                "If this user should edit the record as a data manager, grant data edit permission and retry record_update.",
+                "If the record is editable from a specific table view in the UI, make sure the target fields are visible and editable in that view.",
+                "If this is workflow work, use task_list -> task_get -> task_action_execute(action='save_only') with the current task context.",
+            ],
+        }
+
+    def _record_update_selected_custom_view_route(self, preflight_data: JSONObject) -> JSONObject | None:
+        selection = preflight_data.get("selection")
+        if not isinstance(selection, dict):
+            return None
+        view = selection.get("view")
+        if not isinstance(view, dict):
+            return None
+        view_id = _normalize_optional_text(view.get("view_id"))
+        if not view_id or not view_id.startswith("custom:"):
+            return None
+        view_key = _normalize_optional_text(view.get("view_key")) or view_id.split(":", 1)[1].strip()
+        if not view_key:
+            return None
+        return {
+            "view_id": view_id,
+            "view_key": view_key,
+            "name": view.get("name"),
+        }
+
+    def _record_update_route_attempt(
+        self,
+        *,
+        route_type: str,
+        endpoint_kind: str,
+        status: str = "attempted",
+        role: int | None = None,
+        task_id: str | None = None,
+        workflow_node_id: int | None = None,
+        view_id: str | None = None,
+        view_key: str | None = None,
+        view_name: str | None = None,
+        error_code: str | None = None,
+        reason: str | None = None,
+    ) -> JSONObject:
+        payload: JSONObject = {
+            "route_type": route_type,
+            "endpoint_kind": endpoint_kind,
+            "status": status,
+        }
+        if role is not None:
+            payload["role"] = role
+        if task_id:
+            payload["task_id"] = task_id
+        if workflow_node_id is not None:
+            payload["workflow_node_id"] = workflow_node_id
+        if view_id:
+            payload["view_id"] = view_id
+        if view_key:
+            payload["view_key"] = view_key
+        if view_name:
+            payload["view_name"] = view_name
+        if error_code:
+            payload["error_code"] = error_code
+        if reason:
+            payload["reason"] = reason
+        return payload
+
+    def _record_update_route_public(self, attempt: JSONObject) -> JSONObject:
+        return _pick_route_payload(attempt)
+
+    def _record_update_route_error_payload(
+        self,
+        exc: QingflowApiError,
+        *,
+        status: str,
+        error_code: str,
+    ) -> JSONObject:
+        payload: JSONObject = {
+            "status": status,
+            "error_code": error_code,
+            "message": exc.message,
+        }
+        if exc.backend_code is not None:
+            payload["backend_code"] = exc.backend_code
+        if exc.http_status is not None:
+            payload["http_status"] = exc.http_status
+        if exc.request_id is not None:
+            payload["request_id"] = exc.request_id
+        return payload
+
+    def _record_update_extract_api_error(self, exc: QingflowApiError | RuntimeError) -> QingflowApiError | None:
+        if isinstance(exc, QingflowApiError):
+            return exc
+        try:
+            payload = json.loads(str(exc))
+        except json.JSONDecodeError:
+            return None
+        if not isinstance(payload, dict):
+            return None
+        return QingflowApiError(
+            category=str(payload.get("category") or "backend"),
+            message=str(payload.get("message") or exc),
+            backend_code=payload.get("backend_code"),
+            request_id=_normalize_optional_text(payload.get("request_id")),
+            http_status=_coerce_count(payload.get("http_status")),
+            details=cast(JSONObject | None, payload.get("details") if isinstance(payload.get("details"), dict) else None),
+        )
+
+    def _record_update_route_permission_denied(self, exc: QingflowApiError) -> bool:
+        if is_auth_like_error(exc):
+            return False
+        if backend_code_int(exc) in {40002, 40027, 40038, 404}:
+            return True
+        if exc.http_status == 404:
+            return True
+        return False
+
+    def _record_update_route_blocked_response(
+        self,
+        *,
+        raw_preflight: JSONObject,
+        operation: str,
+        normalized_payload: JSONObject,
+        output_profile: str,
+        human_review: bool,
+        app_key: str,
+        record_id: int,
+        tried_routes: list[JSONObject],
+        route_blocker: JSONObject,
+    ) -> JSONObject:
+        plan_data = cast(JSONObject, raw_preflight.get("data", {}))
+        validation = cast(JSONObject, plan_data.get("validation", {}))
+        warnings_payload = validation.get("warnings", [])
+        warnings = [{"code": "PREFLIGHT_WARNING", "message": str(item)} for item in warnings_payload] if isinstance(warnings_payload, list) else []
+        warnings.append(
+            {
+                "code": cast(str, route_blocker.get("error_code") or "NO_AVAILABLE_UPDATE_ROUTE"),
+                "message": cast(str, route_blocker.get("message") or "No update route could execute the write."),
+            }
+        )
+        recommended = list(route_blocker.get("recommended_next_actions") or [])
+        response: JSONObject = {
+            "profile": raw_preflight.get("profile"),
+            "ws_id": raw_preflight.get("ws_id"),
+            "ok": False,
+            "status": "blocked",
+            "write_executed": False,
+            "verification_status": "not_requested",
+            "safe_to_retry": True,
+            "request_route": raw_preflight.get("request_route"),
+            "warnings": warnings,
+            "output_profile": output_profile,
+            "update_route": None,
+            "tried_routes": tried_routes,
+            "error_code": route_blocker.get("error_code"),
+            "data": {
+                "action": {"operation": operation, "executed": False},
+                "resource": {"type": "record", "app_key": app_key, "record_id": stringify_backend_id(record_id), "record_ids": []},
+                "verification": None,
+                "normalized_payload": normalized_payload,
+                "blockers": [route_blocker.get("error_code") or "NO_AVAILABLE_UPDATE_ROUTE"],
+                "field_errors": [],
+                "confirmation_requests": [],
+                "resolved_fields": cast(list[JSONObject], plan_data.get("lookup_resolved_fields", [])),
+                "recommended_next_actions": recommended,
+                "human_review": self._record_write_human_review_payload(operation, enabled=human_review),
+                "error": route_blocker,
+                "update_route": None,
+                "tried_routes": tried_routes,
+            },
+        }
+        if output_profile == "verbose":
+            response["data"]["debug"] = {"preflight": plan_data}
+        return response
+
+    def _record_update_task_save_only_candidate(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        record_id: int,
+        normalized_answers: list[JSONObject],
+    ) -> JSONObject:
+        requested_question_ids = self._record_update_answer_question_ids(normalized_answers)
+
+        def unavailable(*, status: str = "skipped", error_code: str, reason: str, extra: JSONObject | None = None) -> JSONObject:
+            attempt = self._record_update_route_attempt(
+                route_type="task_save_only",
+                endpoint_kind="workflow_node_save_only",
+                status=status,
+                error_code=error_code,
+                reason=reason,
+            )
+            if extra:
+                attempt.update(extra)
+            return {"available": False, "attempt": attempt}
+
+        def runner(session_profile, context):
+            matches: list[JSONObject] = []
+            pages_scanned = 0
+            for page_num in range(1, VERIFY_TASK_FALLBACK_MAX_PAGES + 1):
+                try:
+                    task_page = self.backend.request(
+                        "POST",
+                        context,
+                        "/task/dynamic/page",
+                        json_body={
+                            "type": 1,
+                            "processStatus": 1,
+                            "appKey": app_key,
+                            "pageNum": page_num,
+                            "pageSize": VERIFY_TASK_FALLBACK_PAGE_SIZE,
+                        },
+                    )
+                except QingflowApiError as exc:
+                    if not _is_optional_record_auxiliary_lookup_error(exc):
+                        raise
+                    return unavailable(
+                        error_code="TASK_UPDATE_ROUTE_NOT_AVAILABLE",
+                        reason="current-user todo task list is unavailable",
+                        extra=self._record_update_route_error_payload(
+                            exc,
+                            status="skipped",
+                            error_code="TASK_UPDATE_ROUTE_NOT_AVAILABLE",
+                        ),
+                    )
+                pages_scanned += 1
+                rows = task_page.get("list") if isinstance(task_page, dict) else None
+                items = [item for item in rows if isinstance(item, dict)] if isinstance(rows, list) else []
+                for item in items:
+                    candidate_record_id = _coerce_count(item.get("rowRecordId") or item.get("recordId") or item.get("applyId"))
+                    if candidate_record_id == record_id:
+                        matches.append(dict(item))
+                if not _page_has_more(cast(JSONObject, task_page if isinstance(task_page, dict) else {}), page_num, VERIFY_TASK_FALLBACK_PAGE_SIZE, len(items)):
+                    break
+
+            if not matches:
+                return unavailable(
+                    error_code="TASK_UPDATE_ROUTE_NOT_AVAILABLE",
+                    reason="no current-user todo task was found for this record",
+                    extra={"pages_scanned": pages_scanned},
+                )
+            if len(matches) > 1:
+                return unavailable(
+                    error_code="TASK_UPDATE_ROUTE_AMBIGUOUS",
+                    reason="multiple current-user todo tasks match this record; refusing to guess workflow context",
+                    extra={"matched_tasks": [self._record_update_compact_task_match(item) for item in matches[:5]]},
+                )
+
+            task = matches[0]
+            workflow_node_id = _coerce_count(task.get("nodeId") or task.get("auditNodeId"))
+            if workflow_node_id is None:
+                return unavailable(
+                    error_code="TASK_UPDATE_ROUTE_NOT_AVAILABLE",
+                    reason="matched todo task does not expose a workflow node id",
+                    extra={"matched_task": self._record_update_compact_task_match(task)},
+                )
+            try:
+                editable_payload = self.backend.request(
+                    "GET",
+                    context,
+                    f"/app/{app_key}/auditNode/{workflow_node_id}/editableQueIds",
+                )
+            except QingflowApiError as exc:
+                if not _is_optional_record_auxiliary_lookup_error(exc):
+                    raise
+                return unavailable(
+                    error_code="TASK_EDITABLE_FIELDS_UNAVAILABLE",
+                    reason="workflow node editable field list is unavailable; record_update will not guess task editability",
+                    extra=self._record_update_route_error_payload(
+                        exc,
+                        status="skipped",
+                        error_code="TASK_EDITABLE_FIELDS_UNAVAILABLE",
+                    ),
+                )
+            editable_question_ids = self._record_update_extract_question_ids(editable_payload)
+            if not editable_question_ids:
+                return unavailable(
+                    error_code="TASK_UPDATE_ROUTE_NOT_AVAILABLE",
+                    reason="workflow node editable field list is empty",
+                    extra={
+                        "task_id": stringify_backend_id(task.get("id") or task.get("taskId")),
+                        "workflow_node_id": workflow_node_id,
+                    },
+                )
+            effective_editable_question_ids = self._record_update_effective_task_editable_ids(
+                editable_question_ids,
+                normalized_answers=normalized_answers,
+            )
+            non_editable = sorted(
+                question_id for question_id in requested_question_ids
+                if question_id not in effective_editable_question_ids
+            )
+            if non_editable:
+                return unavailable(
+                    status="denied",
+                    error_code="TASK_UPDATE_FIELD_NOT_EDITABLE",
+                    reason="one or more requested fields are not editable on the current workflow node",
+                    extra={
+                        "task_id": stringify_backend_id(task.get("id") or task.get("taskId")),
+                        "workflow_node_id": workflow_node_id,
+                        "non_editable_question_ids": non_editable,
+                    },
+                )
+            return {
+                "available": True,
+                "task_id": stringify_backend_id(task.get("id") or task.get("taskId")),
+                "workflow_node_id": workflow_node_id,
+                "matched_task": self._record_update_compact_task_match(task),
+                "editable_question_ids": sorted(editable_question_ids),
+                "effective_editable_question_ids": sorted(effective_editable_question_ids),
+            }
+
+        return self._run_record_tool(profile, runner)
+
+    def _record_update_compact_task_match(self, item: JSONObject) -> JSONObject:
+        return {
+            key: value
+            for key, value in {
+                "task_id": stringify_backend_id(item.get("id") or item.get("taskId")),
+                "record_id": stringify_backend_id(item.get("rowRecordId") or item.get("recordId") or item.get("applyId")),
+                "workflow_node_id": item.get("nodeId") or item.get("auditNodeId"),
+                "workflow_node_name": item.get("nodeName") or item.get("auditNodeName"),
+            }.items()
+            if value not in (None, "", [], {})
+        }
+
+    def _record_update_answer_question_ids(self, answers: list[JSONObject]) -> set[int]:
+        question_ids: set[int] = set()
+        for answer in answers:
+            if not isinstance(answer, dict):
+                continue
+            que_id = _coerce_count(answer.get("queId"))
+            if que_id is not None and que_id > 0:
+                question_ids.add(que_id)
+            table_values = answer.get("tableValues")
+            if not isinstance(table_values, list):
+                continue
+            for row in table_values:
+                if not isinstance(row, list):
+                    continue
+                for cell in row:
+                    if not isinstance(cell, dict):
+                        continue
+                    cell_que_id = _coerce_count(cell.get("queId"))
+                    if cell_que_id is not None and cell_que_id > 0:
+                        question_ids.add(cell_que_id)
+        return question_ids
+
+    def _record_update_extract_question_ids(self, payload: JSONValue) -> set[int]:
+        candidates: list[Any] = []
+        if isinstance(payload, list):
+            candidates = payload
+        elif isinstance(payload, dict):
+            for key in ("editableQueIds", "editableQuestionIds", "queIds", "questionIds", "ids", "list", "result"):
+                value = payload.get(key)
+                if isinstance(value, list):
+                    candidates = value
+                    break
+        question_ids: set[int] = set()
+        for item in candidates:
+            value: Any = item
+            if isinstance(item, dict):
+                value = item.get("queId", item.get("questionId", item.get("id")))
+            que_id = _coerce_count(value)
+            if que_id is not None and que_id > 0:
+                question_ids.add(que_id)
+        return question_ids
+
+    def _record_update_effective_task_editable_ids(
+        self,
+        editable_question_ids: set[int],
+        *,
+        normalized_answers: list[JSONObject],
+    ) -> set[int]:
+        effective_editable_ids = set(editable_question_ids)
+        for answer in normalized_answers:
+            if not isinstance(answer, dict):
+                continue
+            parent_que_id = _coerce_count(answer.get("queId"))
+            if parent_que_id is None or parent_que_id <= 0:
+                continue
+            table_values = answer.get("tableValues")
+            if not isinstance(table_values, list) or not table_values:
+                continue
+            row_subfield_ids: set[int] = set()
+            for row in table_values:
+                if not isinstance(row, list):
+                    continue
+                for cell in row:
+                    if not isinstance(cell, dict):
+                        continue
+                    cell_que_id = _coerce_count(cell.get("queId"))
+                    if cell_que_id is not None and cell_que_id > 0:
+                        row_subfield_ids.add(cell_que_id)
+            if row_subfield_ids & editable_question_ids:
+                effective_editable_ids.add(parent_que_id)
+        return effective_editable_ids
+
+    def _record_update_via_custom_view(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        apply_id: int,
+        view_key: str,
+        answers: list[JSONObject],
+        verify_write: bool,
+        force_refresh_form: bool,
+    ) -> JSONObject:
+        normalized_apply_id = self._validate_app_and_record(app_key, apply_id)
+        normalized_view_key = view_key.strip()
+        if not normalized_view_key:
+            raise_tool_error(QingflowApiError.config_error("view_key is required for custom view update"))
+
+        def runner(session_profile, context):
+            index = self._get_view_field_index(profile, context, normalized_view_key, force_refresh=force_refresh_form) if verify_write else None
+            normalized_answers = [dict(item) for item in answers if isinstance(item, dict)]
+            self._validate_record_write(app_key, normalized_answers, apply_id=normalized_apply_id)
+            result = self.backend.request(
+                "POST",
+                context,
+                f"/view/{normalized_view_key}/apply/{normalized_apply_id}",
+                json_body={"answers": normalized_answers},
+            )
+            verification = self._verify_record_write_result(
+                context,
+                app_key=app_key,
+                apply_id=normalized_apply_id,
+                normalized_answers=normalized_answers,
+                index=cast(FieldIndex, index),
+                verify_view_key=normalized_view_key,
+            ) if verify_write and index is not None else None
+            verified = True if verification is None else bool(verification.get("verified"))
+            return self._attach_human_review_notice(
+                {
+                    "profile": profile,
+                    "ws_id": session_profile.selected_ws_id,
+                    "request_route": self._request_route_payload(context),
+                    "app_key": app_key,
+                    "apply_id": normalized_apply_id,
+                    "record_id": normalized_apply_id,
+                    "result": result,
+                    "normalized_answers": normalized_answers,
+                    "status": "completed" if verified else "verification_failed",
+                    "ok": True,
+                    "verify_write": verify_write,
+                    "write_verified": verified if verify_write else None,
+                    "verification": verification,
+                    "resource": _record_resource_payload(normalized_apply_id),
+                },
+                operation="update",
+                target="record data",
+            )
 
-    def _record_update_public_single(
+        return self._run_record_tool(profile, runner)
+
+    def _record_update_via_task_save_only(
         self,
         *,
         profile: str,
         app_key: str,
-        record_id: int,
-        fields: JSONObject,
+        apply_id: int,
+        workflow_node_id: int,
+        answers: list[JSONObject],
         verify_write: bool,
-        output_profile: str,
+        force_refresh_form: bool,
     ) -> JSONObject:
-        """执行内部辅助逻辑。"""
-        raw_preflight = self._preflight_record_update_with_auto_view(
-            profile=profile,
-            app_key=app_key,
-            record_id=record_id,
-            fields=fields,
-            force_refresh_form=False,
-        )
-        preflight_used_force_refresh = self._record_preflight_used_force_refresh(raw_preflight)
-        preflight_data = cast(JSONObject, raw_preflight.get("data", {}))
-        normalized_payload = self._record_write_normalized_payload(
-            operation="update",
-            record_id=record_id,
-            record_ids=[],
-            normalized_answers=cast(list[JSONObject], preflight_data.get("normalized_answers", [])),
-            submit_type=1,
-            selection=cast(JSONObject | None, preflight_data.get("selection") if isinstance(preflight_data.get("selection"), dict) else None),
-        )
-        if preflight_data.get("blockers"):
-            return self._record_write_blocked_response(
-                raw_preflight,
-                operation="update",
-                normalized_payload=normalized_payload,
-                output_profile=output_profile,
-                human_review=True,
-                target_resource={"type": "record", "app_key": app_key, "record_id": record_id, "record_ids": []},
+        normalized_apply_id = self._validate_app_and_record(app_key, apply_id)
+        if workflow_node_id <= 0:
+            raise_tool_error(QingflowApiError.config_error("workflow_node_id must be positive for task save-only update"))
+
+        def runner(session_profile, context):
+            index = self._get_field_index(profile, context, app_key, force_refresh=force_refresh_form) if verify_write else None
+            normalized_answers = [dict(item) for item in answers if isinstance(item, dict)]
+            self._validate_record_write(app_key, normalized_answers, apply_id=normalized_apply_id)
+            result = self.backend.request(
+                "POST",
+                context,
+                f"/app/{app_key}/apply/{normalized_apply_id}",
+                json_body={"role": 3, "auditNodeId": workflow_node_id, "answers": normalized_answers},
             )
-        try:
-            raw_apply = self.record_update(
-                profile=profile,
+            verification = self._verify_record_write_result(
+                context,
                 app_key=app_key,
-                apply_id=record_id,
-                answers=cast(list[JSONObject], preflight_data.get("normalized_answers", [])),
-                fields={},
-                role=1,
-                verify_write=verify_write,
-                force_refresh_form=preflight_used_force_refresh,
-            )
-        except QingflowApiError as exc:
-            self._raise_record_write_permission_error(
-                exc,
+                apply_id=normalized_apply_id,
+                normalized_answers=normalized_answers,
+                index=cast(FieldIndex, index),
+            ) if verify_write and index is not None else None
+            verified = True if verification is None else bool(verification.get("verified"))
+            return self._attach_human_review_notice(
+                {
+                    "profile": profile,
+                    "ws_id": session_profile.selected_ws_id,
+                    "request_route": self._request_route_payload(context),
+                    "app_key": app_key,
+                    "apply_id": normalized_apply_id,
+                    "record_id": normalized_apply_id,
+                    "result": result,
+                    "normalized_answers": normalized_answers,
+                    "status": "completed" if verified else "verification_failed",
+                    "ok": True,
+                    "verify_write": verify_write,
+                    "write_verified": verified if verify_write else None,
+                    "verification": verification,
+                    "resource": _record_resource_payload(normalized_apply_id),
+                },
                 operation="update",
-                app_key=app_key,
-                record_id=record_id,
-                selection=cast(JSONObject | None, preflight_data.get("selection") if isinstance(preflight_data.get("selection"), dict) else None),
+                target="record data",
             )
-            raise
-        return self._record_write_apply_response(
-            raw_apply,
-            operation="update",
-            normalized_payload=normalized_payload,
-            output_profile=output_profile,
-            human_review=True,
-            preflight=raw_preflight,
-        )
+
+        return self._run_record_tool(profile, runner)
 
     def _record_update_public_batch(
         self,
@@ -3602,6 +4932,7 @@ class RecordTools(ToolBase):
         profile: str,
         app_key: str,
         items: list[JSONObject],
+        view_id: str | None,
         dry_run: bool,
         verify_write: bool,
         output_profile: str,
@@ -3613,6 +4944,7 @@ class RecordTools(ToolBase):
                 app_key=app_key,
                 record_id=cast(int, item["record_id"]),
                 fields=cast(JSONObject, item["fields"]),
+                view_id=view_id,
                 output_profile=output_profile,
             )
             for item in items
@@ -3641,8 +4973,10 @@ class RecordTools(ToolBase):
                         app_key=app_key,
                         record_id=record_id,
                         fields=fields,
+                        view_id=view_id,
                         verify_write=verify_write,
                         output_profile=output_profile,
+                        capture_exceptions=True,
                     )
                 )
             except (QingflowApiError, RuntimeError) as exc:
@@ -3673,16 +5007,20 @@ class RecordTools(ToolBase):
         app_key: str,
         record_id: int,
         fields: JSONObject,
+        view_id: str | None,
         output_profile: str,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        raw_preflight = self._preflight_record_update_with_auto_view(
-            profile=profile,
-            app_key=app_key,
-            record_id=record_id,
-            fields=fields,
-            force_refresh_form=False,
-        )
+        preflight_kwargs: dict[str, Any] = {
+            "profile": profile,
+            "app_key": app_key,
+            "record_id": record_id,
+            "fields": fields,
+            "force_refresh_form": False,
+        }
+        if view_id is not None:
+            preflight_kwargs["preferred_view_id"] = view_id
+        raw_preflight = self._preflight_record_update_with_auto_view(**preflight_kwargs)
         preflight_data = cast(JSONObject, raw_preflight.get("data", {}))
         normalized_payload = self._record_write_normalized_payload(
             operation="update",
@@ -3888,11 +5226,20 @@ class RecordTools(ToolBase):
         item: JSONObject = {
             "resource": data.get("resource"),
             "status": response.get("status"),
+            "write_executed": bool(response.get("write_executed")),
+            "safe_to_retry": bool(response.get("safe_to_retry", True)),
+            "verification_status": response.get("verification_status", "not_requested"),
             "verification": data.get("verification"),
             "field_errors": cast(list[JSONObject], data.get("field_errors", [])),
             "confirmation_requests": cast(list[JSONObject], data.get("confirmation_requests", [])),
             "resolved_fields": cast(list[JSONObject], data.get("resolved_fields", [])),
         }
+        update_route = response.get("update_route")
+        if isinstance(update_route, dict):
+            item["update_route"] = update_route
+        tried_routes = response.get("tried_routes")
+        if isinstance(tried_routes, list) and (output_profile == "verbose" or response.get("status") != "success"):
+            item["tried_routes"] = tried_routes
         blockers = data.get("blockers")
         if isinstance(blockers, list) and blockers:
             item["blockers"] = blockers
@@ -3913,6 +5260,7 @@ class RecordTools(ToolBase):
         app_key: str,
         record_id: int,
         fields: JSONObject,
+        preferred_view_id: str | None = None,
         force_refresh_form: bool,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
@@ -3920,6 +5268,25 @@ class RecordTools(ToolBase):
             request_route = self._request_route_payload(context)
             def build_once(*, effective_force_refresh: bool) -> JSONObject:
                 candidate_routes = self._candidate_update_views(profile, context, app_key)
+                normalized_preferred_view_id = _normalize_optional_text(preferred_view_id)
+                if normalized_preferred_view_id:
+                    preferred_route = next(
+                        (
+                            route
+                            for route in candidate_routes
+                            if route.view_id == normalized_preferred_view_id
+                        ),
+                        None,
+                    )
+                    if preferred_route is None:
+                        raise_tool_error(
+                            QingflowApiError.config_error(
+                                f"view_id '{normalized_preferred_view_id}' is not an accessible update candidate"
+                        )
+                    )
+                    candidate_routes = [preferred_route]
+                else:
+                    candidate_routes = _prefer_custom_update_routes(candidate_routes)
                 probes = self._probe_candidate_record_contexts(
                     context,
                     app_key=app_key,
@@ -4133,41 +5500,24 @@ class RecordTools(ToolBase):
                         "data": first_confirmation_plan,
                     }
 
-                union_plan = self._build_record_update_union_preflight(
-                    profile=profile,
-                    context=context,
-                    app_key=app_key,
-                    record_id=record_id,
-                    fields=fields,
-                    current_answers=matched_answers_for_union or [],
-                    matched_routes=matched_routes,
-                    force_refresh_form=effective_force_refresh,
-                )
-                if union_plan is not None:
-                    validation = union_plan.get("validation")
-                    if isinstance(validation, dict):
-                        warnings = validation.get("warnings")
-                        if not isinstance(warnings, list):
-                            warnings = []
-                            validation["warnings"] = warnings
-                        for message in fallback_warning_messages:
-                            if message not in warnings:
-                                warnings.append(message)
-                    union_plan["view_probe_summary"] = probe_summary
-                    union_plan["record_context_probe"] = probe_summary
+                if normalized_preferred_view_id and first_blocked_plan is not None:
+                    first_blocked_plan["view_probe_summary"] = probe_summary
+                    first_blocked_plan["record_context_probe"] = probe_summary
                     return {
                         "profile": profile,
                         "ws_id": session_profile.selected_ws_id,
                         "ok": True,
                         "request_route": request_route,
-                        "data": union_plan,
+                        "data": first_blocked_plan,
                     }
 
                 blocked_data = self._build_auto_view_blocked_preflight_data(
                     app_key=app_key,
                     record_id=record_id,
                     blockers=["NO_SINGLE_VIEW_CAN_UPDATE_ALL_FIELDS"],
-                    warnings=[],
+                    warnings=[
+                        "record_update requires one executable frontend route for the full payload; it does not merge writable fields across multiple views."
+                    ],
                     recommended_next_actions=[
                         "Call record_update_schema_get first to inspect the overall writable field set for this record.",
                         "Reduce the update payload until all requested fields fit inside one matched accessible view.",
@@ -4214,6 +5564,7 @@ class RecordTools(ToolBase):
         union_writable_field_ids: set[int] = set()
         union_visible_question_ids: set[int] = set()
         matched_view_payloads: list[JSONObject] = []
+        union_index: FieldIndex | None = None
 
         for candidate in matched_routes:
             browse_scope = self._build_browse_write_scope(
@@ -4223,11 +5574,13 @@ class RecordTools(ToolBase):
                 candidate,
                 force_refresh=force_refresh_form,
             )
+            browse_index = cast(FieldIndex, browse_scope["index"])
+            union_index = browse_index if union_index is None else _merge_field_indexes(union_index, browse_index)
             union_writable_field_ids.update(cast(set[int], browse_scope["writable_field_ids"]))
             union_visible_question_ids.update(cast(set[int], browse_scope["visible_question_ids"]))
             matched_view_payloads.append(_accessible_view_payload(candidate))
 
-        if not union_writable_field_ids and not union_visible_question_ids:
+        if union_index is None or (not union_writable_field_ids and not union_visible_question_ids):
             return None
 
         plan_data = self._build_record_write_preflight(
@@ -4244,10 +5597,9 @@ class RecordTools(ToolBase):
             view_key=None,
             view_name=None,
             existing_answers_override=current_answers,
+            field_index_override=union_index,
         )
 
-        schema = self._get_form_schema(profile, context, app_key, force_refresh=force_refresh_form)
-        app_index = _build_applicant_top_level_field_index(schema)
         validation = cast(JSONObject, plan_data.get("validation", {}))
         invalid_fields = cast(list[JSONObject], validation.get("invalid_fields", []))
         missing_required_fields = cast(list[JSONObject], validation.get("missing_required_fields", []))
@@ -4258,12 +5610,21 @@ class RecordTools(ToolBase):
             invalid_fields.extend(
                 self._validate_view_scoped_subtable_answers(
                     normalized_answers=cast(list[JSONObject], plan_data.get("normalized_answers", [])),
-                    full_index=app_index,
-                    selector_index=app_index,
+                    full_index=union_index,
+                    selector_index=union_index,
                     visible_question_ids=union_visible_question_ids,
                 )
             )
 
+        readonly_or_system_fields = [
+            item
+            for item in readonly_or_system_fields
+            if not (
+                isinstance(item, dict)
+                and (que_id := _coerce_count(item.get("que_id"))) is not None
+                and que_id in union_writable_field_ids
+            )
+        ]
         existing_readonly_ids = {
             str(_coerce_count(item.get("que_id")))
             for item in readonly_or_system_fields
@@ -4427,7 +5788,13 @@ class RecordTools(ToolBase):
                     view_type=None,
                 )
             )
-        for item in self._get_view_list(profile, context, app_key):
+        try:
+            view_items = self._get_view_list(profile, context, app_key)
+        except QingflowApiError as exc:
+            if not _is_record_permission_denied_error(exc):
+                raise
+            view_items = []
+        for item in view_items:
             if not isinstance(item, dict):
                 continue
             view_key = _normalize_optional_text(item.get("viewKey"))
@@ -4484,7 +5851,9 @@ class RecordTools(ToolBase):
         return payload
 
     def _is_record_context_route_miss(self, error: QingflowApiError) -> bool:
-        if error.backend_code in {40002, 40023, 40027, 40038, 404}:
+        if is_auth_like_error(error):
+            return False
+        if backend_code_int(error) in {40002, 40023, 40027, 40038, 404}:
             return True
         if error.http_status == 404:
             return True
@@ -4514,11 +5883,12 @@ class RecordTools(ToolBase):
             used_list_type = None
         else:
             used_list_type = resolved_view.list_type if resolved_view.list_type is not None else DEFAULT_RECORD_LIST_TYPE
+            role = _record_detail_role_for_list_type(used_list_type)
             record = self.backend.request(
                 "GET",
                 context,
                 f"/app/{app_key}/apply/{apply_id}",
-                params={"role": 1, "listType": used_list_type},
+                params={"role": role, "listType": used_list_type},
             )
         answers = record.get("answers") if isinstance(record, dict) else None
         normalized_answers = [item for item in answers if isinstance(item, dict)] if isinstance(answers, list) else []
@@ -4548,6 +5918,8 @@ class RecordTools(ToolBase):
                 error_payload=None,
             )
         except QingflowApiError as exc:
+            if not self._is_record_context_route_miss(exc):
+                raise
             return RecordContextRouteProbe(
                 route=resolved_view,
                 answer_list=None,
@@ -4619,7 +5991,7 @@ class RecordTools(ToolBase):
         ]
 
     def _looks_like_generic_record_update_backend_failure(self, exc: QingflowApiError) -> bool:
-        if exc.backend_code == 500:
+        if backend_code_int(exc) == 500:
             return True
         if exc.http_status is not None and exc.http_status >= 500:
             return True
@@ -4744,12 +6116,15 @@ class RecordTools(ToolBase):
         app_key: str,
         record_id: Any | None = None,
         record_ids: list[Any] | None = None,
+        view_id: str | None = None,
+        list_type: int | None = None,
         output_profile: str = "normal",
     ) -> JSONObject:
         """执行记录相关逻辑。"""
         normalized_output_profile = self._normalize_public_output_profile(output_profile)
         if not app_key:
             raise_tool_error(QingflowApiError.config_error("app_key is required"))
+        delete_list_type = self._resolve_record_delete_list_type(view_id=view_id, list_type=list_type)
         normalized_record_ids: list[int] = []
         for index, item in enumerate(record_ids or []):
             normalized_record_ids.append(normalize_positive_id_int(item, field_name=f"record_ids[{index}]"))
@@ -4769,21 +6144,72 @@ class RecordTools(ToolBase):
             "record_ids": [stringify_backend_id(item) for item in delete_ids],
             "answers": [],
             "submit_type": 1,
+            "selection": {"view_id": view_id, "list_type": delete_list_type},
         }
         return self._record_delete_public_batch(
             profile=profile,
             app_key=app_key,
             delete_ids=delete_ids,
+            list_type=delete_list_type,
             normalized_payload=normalized_payload,
             output_profile=normalized_output_profile,
         )
 
+    def _resolve_record_delete_list_type(self, *, view_id: str | None, list_type: int | None) -> int:
+        normalized_view_id = _normalize_optional_text(view_id)
+        if normalized_view_id:
+            if normalized_view_id.startswith("custom:"):
+                raise_tool_error(
+                    QingflowApiError.config_error(
+                        "record_delete does not support custom view deletion; the backend delete route accepts system listType only",
+                        details={
+                            "error_code": "RECORD_DELETE_CUSTOM_VIEW_UNSUPPORTED",
+                            "view_id": normalized_view_id,
+                            "fix_hint": (
+                                "Use a system view_id from app_get.accessible_views, or resolve target record_ids with "
+                                "record list/get first and retry delete without a custom view selector."
+                            ),
+                        },
+                    )
+                )
+            if not normalized_view_id.startswith("system:"):
+                raise_tool_error(QingflowApiError.config_error("view_id must start with system: or custom:"))
+            mapped_list_type = SYSTEM_VIEW_ID_TO_LIST_TYPE.get(normalized_view_id)
+            if mapped_list_type is None:
+                raise_tool_error(QingflowApiError.config_error(f"unsupported view_id '{normalized_view_id}'"))
+            return mapped_list_type
+        if list_type is not None:
+            normalized_list_type = int(list_type)
+            if normalized_list_type not in SYSTEM_VIEW_LIST_TYPES:
+                raise_tool_error(
+                    QingflowApiError.config_error(
+                        "record_delete list_type must map to a supported system view",
+                        details={
+                            "error_code": "RECORD_DELETE_SYSTEM_VIEW_REQUIRED",
+                            "list_type": normalized_list_type,
+                            "supported_list_types": sorted(SYSTEM_VIEW_LIST_TYPES),
+                            "fix_hint": "Pass a system view_id from app_get.accessible_views instead of an arbitrary list_type.",
+                        },
+                    )
+                )
+            return normalized_list_type
+        raise_tool_error(
+            QingflowApiError.config_error(
+                "record_delete requires a system view_id or list_type; deleting without frontend list context is ambiguous",
+                details={
+                    "error_code": "RECORD_DELETE_VIEW_REQUIRED",
+                    "fix_hint": "Pass a system view_id from app_get.accessible_views, for example --view-id system:all. If the target came from a custom view, first confirm the record_id, then choose an accessible system view for deletion.",
+                },
+            )
+        )
+
     def _record_delete_public_batch(
         self,
         *,
         profile: str,
         app_key: str,
         delete_ids: list[int],
+        list_type: int,
         normalized_payload: JSONObject,
         output_profile: str,
     ) -> JSONObject:
@@ -4793,7 +6219,7 @@ class RecordTools(ToolBase):
         for index, delete_id in enumerate(delete_ids):
             record_id_text = stringify_backend_id(delete_id)
             try:
-                raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=[delete_id])
+                raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=[delete_id], list_type=list_type)
                 request_route = cast(JSONObject, raw_apply.get("request_route")) if isinstance(raw_apply.get("request_route"), dict) else request_route
                 ws_id = raw_apply.get("ws_id", ws_id)
                 single_payload = {
@@ -4802,6 +6228,7 @@ class RecordTools(ToolBase):
                     "record_ids": [record_id_text],
                     "answers": [],
                     "submit_type": 1,
+                    "selection": normalized_payload.get("selection"),
                 }
                 single_response = self._record_write_apply_response(
                     raw_apply,
@@ -5084,12 +6511,13 @@ class RecordTools(ToolBase):
                 preflight=raw_preflight,
             )
 
-        if uses_view_scope:
+        if view_key is not None or view_name is not None:
             raise_tool_error(
                 QingflowApiError.config_error(
-                    "delete does not accept view selectors yet; resolve target record_ids from the selected view first, then call delete by record_id/record_ids"
+                    "delete does not support custom view selectors; use a system view_id/list_type or resolve target record_ids first"
                 )
             )
+        delete_list_type = self._resolve_record_delete_list_type(view_id=view_id, list_type=list_type)
         if normalized_values or normalized_set:
             raise_tool_error(QingflowApiError.config_error("delete must not include values or set"))
         delete_ids = normalized_record_ids or ([record_id] if record_id is not None and record_id > 0 else [])
@@ -5101,8 +6529,9 @@ class RecordTools(ToolBase):
             "record_ids": delete_ids,
             "answers": [],
             "submit_type": submit_type_value,
+            "selection": {"view_id": view_id, "list_type": delete_list_type},
         }
-        raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=delete_ids)
+        raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=delete_ids, list_type=delete_list_type)
         return self._record_write_apply_response(
             raw_apply,
             operation="delete",
@@ -5252,7 +6681,9 @@ class RecordTools(ToolBase):
                     or _normalize_optional_text(payload.get("appName"))
                     or _normalize_optional_text(payload.get("appTitle"))
                 )
-        except QingflowApiError:
+        except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             name = None
         self._app_name_cache[cache_key] = name
         return name
@@ -5406,7 +6837,9 @@ class RecordTools(ToolBase):
         try:
             result = self.backend.request("GET", context, "/data/baseInfo", params={"queId": field.que_id})
             payload = result if isinstance(result, dict) else None
-        except QingflowApiError:
+        except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             payload = None
         self._relation_base_info_cache[cache_key] = payload or {}
         return payload
@@ -5679,6 +7112,26 @@ class RecordTools(ToolBase):
             or bool(fields)
         )
 
+    def _member_candidate_static_preview_should_use_backend(self, field: FormField) -> bool:
+        """Return true when the frontend field-scope endpoint is safer than directory expansion."""
+        scope = field.member_select_scope if isinstance(field.member_select_scope, dict) else {}
+        if field.member_select_scope_type != 2:
+            return False
+        return bool(
+            _scope_has_dynamic_or_external(scope)
+            or list(scope.get("depart") or [])
+            or list(scope.get("role") or [])
+        )
+
+    def _department_candidate_static_preview_should_use_backend(self, field: FormField) -> bool:
+        """Return true when static preview would otherwise need ContactAuth-only directory APIs."""
+        scope = field.dept_select_scope if isinstance(field.dept_select_scope, dict) else {}
+        if field.dept_select_scope_type != 2:
+            return False
+        if _scope_has_dynamic_or_external(scope):
+            return True
+        return bool(_normalize_bool(scope.get("includeSubDeparts")) or not list(scope.get("depart") or []))
+
     def _build_candidate_lookup_state(
         self,
         profile: str,
@@ -5697,7 +7150,9 @@ class RecordTools(ToolBase):
         if apply_id is not None:
             try:
                 base_answers = self._load_record_answers_for_preflight(context, app_key=app_key, apply_id=apply_id)
-            except QingflowApiError:
+            except QingflowApiError as exc:
+                if not _is_optional_record_auxiliary_lookup_error(exc):
+                    raise
                 context_complete = False
         state = LookupResolutionState(
             operation="update" if apply_id is not None else "insert",
@@ -6187,15 +7642,16 @@ class RecordTools(ToolBase):
                 )
                 if configured_candidate is not None:
                     self._merge_department_candidate(merged, configured_candidate)
-                for dept in self._list_departments_by_scope(context, dept_id=dept_id, include_sub_departments=include_sub):
-                    normalized = _normalize_candidate_department(
-                        dept,
-                        source_kind="department",
-                        source_id=dept_id,
-                        source_value=dept_name,
-                    )
-                    if normalized is not None:
-                        self._merge_department_candidate(merged, normalized)
+                if include_sub:
+                    for dept in self._list_departments_by_scope(context, dept_id=dept_id, include_sub_departments=True):
+                        normalized = _normalize_candidate_department(
+                            dept,
+                            source_kind="department",
+                            source_id=dept_id,
+                            source_value=dept_name,
+                        )
+                        if normalized is not None:
+                            self._merge_department_candidate(merged, normalized)
         filtered = _filter_department_candidates(list(merged.values()), keyword)
         filtered.sort(key=lambda item: (_normalize_optional_text(item.get("value")) or "", _coerce_count(item.get("id")) or 0))
         return filtered
@@ -7336,22 +8792,10 @@ class RecordTools(ToolBase):
         field_index_override: FieldIndex | None = None,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        schema = self._get_form_schema(profile, context, app_key, force_refresh=force_refresh_form)
-        base_index = field_index_override or _build_applicant_top_level_field_index(schema)
-        question_relations = _collect_question_relations(schema)
-        runtime_linked_field_ids = _collect_linked_required_field_ids(question_relations)
-        runtime_linked_field_ids.update(_collect_option_linked_field_ids(base_index))
-        index = base_index
-        if operation == "create" and field_index_override is None:
-            linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
-                schema,
-                linked_field_ids=runtime_linked_field_ids,
-            )
-            index = _merge_field_indexes(base_index, linked_hidden_index)
         normalized_fields = fields or {}
         normalized_answers_input = answers or []
         resolved_view: AccessibleViewRoute | None = None
-        selector_index = index
+        selector_index: FieldIndex | None = field_index_override
         browse_writable_field_ids: set[int] = set()
         visible_question_ids: set[int] = set()
         if any(item is not None for item in (view_id, list_type, view_key, view_name)):
@@ -7377,6 +8821,31 @@ class RecordTools(ToolBase):
             visible_question_ids = cast(set[int], browse_scope["visible_question_ids"])
         else:
             compatibility_warnings = []
+        if field_index_override is not None:
+            base_index = field_index_override
+            question_relations: list[JSONObject] = []
+            runtime_linked_field_ids: set[int] = set()
+            index = base_index
+        elif operation == "update" and resolved_view is not None:
+            base_index = cast(FieldIndex, selector_index)
+            question_relations = []
+            runtime_linked_field_ids = set()
+            index = base_index
+        else:
+            schema = self._get_form_schema(profile, context, app_key, force_refresh=force_refresh_form)
+            base_index = _build_applicant_top_level_field_index(schema)
+            question_relations = _collect_question_relations(schema)
+            runtime_linked_field_ids = _collect_linked_required_field_ids(question_relations)
+            runtime_linked_field_ids.update(_collect_option_linked_field_ids(base_index))
+            index = base_index
+            if operation == "create":
+                linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
+                    schema,
+                    linked_field_ids=runtime_linked_field_ids,
+                )
+                index = _merge_field_indexes(base_index, linked_hidden_index)
+        if selector_index is None:
+            selector_index = index
         resolved_fields = self._collect_write_plan_field_refs(fields=normalized_fields, answers=normalized_answers_input, index=selector_index)
         support_matrix = _summarize_write_support(resolved_fields)
         invalid_fields: list[JSONObject] = []
@@ -7420,7 +8889,9 @@ class RecordTools(ToolBase):
                             apply_id=apply_id,
                         )
                     existing_answers_loaded = True
-                except QingflowApiError:
+                except QingflowApiError as exc:
+                    if not _is_optional_record_auxiliary_lookup_error(exc):
+                        raise
                     validation_warnings.append(
                         "update preflight could not load the current record; required-field completeness and dynamic lookup context were not fully revalidated."
                     )
@@ -8009,7 +9480,7 @@ class RecordTools(ToolBase):
                     break
                 except QingflowApiError as exc:
                     last_error = exc
-                    if exc.backend_code == 40002:
+                    if _is_record_permission_denied_error(exc):
                         continue
                     raise
             if result is None:
@@ -8112,7 +9583,21 @@ class RecordTools(ToolBase):
         normalized_apply_id = self._validate_app_and_record(app_key, apply_id)
 
         def runner(session_profile, context):
-            index = self._get_field_index(profile, context, app_key, force_refresh=force_refresh_form) if verify_write else None
+            needs_index = verify_write or bool(fields) or _answers_need_resolution(answers or [])
+            update_index = None
+            if needs_index:
+                update_index = (
+                    self._get_system_browse_field_index(
+                        profile,
+                        context,
+                        app_key,
+                        list_type=DEFAULT_RECORD_LIST_TYPE,
+                        force_refresh=force_refresh_form,
+                    )
+                    if role == 1
+                    else self._get_field_index(profile, context, app_key, force_refresh=force_refresh_form)
+                )
+            index = update_index if verify_write else None
             normalized_answers = self._resolve_answers(
                 profile,
                 context,
@@ -8120,6 +9605,7 @@ class RecordTools(ToolBase):
                 answers=answers or [],
                 fields=fields or {},
                 force_refresh_form=force_refresh_form,
+                field_index_override=update_index,
             )
             self._validate_record_write(app_key, normalized_answers, apply_id=normalized_apply_id)
             try:
@@ -8173,13 +9659,14 @@ class RecordTools(ToolBase):
     def record_delete(self, *, profile: str, app_key: str, apply_id: int, list_type: int) -> JSONObject:
         """执行记录相关逻辑。"""
         normalized_apply_id = self._validate_app_and_record(app_key, apply_id)
+        delete_list_type = self._resolve_record_delete_list_type(view_id=None, list_type=list_type)
 
         def runner(session_profile, context):
             result = self.backend.request(
                 "DELETE",
                 context,
                 f"/app/{app_key}/apply",
-                json_body={"type": list_type, "applyIds": [normalized_apply_id]},
+                json_body={"type": delete_list_type, "applyIds": [normalized_apply_id]},
             )
             return self._attach_human_review_notice(
                 {
@@ -8188,6 +9675,7 @@ class RecordTools(ToolBase):
                     "request_route": self._request_route_payload(context),
                     "app_key": app_key,
                     "apply_id": normalized_apply_id,
+                    "list_type": delete_list_type,
                     "result": result,
                 },
                 operation="delete",
@@ -8232,7 +9720,7 @@ class RecordTools(ToolBase):
                 "GET",
                 context,
                 f"/app/{app_key}/apply/{apply_id}",
-                params={"role": 1, "listType": list_type},
+                params={"role": _record_detail_role_for_list_type(list_type), "listType": list_type},
             )
             answers = result.get("answers") if isinstance(result, dict) else None
             answer_list = answers if isinstance(answers, list) else []
@@ -8591,7 +10079,7 @@ class RecordTools(ToolBase):
         used_list_type: int | None = None
         if view_selection is not None:
             fallback_list_types = [view_route.list_type if view_route.list_type is not None else DEFAULT_RECORD_LIST_TYPE]
-        elif view_route.list_type is not None and view_route.list_type != DEFAULT_RECORD_LIST_TYPE:
+        elif view_route.list_type is not None:
             fallback_list_types = [view_route.list_type]
         else:
             fallback_list_types = [DEFAULT_RECORD_LIST_TYPE, 14, 1, 2, 12]
@@ -8822,7 +10310,7 @@ class RecordTools(ToolBase):
         try:
             payload = self.backend.request("GET", context, f"/view/{view_key}/viewConfig")
         except QingflowApiError as exc:
-            if exc.backend_code in {40002, 40027, 404} or exc.http_status == 404:
+            if _is_optional_schema_permission_error(exc):
                 self._view_config_cache[cache_key] = None
                 return None
             raise
@@ -8943,7 +10431,12 @@ class RecordTools(ToolBase):
         )
         normalized = _normalize_data_list_base_info_schema(payload)
         if not isinstance(normalized.get("formQues"), list) or not normalized.get("formQues"):
-            return self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
+            try:
+                return self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+                return normalized
         self._form_cache[cache_key] = normalized
         return normalized
 
@@ -8975,8 +10468,16 @@ class RecordTools(ToolBase):
         cache_key = (profile, f"view:{view_key}", "browse_view_base_info", None)
         if not force_refresh and cache_key in self._form_cache:
             return self._form_cache[cache_key]
-        payload = self.backend.request("GET", context, f"/view/{view_key}/apply/baseInfo")
-        normalized = _normalize_data_list_base_info_schema(payload)
+        try:
+            payload = self.backend.request("GET", context, f"/view/{view_key}/apply/baseInfo")
+            normalized = _normalize_data_list_base_info_schema(payload)
+            form_ques = normalized.get("formQues")
+            if not isinstance(form_ques, list) or not form_ques:
+                normalized = self._get_view_form_schema(profile, context, view_key, force_refresh=force_refresh)
+        except QingflowApiError as exc:
+            if not _is_optional_schema_permission_error(exc):
+                raise
+            normalized = self._get_view_form_schema(profile, context, view_key, force_refresh=force_refresh)
         self._form_cache[cache_key] = normalized
         return normalized
 
@@ -9032,22 +10533,6 @@ class RecordTools(ToolBase):
         force_refresh: bool,
     ) -> JSONObject:
         """Build the UI/table-view readable field scope from apply/baseInfo."""
-        applicant_index: FieldIndex | None
-        applicant_writable_field_ids: set[int]
-        try:
-            applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
-        except QingflowApiError as exc:
-            if exc.backend_code != 40002:
-                raise
-            applicant_index = None
-            applicant_writable_field_ids = set()
-        else:
-            applicant_writable_field_ids = {
-                field.que_id
-                for field in applicant_index.by_id.values()
-                if bool(self._schema_write_hints(field)["writable"])
-            }
-
         if resolved_view is not None and resolved_view.kind == "custom" and resolved_view.view_selection is not None:
             schema = self._get_custom_view_browse_schema(
                 profile,
@@ -9056,6 +10541,16 @@ class RecordTools(ToolBase):
                 force_refresh=force_refresh,
             )
             index = _build_top_level_field_index(schema)
+            visible_question_ids = {field.que_id for field in index.by_id.values()}
+            return {
+                "index": index,
+                "writable_field_ids": {
+                    field.que_id
+                    for field in index.by_id.values()
+                    if bool(self._schema_write_hints(field)["writable"])
+                },
+                "visible_question_ids": visible_question_ids,
+            }
         elif resolved_view is not None and resolved_view.kind == "system" and resolved_view.list_type is not None:
             schema = self._get_system_browse_base_info_schema(
                 profile,
@@ -9065,34 +10560,26 @@ class RecordTools(ToolBase):
                 force_refresh=force_refresh,
             )
             index = _build_top_level_field_index(schema)
-        else:
-            index = applicant_index or _build_top_level_field_index(
-                self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
-            )
-
-        if applicant_index is not None and index.by_id:
-            enriched_fields = [
-                _enrich_read_field_from_applicant(field, applicant_index.by_id.get(str(field.que_id)))
-                for field in index.by_id.values()
-            ]
-            index = _build_top_level_field_index({"formQues": [[_form_field_to_question(field) for field in enriched_fields]]})
+            visible_question_ids = {field.que_id for field in index.by_id.values()}
+            return {
+                "index": index,
+                "writable_field_ids": {
+                    field.que_id
+                    for field in index.by_id.values()
+                    if bool(self._schema_write_hints(field)["writable"])
+                },
+                "visible_question_ids": visible_question_ids,
+            }
 
-        visible_question_ids = {field.que_id for field in index.by_id.values()}
-        if applicant_index is None:
-            writable_field_ids = {
+        applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
+        visible_question_ids = {field.que_id for field in applicant_index.by_id.values()}
+        return {
+            "index": applicant_index,
+            "writable_field_ids": {
                 field.que_id
-                for field in index.by_id.values()
+                for field in applicant_index.by_id.values()
                 if bool(self._schema_write_hints(field)["writable"])
-            }
-        else:
-            writable_field_ids = {
-                field_id
-                for field_id in visible_question_ids
-                if field_id in applicant_writable_field_ids
-            }
-        return {
-            "index": index,
-            "writable_field_ids": writable_field_ids,
+            },
             "visible_question_ids": visible_question_ids,
         }
 
@@ -9106,23 +10593,13 @@ class RecordTools(ToolBase):
         force_refresh: bool,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        applicant_index: FieldIndex | None
-        applicant_writable_field_ids: set[int]
-        try:
-            applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
-        except QingflowApiError as exc:
-            if exc.backend_code != 40002:
-                raise
-            applicant_index = None
-            applicant_writable_field_ids = set()
-        else:
-            applicant_writable_field_ids = {
-                field.que_id
-                for field in applicant_index.by_id.values()
-                if bool(self._schema_write_hints(field)["writable"])
-            }
         if resolved_view is not None and resolved_view.kind == "custom" and resolved_view.view_selection is not None:
-            schema = self._get_view_form_schema(profile, context, resolved_view.view_selection.view_key, force_refresh=force_refresh)
+            schema = self._get_custom_view_browse_schema(
+                profile,
+                context,
+                resolved_view.view_selection.view_key,
+                force_refresh=force_refresh,
+            )
             index = _build_top_level_field_index(schema)
             visible_question_ids = self._get_view_question_ids(profile, context, resolved_view.view_selection.view_key)
             if not visible_question_ids:
@@ -9138,6 +10615,12 @@ class RecordTools(ToolBase):
             index = _build_top_level_field_index(schema)
             visible_question_ids = _question_ids_from_schema(schema)
         else:
+            applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
+            applicant_writable_field_ids = {
+                field.que_id
+                for field in applicant_index.by_id.values()
+                if bool(self._schema_write_hints(field)["writable"])
+            }
             index = applicant_index or _build_top_level_field_index(
                 self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
             )
@@ -9156,43 +10639,13 @@ class RecordTools(ToolBase):
                 "visible_question_ids": set(visible_question_ids),
             }
 
-        if applicant_index is None:
-            return {
-                "index": index,
-                "writable_field_ids": {
-                    field.que_id
-                    for field in index.by_id.values()
-                    if bool(self._schema_write_hints(field)["writable"])
-                },
-                "visible_question_ids": visible_question_ids,
-            }
-
-        augmented_fields = [
-            _clone_form_field(applicant_index.by_id.get(str(field.que_id)) or field)
-            for field in index.by_id.values()
-        ]
-        augmented_field_ids = {field.que_id for field in augmented_fields}
-        writable_field_ids = {
-            field_id
-            for field_id in visible_question_ids
-            if field_id in applicant_writable_field_ids
-        }
-        for field in applicant_index.by_id.values():
-            descendant_ids = _subtable_descendant_ids(field)
-            field_visible = field.que_id in visible_question_ids
-            descendant_visible = bool(descendant_ids and (descendant_ids & visible_question_ids))
-            if not field_visible and not descendant_visible:
-                continue
-            if field.que_id not in augmented_field_ids:
-                augmented_fields.append(_clone_form_field(field))
-                augmented_field_ids.add(field.que_id)
-            if descendant_visible:
-                visible_question_ids.add(field.que_id)
-            if field.que_id in applicant_writable_field_ids and (field_visible or descendant_visible):
-                writable_field_ids.add(field.que_id)
         return {
-            "index": _build_top_level_field_index({"formQues": [[_form_field_to_question(field) for field in augmented_fields]]}),
-            "writable_field_ids": writable_field_ids,
+            "index": index,
+            "writable_field_ids": {
+                field.que_id
+                for field in index.by_id.values()
+                if bool(self._schema_write_hints(field)["writable"])
+            },
             "visible_question_ids": visible_question_ids,
         }
 
@@ -9257,7 +10710,7 @@ class RecordTools(ToolBase):
         try:
             payload = self.backend.request("GET", context, f"/view/{view_key}/question")
         except QingflowApiError as exc:
-            if exc.backend_code in {40002, 40027}:
+            if _is_record_permission_denied_error(exc):
                 return set()
             raise
         if not isinstance(payload, list):
@@ -9301,7 +10754,7 @@ class RecordTools(ToolBase):
             )
             return True
         except QingflowApiError as exc:
-            if exc.backend_code in {40002, 40027}:
+            if _is_record_permission_denied_error(exc):
                 return False
             raise
 
@@ -9454,7 +10907,12 @@ class RecordTools(ToolBase):
         requested_name = _normalize_optional_text(view_name)
         if requested_key is None and requested_name is None:
             return None
-        views = self._get_view_list(profile, context, app_key)
+        try:
+            views = self._get_view_list(profile, context, app_key)
+        except QingflowApiError as exc:
+            if requested_key is None or not _is_record_permission_denied_error(exc):
+                raise
+            views = []
         selected: JSONObject | None = None
         if requested_key is not None:
             selected = next((item for item in views if _normalize_optional_text(item.get("viewKey")) == requested_key), None)
@@ -9652,9 +11110,11 @@ class RecordTools(ToolBase):
 
     def _should_retry_list_type_fallback(self, error: QingflowApiError) -> bool:
         """执行内部辅助逻辑。"""
-        if error.backend_code in {40002, 40027, 404}:
+        if is_auth_like_error(error):
+            return False
+        if backend_code_int(error) in {40002, 40027, 404}:
             return True
-        if error.http_status in {404, 500}:
+        if error.http_status == 404:
             return True
         return False
 
@@ -10475,6 +11935,70 @@ class RecordTools(ToolBase):
                 )
             )
 
+    def _candidate_lookup_failed_response(
+        self,
+        *,
+        profile: str,
+        session_profile,  # type: ignore[no-untyped-def]
+        context,  # type: ignore[no-untyped-def]
+        kind: str,
+        error: RecordInputError,
+        field: FormField,
+        app_key: str,
+        record_id_text: str | None,
+        workflow_node_id: int | None,
+        fields_present: bool,
+        keyword: str,
+        scope_source: str,
+    ) -> JSONObject:
+        """Return a structured result when an optional field candidate lookup is unavailable."""
+        error_payload = error.to_dict()
+        error_details = error_payload.get("details") if isinstance(error_payload.get("details"), dict) else {}
+        candidate_error = error_details.get("candidate_error") if isinstance(error_details.get("candidate_error"), dict) else {}
+        warning_transport = {
+            key: candidate_error.get(key)
+            for key in ("backend_code", "http_status", "request_id")
+            if candidate_error.get(key) is not None
+        }
+        selection: JSONObject = {
+            "app_key": app_key,
+            "field_id": field.que_id,
+            "field_title": field.que_title,
+            "record_id": record_id_text,
+            "workflow_node_id": workflow_node_id,
+            "fields_present": fields_present,
+            "keyword": keyword,
+            "permission_scope": "applicant_node",
+        }
+        return {
+            "profile": profile,
+            "ws_id": session_profile.selected_ws_id,
+            "ok": False,
+            "status": "failed",
+            "error_code": error.error_code,
+            "message": error.message,
+            "request_route": self._request_route_payload(context),
+            "warnings": [
+                {
+                    "code": error.error_code,
+                    "message": error.fix_hint,
+                    "kind": kind,
+                    "field_id": field.que_id,
+                    "field_title": field.que_title,
+                    **warning_transport,
+                }
+            ],
+            "output_profile": "normal",
+            "data": {
+                "items": [],
+                "pagination": {"returned_items": 0},
+                "selection": selection,
+                "scope_source": scope_source,
+                "fix_hint": error.fix_hint,
+            },
+            "details": error_details,
+        }
+
     def _request_route_payload(self, context) -> JSONObject:  # type: ignore[no-untyped-def]
         """执行内部辅助逻辑。"""
         describe_route = getattr(self.backend, "describe_route", None)
@@ -10648,7 +12172,7 @@ class RecordTools(ToolBase):
         selection: JSONObject | None,
     ) -> None:
         """执行内部辅助逻辑。"""
-        if exc.backend_code != 40002:
+        if not _is_record_permission_denied_error(exc):
             raise exc
         raise_tool_error(
             QingflowApiError(
@@ -10812,6 +12336,9 @@ class RecordTools(ToolBase):
         response_status = "verification_failed" if verification_status == "failed" else "success"
         if not bool(raw_apply.get("ok", True)) and verification_status != "failed":
             response_status = raw_status or "failed"
+        update_route = raw_apply.get("update_route") if isinstance(raw_apply.get("update_route"), dict) else None
+        tried_routes = raw_apply.get("tried_routes") if isinstance(raw_apply.get("tried_routes"), list) else []
+        expose_tried_routes = output_profile == "verbose" or response_status != "success"
         response: JSONObject = {
             "profile": raw_apply.get("profile"),
             "ws_id": raw_apply.get("ws_id"),
@@ -10823,6 +12350,7 @@ class RecordTools(ToolBase):
             "request_route": raw_apply.get("request_route"),
             "warnings": warnings,
             "output_profile": output_profile,
+            "update_route": update_route,
             "data": {
                 "action": {"operation": operation, "executed": True},
                 "resource": resource,
@@ -10833,8 +12361,12 @@ class RecordTools(ToolBase):
                 "confirmation_requests": [],
                 "resolved_fields": resolved_fields,
                 "human_review": self._record_write_human_review_payload(operation, enabled=human_review),
+                "update_route": update_route,
             },
         }
+        if expose_tried_routes:
+            response["tried_routes"] = tried_routes
+            response["data"]["tried_routes"] = tried_routes
         if record_id is not None:
             response["record_id"] = record_id
         if apply_id is not None:
@@ -11014,7 +12546,7 @@ class RecordTools(ToolBase):
             )
         return errors
 
-    def _record_delete_many(self, *, profile: str, app_key: str, record_ids: list[int]) -> JSONObject:
+    def _record_delete_many(self, *, profile: str, app_key: str, record_ids: list[int], list_type: int = DEFAULT_RECORD_LIST_TYPE) -> JSONObject:
         """执行内部辅助逻辑。"""
         if not app_key:
             raise_tool_error(QingflowApiError.config_error("app_key is required"))
@@ -11027,14 +12559,14 @@ class RecordTools(ToolBase):
                 "DELETE",
                 context,
                 f"/app/{app_key}/apply",
-                json_body={"type": DEFAULT_RECORD_LIST_TYPE, "applyIds": normalized_ids},
+                json_body={"type": list_type, "applyIds": normalized_ids},
             )
             return {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
                 "request_route": self._request_route_payload(context),
                 "result": result,
-                "resource": {"type": "record", "apply_ids": normalized_ids},
+                "resource": {"type": "record", "apply_ids": normalized_ids, "list_type": list_type},
                 "ok": True,
             }
 
@@ -11608,6 +13140,30 @@ class RecordTools(ToolBase):
             },
         )
 
+    def _candidate_lookup_error(
+        self,
+        *,
+        kind: str,
+        field: FormField,
+        value: JSONValue,
+        error: QingflowApiError,
+    ) -> RecordInputError:
+        """Build the standard candidate lookup failure without raising it."""
+        field_kind = "member" if kind == "member" else "department"
+        return RecordInputError(
+            message=f"{field_kind} candidates for field '{field.que_title}' could not be loaded",
+            error_code=f"{kind.upper()}_CANDIDATE_LOOKUP_FAILED",
+            fix_hint=(
+                f"Run record_{field_kind}_candidates again after the backend error is resolved, "
+                "then choose one returned item exactly."
+            ),
+            details={
+                "field": _field_ref_payload(field),
+                "received_value": value,
+                "candidate_error": error.to_dict(),
+            },
+        )
+
     def _candidate_keyword_from_value(
         self,
         value: JSONValue,
@@ -11872,14 +13428,7 @@ class RecordTools(ToolBase):
 
     def _lookup_department_detail(self, context, keyword: str, *, purpose: str) -> JSONObject:  # type: ignore[no-untyped-def]
         """执行内部辅助逻辑。"""
-        payload = self.backend.request(
-            "GET",
-            context,
-            "/contact/deptByPage",
-            params={"keyword": keyword, "pageNum": 1, "pageSize": 20},
-        )
-        rows = payload.get("list") if isinstance(payload, dict) else None
-        items = [item for item in rows if isinstance(item, dict)] if isinstance(rows, list) else []
+        items = self._search_workspace_departments(context, keyword=keyword)
         normalized_keyword = keyword.strip()
         exact = [
             item for item in items
@@ -12404,6 +13953,8 @@ class RecordTools(ToolBase):
         normalized_answers: list[JSONObject],
         index: FieldIndex,
         verify_list_type: int = DEFAULT_RECORD_LIST_TYPE,
+        verify_role: int | None = None,
+        verify_view_key: str | None = None,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
         if apply_id is None:
@@ -12415,14 +13966,38 @@ class RecordTools(ToolBase):
                 "count_mismatches": [],
             }
         try:
-            record = self.backend.request(
-                "GET",
-                context,
-                f"/app/{app_key}/apply/{apply_id}",
-                params={"role": 1, "listType": verify_list_type},
-            )
+            if verify_view_key:
+                record = self.backend.request(
+                    "GET",
+                    context,
+                    f"/view/{verify_view_key}/apply/{apply_id}",
+                )
+            else:
+                role = verify_role if verify_role is not None else 1
+                record = self.backend.request(
+                    "GET",
+                    context,
+                    f"/app/{app_key}/apply/{apply_id}",
+                    params={"role": role, "listType": verify_list_type},
+                )
         except QingflowApiError as exc:
-            if exc.backend_code != 40002:
+            if verify_view_key:
+                warning: JSONObject = {
+                    "code": "WRITE_VERIFY_CUSTOM_VIEW_READBACK_FAILED",
+                    "message": "Write was sent through a custom view route, but the same view could not be re-read for field-level verification.",
+                }
+                warning.update(_record_detail_error_warning_fields(exc))
+                return {
+                    "verified": False,
+                    "verification_mode": "custom_view_record_detail",
+                    "field_level_verified": False,
+                    "error": "custom_view_readback_failed",
+                    "missing_fields": [],
+                    "empty_fields": [],
+                    "count_mismatches": [],
+                    "warnings": [warning],
+                }
+            if not _is_record_permission_denied_error(exc):
                 raise
             return self._verify_record_write_result_via_initiated_tasks(
                 context,
@@ -12485,7 +14060,7 @@ class RecordTools(ToolBase):
                 )
         return {
             "verified": not missing_fields and not empty_fields and not count_mismatches,
-            "verification_mode": "initiated_record_view",
+            "verification_mode": "custom_view_record_detail" if verify_view_key else "initiated_record_view",
             "field_level_verified": True,
             "missing_fields": missing_fields,
             "empty_fields": empty_fields,
@@ -12716,6 +14291,8 @@ def _normalize_data_list_base_info_schema(payload: JSONValue) -> JSONObject:
     if not isinstance(payload, dict):
         return {}
     que_base_infos = payload.get("queBaseInfos")
+    if not isinstance(que_base_infos, list) and isinstance(payload.get("formQues"), list):
+        que_base_infos = payload.get("formQues")
     if not isinstance(que_base_infos, list):
         return {}
     return {
@@ -13102,6 +14679,44 @@ def _build_answer_backed_field_index(
     )
 
 
+def _merge_subtable_parent_field(primary: FormField, extra: FormField) -> FormField:
+    if primary.que_type not in SUBTABLE_QUE_TYPES or extra.que_type not in SUBTABLE_QUE_TYPES:
+        return primary
+    primary_raw = dict(primary.raw) if isinstance(primary.raw, dict) else {}
+    extra_raw = dict(extra.raw) if isinstance(extra.raw, dict) else {}
+    primary_subquestions = primary_raw.get("subQuestions")
+    extra_subquestions = extra_raw.get("subQuestions")
+    if not isinstance(primary_subquestions, list) or not isinstance(extra_subquestions, list):
+        return primary
+    merged_subquestions = [item for item in primary_subquestions if isinstance(item, dict)]
+    seen_ids = {
+        _coerce_count(item.get("queId"))
+        for item in merged_subquestions
+        if isinstance(item, dict) and _coerce_count(item.get("queId")) is not None
+    }
+    for item in extra_subquestions:
+        if not isinstance(item, dict):
+            continue
+        que_id = _coerce_count(item.get("queId"))
+        if que_id is not None and que_id in seen_ids:
+            continue
+        merged_subquestions.append(item)
+        if que_id is not None:
+            seen_ids.add(que_id)
+    if len(merged_subquestions) == len(primary_subquestions):
+        return primary
+    merged_raw = dict(primary_raw)
+    merged_raw["subQuestions"] = merged_subquestions
+    merged_field = _clone_form_field(primary)
+    merged_field.raw = merged_raw
+    return merged_field
+
+
+def _replace_field_in_lookup(index: dict[str, list[FormField]], field: FormField) -> None:
+    for key, fields in list(index.items()):
+        index[key] = [field if existing.que_id == field.que_id else existing for existing in fields]
+
+
 def _merge_field_indexes(primary: FieldIndex, extra: FieldIndex) -> FieldIndex:
     by_id = dict(primary.by_id)
     by_title = {key: list(value) for key, value in primary.by_title.items()}
@@ -13112,12 +14727,42 @@ def _merge_field_indexes(primary: FieldIndex, extra: FieldIndex) -> FieldIndex:
 
     for field_id, field in extra.by_id.items():
         if field_id in by_id:
+            merged_field = _merge_subtable_parent_field(by_id[field_id], field)
+            if merged_field is not by_id[field_id]:
+                by_id[field_id] = merged_field
+                _replace_field_in_lookup(by_title, merged_field)
+                _replace_field_in_lookup(by_alias, merged_field)
             continue
         by_id[field_id] = field
         by_title.setdefault(_normalize_field_lookup_key(field.que_title), []).append(field)
         for alias in field.aliases:
             by_alias.setdefault(_normalize_field_lookup_key(alias), []).append(field)
 
+    for field_id, fields in extra.subtable_leaf_by_id.items():
+        merged = subtable_leaf_by_id.setdefault(field_id, [])
+        existing = {(ref.field.que_id, ref.parent_field.que_id) for ref in merged}
+        for field in fields:
+            key = (field.field.que_id, field.parent_field.que_id)
+            if key not in existing:
+                merged.append(field)
+                existing.add(key)
+    for title, fields in extra.subtable_leaf_by_title.items():
+        merged = subtable_leaf_by_title.setdefault(title, [])
+        existing = {(ref.field.que_id, ref.parent_field.que_id) for ref in merged}
+        for field in fields:
+            key = (field.field.que_id, field.parent_field.que_id)
+            if key not in existing:
+                merged.append(field)
+                existing.add(key)
+    for alias, fields in extra.subtable_leaf_by_alias.items():
+        merged = subtable_leaf_by_alias.setdefault(alias, [])
+        existing = {(ref.field.que_id, ref.parent_field.que_id) for ref in merged}
+        for field in fields:
+            key = (field.field.que_id, field.parent_field.que_id)
+            if key not in existing:
+                merged.append(field)
+                existing.add(key)
+
     return FieldIndex(
         by_id=by_id,
         by_title=by_title,
@@ -13397,6 +15042,13 @@ def _record_access_run_dir() -> Path:
     return base_dir / run_id
 
 
+def _record_logs_run_dir() -> Path:
+    custom_home = os.getenv("QINGFLOW_MCP_RECORD_LOGS_HOME")
+    base_dir = Path(custom_home).expanduser() if custom_home else get_mcp_home() / "record-logs"
+    run_id = f"{datetime.now(UTC).strftime('%Y%m%dT%H%M%SZ')}-{uuid4().hex[:8]}"
+    return base_dir / run_id
+
+
 def _record_access_field_payload(field: FormField) -> JSONObject:
     return {
         "field_id": field.que_id,
@@ -14165,6 +15817,159 @@ def _record_detail_log_unavailable_payload(source: str, reason: str) -> JSONObje
     }
 
 
+def _record_logs_hidden_payload(source: str) -> JSONObject:
+    return {
+        "status": "hidden",
+        "visible": False,
+        "source": source,
+        "complete": False,
+        "items_count": 0,
+        "pages_fetched": 0,
+        "reported_total": None,
+        "local_path": None,
+        "preview_items": [],
+        "warnings": [],
+    }
+
+
+def _record_logs_unavailable_payload(source: str, reason: str) -> JSONObject:
+    return {
+        "status": "unavailable",
+        "visible": None,
+        "source": source,
+        "reason": reason,
+        "complete": False,
+        "items_count": 0,
+        "pages_fetched": 0,
+        "reported_total": None,
+        "local_path": None,
+        "preview_items": [],
+        "warnings": [],
+    }
+
+
+def _record_logs_fetch_all_to_jsonl(
+    *,
+    fetch_page,
+    normalizer,
+    source: str,
+    file_path: Path,
+    deadline: float,
+) -> JSONObject:  # type: ignore[no-untyped-def]
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    page_num = 1
+    pages_fetched = 0
+    items_count = 0
+    reported_total: int | None = None
+    preview_items: list[JSONObject] = []
+    warnings: list[JSONObject] = []
+    stopped_reason: str | None = None
+    complete = True
+
+    with file_path.open("w", encoding="utf-8") as handle:
+        while True:
+            if _record_logs_time_budget_exceeded(deadline=deadline):
+                complete = False
+                stopped_reason = "time_budget_exceeded"
+                warnings.append(_record_logs_time_budget_warning(source=source, pages_fetched=pages_fetched, items_count=items_count))
+                break
+            payload = fetch_page(page_num)
+            pages_fetched += 1
+            items = _record_detail_page_items(payload)
+            if reported_total is None:
+                reported_total = _record_detail_page_total(payload)
+            if not items:
+                break
+            for item in items:
+                normalized = normalizer(item)
+                handle.write(json.dumps(normalized, ensure_ascii=False) + "\n")
+                items_count += 1
+                if len(preview_items) < RECORD_LOGS_PREVIEW_LIMIT:
+                    preview_items.append(normalized)
+                if items_count >= RECORD_LOGS_MAX_ITEMS:
+                    complete = False
+                    stopped_reason = "item_limit_exceeded"
+                    warnings.append(_record_logs_item_limit_warning(source=source, item_limit=RECORD_LOGS_MAX_ITEMS))
+                    break
+            if stopped_reason:
+                break
+            if reported_total is not None and items_count >= reported_total:
+                break
+            if reported_total is None and len(items) < RECORD_LOGS_PAGE_SIZE:
+                break
+            page_num += 1
+
+    return {
+        "status": "ok" if complete else "partial",
+        "visible": True,
+        "source": source,
+        "complete": complete,
+        "items_count": items_count,
+        "pages_fetched": pages_fetched,
+        "page_size": RECORD_LOGS_PAGE_SIZE,
+        "reported_total": reported_total,
+        "local_path": str(file_path),
+        "preview_items": preview_items,
+        "warnings": warnings,
+        "stopped_reason": stopped_reason,
+    }
+
+
+def _record_logs_time_budget_exceeded(*, deadline: float) -> bool:
+    return time.monotonic() + RECORD_LOGS_MIN_REMAINING_SECONDS >= deadline
+
+
+def _record_logs_time_budget_warning(*, source: str, pages_fetched: int, items_count: int) -> JSONObject:
+    return {
+        "code": "RECORD_LOGS_TIME_BUDGET_EXCEEDED",
+        "source": source,
+        "message": "record_logs_get stopped early to return partial JSONL files before the caller timeout.",
+        "pages_fetched": pages_fetched,
+        "items_count": items_count,
+    }
+
+
+def _record_logs_item_limit_warning(*, source: str, item_limit: int) -> JSONObject:
+    return {
+        "code": "RECORD_LOGS_ITEM_LIMIT_EXCEEDED",
+        "source": source,
+        "message": f"record_logs_get stopped after the internal {item_limit} item limit.",
+        "item_limit": item_limit,
+    }
+
+
+def _record_logs_overall_status(*, data_logs: JSONObject, workflow_logs: JSONObject) -> str:
+    statuses = {str(data_logs.get("status") or ""), str(workflow_logs.get("status") or "")}
+    if statuses == {"unavailable"}:
+        return "unavailable"
+    if "partial" in statuses or "unavailable" in statuses:
+        return "partial"
+    return "success"
+
+
+def _record_logs_context_integrity(*, data_logs: JSONObject, workflow_logs: JSONObject) -> JSONObject:
+    data_integrity = _record_logs_section_integrity(data_logs)
+    workflow_integrity = _record_logs_section_integrity(workflow_logs)
+    return {
+        "data_logs": data_integrity,
+        "workflow_logs": workflow_integrity,
+        "safe_for_full_log_conclusion": data_integrity == "full" and workflow_integrity == "full",
+    }
+
+
+def _record_logs_section_integrity(section: JSONObject) -> str:
+    status = str(section.get("status") or "")
+    if status == "ok" and section.get("complete") is True:
+        return "full"
+    if status == "hidden":
+        return "hidden"
+    if status == "partial":
+        return "partial"
+    if status == "unavailable":
+        return "unavailable"
+    return "unknown"
+
+
 def _record_detail_log_page_payload(payload: JSONValue, *, normalizer, source: str) -> JSONObject:  # type: ignore[no-untyped-def]
     items = _record_detail_page_items(payload)
     total = _record_detail_page_total(payload)
@@ -14348,6 +16153,28 @@ def _record_detail_unavailable_context(section: str, message: str, exc: Qingflow
         "message": message,
         "category": exc.category,
     }
+    if is_auth_like_error(exc):
+        payload["auth_like"] = True
+        payload["error_code"] = "AUTH_REQUIRED"
+    if exc.backend_code is not None:
+        payload["backend_code"] = exc.backend_code
+    if exc.http_status is not None:
+        payload["http_status"] = exc.http_status
+    request_id = getattr(exc, "request_id", None)
+    if request_id:
+        payload["request_id"] = request_id
+    details = exc.details if isinstance(exc.details, dict) else {}
+    error_code = details.get("error_code")
+    if error_code and not payload.get("error_code"):
+        payload["error_code"] = error_code
+    return payload
+
+
+def _record_detail_error_warning_fields(exc: QingflowApiError) -> JSONObject:
+    payload: JSONObject = {"category": exc.category}
+    if is_auth_like_error(exc):
+        payload["auth_like"] = True
+        payload["error_code"] = "AUTH_REQUIRED"
     if exc.backend_code is not None:
         payload["backend_code"] = exc.backend_code
     if exc.http_status is not None:
@@ -14357,11 +16184,35 @@ def _record_detail_unavailable_context(section: str, message: str, exc: Qingflow
         payload["request_id"] = request_id
     details = exc.details if isinstance(exc.details, dict) else {}
     error_code = details.get("error_code")
-    if error_code:
+    if error_code and not payload.get("error_code"):
         payload["error_code"] = error_code
     return payload
 
 
+def _record_detail_refreshed_source_url(refresh_result: Any) -> str | None:
+    if isinstance(refresh_result, dict):
+        return _normalize_optional_text(refresh_result.get("source_url"))
+    return _normalize_optional_text(refresh_result)
+
+
+def _record_detail_append_refresh_warning(
+    warnings: list[JSONObject],
+    refresh_result: Any,
+    *,
+    id_key: str,
+    id_value: str,
+) -> None:
+    if not isinstance(refresh_result, dict):
+        return
+    warning = refresh_result.get("warning")
+    if not isinstance(warning, dict):
+        return
+    payload: JSONObject = dict(warning)
+    payload.setdefault("code", "ASSET_STORAGE_URL_REFRESH_FAILED")
+    payload.setdefault(id_key, id_value)
+    warnings.append(payload)
+
+
 _RECORD_MEDIA_IMG_SRC_RE = re.compile(r"""<img\b[^>]*\bsrc\s*=\s*["']?([^"'\s>]+)""", re.IGNORECASE)
 _RECORD_MEDIA_MD_IMAGE_RE = re.compile(r"""!\[[^\]]*]\(([^)\s]+)(?:\s+["'][^"']*["'])?\)""")
 _RECORD_MEDIA_URL_RE = re.compile(r"""https?://[^\s<>"')\]]+""", re.IGNORECASE)
@@ -14516,7 +16367,14 @@ def _record_detail_media_assets_payload(
         except QingflowApiError as exc:
             blocked = exc.http_status in {401, 403}
             if blocked and download_strategy != "referer_acl" and callable(refresh_source_url):
-                refreshed_url = _normalize_optional_text(refresh_source_url(candidate))
+                refresh_result = refresh_source_url(candidate)
+                _record_detail_append_refresh_warning(
+                    warnings,
+                    refresh_result,
+                    id_key="asset_id",
+                    id_value=asset_id,
+                )
+                refreshed_url = _record_detail_refreshed_source_url(refresh_result)
                 if refreshed_url and refreshed_url != source_url:
                     refreshed_strategy = _record_detail_media_download_strategy(refreshed_url)
                     try:
@@ -14558,14 +16416,13 @@ def _record_detail_media_assets_payload(
                         "readable_by_agent": False,
                     }
                 )
-                warnings.append(
-                    {
-                        "code": warning_code,
-                        "asset_id": asset_id,
-                        "message": f"record_get could not download image asset {asset_id}: {exc.message}",
-                        "http_status": exc.http_status,
-                    }
-                )
+                warning: JSONObject = {
+                    "code": warning_code,
+                    "asset_id": asset_id,
+                    "message": f"record_get could not download image asset {asset_id}: {exc.message}",
+                }
+                warning.update(_record_detail_error_warning_fields(exc))
+                warnings.append(warning)
                 continue
 
         if not isinstance(content, bytes):
@@ -14783,7 +16640,14 @@ def _record_detail_file_assets_payload(
         except QingflowApiError as exc:
             blocked = exc.http_status in {401, 403}
             if blocked and download_strategy != "referer_acl" and callable(refresh_source_url):
-                refreshed_url = _normalize_optional_text(refresh_source_url(candidate))
+                refresh_result = refresh_source_url(candidate)
+                _record_detail_append_refresh_warning(
+                    warnings,
+                    refresh_result,
+                    id_key="file_asset_id",
+                    id_value=file_asset_id,
+                )
+                refreshed_url = _record_detail_refreshed_source_url(refresh_result)
                 if refreshed_url and refreshed_url != source_url:
                     refreshed_strategy = _record_detail_media_download_strategy(refreshed_url)
                     try:
@@ -14830,14 +16694,13 @@ def _record_detail_file_assets_payload(
                         "extraction": {"status": "failed", "text_path": None, "preview": None},
                     }
                 )
-                warnings.append(
-                    {
-                        "code": warning_code,
-                        "file_asset_id": file_asset_id,
-                        "message": f"record_get could not download file asset {file_asset_id}: {exc.message}",
-                        "http_status": exc.http_status,
-                    }
-                )
+                warning = {
+                    "code": warning_code,
+                    "file_asset_id": file_asset_id,
+                    "message": f"record_get could not download file asset {file_asset_id}: {exc.message}",
+                }
+                warning.update(_record_detail_error_warning_fields(exc))
+                warnings.append(warning)
                 continue
 
         if not isinstance(content, bytes):