@qingflow-tech/qingflow-app-user-mcp 1.0.11 → 1.0.12

package/src/qingflow_mcp/tools/record_tools.py

@@ -14,7 +14,7 @@ from datetime import UTC, datetime, timedelta
 from decimal import Decimal, InvalidOperation
 from io import BytesIO
 from pathlib import Path
-from typing import Any, cast
+from typing import Any, Callable, cast
 from urllib.parse import parse_qs, unquote, urlsplit
 from uuid import uuid4
 from xml.etree import ElementTree
@@ -22,7 +22,7 @@ from xml.etree import ElementTree
 from mcp.server.fastmcp import FastMCP
 
 from ..config import DEFAULT_PROFILE, DEFAULT_RECORD_LIST_TYPE, DEFAULT_USER_AGENT, get_mcp_home
-from ..errors import QingflowApiError, raise_tool_error
+from ..errors import QingflowApiError, backend_code_int, is_auth_like_error, raise_tool_error
 from ..id_utils import normalize_positive_id_int, stringify_backend_id
 from ..json_types import JSONObject, JSONScalar, JSONValue
 from ..list_type_labels import (
@@ -131,6 +131,27 @@ SCHEMA_LINKAGE_REFERENCE_SOURCE_MESSAGE = "updating this field may auto-fill or
 SCHEMA_LINKAGE_REFERENCE_TARGET_MESSAGE = "this field is usually filled from an upstream reference selection or default matching logic"
 SCHEMA_LINKAGE_REFERENCE_BOTH_MESSAGE = "this field participates in reference-driven auto-fill logic"
 SCHEMA_LINKAGE_FORMULA_MESSAGE = "this field is usually derived by formula or default auto-fill logic"
+OPTIONAL_SCHEMA_PERMISSION_CODES = {40002, 40027, 404}
+RECORD_PERMISSION_DENIED_CODES = {40002, 40027}
+SYSTEM_VIEW_LIST_TYPES = {int(list_type) for _view_id, list_type, _name in SYSTEM_VIEW_DEFINITIONS}
+
+
+def _is_optional_schema_permission_error(error: QingflowApiError) -> bool:
+    if is_auth_like_error(error):
+        return False
+    return backend_code_int(error) in OPTIONAL_SCHEMA_PERMISSION_CODES or error.http_status == 404
+
+
+def _is_record_permission_denied_error(error: QingflowApiError) -> bool:
+    if is_auth_like_error(error):
+        return False
+    return backend_code_int(error) in RECORD_PERMISSION_DENIED_CODES
+
+
+def _is_optional_record_auxiliary_lookup_error(error: QingflowApiError) -> bool:
+    if is_auth_like_error(error):
+        return False
+    return backend_code_int(error) in {40002, 40027, 404} or error.http_status == 404
 
 
 @dataclass(slots=True)
@@ -215,6 +236,13 @@ class AccessibleViewRoute:
     view_type: str | None = None
 
 
+def _prefer_custom_update_routes(routes: list[AccessibleViewRoute]) -> list[AccessibleViewRoute]:
+    return [
+        *[route for route in routes if route.kind == "custom"],
+        *[route for route in routes if route.kind != "custom"],
+    ]
+
+
 @dataclass(slots=True)
 class RecordContextRouteProbe:
     route: AccessibleViewRoute
@@ -471,7 +499,7 @@ class RecordTools(ToolBase):
                 output_profile=output_profile,
             )
 
-        @mcp.tool(description="Read all visible data logs and workflow logs for one Qingflow record into local JSONL files. This tool hides pagination and returns file paths plus completeness metadata.")
+        @mcp.tool(description="Read all visible data logs and workflow logs for one Qingflow record into local JSONL files. Requires the same view_id as the frontend record context. This tool hides pagination and returns file paths plus completeness metadata.")
         def record_logs_get(
             profile: str = DEFAULT_PROFILE,
             app_key: str = "",
@@ -502,12 +530,14 @@ class RecordTools(ToolBase):
         def record_update_schema_get(
             app_key: str = "",
             record_id: str = "",
+            view_id: str | None = None,
             output_profile: str = "normal",
         ) -> JSONObject:
             return self.record_update_schema_get_public(
                 profile=DEFAULT_PROFILE,
                 app_key=app_key,
                 record_id=record_id,
+                view_id=view_id,
                 output_profile=output_profile,
             )
 
@@ -537,6 +567,7 @@ class RecordTools(ToolBase):
             description=(
                 "Update one Qingflow record using a field map. "
                 "For simple field changes, call this tool directly after the target record is clear. "
+                "Pass view_id when the frontend detail view is known; the tool will try that view first. "
                 "It first tries the data-manager direct route, then falls back to the frontend custom-view edit route when available. "
                 "Use record_update_schema_get for diagnostics or complex field-scope inspection."
             )
@@ -546,6 +577,7 @@ class RecordTools(ToolBase):
             record_id: str | None = None,
             fields: JSONObject | None = None,
             items: list[JSONObject] | None = None,
+            view_id: str | None = None,
             dry_run: bool = False,
             verify_write: bool = True,
             output_profile: str = "normal",
@@ -556,6 +588,7 @@ class RecordTools(ToolBase):
                 record_id=record_id,
                 fields=fields,
                 items=items,
+                view_id=view_id,
                 dry_run=dry_run,
                 verify_write=verify_write,
                 output_profile=output_profile,
@@ -564,13 +597,14 @@ class RecordTools(ToolBase):
         @mcp.tool(
             description=(
                 "Delete Qingflow records by record_id or record_ids. "
-                "This tool does not accept view selectors; resolve target record ids first, then delete by id."
+                "Pass view_id when deleting from a known system list route; custom view deletion is not supported by this backend route."
             )
         )
         def record_delete(
             app_key: str = "",
             record_id: str | None = None,
             record_ids: list[str] | None = None,
+            view_id: str | None = None,
             output_profile: str = "normal",
         ) -> JSONObject:
             return self.record_delete_public(
@@ -578,6 +612,7 @@ class RecordTools(ToolBase):
                 app_key=app_key,
                 record_id=record_id,
                 record_ids=record_ids or [],
+                view_id=view_id,
                 output_profile=output_profile,
             )
 
@@ -849,6 +884,7 @@ class RecordTools(ToolBase):
         profile: str = DEFAULT_PROFILE,
         app_key: str,
         record_id: Any,
+        view_id: str | None = None,
         output_profile: str = "normal",
     ) -> JSONObject:
         """执行记录相关逻辑。"""
@@ -860,21 +896,44 @@ class RecordTools(ToolBase):
         def runner(session_profile, context):
             request_route = self._request_route_payload(context)
             self._clear_record_schema_caches(profile=profile, app_key=app_key, clear_view_caches=True)
-            app_schema = self._get_form_schema(profile, context, app_key, force_refresh=True)
-            question_relations = _collect_question_relations(app_schema)
-            app_index = _build_applicant_top_level_field_index(app_schema)
-            linked_field_ids = _collect_linked_required_field_ids(question_relations)
-            linked_field_ids.update(_collect_option_linked_field_ids(app_index))
-            linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
-                app_schema,
-                linked_field_ids=linked_field_ids,
-            )
-            app_index = _merge_field_indexes(app_index, linked_hidden_index)
-            linkage_payloads_by_field_id = _build_static_schema_linkage_payloads(
-                index=app_index,
-                question_relations=question_relations,
-            )
+            linkage_payloads_by_field_id: dict[str, JSONObject] = {}
+            try:
+                app_schema = self._get_form_schema(profile, context, app_key, force_refresh=True)
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+            else:
+                question_relations = _collect_question_relations(app_schema)
+                app_index = _build_applicant_top_level_field_index(app_schema)
+                linked_field_ids = _collect_linked_required_field_ids(question_relations)
+                linked_field_ids.update(_collect_option_linked_field_ids(app_index))
+                linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
+                    app_schema,
+                    linked_field_ids=linked_field_ids,
+                )
+                app_index = _merge_field_indexes(app_index, linked_hidden_index)
+                linkage_payloads_by_field_id = _build_static_schema_linkage_payloads(
+                    index=app_index,
+                    question_relations=question_relations,
+                )
+            preferred_view_id = _normalize_optional_text(view_id)
             candidate_routes = self._candidate_update_views(profile, context, app_key)
+            if preferred_view_id:
+                preferred_route = next(
+                    (
+                        route
+                        for route in candidate_routes
+                        if route.view_id == preferred_view_id
+                    ),
+                    None,
+                )
+                if preferred_route is None:
+                    raise_tool_error(
+                        QingflowApiError.config_error(
+                            f"view_id '{preferred_view_id}' is not an accessible update candidate"
+                        )
+                    )
+                candidate_routes = [preferred_route]
             probes = self._probe_candidate_record_contexts(
                 context,
                 app_key=app_key,
@@ -976,6 +1035,7 @@ class RecordTools(ToolBase):
                     output_profile=normalized_output_profile,
                     view_probe_summary=probe_summary,
                     ambiguous_fields=[],
+                    preferred_view_id=preferred_view_id,
                 )
 
             ambiguous_field_ids: set[int] = set()
@@ -1022,6 +1082,7 @@ class RecordTools(ToolBase):
                     output_profile=normalized_output_profile,
                     view_probe_summary=probe_summary,
                     ambiguous_fields=ambiguous_fields,
+                    preferred_view_id=preferred_view_id,
                 )
 
             response: JSONObject = {
@@ -1046,6 +1107,8 @@ class RecordTools(ToolBase):
                     "message": "record_update will try data-manager direct edit first, then a matching custom-view edit route, then a unique current-user todo save-only route when the target fields are editable on that workflow node.",
                 },
             }
+            if preferred_view_id:
+                response["preferred_view_id"] = preferred_view_id
             if normalized_output_profile == "verbose":
                 response["view_probe_summary"] = probe_summary
                 response["record_context_probe"] = probe_summary
@@ -1106,6 +1169,7 @@ class RecordTools(ToolBase):
         output_profile: str,
         view_probe_summary: list[JSONObject],
         ambiguous_fields: list[JSONObject],
+        preferred_view_id: str | None = None,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
         response: JSONObject = {
@@ -1123,6 +1187,8 @@ class RecordTools(ToolBase):
             "payload_template": {},
             "recommended_next_actions": recommended_next_actions,
         }
+        if preferred_view_id:
+            response["preferred_view_id"] = preferred_view_id
         if output_profile == "verbose":
             response["view_probe_summary"] = view_probe_summary
             response["ambiguous_fields"] = ambiguous_fields
@@ -1440,24 +1506,58 @@ class RecordTools(ToolBase):
             )
             warnings: list[JSONObject] = []
             scope_source = "static_applicant_scope"
-            if runtime_lookup:
-                state = self._build_candidate_lookup_state(
-                    profile,
-                    context,
+            try:
+                if runtime_lookup:
+                    state = self._build_candidate_lookup_state(
+                        profile,
+                        context,
+                        app_key=app_key,
+                        record_id=record_id_int,
+                        workflow_node_id=workflow_node_id,
+                        fields=normalized_fields,
+                    )
+                    items = self._resolve_member_candidates_backend(context, field, keyword=keyword, state=state)
+                    scope_source = "backend_runtime_scope"
+                else:
+                    items: list[JSONObject] | None = None
+                    if self._member_candidate_static_preview_should_use_backend(field):
+                        state = self._build_candidate_lookup_state(
+                            profile,
+                            context,
+                            app_key=app_key,
+                            record_id=None,
+                            workflow_node_id=None,
+                            fields={},
+                        )
+                        items = self._resolve_member_candidates_backend(context, field, keyword=keyword, state=state)
+                        scope_source = "backend_applicant_scope"
+                    if items is None:
+                        items = self._resolve_member_candidates(context, field, keyword=keyword)
+                    warnings.append(
+                        {
+                            "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
+                            "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
+                        }
+                    )
+            except (RecordInputError, QingflowApiError) as error:
+                record_error = (
+                    error
+                    if isinstance(error, RecordInputError)
+                    else self._candidate_lookup_error(kind="member", field=field, value=keyword, error=error)
+                )
+                return self._candidate_lookup_failed_response(
+                    profile=profile,
+                    session_profile=session_profile,
+                    context=context,
+                    kind="member",
+                    error=record_error,
+                    field=field,
                     app_key=app_key,
-                    record_id=record_id_int,
+                    record_id_text=record_id_text,
                     workflow_node_id=workflow_node_id,
-                    fields=normalized_fields,
-                )
-                items = self._resolve_member_candidates_backend(context, field, keyword=keyword, state=state)
-                scope_source = "backend_runtime_scope"
-            else:
-                items = self._resolve_member_candidates(context, field, keyword=keyword)
-                warnings.append(
-                    {
-                        "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
-                        "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
-                    }
+                    fields_present=bool(normalized_fields),
+                    keyword=keyword,
+                    scope_source=scope_source,
                 )
             total = len(items)
             start = (page_num - 1) * page_size
@@ -1550,41 +1650,75 @@ class RecordTools(ToolBase):
             )
             warnings: list[JSONObject] = []
             scope_source = "static_applicant_scope"
-            if runtime_lookup:
-                state = self._build_candidate_lookup_state(
-                    profile,
-                    context,
-                    app_key=app_key,
-                    record_id=record_id_int,
-                    workflow_node_id=workflow_node_id,
-                    fields=normalized_fields,
-                )
-                items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
-                scope_source = "backend_runtime_scope"
-            else:
-                items = self._resolve_department_candidates(context, field, keyword=keyword)
-                scope = field.dept_select_scope if isinstance(field.dept_select_scope, dict) else {}
-                if (
-                    not items
-                    and field.dept_select_scope_type == 2
-                    and not _scope_has_dynamic_or_external(scope)
-                    and not list(scope.get("depart") or [])
-                ):
+            try:
+                if runtime_lookup:
                     state = self._build_candidate_lookup_state(
                         profile,
                         context,
                         app_key=app_key,
-                        record_id=None,
-                        workflow_node_id=None,
-                        fields={},
+                        record_id=record_id_int,
+                        workflow_node_id=workflow_node_id,
+                        fields=normalized_fields,
                     )
                     items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
                     scope_source = "backend_runtime_scope"
-                warnings.append(
-                    {
-                        "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
-                        "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
-                    }
+                else:
+                    items: list[JSONObject] | None = None
+                    if self._department_candidate_static_preview_should_use_backend(field):
+                        state = self._build_candidate_lookup_state(
+                            profile,
+                            context,
+                            app_key=app_key,
+                            record_id=None,
+                            workflow_node_id=None,
+                            fields={},
+                        )
+                        items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
+                        scope_source = "backend_applicant_scope"
+                    if items is None:
+                        items = self._resolve_department_candidates(context, field, keyword=keyword)
+                        scope = field.dept_select_scope if isinstance(field.dept_select_scope, dict) else {}
+                        if (
+                            not items
+                            and field.dept_select_scope_type == 2
+                            and not _scope_has_dynamic_or_external(scope)
+                            and not list(scope.get("depart") or [])
+                        ):
+                            state = self._build_candidate_lookup_state(
+                                profile,
+                                context,
+                                app_key=app_key,
+                                record_id=None,
+                                workflow_node_id=None,
+                                fields={},
+                            )
+                            items = self._resolve_department_candidates_backend(context, field, keyword=keyword, state=state)
+                            scope_source = "backend_applicant_scope"
+                    warnings.append(
+                        {
+                            "code": "CANDIDATE_SCOPE_PREVIEW_ONLY",
+                            "message": "candidate scope is a static applicant-node preview; pass record_id/workflow_node_id/fields to match runtime write scope",
+                        }
+                    )
+            except (RecordInputError, QingflowApiError) as error:
+                record_error = (
+                    error
+                    if isinstance(error, RecordInputError)
+                    else self._candidate_lookup_error(kind="department", field=field, value=keyword, error=error)
+                )
+                return self._candidate_lookup_failed_response(
+                    profile=profile,
+                    session_profile=session_profile,
+                    context=context,
+                    kind="department",
+                    error=record_error,
+                    field=field,
+                    app_key=app_key,
+                    record_id_text=record_id_text,
+                    workflow_node_id=workflow_node_id,
+                    fields_present=bool(normalized_fields),
+                    keyword=keyword,
+                    scope_source=scope_source,
                 )
             total = len(items)
             start = (page_num - 1) * page_size
@@ -1646,6 +1780,21 @@ class RecordTools(ToolBase):
             raise_tool_error(QingflowApiError.config_error("app_key is required"))
         if limit <= 0:
             raise_tool_error(QingflowApiError.config_error("limit must be positive"))
+        if not (
+            _normalize_optional_text(view_id)
+            or list_type is not None
+            or _normalize_optional_text(view_key)
+            or _normalize_optional_text(view_name)
+        ):
+            raise_tool_error(
+                QingflowApiError.config_error(
+                    "record_analyze requires view_id. Call app_get first and pass accessible_views[].view_id.",
+                    details={
+                        "error_code": "RECORD_ANALYZE_VIEW_REQUIRED",
+                        "fix_hint": "Call app_get first and choose one accessible_views[].view_id, then retry record_analyze with view_id.",
+                    },
+                )
+            )
         legacy_warnings = _detect_analyze_legacy_warnings(
             dimensions=dimensions,
             metrics=metrics,
@@ -1662,7 +1811,7 @@ class RecordTools(ToolBase):
                 list_type=list_type,
                 view_key=view_key,
                 view_name=view_name,
-                allow_default=True,
+                allow_default=False,
             )
             if not _view_type_supports_analysis(resolved_view.view_type):
                 raise_tool_error(
@@ -1743,6 +1892,21 @@ class RecordTools(ToolBase):
             raise_tool_error(QingflowApiError.config_error("limit must be positive"))
         if page <= 0:
             raise_tool_error(QingflowApiError.config_error("page must be positive"))
+        if not (
+            _normalize_optional_text(view_id)
+            or list_type is not None
+            or _normalize_optional_text(view_key)
+            or _normalize_optional_text(view_name)
+        ):
+            raise_tool_error(
+                QingflowApiError.config_error(
+                    "record_list requires view_id. Call app_get first and pass accessible_views[].view_id.",
+                    details={
+                        "error_code": "RECORD_LIST_VIEW_REQUIRED",
+                        "fix_hint": "Call app_get first and choose one accessible_views[].view_id, then retry record_list with view_id.",
+                    },
+                )
+            )
         view_route, compatibility_warnings = self._resolve_accessible_view_route_for_public(
             profile=profile,
             app_key=app_key,
@@ -1750,7 +1914,7 @@ class RecordTools(ToolBase):
             list_type=list_type,
             view_key=view_key,
             view_name=view_name,
-            allow_default=True,
+            allow_default=False,
         )
         if not _view_type_supports_analysis(view_route.view_type):
             raise_tool_error(
@@ -2224,6 +2388,7 @@ class RecordTools(ToolBase):
         requested_output_profile = _normalize_record_get_detail_output_profile(output_profile)
         record_id_int = normalize_positive_id_int(record_id, field_name="record_id")
         normalized_columns = _normalize_public_column_selectors(columns)
+        explicit_view_id = _normalize_optional_text(view_id)
 
         def runner(session_profile, context):
             resolved_view, compatibility_warnings = self._resolve_accessible_view_route(
@@ -2249,17 +2414,45 @@ class RecordTools(ToolBase):
                     "code": "OUTPUT_PROFILE_DEPRECATED_FOR_DETAIL_CONTEXT",
                     "message": f"output_profile={requested_output_profile!r} is deprecated for record_get; detail_context is always returned.",
                 })
-            return self._record_get_detail_context(
-                profile=profile,
-                session_profile=session_profile,
-                context=context,
-                app_key=app_key,
-                record_id_int=record_id_int,
-                resolved_view=resolved_view,
-                requested_focus_field_ids=normalized_columns,
-                workflow_node_id=workflow_node_id,
-                warnings=warnings,
-            )
+            def get_detail_for_route(route: AccessibleViewRoute, route_warnings: list[JSONObject]) -> JSONObject:
+                return self._record_get_detail_context(
+                    profile=profile,
+                    session_profile=session_profile,
+                    context=context,
+                    app_key=app_key,
+                    record_id_int=record_id_int,
+                    resolved_view=route,
+                    requested_focus_field_ids=normalized_columns,
+                    workflow_node_id=workflow_node_id,
+                    warnings=route_warnings,
+                )
+
+            try:
+                return get_detail_for_route(resolved_view, warnings)
+            except QingflowApiError as exc:
+                if explicit_view_id is not None:
+                    raise
+                if not self._is_record_context_route_miss(exc):
+                    raise
+                fallback_warnings = list(warnings)
+                fallback_warnings.append(
+                    {
+                        "code": "DEFAULT_DETAIL_ROUTE_DENIED",
+                        "message": "record_get default system:all route was not readable; trying accessible views that match the frontend route model.",
+                        "backend_code": exc.backend_code,
+                    }
+                )
+                last_error = exc
+                for candidate in self._candidate_update_views(profile, context, app_key):
+                    if candidate.view_id == resolved_view.view_id:
+                        continue
+                    try:
+                        return get_detail_for_route(candidate, fallback_warnings)
+                    except QingflowApiError as candidate_exc:
+                        if not self._is_record_context_route_miss(candidate_exc):
+                            raise
+                        last_error = candidate_exc
+                raise last_error
 
         return self._run_record_tool(profile, runner)
 
@@ -2274,6 +2467,16 @@ class RecordTools(ToolBase):
     ) -> JSONObject:
         """读取单条记录可见的全量数据日志和流程日志，写入本地 JSONL。"""
         record_id_int = normalize_positive_id_int(record_id, field_name="record_id")
+        if not _normalize_optional_text(view_id):
+            raise_tool_error(
+                QingflowApiError.config_error(
+                    "record_logs_get requires view_id. Call app_get first and pass accessible_views[].view_id.",
+                    details={
+                        "error_code": "RECORD_LOGS_VIEW_REQUIRED",
+                        "fix_hint": "Call app_get first and choose one accessible_views[].view_id, then retry record_logs_get with view_id.",
+                    },
+                )
+            )
 
         def runner(session_profile, context):
             resolved_view, compatibility_warnings = self._resolve_accessible_view_route(
@@ -2284,21 +2487,45 @@ class RecordTools(ToolBase):
                 list_type=None,
                 view_key=None,
                 view_name=None,
-                allow_default=True,
+                allow_default=False,
             )
             warnings: list[JSONObject] = []
             warnings.extend(compatibility_warnings)
             warnings.extend(_view_filter_trust_warnings(resolved_view))
             unavailable_context: list[JSONObject] = []
 
-            schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=False)
+            schema: JSONObject = {}
+            try:
+                schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=False)
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+                unavailable_context.append(
+                    _record_detail_unavailable_context(
+                        "detail_schema",
+                        "记录日志字段结构辅助信息获取失败，已尝试使用详情主数据中的字段信息继续。",
+                        exc,
+                    )
+                )
             index = _build_top_level_field_index(schema)
-            audit_info = self._record_get_audit_info(
-                context,
-                app_key=app_key,
-                record_id=record_id_int,
-                resolved_view=resolved_view,
-            )
+            try:
+                audit_info = self._record_get_audit_info(
+                    context,
+                    app_key=app_key,
+                    record_id=record_id_int,
+                    resolved_view=resolved_view,
+                )
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+                audit_info = {}
+                unavailable_context.append(
+                    _record_detail_unavailable_context(
+                        "audit_info",
+                        "记录审批节点辅助信息获取失败，已继续读取详情主数据和日志。",
+                        exc,
+                    )
+                )
             audit_context = _record_detail_audit_context(audit_info, workflow_node_id=None)
             detail_result, used_list_type, used_role = self._record_get_apply_detail(
                 context,
@@ -2308,6 +2535,17 @@ class RecordTools(ToolBase):
                 audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
             )
             answer_list = _record_detail_answers(detail_result)
+            if not index.by_id:
+                answer_index = _build_answer_backed_field_index(cast(list[JSONObject], answer_list))
+                if answer_index.by_id:
+                    index = answer_index
+                    unavailable_context.append(
+                        {
+                            "section": "detail_schema",
+                            "message": "字段结构由详情 answers 回退构造；候选范围、只读状态、选项和联动信息可能不完整。",
+                            "category": "partial_context",
+                        }
+                    )
             selected_fields = list(index.by_id.values())
             fields = [
                 _record_detail_field_payload(field, _find_answer_for_field(cast(list[JSONValue], answer_list), field), focus_id_set=set())
@@ -2401,14 +2639,41 @@ class RecordTools(ToolBase):
         warnings: list[JSONObject],
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=False)
+        unavailable_context: list[JSONObject] = []
+        schema: JSONObject = {}
+        schema_available = True
+        try:
+            schema = self._record_get_detail_schema(profile, context, app_key, resolved_view, force_refresh=False)
+        except QingflowApiError as exc:
+            if not _is_optional_schema_permission_error(exc):
+                raise
+            schema_available = False
+            unavailable_context.append(
+                _record_detail_unavailable_context(
+                    "detail_schema",
+                    "记录详情字段结构辅助信息获取失败，已尝试使用详情主数据中的字段信息继续。",
+                    exc,
+                )
+            )
         index = _build_top_level_field_index(schema)
-        audit_info = self._record_get_audit_info(
-            context,
-            app_key=app_key,
-            record_id=record_id_int,
-            resolved_view=resolved_view,
-        )
+        try:
+            audit_info = self._record_get_audit_info(
+                context,
+                app_key=app_key,
+                record_id=record_id_int,
+                resolved_view=resolved_view,
+            )
+        except QingflowApiError as exc:
+            if not _is_optional_schema_permission_error(exc):
+                raise
+            audit_info = {}
+            unavailable_context.append(
+                _record_detail_unavailable_context(
+                    "audit_info",
+                    "记录审批节点辅助信息获取失败，已继续读取详情主数据。",
+                    exc,
+                )
+            )
         audit_context = _record_detail_audit_context(audit_info, workflow_node_id=workflow_node_id)
         detail_result, used_list_type, used_role = self._record_get_apply_detail(
             context,
@@ -2418,13 +2683,24 @@ class RecordTools(ToolBase):
             audit_node_id=cast(int | None, audit_context.get("audit_node_id")),
         )
         answer_list = _record_detail_answers(detail_result)
+        if not index.by_id:
+            answer_index = _build_answer_backed_field_index(cast(list[JSONObject], answer_list))
+            if answer_index.by_id:
+                index = answer_index
+                unavailable_context.append(
+                    {
+                        "section": "detail_schema",
+                        "message": "字段结构由详情 answers 回退构造；候选范围、只读状态、选项和联动信息可能不完整。",
+                        "category": "partial_context",
+                    }
+                )
         selected_fields = list(index.by_id.values())
         row = _build_flat_row(cast(list[JSONValue], answer_list), selected_fields, apply_id=record_id_int)
         normalized_record, _normalized_ambiguous_fields = _build_normalized_row_from_answers(
             cast(list[JSONValue], answer_list),
             selected_fields,
         )
-        if self._record_get_needs_schema_refresh(
+        if schema_available and self._record_get_needs_schema_refresh(
             answer_list=cast(list[JSONValue], answer_list),
             selected_fields=selected_fields,
             record=row,
@@ -2440,7 +2716,6 @@ class RecordTools(ToolBase):
             index = _build_top_level_field_index(schema)
             selected_fields = list(index.by_id.values())
 
-        unavailable_context: list[JSONObject] = []
         dynamic_reference_answers, dynamic_reference_unavailable = self._record_get_dynamic_reference_answers(
             context,
             app_key=app_key,
@@ -2599,7 +2874,20 @@ class RecordTools(ToolBase):
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
         if resolved_view.kind == "custom" and resolved_view.view_selection is not None:
-            return self._get_view_form_schema(profile, context, resolved_view.view_selection.view_key, force_refresh=force_refresh)
+            return self._get_custom_view_browse_schema(
+                profile,
+                context,
+                resolved_view.view_selection.view_key,
+                force_refresh=force_refresh,
+            )
+        if resolved_view.kind == "system" and resolved_view.list_type is not None:
+            return self._get_system_browse_schema(
+                profile,
+                context,
+                app_key,
+                list_type=resolved_view.list_type,
+                force_refresh=force_refresh,
+            )
         return self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
 
     def _record_get_audit_info(
@@ -2660,7 +2948,7 @@ class RecordTools(ToolBase):
             )
             return result if isinstance(result, dict) else {"value": result}, list_type, role
         except QingflowApiError as exc:
-            if resolved_view.list_type is not None or exc.backend_code != 40002:
+            if resolved_view.list_type is not None or not _is_record_permission_denied_error(exc):
                 raise
             last_error: QingflowApiError = exc
             for fallback_list_type in (14, 1, 2, 12):
@@ -2678,7 +2966,7 @@ class RecordTools(ToolBase):
                     return result if isinstance(result, dict) else {"value": result}, fallback_list_type, role
                 except QingflowApiError as fallback_exc:
                     last_error = fallback_exc
-                    if fallback_exc.backend_code == 40002:
+                    if _is_record_permission_denied_error(fallback_exc):
                         continue
                     raise
             raise last_error
@@ -2776,6 +3064,8 @@ class RecordTools(ToolBase):
                     if target_app_key == app_key and str(target_record_id) == str(source_record_id):
                         reference_payload["self_reference"] = True
                 except QingflowApiError as exc:
+                    if is_auth_like_error(exc):
+                        raise
                     unavailable = _record_detail_unavailable_context(
                         "reference_detail",
                         f"引用字段「{field.que_title}」的目标记录详情获取失败。",
@@ -2873,6 +3163,8 @@ class RecordTools(ToolBase):
                     json_body=body,
                 )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable = _record_detail_unavailable_context(
                 "reference_runtime_match",
                 "动态引用字段匹配数据获取失败。",
@@ -2927,6 +3219,8 @@ class RecordTools(ToolBase):
                 },
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("log_visibility", "侧边栏日志可见性获取失败。", exc))
             return {"status": "unavailable", "channel": channel, "data_log_visible": None, "workflow_log_visible": None}
         payload = visibility if isinstance(visibility, dict) else {}
@@ -2980,6 +3274,8 @@ class RecordTools(ToolBase):
                 source="data_logs",
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("data_logs", "最近数据日志获取失败。", exc))
             return _record_detail_log_unavailable_payload("data_logs", "fetch_unavailable")
 
@@ -3033,6 +3329,8 @@ class RecordTools(ToolBase):
                 source="workflow_logs",
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("workflow_logs", "流程日志本次获取失败。", exc))
             return _record_detail_log_unavailable_payload("workflow_logs", "fetch_unavailable")
 
@@ -3076,6 +3374,8 @@ class RecordTools(ToolBase):
                 deadline=deadline,
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("data_logs", "全量数据日志获取失败。", exc))
             return _record_logs_unavailable_payload("data_logs", "fetch_unavailable")
 
@@ -3135,6 +3435,8 @@ class RecordTools(ToolBase):
                 deadline=deadline,
             )
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("workflow_logs", "全量流程日志获取失败。", exc))
             return _record_logs_unavailable_payload("workflow_logs", "fetch_unavailable")
 
@@ -3167,6 +3469,8 @@ class RecordTools(ToolBase):
                     params["auditNodeId"] = audit_node_id
                 payload = self.backend.request("GET", context, f"/app/{app_key}/asosChart", params=params)
         except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             unavailable_context.append(_record_detail_unavailable_context("associated_resources", "关联资源获取失败。", exc))
             return []
         return [_record_detail_associated_resource(item) for item in _record_detail_associated_resource_items(payload)]
@@ -3204,16 +3508,17 @@ class RecordTools(ToolBase):
                 refresh_source_url=refresh_source_url,
             )
         except Exception as exc:  # defensive: media should never break the core record detail.
+            warning: JSONObject = {
+                "code": "MEDIA_ASSETS_UNAVAILABLE",
+                "message": f"record_get could not collect media assets: {exc}",
+            }
+            if isinstance(exc, QingflowApiError):
+                warning.update(_record_detail_error_warning_fields(exc))
             return {
                 "status": "unavailable",
                 "local_dir": None,
                 "items": [],
-                "warnings": [
-                    {
-                        "code": "MEDIA_ASSETS_UNAVAILABLE",
-                        "message": f"record_get could not collect media assets: {exc}",
-                    }
-                ],
+                "warnings": [warning],
             }
 
     def _record_get_file_assets(
@@ -3251,16 +3556,17 @@ class RecordTools(ToolBase):
                 refresh_source_url=refresh_source_url,
             )
         except Exception as exc:  # defensive: file assets should never break the core record detail.
+            warning = {
+                "code": "FILE_ASSETS_UNAVAILABLE",
+                "message": f"record_get could not collect file assets: {exc}",
+            }
+            if isinstance(exc, QingflowApiError):
+                warning.update(_record_detail_error_warning_fields(exc))
             return {
                 "status": "unavailable",
                 "local_dir": None,
                 "items": [],
-                "warnings": [
-                    {
-                        "code": "FILE_ASSETS_UNAVAILABLE",
-                        "message": f"record_get could not collect file assets: {exc}",
-                    }
-                ],
+                "warnings": [warning],
             }
 
     def _record_get_refreshed_media_source_url(
@@ -3272,7 +3578,7 @@ class RecordTools(ToolBase):
         resolved_view: AccessibleViewRoute,
         audit_node_id: int | None,
         candidate: JSONObject,
-    ) -> str | None:
+    ) -> JSONValue | None:
         """Refresh the detail payload once to recover an expired attachment storage signature."""
         if candidate.get("source") not in {"attachment", "image_field", "subtable"}:
             return None
@@ -3288,8 +3594,15 @@ class RecordTools(ToolBase):
                 resolved_view=resolved_view,
                 audit_node_id=audit_node_id,
             )
-        except QingflowApiError:
-            return None
+        except QingflowApiError as exc:
+            return {
+                "source_url": None,
+                "warning": _record_detail_unavailable_context(
+                    "asset_url_refresh",
+                    "record_get could not refresh the record detail before downloading a private asset.",
+                    exc,
+                ),
+            }
         for answer in _record_detail_answers(detail_result):
             if not isinstance(answer, dict) or _coerce_count(answer.get("queId")) != field_id:
                 continue
@@ -3804,6 +4117,7 @@ class RecordTools(ToolBase):
         record_id: Any | None,
         fields: JSONObject | None = None,
         items: list[JSONObject] | None = None,
+        view_id: str | None = None,
         dry_run: bool = False,
         verify_write: bool = True,
         output_profile: str = "normal",
@@ -3824,6 +4138,7 @@ class RecordTools(ToolBase):
                 profile=profile,
                 app_key=app_key,
                 items=normalized_items,
+                view_id=view_id,
                 dry_run=dry_run,
                 verify_write=verify_write,
                 output_profile=normalized_output_profile,
@@ -3840,6 +4155,7 @@ class RecordTools(ToolBase):
             app_key=app_key,
             record_id=record_id_int,
             fields=cast(JSONObject, fields or {}),
+            view_id=view_id,
             verify_write=verify_write,
             output_profile=normalized_output_profile,
         )
@@ -3851,17 +4167,61 @@ class RecordTools(ToolBase):
         app_key: str,
         record_id: int,
         fields: JSONObject,
+        view_id: str | None,
         verify_write: bool,
         output_profile: str,
+        capture_exceptions: bool = False,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        raw_preflight = self._preflight_record_update_with_auto_view(
-            profile=profile,
-            app_key=app_key,
-            record_id=record_id,
-            fields=fields,
-            force_refresh_form=False,
-        )
+        write_state = {"attempted": False}
+        try:
+            return self._record_update_public_single_impl(
+                profile=profile,
+                app_key=app_key,
+                record_id=record_id,
+                fields=fields,
+                view_id=view_id,
+                verify_write=verify_write,
+                output_profile=output_profile,
+                write_attempted_ref=lambda value: write_state.__setitem__("attempted", value),
+            )
+        except (QingflowApiError, RuntimeError) as exc:
+            if not capture_exceptions:
+                raise
+            return self._record_write_exception_response(
+                exc,
+                operation="update",
+                profile=profile,
+                app_key=app_key,
+                record_id=record_id,
+                output_profile=output_profile,
+                human_review=True,
+                write_executed=write_state["attempted"],
+            )
+
+    def _record_update_public_single_impl(
+        self,
+        *,
+        profile: str,
+        app_key: str,
+        record_id: int,
+        fields: JSONObject,
+        view_id: str | None,
+        verify_write: bool,
+        output_profile: str,
+        write_attempted_ref: Callable[[bool], None],
+    ) -> JSONObject:
+        """执行内部辅助逻辑。"""
+        preflight_kwargs: dict[str, Any] = {
+            "profile": profile,
+            "app_key": app_key,
+            "record_id": record_id,
+            "fields": fields,
+            "force_refresh_form": False,
+        }
+        if view_id is not None:
+            preflight_kwargs["preferred_view_id"] = view_id
+        raw_preflight = self._preflight_record_update_with_auto_view(**preflight_kwargs)
         preflight_used_force_refresh = self._record_preflight_used_force_refresh(raw_preflight)
         preflight_data = cast(JSONObject, raw_preflight.get("data", {}))
         normalized_payload = self._record_write_normalized_payload(
@@ -3881,6 +4241,7 @@ class RecordTools(ToolBase):
                 human_review=True,
                 target_resource={"type": "record", "app_key": app_key, "record_id": record_id, "record_ids": []},
             )
+        write_attempted_ref(True)
         route_apply, tried_routes, route_blocker = self._record_update_apply_with_auto_route(
             profile=profile,
             app_key=app_key,
@@ -4161,7 +4522,9 @@ class RecordTools(ToolBase):
         )
 
     def _record_update_route_permission_denied(self, exc: QingflowApiError) -> bool:
-        if exc.backend_code in {40002, 40027, 40038, 404}:
+        if is_auth_like_error(exc):
+            return False
+        if backend_code_int(exc) in {40002, 40027, 40038, 404}:
             return True
         if exc.http_status == 404:
             return True
@@ -4265,6 +4628,8 @@ class RecordTools(ToolBase):
                         },
                     )
                 except QingflowApiError as exc:
+                    if not _is_optional_record_auxiliary_lookup_error(exc):
+                        raise
                     return unavailable(
                         error_code="TASK_UPDATE_ROUTE_NOT_AVAILABLE",
                         reason="current-user todo task list is unavailable",
@@ -4312,6 +4677,8 @@ class RecordTools(ToolBase):
                     f"/app/{app_key}/auditNode/{workflow_node_id}/editableQueIds",
                 )
             except QingflowApiError as exc:
+                if not _is_optional_record_auxiliary_lookup_error(exc):
+                    raise
                 return unavailable(
                     error_code="TASK_EDITABLE_FIELDS_UNAVAILABLE",
                     reason="workflow node editable field list is unavailable; record_update will not guess task editability",
@@ -4462,7 +4829,7 @@ class RecordTools(ToolBase):
             raise_tool_error(QingflowApiError.config_error("view_key is required for custom view update"))
 
         def runner(session_profile, context):
-            index = self._get_field_index(profile, context, app_key, force_refresh=force_refresh_form) if verify_write else None
+            index = self._get_view_field_index(profile, context, normalized_view_key, force_refresh=force_refresh_form) if verify_write else None
             normalized_answers = [dict(item) for item in answers if isinstance(item, dict)]
             self._validate_record_write(app_key, normalized_answers, apply_id=normalized_apply_id)
             result = self.backend.request(
@@ -4565,6 +4932,7 @@ class RecordTools(ToolBase):
         profile: str,
         app_key: str,
         items: list[JSONObject],
+        view_id: str | None,
         dry_run: bool,
         verify_write: bool,
         output_profile: str,
@@ -4576,6 +4944,7 @@ class RecordTools(ToolBase):
                 app_key=app_key,
                 record_id=cast(int, item["record_id"]),
                 fields=cast(JSONObject, item["fields"]),
+                view_id=view_id,
                 output_profile=output_profile,
             )
             for item in items
@@ -4604,8 +4973,10 @@ class RecordTools(ToolBase):
                         app_key=app_key,
                         record_id=record_id,
                         fields=fields,
+                        view_id=view_id,
                         verify_write=verify_write,
                         output_profile=output_profile,
+                        capture_exceptions=True,
                     )
                 )
             except (QingflowApiError, RuntimeError) as exc:
@@ -4636,16 +5007,20 @@ class RecordTools(ToolBase):
         app_key: str,
         record_id: int,
         fields: JSONObject,
+        view_id: str | None,
         output_profile: str,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        raw_preflight = self._preflight_record_update_with_auto_view(
-            profile=profile,
-            app_key=app_key,
-            record_id=record_id,
-            fields=fields,
-            force_refresh_form=False,
-        )
+        preflight_kwargs: dict[str, Any] = {
+            "profile": profile,
+            "app_key": app_key,
+            "record_id": record_id,
+            "fields": fields,
+            "force_refresh_form": False,
+        }
+        if view_id is not None:
+            preflight_kwargs["preferred_view_id"] = view_id
+        raw_preflight = self._preflight_record_update_with_auto_view(**preflight_kwargs)
         preflight_data = cast(JSONObject, raw_preflight.get("data", {}))
         normalized_payload = self._record_write_normalized_payload(
             operation="update",
@@ -4851,6 +5226,9 @@ class RecordTools(ToolBase):
         item: JSONObject = {
             "resource": data.get("resource"),
             "status": response.get("status"),
+            "write_executed": bool(response.get("write_executed")),
+            "safe_to_retry": bool(response.get("safe_to_retry", True)),
+            "verification_status": response.get("verification_status", "not_requested"),
             "verification": data.get("verification"),
             "field_errors": cast(list[JSONObject], data.get("field_errors", [])),
             "confirmation_requests": cast(list[JSONObject], data.get("confirmation_requests", [])),
@@ -4860,7 +5238,7 @@ class RecordTools(ToolBase):
         if isinstance(update_route, dict):
             item["update_route"] = update_route
         tried_routes = response.get("tried_routes")
-        if isinstance(tried_routes, list):
+        if isinstance(tried_routes, list) and (output_profile == "verbose" or response.get("status") != "success"):
             item["tried_routes"] = tried_routes
         blockers = data.get("blockers")
         if isinstance(blockers, list) and blockers:
@@ -4882,6 +5260,7 @@ class RecordTools(ToolBase):
         app_key: str,
         record_id: int,
         fields: JSONObject,
+        preferred_view_id: str | None = None,
         force_refresh_form: bool,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
@@ -4889,6 +5268,25 @@ class RecordTools(ToolBase):
             request_route = self._request_route_payload(context)
             def build_once(*, effective_force_refresh: bool) -> JSONObject:
                 candidate_routes = self._candidate_update_views(profile, context, app_key)
+                normalized_preferred_view_id = _normalize_optional_text(preferred_view_id)
+                if normalized_preferred_view_id:
+                    preferred_route = next(
+                        (
+                            route
+                            for route in candidate_routes
+                            if route.view_id == normalized_preferred_view_id
+                        ),
+                        None,
+                    )
+                    if preferred_route is None:
+                        raise_tool_error(
+                            QingflowApiError.config_error(
+                                f"view_id '{normalized_preferred_view_id}' is not an accessible update candidate"
+                        )
+                    )
+                    candidate_routes = [preferred_route]
+                else:
+                    candidate_routes = _prefer_custom_update_routes(candidate_routes)
                 probes = self._probe_candidate_record_contexts(
                     context,
                     app_key=app_key,
@@ -5102,41 +5500,24 @@ class RecordTools(ToolBase):
                         "data": first_confirmation_plan,
                     }
 
-                union_plan = self._build_record_update_union_preflight(
-                    profile=profile,
-                    context=context,
-                    app_key=app_key,
-                    record_id=record_id,
-                    fields=fields,
-                    current_answers=matched_answers_for_union or [],
-                    matched_routes=matched_routes,
-                    force_refresh_form=effective_force_refresh,
-                )
-                if union_plan is not None:
-                    validation = union_plan.get("validation")
-                    if isinstance(validation, dict):
-                        warnings = validation.get("warnings")
-                        if not isinstance(warnings, list):
-                            warnings = []
-                            validation["warnings"] = warnings
-                        for message in fallback_warning_messages:
-                            if message not in warnings:
-                                warnings.append(message)
-                    union_plan["view_probe_summary"] = probe_summary
-                    union_plan["record_context_probe"] = probe_summary
+                if normalized_preferred_view_id and first_blocked_plan is not None:
+                    first_blocked_plan["view_probe_summary"] = probe_summary
+                    first_blocked_plan["record_context_probe"] = probe_summary
                     return {
                         "profile": profile,
                         "ws_id": session_profile.selected_ws_id,
                         "ok": True,
                         "request_route": request_route,
-                        "data": union_plan,
+                        "data": first_blocked_plan,
                     }
 
                 blocked_data = self._build_auto_view_blocked_preflight_data(
                     app_key=app_key,
                     record_id=record_id,
                     blockers=["NO_SINGLE_VIEW_CAN_UPDATE_ALL_FIELDS"],
-                    warnings=[],
+                    warnings=[
+                        "record_update requires one executable frontend route for the full payload; it does not merge writable fields across multiple views."
+                    ],
                     recommended_next_actions=[
                         "Call record_update_schema_get first to inspect the overall writable field set for this record.",
                         "Reduce the update payload until all requested fields fit inside one matched accessible view.",
@@ -5183,6 +5564,7 @@ class RecordTools(ToolBase):
         union_writable_field_ids: set[int] = set()
         union_visible_question_ids: set[int] = set()
         matched_view_payloads: list[JSONObject] = []
+        union_index: FieldIndex | None = None
 
         for candidate in matched_routes:
             browse_scope = self._build_browse_write_scope(
@@ -5192,11 +5574,13 @@ class RecordTools(ToolBase):
                 candidate,
                 force_refresh=force_refresh_form,
             )
+            browse_index = cast(FieldIndex, browse_scope["index"])
+            union_index = browse_index if union_index is None else _merge_field_indexes(union_index, browse_index)
             union_writable_field_ids.update(cast(set[int], browse_scope["writable_field_ids"]))
             union_visible_question_ids.update(cast(set[int], browse_scope["visible_question_ids"]))
             matched_view_payloads.append(_accessible_view_payload(candidate))
 
-        if not union_writable_field_ids and not union_visible_question_ids:
+        if union_index is None or (not union_writable_field_ids and not union_visible_question_ids):
             return None
 
         plan_data = self._build_record_write_preflight(
@@ -5213,10 +5597,9 @@ class RecordTools(ToolBase):
             view_key=None,
             view_name=None,
             existing_answers_override=current_answers,
+            field_index_override=union_index,
         )
 
-        schema = self._get_form_schema(profile, context, app_key, force_refresh=force_refresh_form)
-        app_index = _build_applicant_top_level_field_index(schema)
         validation = cast(JSONObject, plan_data.get("validation", {}))
         invalid_fields = cast(list[JSONObject], validation.get("invalid_fields", []))
         missing_required_fields = cast(list[JSONObject], validation.get("missing_required_fields", []))
@@ -5227,12 +5610,21 @@ class RecordTools(ToolBase):
             invalid_fields.extend(
                 self._validate_view_scoped_subtable_answers(
                     normalized_answers=cast(list[JSONObject], plan_data.get("normalized_answers", [])),
-                    full_index=app_index,
-                    selector_index=app_index,
+                    full_index=union_index,
+                    selector_index=union_index,
                     visible_question_ids=union_visible_question_ids,
                 )
             )
 
+        readonly_or_system_fields = [
+            item
+            for item in readonly_or_system_fields
+            if not (
+                isinstance(item, dict)
+                and (que_id := _coerce_count(item.get("que_id"))) is not None
+                and que_id in union_writable_field_ids
+            )
+        ]
         existing_readonly_ids = {
             str(_coerce_count(item.get("que_id")))
             for item in readonly_or_system_fields
@@ -5396,7 +5788,13 @@ class RecordTools(ToolBase):
                     view_type=None,
                 )
             )
-        for item in self._get_view_list(profile, context, app_key):
+        try:
+            view_items = self._get_view_list(profile, context, app_key)
+        except QingflowApiError as exc:
+            if not _is_record_permission_denied_error(exc):
+                raise
+            view_items = []
+        for item in view_items:
             if not isinstance(item, dict):
                 continue
             view_key = _normalize_optional_text(item.get("viewKey"))
@@ -5453,7 +5851,9 @@ class RecordTools(ToolBase):
         return payload
 
     def _is_record_context_route_miss(self, error: QingflowApiError) -> bool:
-        if error.backend_code in {40002, 40023, 40027, 40038, 404}:
+        if is_auth_like_error(error):
+            return False
+        if backend_code_int(error) in {40002, 40023, 40027, 40038, 404}:
             return True
         if error.http_status == 404:
             return True
@@ -5483,11 +5883,12 @@ class RecordTools(ToolBase):
             used_list_type = None
         else:
             used_list_type = resolved_view.list_type if resolved_view.list_type is not None else DEFAULT_RECORD_LIST_TYPE
+            role = _record_detail_role_for_list_type(used_list_type)
             record = self.backend.request(
                 "GET",
                 context,
                 f"/app/{app_key}/apply/{apply_id}",
-                params={"role": 1, "listType": used_list_type},
+                params={"role": role, "listType": used_list_type},
             )
         answers = record.get("answers") if isinstance(record, dict) else None
         normalized_answers = [item for item in answers if isinstance(item, dict)] if isinstance(answers, list) else []
@@ -5517,6 +5918,8 @@ class RecordTools(ToolBase):
                 error_payload=None,
             )
         except QingflowApiError as exc:
+            if not self._is_record_context_route_miss(exc):
+                raise
             return RecordContextRouteProbe(
                 route=resolved_view,
                 answer_list=None,
@@ -5588,7 +5991,7 @@ class RecordTools(ToolBase):
         ]
 
     def _looks_like_generic_record_update_backend_failure(self, exc: QingflowApiError) -> bool:
-        if exc.backend_code == 500:
+        if backend_code_int(exc) == 500:
             return True
         if exc.http_status is not None and exc.http_status >= 500:
             return True
@@ -5713,12 +6116,15 @@ class RecordTools(ToolBase):
         app_key: str,
         record_id: Any | None = None,
         record_ids: list[Any] | None = None,
+        view_id: str | None = None,
+        list_type: int | None = None,
         output_profile: str = "normal",
     ) -> JSONObject:
         """执行记录相关逻辑。"""
         normalized_output_profile = self._normalize_public_output_profile(output_profile)
         if not app_key:
             raise_tool_error(QingflowApiError.config_error("app_key is required"))
+        delete_list_type = self._resolve_record_delete_list_type(view_id=view_id, list_type=list_type)
         normalized_record_ids: list[int] = []
         for index, item in enumerate(record_ids or []):
             normalized_record_ids.append(normalize_positive_id_int(item, field_name=f"record_ids[{index}]"))
@@ -5738,21 +6144,72 @@ class RecordTools(ToolBase):
             "record_ids": [stringify_backend_id(item) for item in delete_ids],
             "answers": [],
             "submit_type": 1,
+            "selection": {"view_id": view_id, "list_type": delete_list_type},
         }
         return self._record_delete_public_batch(
             profile=profile,
             app_key=app_key,
             delete_ids=delete_ids,
+            list_type=delete_list_type,
             normalized_payload=normalized_payload,
             output_profile=normalized_output_profile,
         )
 
+    def _resolve_record_delete_list_type(self, *, view_id: str | None, list_type: int | None) -> int:
+        normalized_view_id = _normalize_optional_text(view_id)
+        if normalized_view_id:
+            if normalized_view_id.startswith("custom:"):
+                raise_tool_error(
+                    QingflowApiError.config_error(
+                        "record_delete does not support custom view deletion; the backend delete route accepts system listType only",
+                        details={
+                            "error_code": "RECORD_DELETE_CUSTOM_VIEW_UNSUPPORTED",
+                            "view_id": normalized_view_id,
+                            "fix_hint": (
+                                "Use a system view_id from app_get.accessible_views, or resolve target record_ids with "
+                                "record list/get first and retry delete without a custom view selector."
+                            ),
+                        },
+                    )
+                )
+            if not normalized_view_id.startswith("system:"):
+                raise_tool_error(QingflowApiError.config_error("view_id must start with system: or custom:"))
+            mapped_list_type = SYSTEM_VIEW_ID_TO_LIST_TYPE.get(normalized_view_id)
+            if mapped_list_type is None:
+                raise_tool_error(QingflowApiError.config_error(f"unsupported view_id '{normalized_view_id}'"))
+            return mapped_list_type
+        if list_type is not None:
+            normalized_list_type = int(list_type)
+            if normalized_list_type not in SYSTEM_VIEW_LIST_TYPES:
+                raise_tool_error(
+                    QingflowApiError.config_error(
+                        "record_delete list_type must map to a supported system view",
+                        details={
+                            "error_code": "RECORD_DELETE_SYSTEM_VIEW_REQUIRED",
+                            "list_type": normalized_list_type,
+                            "supported_list_types": sorted(SYSTEM_VIEW_LIST_TYPES),
+                            "fix_hint": "Pass a system view_id from app_get.accessible_views instead of an arbitrary list_type.",
+                        },
+                    )
+                )
+            return normalized_list_type
+        raise_tool_error(
+            QingflowApiError.config_error(
+                "record_delete requires a system view_id or list_type; deleting without frontend list context is ambiguous",
+                details={
+                    "error_code": "RECORD_DELETE_VIEW_REQUIRED",
+                    "fix_hint": "Pass a system view_id from app_get.accessible_views, for example --view-id system:all. If the target came from a custom view, first confirm the record_id, then choose an accessible system view for deletion.",
+                },
+            )
+        )
+
     def _record_delete_public_batch(
         self,
         *,
         profile: str,
         app_key: str,
         delete_ids: list[int],
+        list_type: int,
         normalized_payload: JSONObject,
         output_profile: str,
     ) -> JSONObject:
@@ -5762,7 +6219,7 @@ class RecordTools(ToolBase):
         for index, delete_id in enumerate(delete_ids):
             record_id_text = stringify_backend_id(delete_id)
             try:
-                raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=[delete_id])
+                raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=[delete_id], list_type=list_type)
                 request_route = cast(JSONObject, raw_apply.get("request_route")) if isinstance(raw_apply.get("request_route"), dict) else request_route
                 ws_id = raw_apply.get("ws_id", ws_id)
                 single_payload = {
@@ -5771,6 +6228,7 @@ class RecordTools(ToolBase):
                     "record_ids": [record_id_text],
                     "answers": [],
                     "submit_type": 1,
+                    "selection": normalized_payload.get("selection"),
                 }
                 single_response = self._record_write_apply_response(
                     raw_apply,
@@ -6053,12 +6511,13 @@ class RecordTools(ToolBase):
                 preflight=raw_preflight,
             )
 
-        if uses_view_scope:
+        if view_key is not None or view_name is not None:
             raise_tool_error(
                 QingflowApiError.config_error(
-                    "delete does not accept view selectors yet; resolve target record_ids from the selected view first, then call delete by record_id/record_ids"
+                    "delete does not support custom view selectors; use a system view_id/list_type or resolve target record_ids first"
                 )
             )
+        delete_list_type = self._resolve_record_delete_list_type(view_id=view_id, list_type=list_type)
         if normalized_values or normalized_set:
             raise_tool_error(QingflowApiError.config_error("delete must not include values or set"))
         delete_ids = normalized_record_ids or ([record_id] if record_id is not None and record_id > 0 else [])
@@ -6070,8 +6529,9 @@ class RecordTools(ToolBase):
             "record_ids": delete_ids,
             "answers": [],
             "submit_type": submit_type_value,
+            "selection": {"view_id": view_id, "list_type": delete_list_type},
         }
-        raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=delete_ids)
+        raw_apply = self._record_delete_many(profile=profile, app_key=app_key, record_ids=delete_ids, list_type=delete_list_type)
         return self._record_write_apply_response(
             raw_apply,
             operation="delete",
@@ -6221,7 +6681,9 @@ class RecordTools(ToolBase):
                     or _normalize_optional_text(payload.get("appName"))
                     or _normalize_optional_text(payload.get("appTitle"))
                 )
-        except QingflowApiError:
+        except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             name = None
         self._app_name_cache[cache_key] = name
         return name
@@ -6375,7 +6837,9 @@ class RecordTools(ToolBase):
         try:
             result = self.backend.request("GET", context, "/data/baseInfo", params={"queId": field.que_id})
             payload = result if isinstance(result, dict) else None
-        except QingflowApiError:
+        except QingflowApiError as exc:
+            if is_auth_like_error(exc):
+                raise
             payload = None
         self._relation_base_info_cache[cache_key] = payload or {}
         return payload
@@ -6648,6 +7112,26 @@ class RecordTools(ToolBase):
             or bool(fields)
         )
 
+    def _member_candidate_static_preview_should_use_backend(self, field: FormField) -> bool:
+        """Return true when the frontend field-scope endpoint is safer than directory expansion."""
+        scope = field.member_select_scope if isinstance(field.member_select_scope, dict) else {}
+        if field.member_select_scope_type != 2:
+            return False
+        return bool(
+            _scope_has_dynamic_or_external(scope)
+            or list(scope.get("depart") or [])
+            or list(scope.get("role") or [])
+        )
+
+    def _department_candidate_static_preview_should_use_backend(self, field: FormField) -> bool:
+        """Return true when static preview would otherwise need ContactAuth-only directory APIs."""
+        scope = field.dept_select_scope if isinstance(field.dept_select_scope, dict) else {}
+        if field.dept_select_scope_type != 2:
+            return False
+        if _scope_has_dynamic_or_external(scope):
+            return True
+        return bool(_normalize_bool(scope.get("includeSubDeparts")) or not list(scope.get("depart") or []))
+
     def _build_candidate_lookup_state(
         self,
         profile: str,
@@ -6666,7 +7150,9 @@ class RecordTools(ToolBase):
         if apply_id is not None:
             try:
                 base_answers = self._load_record_answers_for_preflight(context, app_key=app_key, apply_id=apply_id)
-            except QingflowApiError:
+            except QingflowApiError as exc:
+                if not _is_optional_record_auxiliary_lookup_error(exc):
+                    raise
                 context_complete = False
         state = LookupResolutionState(
             operation="update" if apply_id is not None else "insert",
@@ -7156,15 +7642,16 @@ class RecordTools(ToolBase):
                 )
                 if configured_candidate is not None:
                     self._merge_department_candidate(merged, configured_candidate)
-                for dept in self._list_departments_by_scope(context, dept_id=dept_id, include_sub_departments=include_sub):
-                    normalized = _normalize_candidate_department(
-                        dept,
-                        source_kind="department",
-                        source_id=dept_id,
-                        source_value=dept_name,
-                    )
-                    if normalized is not None:
-                        self._merge_department_candidate(merged, normalized)
+                if include_sub:
+                    for dept in self._list_departments_by_scope(context, dept_id=dept_id, include_sub_departments=True):
+                        normalized = _normalize_candidate_department(
+                            dept,
+                            source_kind="department",
+                            source_id=dept_id,
+                            source_value=dept_name,
+                        )
+                        if normalized is not None:
+                            self._merge_department_candidate(merged, normalized)
         filtered = _filter_department_candidates(list(merged.values()), keyword)
         filtered.sort(key=lambda item: (_normalize_optional_text(item.get("value")) or "", _coerce_count(item.get("id")) or 0))
         return filtered
@@ -8305,22 +8792,10 @@ class RecordTools(ToolBase):
         field_index_override: FieldIndex | None = None,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        schema = self._get_form_schema(profile, context, app_key, force_refresh=force_refresh_form)
-        base_index = field_index_override or _build_applicant_top_level_field_index(schema)
-        question_relations = _collect_question_relations(schema)
-        runtime_linked_field_ids = _collect_linked_required_field_ids(question_relations)
-        runtime_linked_field_ids.update(_collect_option_linked_field_ids(base_index))
-        index = base_index
-        if operation == "create" and field_index_override is None:
-            linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
-                schema,
-                linked_field_ids=runtime_linked_field_ids,
-            )
-            index = _merge_field_indexes(base_index, linked_hidden_index)
         normalized_fields = fields or {}
         normalized_answers_input = answers or []
         resolved_view: AccessibleViewRoute | None = None
-        selector_index = index
+        selector_index: FieldIndex | None = field_index_override
         browse_writable_field_ids: set[int] = set()
         visible_question_ids: set[int] = set()
         if any(item is not None for item in (view_id, list_type, view_key, view_name)):
@@ -8346,6 +8821,31 @@ class RecordTools(ToolBase):
             visible_question_ids = cast(set[int], browse_scope["visible_question_ids"])
         else:
             compatibility_warnings = []
+        if field_index_override is not None:
+            base_index = field_index_override
+            question_relations: list[JSONObject] = []
+            runtime_linked_field_ids: set[int] = set()
+            index = base_index
+        elif operation == "update" and resolved_view is not None:
+            base_index = cast(FieldIndex, selector_index)
+            question_relations = []
+            runtime_linked_field_ids = set()
+            index = base_index
+        else:
+            schema = self._get_form_schema(profile, context, app_key, force_refresh=force_refresh_form)
+            base_index = _build_applicant_top_level_field_index(schema)
+            question_relations = _collect_question_relations(schema)
+            runtime_linked_field_ids = _collect_linked_required_field_ids(question_relations)
+            runtime_linked_field_ids.update(_collect_option_linked_field_ids(base_index))
+            index = base_index
+            if operation == "create":
+                linked_hidden_index = _build_applicant_hidden_linked_top_level_field_index(
+                    schema,
+                    linked_field_ids=runtime_linked_field_ids,
+                )
+                index = _merge_field_indexes(base_index, linked_hidden_index)
+        if selector_index is None:
+            selector_index = index
         resolved_fields = self._collect_write_plan_field_refs(fields=normalized_fields, answers=normalized_answers_input, index=selector_index)
         support_matrix = _summarize_write_support(resolved_fields)
         invalid_fields: list[JSONObject] = []
@@ -8389,7 +8889,9 @@ class RecordTools(ToolBase):
                             apply_id=apply_id,
                         )
                     existing_answers_loaded = True
-                except QingflowApiError:
+                except QingflowApiError as exc:
+                    if not _is_optional_record_auxiliary_lookup_error(exc):
+                        raise
                     validation_warnings.append(
                         "update preflight could not load the current record; required-field completeness and dynamic lookup context were not fully revalidated."
                     )
@@ -8978,7 +9480,7 @@ class RecordTools(ToolBase):
                     break
                 except QingflowApiError as exc:
                     last_error = exc
-                    if exc.backend_code == 40002:
+                    if _is_record_permission_denied_error(exc):
                         continue
                     raise
             if result is None:
@@ -9081,7 +9583,21 @@ class RecordTools(ToolBase):
         normalized_apply_id = self._validate_app_and_record(app_key, apply_id)
 
         def runner(session_profile, context):
-            index = self._get_field_index(profile, context, app_key, force_refresh=force_refresh_form) if verify_write else None
+            needs_index = verify_write or bool(fields) or _answers_need_resolution(answers or [])
+            update_index = None
+            if needs_index:
+                update_index = (
+                    self._get_system_browse_field_index(
+                        profile,
+                        context,
+                        app_key,
+                        list_type=DEFAULT_RECORD_LIST_TYPE,
+                        force_refresh=force_refresh_form,
+                    )
+                    if role == 1
+                    else self._get_field_index(profile, context, app_key, force_refresh=force_refresh_form)
+                )
+            index = update_index if verify_write else None
             normalized_answers = self._resolve_answers(
                 profile,
                 context,
@@ -9089,6 +9605,7 @@ class RecordTools(ToolBase):
                 answers=answers or [],
                 fields=fields or {},
                 force_refresh_form=force_refresh_form,
+                field_index_override=update_index,
             )
             self._validate_record_write(app_key, normalized_answers, apply_id=normalized_apply_id)
             try:
@@ -9142,13 +9659,14 @@ class RecordTools(ToolBase):
     def record_delete(self, *, profile: str, app_key: str, apply_id: int, list_type: int) -> JSONObject:
         """执行记录相关逻辑。"""
         normalized_apply_id = self._validate_app_and_record(app_key, apply_id)
+        delete_list_type = self._resolve_record_delete_list_type(view_id=None, list_type=list_type)
 
         def runner(session_profile, context):
             result = self.backend.request(
                 "DELETE",
                 context,
                 f"/app/{app_key}/apply",
-                json_body={"type": list_type, "applyIds": [normalized_apply_id]},
+                json_body={"type": delete_list_type, "applyIds": [normalized_apply_id]},
             )
             return self._attach_human_review_notice(
                 {
@@ -9157,6 +9675,7 @@ class RecordTools(ToolBase):
                     "request_route": self._request_route_payload(context),
                     "app_key": app_key,
                     "apply_id": normalized_apply_id,
+                    "list_type": delete_list_type,
                     "result": result,
                 },
                 operation="delete",
@@ -9201,7 +9720,7 @@ class RecordTools(ToolBase):
                 "GET",
                 context,
                 f"/app/{app_key}/apply/{apply_id}",
-                params={"role": 1, "listType": list_type},
+                params={"role": _record_detail_role_for_list_type(list_type), "listType": list_type},
             )
             answers = result.get("answers") if isinstance(result, dict) else None
             answer_list = answers if isinstance(answers, list) else []
@@ -9560,7 +10079,7 @@ class RecordTools(ToolBase):
         used_list_type: int | None = None
         if view_selection is not None:
             fallback_list_types = [view_route.list_type if view_route.list_type is not None else DEFAULT_RECORD_LIST_TYPE]
-        elif view_route.list_type is not None and view_route.list_type != DEFAULT_RECORD_LIST_TYPE:
+        elif view_route.list_type is not None:
             fallback_list_types = [view_route.list_type]
         else:
             fallback_list_types = [DEFAULT_RECORD_LIST_TYPE, 14, 1, 2, 12]
@@ -9791,7 +10310,7 @@ class RecordTools(ToolBase):
         try:
             payload = self.backend.request("GET", context, f"/view/{view_key}/viewConfig")
         except QingflowApiError as exc:
-            if exc.backend_code in {40002, 40027, 404} or exc.http_status == 404:
+            if _is_optional_schema_permission_error(exc):
                 self._view_config_cache[cache_key] = None
                 return None
             raise
@@ -9912,7 +10431,12 @@ class RecordTools(ToolBase):
         )
         normalized = _normalize_data_list_base_info_schema(payload)
         if not isinstance(normalized.get("formQues"), list) or not normalized.get("formQues"):
-            return self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
+            try:
+                return self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
+            except QingflowApiError as exc:
+                if not _is_optional_schema_permission_error(exc):
+                    raise
+                return normalized
         self._form_cache[cache_key] = normalized
         return normalized
 
@@ -9944,8 +10468,16 @@ class RecordTools(ToolBase):
         cache_key = (profile, f"view:{view_key}", "browse_view_base_info", None)
         if not force_refresh and cache_key in self._form_cache:
             return self._form_cache[cache_key]
-        payload = self.backend.request("GET", context, f"/view/{view_key}/apply/baseInfo")
-        normalized = _normalize_data_list_base_info_schema(payload)
+        try:
+            payload = self.backend.request("GET", context, f"/view/{view_key}/apply/baseInfo")
+            normalized = _normalize_data_list_base_info_schema(payload)
+            form_ques = normalized.get("formQues")
+            if not isinstance(form_ques, list) or not form_ques:
+                normalized = self._get_view_form_schema(profile, context, view_key, force_refresh=force_refresh)
+        except QingflowApiError as exc:
+            if not _is_optional_schema_permission_error(exc):
+                raise
+            normalized = self._get_view_form_schema(profile, context, view_key, force_refresh=force_refresh)
         self._form_cache[cache_key] = normalized
         return normalized
 
@@ -10001,22 +10533,6 @@ class RecordTools(ToolBase):
         force_refresh: bool,
     ) -> JSONObject:
         """Build the UI/table-view readable field scope from apply/baseInfo."""
-        applicant_index: FieldIndex | None
-        applicant_writable_field_ids: set[int]
-        try:
-            applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
-        except QingflowApiError as exc:
-            if exc.backend_code != 40002:
-                raise
-            applicant_index = None
-            applicant_writable_field_ids = set()
-        else:
-            applicant_writable_field_ids = {
-                field.que_id
-                for field in applicant_index.by_id.values()
-                if bool(self._schema_write_hints(field)["writable"])
-            }
-
         if resolved_view is not None and resolved_view.kind == "custom" and resolved_view.view_selection is not None:
             schema = self._get_custom_view_browse_schema(
                 profile,
@@ -10025,6 +10541,16 @@ class RecordTools(ToolBase):
                 force_refresh=force_refresh,
             )
             index = _build_top_level_field_index(schema)
+            visible_question_ids = {field.que_id for field in index.by_id.values()}
+            return {
+                "index": index,
+                "writable_field_ids": {
+                    field.que_id
+                    for field in index.by_id.values()
+                    if bool(self._schema_write_hints(field)["writable"])
+                },
+                "visible_question_ids": visible_question_ids,
+            }
         elif resolved_view is not None and resolved_view.kind == "system" and resolved_view.list_type is not None:
             schema = self._get_system_browse_base_info_schema(
                 profile,
@@ -10034,34 +10560,26 @@ class RecordTools(ToolBase):
                 force_refresh=force_refresh,
             )
             index = _build_top_level_field_index(schema)
-        else:
-            index = applicant_index or _build_top_level_field_index(
-                self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
-            )
-
-        if applicant_index is not None and index.by_id:
-            enriched_fields = [
-                _enrich_read_field_from_applicant(field, applicant_index.by_id.get(str(field.que_id)))
-                for field in index.by_id.values()
-            ]
-            index = _build_top_level_field_index({"formQues": [[_form_field_to_question(field) for field in enriched_fields]]})
+            visible_question_ids = {field.que_id for field in index.by_id.values()}
+            return {
+                "index": index,
+                "writable_field_ids": {
+                    field.que_id
+                    for field in index.by_id.values()
+                    if bool(self._schema_write_hints(field)["writable"])
+                },
+                "visible_question_ids": visible_question_ids,
+            }
 
-        visible_question_ids = {field.que_id for field in index.by_id.values()}
-        if applicant_index is None:
-            writable_field_ids = {
+        applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
+        visible_question_ids = {field.que_id for field in applicant_index.by_id.values()}
+        return {
+            "index": applicant_index,
+            "writable_field_ids": {
                 field.que_id
-                for field in index.by_id.values()
+                for field in applicant_index.by_id.values()
                 if bool(self._schema_write_hints(field)["writable"])
-            }
-        else:
-            writable_field_ids = {
-                field_id
-                for field_id in visible_question_ids
-                if field_id in applicant_writable_field_ids
-            }
-        return {
-            "index": index,
-            "writable_field_ids": writable_field_ids,
+            },
             "visible_question_ids": visible_question_ids,
         }
 
@@ -10075,23 +10593,13 @@ class RecordTools(ToolBase):
         force_refresh: bool,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
-        applicant_index: FieldIndex | None
-        applicant_writable_field_ids: set[int]
-        try:
-            applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
-        except QingflowApiError as exc:
-            if exc.backend_code != 40002:
-                raise
-            applicant_index = None
-            applicant_writable_field_ids = set()
-        else:
-            applicant_writable_field_ids = {
-                field.que_id
-                for field in applicant_index.by_id.values()
-                if bool(self._schema_write_hints(field)["writable"])
-            }
         if resolved_view is not None and resolved_view.kind == "custom" and resolved_view.view_selection is not None:
-            schema = self._get_view_form_schema(profile, context, resolved_view.view_selection.view_key, force_refresh=force_refresh)
+            schema = self._get_custom_view_browse_schema(
+                profile,
+                context,
+                resolved_view.view_selection.view_key,
+                force_refresh=force_refresh,
+            )
             index = _build_top_level_field_index(schema)
             visible_question_ids = self._get_view_question_ids(profile, context, resolved_view.view_selection.view_key)
             if not visible_question_ids:
@@ -10107,6 +10615,12 @@ class RecordTools(ToolBase):
             index = _build_top_level_field_index(schema)
             visible_question_ids = _question_ids_from_schema(schema)
         else:
+            applicant_index = self._get_applicant_top_level_field_index(profile, context, app_key, force_refresh=force_refresh)
+            applicant_writable_field_ids = {
+                field.que_id
+                for field in applicant_index.by_id.values()
+                if bool(self._schema_write_hints(field)["writable"])
+            }
             index = applicant_index or _build_top_level_field_index(
                 self._get_form_schema(profile, context, app_key, force_refresh=force_refresh)
             )
@@ -10125,43 +10639,13 @@ class RecordTools(ToolBase):
                 "visible_question_ids": set(visible_question_ids),
             }
 
-        if applicant_index is None:
-            return {
-                "index": index,
-                "writable_field_ids": {
-                    field.que_id
-                    for field in index.by_id.values()
-                    if bool(self._schema_write_hints(field)["writable"])
-                },
-                "visible_question_ids": visible_question_ids,
-            }
-
-        augmented_fields = [
-            _clone_form_field(applicant_index.by_id.get(str(field.que_id)) or field)
-            for field in index.by_id.values()
-        ]
-        augmented_field_ids = {field.que_id for field in augmented_fields}
-        writable_field_ids = {
-            field_id
-            for field_id in visible_question_ids
-            if field_id in applicant_writable_field_ids
-        }
-        for field in applicant_index.by_id.values():
-            descendant_ids = _subtable_descendant_ids(field)
-            field_visible = field.que_id in visible_question_ids
-            descendant_visible = bool(descendant_ids and (descendant_ids & visible_question_ids))
-            if not field_visible and not descendant_visible:
-                continue
-            if field.que_id not in augmented_field_ids:
-                augmented_fields.append(_clone_form_field(field))
-                augmented_field_ids.add(field.que_id)
-            if descendant_visible:
-                visible_question_ids.add(field.que_id)
-            if field.que_id in applicant_writable_field_ids and (field_visible or descendant_visible):
-                writable_field_ids.add(field.que_id)
         return {
-            "index": _build_top_level_field_index({"formQues": [[_form_field_to_question(field) for field in augmented_fields]]}),
-            "writable_field_ids": writable_field_ids,
+            "index": index,
+            "writable_field_ids": {
+                field.que_id
+                for field in index.by_id.values()
+                if bool(self._schema_write_hints(field)["writable"])
+            },
             "visible_question_ids": visible_question_ids,
         }
 
@@ -10226,7 +10710,7 @@ class RecordTools(ToolBase):
         try:
             payload = self.backend.request("GET", context, f"/view/{view_key}/question")
         except QingflowApiError as exc:
-            if exc.backend_code in {40002, 40027}:
+            if _is_record_permission_denied_error(exc):
                 return set()
             raise
         if not isinstance(payload, list):
@@ -10270,7 +10754,7 @@ class RecordTools(ToolBase):
             )
             return True
         except QingflowApiError as exc:
-            if exc.backend_code in {40002, 40027}:
+            if _is_record_permission_denied_error(exc):
                 return False
             raise
 
@@ -10423,7 +10907,12 @@ class RecordTools(ToolBase):
         requested_name = _normalize_optional_text(view_name)
         if requested_key is None and requested_name is None:
             return None
-        views = self._get_view_list(profile, context, app_key)
+        try:
+            views = self._get_view_list(profile, context, app_key)
+        except QingflowApiError as exc:
+            if requested_key is None or not _is_record_permission_denied_error(exc):
+                raise
+            views = []
         selected: JSONObject | None = None
         if requested_key is not None:
             selected = next((item for item in views if _normalize_optional_text(item.get("viewKey")) == requested_key), None)
@@ -10621,9 +11110,11 @@ class RecordTools(ToolBase):
 
     def _should_retry_list_type_fallback(self, error: QingflowApiError) -> bool:
         """执行内部辅助逻辑。"""
-        if error.backend_code in {40002, 40027, 404}:
+        if is_auth_like_error(error):
+            return False
+        if backend_code_int(error) in {40002, 40027, 404}:
             return True
-        if error.http_status in {404, 500}:
+        if error.http_status == 404:
             return True
         return False
 
@@ -11444,6 +11935,70 @@ class RecordTools(ToolBase):
                 )
             )
 
+    def _candidate_lookup_failed_response(
+        self,
+        *,
+        profile: str,
+        session_profile,  # type: ignore[no-untyped-def]
+        context,  # type: ignore[no-untyped-def]
+        kind: str,
+        error: RecordInputError,
+        field: FormField,
+        app_key: str,
+        record_id_text: str | None,
+        workflow_node_id: int | None,
+        fields_present: bool,
+        keyword: str,
+        scope_source: str,
+    ) -> JSONObject:
+        """Return a structured result when an optional field candidate lookup is unavailable."""
+        error_payload = error.to_dict()
+        error_details = error_payload.get("details") if isinstance(error_payload.get("details"), dict) else {}
+        candidate_error = error_details.get("candidate_error") if isinstance(error_details.get("candidate_error"), dict) else {}
+        warning_transport = {
+            key: candidate_error.get(key)
+            for key in ("backend_code", "http_status", "request_id")
+            if candidate_error.get(key) is not None
+        }
+        selection: JSONObject = {
+            "app_key": app_key,
+            "field_id": field.que_id,
+            "field_title": field.que_title,
+            "record_id": record_id_text,
+            "workflow_node_id": workflow_node_id,
+            "fields_present": fields_present,
+            "keyword": keyword,
+            "permission_scope": "applicant_node",
+        }
+        return {
+            "profile": profile,
+            "ws_id": session_profile.selected_ws_id,
+            "ok": False,
+            "status": "failed",
+            "error_code": error.error_code,
+            "message": error.message,
+            "request_route": self._request_route_payload(context),
+            "warnings": [
+                {
+                    "code": error.error_code,
+                    "message": error.fix_hint,
+                    "kind": kind,
+                    "field_id": field.que_id,
+                    "field_title": field.que_title,
+                    **warning_transport,
+                }
+            ],
+            "output_profile": "normal",
+            "data": {
+                "items": [],
+                "pagination": {"returned_items": 0},
+                "selection": selection,
+                "scope_source": scope_source,
+                "fix_hint": error.fix_hint,
+            },
+            "details": error_details,
+        }
+
     def _request_route_payload(self, context) -> JSONObject:  # type: ignore[no-untyped-def]
         """执行内部辅助逻辑。"""
         describe_route = getattr(self.backend, "describe_route", None)
@@ -11617,7 +12172,7 @@ class RecordTools(ToolBase):
         selection: JSONObject | None,
     ) -> None:
         """执行内部辅助逻辑。"""
-        if exc.backend_code != 40002:
+        if not _is_record_permission_denied_error(exc):
             raise exc
         raise_tool_error(
             QingflowApiError(
@@ -11783,6 +12338,7 @@ class RecordTools(ToolBase):
             response_status = raw_status or "failed"
         update_route = raw_apply.get("update_route") if isinstance(raw_apply.get("update_route"), dict) else None
         tried_routes = raw_apply.get("tried_routes") if isinstance(raw_apply.get("tried_routes"), list) else []
+        expose_tried_routes = output_profile == "verbose" or response_status != "success"
         response: JSONObject = {
             "profile": raw_apply.get("profile"),
             "ws_id": raw_apply.get("ws_id"),
@@ -11795,7 +12351,6 @@ class RecordTools(ToolBase):
             "warnings": warnings,
             "output_profile": output_profile,
             "update_route": update_route,
-            "tried_routes": tried_routes,
             "data": {
                 "action": {"operation": operation, "executed": True},
                 "resource": resource,
@@ -11807,9 +12362,11 @@ class RecordTools(ToolBase):
                 "resolved_fields": resolved_fields,
                 "human_review": self._record_write_human_review_payload(operation, enabled=human_review),
                 "update_route": update_route,
-                "tried_routes": tried_routes,
             },
         }
+        if expose_tried_routes:
+            response["tried_routes"] = tried_routes
+            response["data"]["tried_routes"] = tried_routes
         if record_id is not None:
             response["record_id"] = record_id
         if apply_id is not None:
@@ -11989,7 +12546,7 @@ class RecordTools(ToolBase):
             )
         return errors
 
-    def _record_delete_many(self, *, profile: str, app_key: str, record_ids: list[int]) -> JSONObject:
+    def _record_delete_many(self, *, profile: str, app_key: str, record_ids: list[int], list_type: int = DEFAULT_RECORD_LIST_TYPE) -> JSONObject:
         """执行内部辅助逻辑。"""
         if not app_key:
             raise_tool_error(QingflowApiError.config_error("app_key is required"))
@@ -12002,14 +12559,14 @@ class RecordTools(ToolBase):
                 "DELETE",
                 context,
                 f"/app/{app_key}/apply",
-                json_body={"type": DEFAULT_RECORD_LIST_TYPE, "applyIds": normalized_ids},
+                json_body={"type": list_type, "applyIds": normalized_ids},
             )
             return {
                 "profile": profile,
                 "ws_id": session_profile.selected_ws_id,
                 "request_route": self._request_route_payload(context),
                 "result": result,
-                "resource": {"type": "record", "apply_ids": normalized_ids},
+                "resource": {"type": "record", "apply_ids": normalized_ids, "list_type": list_type},
                 "ok": True,
             }
 
@@ -12583,6 +13140,30 @@ class RecordTools(ToolBase):
             },
         )
 
+    def _candidate_lookup_error(
+        self,
+        *,
+        kind: str,
+        field: FormField,
+        value: JSONValue,
+        error: QingflowApiError,
+    ) -> RecordInputError:
+        """Build the standard candidate lookup failure without raising it."""
+        field_kind = "member" if kind == "member" else "department"
+        return RecordInputError(
+            message=f"{field_kind} candidates for field '{field.que_title}' could not be loaded",
+            error_code=f"{kind.upper()}_CANDIDATE_LOOKUP_FAILED",
+            fix_hint=(
+                f"Run record_{field_kind}_candidates again after the backend error is resolved, "
+                "then choose one returned item exactly."
+            ),
+            details={
+                "field": _field_ref_payload(field),
+                "received_value": value,
+                "candidate_error": error.to_dict(),
+            },
+        )
+
     def _candidate_keyword_from_value(
         self,
         value: JSONValue,
@@ -12847,14 +13428,7 @@ class RecordTools(ToolBase):
 
     def _lookup_department_detail(self, context, keyword: str, *, purpose: str) -> JSONObject:  # type: ignore[no-untyped-def]
         """执行内部辅助逻辑。"""
-        payload = self.backend.request(
-            "GET",
-            context,
-            "/contact/deptByPage",
-            params={"keyword": keyword, "pageNum": 1, "pageSize": 20},
-        )
-        rows = payload.get("list") if isinstance(payload, dict) else None
-        items = [item for item in rows if isinstance(item, dict)] if isinstance(rows, list) else []
+        items = self._search_workspace_departments(context, keyword=keyword)
         normalized_keyword = keyword.strip()
         exact = [
             item for item in items
@@ -13379,6 +13953,7 @@ class RecordTools(ToolBase):
         normalized_answers: list[JSONObject],
         index: FieldIndex,
         verify_list_type: int = DEFAULT_RECORD_LIST_TYPE,
+        verify_role: int | None = None,
         verify_view_key: str | None = None,
     ) -> JSONObject:
         """执行内部辅助逻辑。"""
@@ -13398,14 +13973,20 @@ class RecordTools(ToolBase):
                     f"/view/{verify_view_key}/apply/{apply_id}",
                 )
             else:
+                role = verify_role if verify_role is not None else 1
                 record = self.backend.request(
                     "GET",
                     context,
                     f"/app/{app_key}/apply/{apply_id}",
-                    params={"role": 1, "listType": verify_list_type},
+                    params={"role": role, "listType": verify_list_type},
                 )
         except QingflowApiError as exc:
             if verify_view_key:
+                warning: JSONObject = {
+                    "code": "WRITE_VERIFY_CUSTOM_VIEW_READBACK_FAILED",
+                    "message": "Write was sent through a custom view route, but the same view could not be re-read for field-level verification.",
+                }
+                warning.update(_record_detail_error_warning_fields(exc))
                 return {
                     "verified": False,
                     "verification_mode": "custom_view_record_detail",
@@ -13414,14 +13995,9 @@ class RecordTools(ToolBase):
                     "missing_fields": [],
                     "empty_fields": [],
                     "count_mismatches": [],
-                    "warnings": [{
-                        "code": "WRITE_VERIFY_CUSTOM_VIEW_READBACK_FAILED",
-                        "message": "Write was sent through a custom view route, but the same view could not be re-read for field-level verification.",
-                        "backend_code": exc.backend_code,
-                        "http_status": exc.http_status,
-                    }],
+                    "warnings": [warning],
                 }
-            if exc.backend_code != 40002:
+            if not _is_record_permission_denied_error(exc):
                 raise
             return self._verify_record_write_result_via_initiated_tasks(
                 context,
@@ -13715,6 +14291,8 @@ def _normalize_data_list_base_info_schema(payload: JSONValue) -> JSONObject:
     if not isinstance(payload, dict):
         return {}
     que_base_infos = payload.get("queBaseInfos")
+    if not isinstance(que_base_infos, list) and isinstance(payload.get("formQues"), list):
+        que_base_infos = payload.get("formQues")
     if not isinstance(que_base_infos, list):
         return {}
     return {
@@ -14101,6 +14679,44 @@ def _build_answer_backed_field_index(
     )
 
 
+def _merge_subtable_parent_field(primary: FormField, extra: FormField) -> FormField:
+    if primary.que_type not in SUBTABLE_QUE_TYPES or extra.que_type not in SUBTABLE_QUE_TYPES:
+        return primary
+    primary_raw = dict(primary.raw) if isinstance(primary.raw, dict) else {}
+    extra_raw = dict(extra.raw) if isinstance(extra.raw, dict) else {}
+    primary_subquestions = primary_raw.get("subQuestions")
+    extra_subquestions = extra_raw.get("subQuestions")
+    if not isinstance(primary_subquestions, list) or not isinstance(extra_subquestions, list):
+        return primary
+    merged_subquestions = [item for item in primary_subquestions if isinstance(item, dict)]
+    seen_ids = {
+        _coerce_count(item.get("queId"))
+        for item in merged_subquestions
+        if isinstance(item, dict) and _coerce_count(item.get("queId")) is not None
+    }
+    for item in extra_subquestions:
+        if not isinstance(item, dict):
+            continue
+        que_id = _coerce_count(item.get("queId"))
+        if que_id is not None and que_id in seen_ids:
+            continue
+        merged_subquestions.append(item)
+        if que_id is not None:
+            seen_ids.add(que_id)
+    if len(merged_subquestions) == len(primary_subquestions):
+        return primary
+    merged_raw = dict(primary_raw)
+    merged_raw["subQuestions"] = merged_subquestions
+    merged_field = _clone_form_field(primary)
+    merged_field.raw = merged_raw
+    return merged_field
+
+
+def _replace_field_in_lookup(index: dict[str, list[FormField]], field: FormField) -> None:
+    for key, fields in list(index.items()):
+        index[key] = [field if existing.que_id == field.que_id else existing for existing in fields]
+
+
 def _merge_field_indexes(primary: FieldIndex, extra: FieldIndex) -> FieldIndex:
     by_id = dict(primary.by_id)
     by_title = {key: list(value) for key, value in primary.by_title.items()}
@@ -14111,12 +14727,42 @@ def _merge_field_indexes(primary: FieldIndex, extra: FieldIndex) -> FieldIndex:
 
     for field_id, field in extra.by_id.items():
         if field_id in by_id:
+            merged_field = _merge_subtable_parent_field(by_id[field_id], field)
+            if merged_field is not by_id[field_id]:
+                by_id[field_id] = merged_field
+                _replace_field_in_lookup(by_title, merged_field)
+                _replace_field_in_lookup(by_alias, merged_field)
             continue
         by_id[field_id] = field
         by_title.setdefault(_normalize_field_lookup_key(field.que_title), []).append(field)
         for alias in field.aliases:
             by_alias.setdefault(_normalize_field_lookup_key(alias), []).append(field)
 
+    for field_id, fields in extra.subtable_leaf_by_id.items():
+        merged = subtable_leaf_by_id.setdefault(field_id, [])
+        existing = {(ref.field.que_id, ref.parent_field.que_id) for ref in merged}
+        for field in fields:
+            key = (field.field.que_id, field.parent_field.que_id)
+            if key not in existing:
+                merged.append(field)
+                existing.add(key)
+    for title, fields in extra.subtable_leaf_by_title.items():
+        merged = subtable_leaf_by_title.setdefault(title, [])
+        existing = {(ref.field.que_id, ref.parent_field.que_id) for ref in merged}
+        for field in fields:
+            key = (field.field.que_id, field.parent_field.que_id)
+            if key not in existing:
+                merged.append(field)
+                existing.add(key)
+    for alias, fields in extra.subtable_leaf_by_alias.items():
+        merged = subtable_leaf_by_alias.setdefault(alias, [])
+        existing = {(ref.field.que_id, ref.parent_field.que_id) for ref in merged}
+        for field in fields:
+            key = (field.field.que_id, field.parent_field.que_id)
+            if key not in existing:
+                merged.append(field)
+                existing.add(key)
+
     return FieldIndex(
         by_id=by_id,
         by_title=by_title,
@@ -15507,6 +16153,28 @@ def _record_detail_unavailable_context(section: str, message: str, exc: Qingflow
         "message": message,
         "category": exc.category,
     }
+    if is_auth_like_error(exc):
+        payload["auth_like"] = True
+        payload["error_code"] = "AUTH_REQUIRED"
+    if exc.backend_code is not None:
+        payload["backend_code"] = exc.backend_code
+    if exc.http_status is not None:
+        payload["http_status"] = exc.http_status
+    request_id = getattr(exc, "request_id", None)
+    if request_id:
+        payload["request_id"] = request_id
+    details = exc.details if isinstance(exc.details, dict) else {}
+    error_code = details.get("error_code")
+    if error_code and not payload.get("error_code"):
+        payload["error_code"] = error_code
+    return payload
+
+
+def _record_detail_error_warning_fields(exc: QingflowApiError) -> JSONObject:
+    payload: JSONObject = {"category": exc.category}
+    if is_auth_like_error(exc):
+        payload["auth_like"] = True
+        payload["error_code"] = "AUTH_REQUIRED"
     if exc.backend_code is not None:
         payload["backend_code"] = exc.backend_code
     if exc.http_status is not None:
@@ -15516,11 +16184,35 @@ def _record_detail_unavailable_context(section: str, message: str, exc: Qingflow
         payload["request_id"] = request_id
     details = exc.details if isinstance(exc.details, dict) else {}
     error_code = details.get("error_code")
-    if error_code:
+    if error_code and not payload.get("error_code"):
         payload["error_code"] = error_code
     return payload
 
 
+def _record_detail_refreshed_source_url(refresh_result: Any) -> str | None:
+    if isinstance(refresh_result, dict):
+        return _normalize_optional_text(refresh_result.get("source_url"))
+    return _normalize_optional_text(refresh_result)
+
+
+def _record_detail_append_refresh_warning(
+    warnings: list[JSONObject],
+    refresh_result: Any,
+    *,
+    id_key: str,
+    id_value: str,
+) -> None:
+    if not isinstance(refresh_result, dict):
+        return
+    warning = refresh_result.get("warning")
+    if not isinstance(warning, dict):
+        return
+    payload: JSONObject = dict(warning)
+    payload.setdefault("code", "ASSET_STORAGE_URL_REFRESH_FAILED")
+    payload.setdefault(id_key, id_value)
+    warnings.append(payload)
+
+
 _RECORD_MEDIA_IMG_SRC_RE = re.compile(r"""<img\b[^>]*\bsrc\s*=\s*["']?([^"'\s>]+)""", re.IGNORECASE)
 _RECORD_MEDIA_MD_IMAGE_RE = re.compile(r"""!\[[^\]]*]\(([^)\s]+)(?:\s+["'][^"']*["'])?\)""")
 _RECORD_MEDIA_URL_RE = re.compile(r"""https?://[^\s<>"')\]]+""", re.IGNORECASE)
@@ -15675,7 +16367,14 @@ def _record_detail_media_assets_payload(
         except QingflowApiError as exc:
             blocked = exc.http_status in {401, 403}
             if blocked and download_strategy != "referer_acl" and callable(refresh_source_url):
-                refreshed_url = _normalize_optional_text(refresh_source_url(candidate))
+                refresh_result = refresh_source_url(candidate)
+                _record_detail_append_refresh_warning(
+                    warnings,
+                    refresh_result,
+                    id_key="asset_id",
+                    id_value=asset_id,
+                )
+                refreshed_url = _record_detail_refreshed_source_url(refresh_result)
                 if refreshed_url and refreshed_url != source_url:
                     refreshed_strategy = _record_detail_media_download_strategy(refreshed_url)
                     try:
@@ -15717,14 +16416,13 @@ def _record_detail_media_assets_payload(
                         "readable_by_agent": False,
                     }
                 )
-                warnings.append(
-                    {
-                        "code": warning_code,
-                        "asset_id": asset_id,
-                        "message": f"record_get could not download image asset {asset_id}: {exc.message}",
-                        "http_status": exc.http_status,
-                    }
-                )
+                warning: JSONObject = {
+                    "code": warning_code,
+                    "asset_id": asset_id,
+                    "message": f"record_get could not download image asset {asset_id}: {exc.message}",
+                }
+                warning.update(_record_detail_error_warning_fields(exc))
+                warnings.append(warning)
                 continue
 
         if not isinstance(content, bytes):
@@ -15942,7 +16640,14 @@ def _record_detail_file_assets_payload(
         except QingflowApiError as exc:
             blocked = exc.http_status in {401, 403}
             if blocked and download_strategy != "referer_acl" and callable(refresh_source_url):
-                refreshed_url = _normalize_optional_text(refresh_source_url(candidate))
+                refresh_result = refresh_source_url(candidate)
+                _record_detail_append_refresh_warning(
+                    warnings,
+                    refresh_result,
+                    id_key="file_asset_id",
+                    id_value=file_asset_id,
+                )
+                refreshed_url = _record_detail_refreshed_source_url(refresh_result)
                 if refreshed_url and refreshed_url != source_url:
                     refreshed_strategy = _record_detail_media_download_strategy(refreshed_url)
                     try:
@@ -15989,14 +16694,13 @@ def _record_detail_file_assets_payload(
                         "extraction": {"status": "failed", "text_path": None, "preview": None},
                     }
                 )
-                warnings.append(
-                    {
-                        "code": warning_code,
-                        "file_asset_id": file_asset_id,
-                        "message": f"record_get could not download file asset {file_asset_id}: {exc.message}",
-                        "http_status": exc.http_status,
-                    }
-                )
+                warning = {
+                    "code": warning_code,
+                    "file_asset_id": file_asset_id,
+                    "message": f"record_get could not download file asset {file_asset_id}: {exc.message}",
+                }
+                warning.update(_record_detail_error_warning_fields(exc))
+                warnings.append(warning)
                 continue
 
         if not isinstance(content, bytes):