fix(formula): 导出文件安全、清理回收、撤权校验与定义库可靠性（F01/F02/F05-F08）

- F01: _safe_unlink_export 不跟随符号链接、逐层校验父目录，导出失败路径与
  清理命令统一使用，只清理受控目录内本次创建的文件
- F02: 清理失败记录告警日志；清理命令回收 failed 任务残留文件
- F05: 定义保存事务内锁数据集行，配额原子检查；revision 冲突返回 409；
  保留最近 20 版历史；支持个人/团队共享；审计与变更同事务
- F06: 工作簿参数页毛利率改为只读快照；可编辑单元格解锁并加数值校验
- F07: 对账按指标分容差（人数 0、比率 0.0001、金额 0.01）；自定义列使用
  服务端 Decimal 表达式求值参考
- F08: 导出任务执行/下载阶段重校验账号有效性与角色
- 对话草稿会话恢复；载入定义后追问携带原定义（F04）；下载改浏览器直传
- 迁移 0006-0008；PostgreSQL 咨询锁语义修正（import_worker）

tests/e2e/formula-export.spec.ts

@@ -119,15 +119,36 @@ test("新增列：补充信息触发追问并重新确认后生成公式工作
   );
   await dialog.getByLabel("关闭", { exact: true }).click();
 
+  await page.getByRole("button", { name: "选择网页自定义列" }).click();
+  const columns = page.getByRole("dialog", { name: "选择网页自定义列" });
+  await columns.getByRole("checkbox", { name: /收入成本差/ }).check();
+  const customQuery = page.waitForResponse(
+    (response) =>
+      response.url().includes("/query") && response.request().method() === "POST",
+  );
+  await columns.getByRole("button", { name: "应用", exact: true }).click();
+  const customResult = await (await customQuery).json();
+  expect(customResult.summary.custom_0.current).toBe("1000");
+  expect(customResult.rows[0].values.custom_0.current).toBe("1000");
+
   await page.getByRole("button", { name: "生成公式工作簿" }).click();
   const reopened = page.getByRole("dialog", { name: "生成公式工作簿" });
   await reopened.getByLabel("已保存定义").selectOption({ label: "收入成本差" });
   await expect(reopened).toContainText("计算表达式：(实际收入 − 成本)");
+  await reopened.getByLabel("列计算描述").fill("把刚才公式乘以 100");
+  await expect(
+    reopened.getByRole("button", { name: "先发送补充内容" }),
+  ).toBeDisabled();
   await reopened
-    .getByRole("button", { name: "确认并生成公式工作簿" })
-    .click();
+    .getByLabel("同意将描述、指标定义和当前筛选范围发送至已配置的外部 AI 服务")
+    .check();
+  await reopened.getByRole("button", { name: "发送描述" }).click();
+  expect(sentMessages[0].content).toContain('"name":"收入成本差"');
+  expect(sentMessages[0].content).toContain('"operator":"subtract"');
+  expect(sentMessages[0].content).toContain("把刚才公式乘以 100");
+  await reopened.getByRole("button", { name: "确认并生成公式工作簿" }).click();
   await expect(reopened.getByRole("status")).toContainText("生成完成", {
     timeout: 30000,
   });
-  expect(designCalls).toBe(4);
+  expect(designCalls).toBe(5);
 });

tests/test_assistant_api.py

@@ -331,19 +331,34 @@ def test_formula_definition_library_is_private_validated_and_audited(workspace):
             "right": {"metric": "cost"},
         },
     }
-    saved = client.post(url, data={"definition": definition}, content_type="application/json")
+    saved = client.post(url, data={"definition": definition, "shared": True}, content_type="application/json")
     assert saved.status_code == 201
+    assert saved.json()["shared"] is True
     definition_id = saved.json()["id"]
     assert client.get(url).json()["items"][0]["definition"] == definition
 
     updated = client.post(
         url,
-        data={"definition": {**definition, "name": "  收入成本差  ", "meaning": "更新说明"}},
+        data={
+            "definition": {**definition, "name": "  收入成本差  ", "meaning": "更新说明"},
+            "shared": True,
+            "revision": saved.json()["revision"],
+        },
         content_type="application/json",
     )
     assert updated.status_code == 200
     assert FormulaDefinition.objects.filter(dataset=ds, user=ds.created_by).count() == 1
     assert updated.json()["definition"]["meaning"] == "更新说明"
+    assert updated.json()["revision"] == 2
+    assert len(updated.json()["history"]) == 1
+
+    stale = client.post(
+        url,
+        data={"definition": {**definition, "meaning": "旧标签页覆盖"}, "revision": 1},
+        content_type="application/json",
+    )
+    assert stale.status_code == 409
+    assert FormulaDefinition.objects.get(pk=definition_id).definition["meaning"] == "更新说明"
 
     other = Client()
     other_user = ds.created_by.__class__.objects.create_user(
@@ -351,7 +366,8 @@ def test_formula_definition_library_is_private_validated_and_audited(workspace):
     )
     Membership.objects.create(user=other_user, organization=ds.organization, role="analyst")
     assert other.login(username=other_user.username, password="Formula-Library-TestPassword991!")
-    assert other.get(url).json()["items"] == []
+    shared = other.get(url).json()["items"]
+    assert len(shared) == 1 and shared[0]["owned"] is False and shared[0]["shared"] is True
     assert other.delete(f"{url}/{definition_id}").status_code == 404
 
     deleted = client.delete(f"{url}/{definition_id}")
@@ -385,3 +401,26 @@ def test_formula_definition_library_rejects_unavailable_metric(workspace):
     )
     assert response.status_code == 400
     assert "成本" in response.json()["error"]
+
+
+def test_formula_definition_audit_failure_rolls_back_definition(workspace, monkeypatch):
+    ds, _, client, *_ = workspace
+    definition = {
+        "name": "审计回滚",
+        "meaning": "实际收入",
+        "scope": "所选分组与期间",
+        "missing": "结果不可用（#N/A）；零分母不可用",
+        "expression": {"metric": "revenue"},
+    }
+
+    def fail(*_args, **_kwargs):
+        raise RuntimeError("audit unavailable")
+
+    monkeypatch.setattr("finance.formula_views.audit", fail)
+    with pytest.raises(RuntimeError, match="audit unavailable"):
+        client.post(
+            f"/api/datasets/{ds.pk}/formula-definitions",
+            data={"definition": definition},
+            content_type="application/json",
+        )
+    assert not FormulaDefinition.objects.filter(dataset=ds, user=ds.created_by).exists()

tests/test_formula_columns.py

@@ -97,8 +97,30 @@ def test_formula_workbook_exposes_custom_metric_as_recalculable_column(formula_d
     custom = workbook["自定义指标"]
     assert custom["B1"].value == "收入成本差（本期）"
     assert custom["B2"].value == f"='分析汇总'!C{metric_row}"
-    assert "含义：实际收入减成本" in workbook["使用说明"]["B12"].value
-    assert "范围：按所选分组及本期、基期计算" in workbook["使用说明"]["B12"].value
+    instruction_text = " ".join(str(cell.value) for row in workbook["使用说明"].iter_rows() for cell in row)
+    assert "含义：实际收入减成本" in instruction_text
+    assert "范围：按所选分组及本期、基期计算" in instruction_text
+
+
+def test_formula_workbook_protects_structure_and_unlocks_calculation_inputs(formula_data):
+    ds, member = formula_data
+    output = BytesIO()
+    build_formula_workbook(
+        ds,
+        member,
+        {"start": "2026-08", "end": "2026-08", "comparison": "yoy", "group": "department"},
+        output,
+    )
+    workbook = load_workbook(BytesIO(output.getvalue()), data_only=False)
+    data = workbook["计算明细"]
+    assert data.protection.sheet
+    assert data["D2"].protection.locked is False
+    assert data["F2"].protection.locked is False
+    assert data["G2"].protection.locked is False
+    assert data["I2"].protection.locked is False
+    assert data["C2"].protection.locked is True
+    assert data["M2"].protection.locked is True
+    assert workbook["原始证据"].protection.sheet
 
 
 def test_custom_expression_rejects_formula_text_and_unknown_metrics():

tests/test_formula_export_reliability.py

@@ -198,6 +198,67 @@ def test_formula_export_worker_records_path_preparation_failure(workspace, setti
     assert job.status == "failed"
 
 
+def test_formula_export_failure_does_not_follow_a_symlinked_user_directory(workspace, settings):
+    from finance.exporting import process_formula_export
+
+    ds, _, client, *_ = workspace
+    response = client.post(
+        f"/api/datasets/{ds.pk}/formula-exports",
+        data={"start": "2026-08", "end": "2026-08", "comparison": "yoy", "group": "department"},
+        content_type="application/json",
+    )
+    job = FormulaExport.objects.get(pk=response.json()["id"])
+    root = Path(settings.MEDIA_ROOT) / "formula-exports"
+    protected = Path(settings.MEDIA_ROOT) / "protected"
+    protected.mkdir()
+    target = protected / f"{job.pk}.xlsx"
+    target.write_bytes(b"keep")
+    root.mkdir()
+    (root / str(job.user_id)).symlink_to(protected, target_is_directory=True)
+
+    with pytest.raises(ValueError, match="符号链接"):
+        process_formula_export(job.pk)
+
+    job.refresh_from_db()
+    assert job.status == "failed"
+    assert target.read_bytes() == b"keep"
+
+
+def test_formula_export_failed_cleanup_is_observable_and_reclaimed(workspace, monkeypatch):
+    from django.core.management import call_command
+
+    from finance.exporting import process_formula_export
+
+    ds, _, client, *_ = workspace
+    response = client.post(
+        f"/api/datasets/{ds.pk}/formula-exports",
+        data={"start": "2026-08", "end": "2026-08", "comparison": "yoy", "group": "department"},
+        content_type="application/json",
+    )
+    job = FormulaExport.objects.get(pk=response.json()["id"])
+    target = Path(job.dataset.file.storage.location) / "formula-exports" / str(job.user_id) / f"{job.pk}.xlsx"
+    target.parent.mkdir(parents=True)
+    target.write_bytes(b"orphan")
+    monkeypatch.setattr(
+        "finance.exporting.build_formula_workbook",
+        lambda *_a, **_k: (_ for _ in ()).throw(ValueError("retry failed")),
+    )
+    real_unlink = Path.unlink
+    monkeypatch.setattr(Path, "unlink", lambda *_a, **_k: (_ for _ in ()).throw(OSError("read-only")))
+
+    with pytest.raises(ValueError, match="retry failed"):
+        process_formula_export(job.pk)
+    job.refresh_from_db()
+    assert job.status == "failed"
+    assert job.path == str(target)
+
+    monkeypatch.setattr(Path, "unlink", real_unlink)
+    call_command("cleanup_formula_exports")
+    job.refresh_from_db()
+    assert job.path == ""
+    assert target.exists() is False
+
+
 def test_formula_workbook_rejects_unclassified_label_collision(workspace):
     from decimal import Decimal
 
@@ -374,3 +435,20 @@ def test_formula_workbook_rejects_dimension_keys_that_collide_with_reserved_head
             {"start": "2026-08", "end": "2026-08", "comparison": "yoy", "group": "revenue"},
             BytesIO(),
         )
+
+
+def test_custom_reconcile_reference_preserves_large_decimal_and_zero_division():
+    from finance.exporting import _evaluate_expression
+
+    expression = {
+        "operator": "divide",
+        "left": {"metric": "revenue"},
+        "right": {"number": 0},
+    }
+    assert (
+        _evaluate_expression(expression, {"revenue": Decimal("1.2345678901234567890123456789012345")}) is None
+    )
+    assert _evaluate_expression(
+        {"operator": "add", "left": {"metric": "revenue"}, "right": {"number": 1}},
+        {"revenue": Decimal("1234567890123456789012345678901234")},
+    ) == Decimal("1234567890123456789012345678901235")

tests/test_operations.py

@@ -46,6 +46,23 @@ def test_worker_processes_queued_import_and_formula_export(workspace):
     assert job.status == "processing"
 
 
+def test_worker_reclaims_processing_formula_export_after_restart(workspace):
+    ds, _, _, *_ = workspace
+    job = FormulaExport.objects.create(
+        dataset=ds,
+        user=ds.created_by,
+        context={"custom_columns": []},
+        status="processing",
+    )
+    from unittest.mock import patch
+
+    with patch(
+        "finance.management.commands.import_worker.process_formula_export", return_value={"rows": 5}
+    ) as process:
+        call_command("import_worker", once=True)
+    process.assert_called_once_with(job.pk)
+
+
 def test_formula_export_status_download_and_access_controls(workspace, settings, tmp_path):
     ds, _, client, _, other_client = workspace
     url = f"/api/datasets/{ds.pk}"
@@ -58,7 +75,7 @@ def test_formula_export_status_download_and_access_controls(workspace, settings,
     job.status = "succeeded"
     job.expires_at = timezone.now() + timedelta(hours=1)
     target = tmp_path / "formula-exports" / str(ds.created_by_id) / f"{job.pk}.xlsx"
-    target.parent.mkdir(parents=True)
+    target.parent.mkdir(parents=True, exist_ok=True)
     target.write_bytes(b"xlsx")
     job.path = str(target)
     job.save()
@@ -85,6 +102,29 @@ def test_formula_export_status_download_and_access_controls(workspace, settings,
     assert client.get(status_url).status_code == 403
 
 
+def test_formula_export_rechecks_role_when_worker_runs_and_file_is_downloaded(workspace, settings, tmp_path):
+    from finance.exporting import process_formula_export
+
+    ds, member, client, _, _ = workspace
+    job = FormulaExport.objects.create(dataset=ds, user=ds.created_by, context={}, status="processing")
+    member.role = "viewer"
+    member.save(update_fields=["role"])
+    with pytest.raises(PermissionError, match="撤权"):
+        process_formula_export(job.pk)
+    job.refresh_from_db()
+    assert job.status == "failed"
+
+    job.status = "succeeded"
+    job.expires_at = timezone.now() + timedelta(hours=1)
+    target = tmp_path / "formula-exports" / str(ds.created_by_id) / f"{job.pk}.xlsx"
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_bytes(b"xlsx")
+    job.path = str(target)
+    job.save(update_fields=["status", "expires_at", "path"])
+    assert client.get(f"/api/datasets/{ds.pk}/formula-exports/{job.pk}").status_code == 403
+    assert client.get(f"/api/datasets/{ds.pk}/formula-exports/{job.pk}/download").status_code == 403
+
+
 def test_formula_export_create_validates_definition_and_records_job(workspace):
     ds, _, client, *_ = workspace
     url = f"/api/datasets/{ds.pk}/formula-exports"