merge account p8 review decision preference

# Conflicts:
#	CLAUDE.md
#	docs/PMFLOW_PRODUCT_DELIVERY_STANDARD.md
#	docs/architecture/ARCHITECTURE_INVENTORY.md
#	docs/architecture/CODE_REFERENCE_INDEX.md

CLAUDE.md

@@ -133,7 +133,7 @@ frontend/
 - 顶层路由已改为 `React.lazy + Suspense`，统一 fallback 使用 `frontend/src/components/layout/LazyBoundary.tsx`；AI Steward / AI Config 页面按 active tab 只渲染当前可见区块，Projects/Users/图表页则把重对话框与图表从同步入口拆出。
 - `frontend/src/features/project-launch/` 是新项目启动台独立产品域：`types.ts / useProjectLaunchState.ts` 承载状态合同和真实 API 编排，`mockData.ts` 只在显式 demo 模式下使用；默认路径调用 `POST /pmflow-launch/drafts` 生成可审查草案，确认后调用 `POST /pmflow-launch/drafts/{draft_id}/confirm` 创建真实项目并跳转 `/pmflow-os?projectId=<id>`。`LaunchShell` 桌面端复用 `frontend/src/features/personal-space/components/SpaceChrome.tsx` 的空间左侧栏和顶部条，主画布仍由 `IntentInputPanel / AIProgressCanvas / HumanReviewCanvas / DraftEditCanvas / FailureStatePanel / SuccessTransitionPanel` 承接，移动端仍由 `MobileLaunchLayout` 承接；`frontend/src/pages/ProjectLaunchPage.tsx` 仅做薄入口。
 - `frontend/src/features/personal-space/` 是空间层入口：`PersonalSpacePage.tsx` 承接桌面个人工作面与独立移动单手布局，`frontend/src/api/space.ts` 只读聚合 `projects` summary、PMFlow OS `truth-state`、`execution-summary` 并生成 `nextActionQueue` 我的下一步队列、继续推进、待确认、review attention、发布关注、发布后反馈关注、下一轮迭代草稿关注、AI 正在推进、草案箱、最近项目摘要；Space P6 的下一步队列按高风险待确认、发布阻塞/失败证据、handoff consumed 后缺少后续 progress、下一轮 draft、发布后反馈/收入/合规信号排序；Space P7 新增 `review_attention`，只读消费 `truth-state.reviewerRouting`，按高风险待我审、`request_changes / rejected` 后待处理、`reviewer_missing` warning、普通 pending review 排序进入“我的下一步”，点击只跳 `/change-review?projectId=<id>&changeSetId=<id>`、已有 `/team-layer?projectId=<id>`、`/execution-bridge?projectId=<id>` 或 `/release-growth?projectId=<id>`；Space P3 的发布关注优先消费 `truth-state.releases` 的 release validation 投影，没有验证投影时才回落 `execution-summary.releaseGate`；Space P4/P5 的发布后反馈/下一轮草稿关注只读消费 `execution-summary.releaseSignals`；不在 Space 写 Project Memory、PMFlowApproval、ProgressEvent、ReleaseValidationRun、FeedbackIngest、RevenueEvent、ComplianceCheckRun、ChangeSet 状态或发布执行，不虚构 reviewer、审查意见或待审 ChangeSet。`components/SpaceChrome.tsx` 承接空间层左侧栏、顶部条与空间用量组件，并被 `/project-launch` 桌面首次新建壳复用；`frontend/src/pages/PersonalSpacePage.tsx` 仅做薄入口。
-- `frontend/src/features/account-settings/` 是 Account Settings 独立产品域：`AccountSettingsPanel.tsx` 承接 `/me` 桌面设置页、移动端分组列表与 bottom sheet，`frontend/src/api/accountSettings.ts` 定义个人资料、默认语言、AI 回答深度、证据展示偏好和四类通知偏好合同；当前已有账号同步 API fallback、本地 UI 通知消费模型、Release/Growth 偏好 helper、post-release / next change review 偏好 helper，以及 `getAccountReminderConsumption(settings, event)` 提醒强度消费合同，支持 `reminderIntensity=silent|normal|prominent` 与 `evidenceDisplay=compact|expanded`；`releaseGate / failureAlert / pendingConfirmation / executionWriteback` 只影响页面内提醒表达强度和证据展开方式，不代表真实邮件、桌面推送或系统通知中心已接入，也不得隐藏真实业务证据或审计状态，不改 OAuth/JWT/auth core；`frontend/src/features/pmflow-os/pages/AccountPage.tsx` 仅做薄入口并复用既有退出登录 bottom sheet。
+- `frontend/src/features/account-settings/` 是 Account Settings 独立产品域：`AccountSettingsPanel.tsx` 承接 `/me` 桌面设置页、移动端分组列表与 bottom sheet，`frontend/src/api/accountSettings.ts` 定义个人资料、默认语言、AI 回答深度、证据展示偏好和四类通知偏好合同；当前已有账号同步 API fallback、本地 UI 通知消费模型、Release/Growth 偏好 helper、post-release / next change review 偏好 helper、`getAccountReminderConsumption(settings, event)` 提醒强度消费合同，以及 `getReviewDecisionNotificationPreference(settings, event)` review decision 偏好合同；支持 `reminderIntensity=silent|normal|prominent` 与 `evidenceDisplay=compact|expanded`，并覆盖 `review_requested / review_approved / review_changes_requested / review_rejected / high_risk_approval_required`；`releaseGate / failureAlert / pendingConfirmation / executionWriteback` 只影响页面内提醒表达强度和证据展开方式，不代表真实邮件、桌面推送或系统通知中心已接入，也不得隐藏真实业务证据、reviewerRouting、approval 或审计状态，不改 OAuth/JWT/auth core；`frontend/src/features/pmflow-os/pages/AccountPage.tsx` 仅做薄入口并复用既有退出登录 bottom sheet。
 - `frontend/src/features/pmflow-os/` 当前承载新的对话驱动前端产品域：`store.tsx` 提供共享 truth store；真实模式通过 `?projectId=<id>` 调用 `frontend/src/api/pmflowOs.ts` 读取后端 `ProjectTruthState` projection，并调用真实 message、`proposed_items` extraction、ChangeItem `accept/edit/defer`、ChangeSet `commit`、review decision、Execution Handoff create/consume、execution progress writeback、release validation run create、release feedback ingest、单条 iteration recommendation -> ChangeSet draft 与同组 iteration recommendation 批量 -> ChangeSet draft API，成功后 refetch truth-state / execution-summary；显式 `?demo=1` 才启用 `command_idle -> ai_extracting -> extraction_ready -> review_open -> writeback_success` 本地演示状态机，以及本地 `promoteAcceptedToGraph` 等演示动作。`pages/` 下包含 `CommandCenter / StructuredExtraction / ChangeReview / MemoryWritebackResult / WorkGraph / ExecutionBridge / ReleaseGrowth / TeamLayer / ProjectMemory / Account` 主页面；`ChangeReviewPage` 真实模式可请求审查、通过、要求修改或拒绝当前 ChangeSet，展示审查状态、建议 reviewer、审查意见和 high-risk approval gate，但不自动 commit；`TeamLayerPage` 真实模式读取 `state.reviewerRouting` 展示 ready/empty/warning、待审 ChangeSet、来源、风险等级、建议审查人或 fallback role、审查原因、待审 item 数、证据数、审查状态、审查意见和请求/决策时间，动作跳转 `/change-review?projectId=<id>&changeSetId=<id>`；`ExecutionBridgePage` 已支持创建 handoff、运行端领取确认和执行进度回写；`ReleaseGrowthPage` 真实模式展示 `execution-summary.releaseGate`、execution evidence、阻塞原因、下一步动作、`latestValidationRun` 和 `releaseSignals`，可创建 release validation run、摄取发布后 feedback、展示 recommendation quality grouping、从真实 recommendation 单条或同组批量生成下一轮待确认 ChangeSet draft，并消费 Account notification preference 静默强调型提醒，但不隐藏真实证据、审计状态或发布后信号；静态发布/增长原型仅保留在显式 demo 模式；后端只记录 review decision/progress/release gate/release validation/release feedback/recommendation draft 元数据，不执行本机命令、真实发布命令、外部支付、真实推送、自动 Project Memory commit 或正式任务创建；`ProjectMemoryPage` 在真实模式消费后端 `truth_nodes + semantic_facts` 的 `projectMemory` 投影，真实模式下 accepted/edited ChangeItem 只有 commit 成功后才进入 Project Memory。`components/` 下除了 `ProjectStageRail / ThreadComposer / ExtractionRail / ChangeGroupPanel / ObjectGraphSection / ContextPacketPanel / ExecutionTimeline / ReleaseGatePanel / TeamFeedPanel` 之外，新增 `ProjectStructuredLoop / PMFlowOsFrame / AccountControls / FeedbackPrimitives` 等行为组件，用来承接项目指挥台、结构化提取、待确认审查、项目记忆写入结果、项目内面包屑、项目切换器、账号退出登录交互，以及 `PageBanner / InlineNotice / HumanDecisionBar / ConfirmDialog / MobileBottomSheet` 这组契约化提示提醒组件；`components/MobileBottomNav.tsx` 是正式应用壳唯一移动底部导航，固定为 `空间 / 指挥台 / 待确认 / 动态 / 我的`。
 - 旧登录实现 `frontend/src/components/ui/sign-in.tsx` 与 `frontend/src/components/ui/demo.tsx` 已移除，`frontend/src/components/login/` 是当前唯一登录真源。
 

docs/PMFLOW_PRODUCT_DELIVERY_STANDARD.md

@@ -893,6 +893,36 @@ P8 可以三条 lane 并行，但共享高冲突文件必须由 Main Flow 或 Sh
 - `cd frontend && npm run typecheck` 通过。
 - `cd frontend && npm run build` 通过；Vite 仍提示既有 manual chunk circular warning（`ai-steward / sstc / charts / governance` chunk 环），构建成功。
 
+### 2026-04-26 / account-p8-review-decision-preference / implemented
+
+完成内容：
+
+- 在 `frontend/src/api/accountSettings.ts` 新增 `getReviewDecisionNotificationPreference(settings, event)`，覆盖 `review_requested / review_approved / review_changes_requested / review_rejected / high_risk_approval_required`。
+- Review decision 类事件统一映射到现有 `pendingConfirmation` 偏好，继续输出 P7 的 `reminderIntensity / evidenceDisplay / showInAppReminder / showProminentReminder` 合同，并固定 `notificationTransport=in_app_only`。
+- helper 明确返回 `reviewerRoutingPolicy=preserve_reviewer_routing`、`approvalPolicy=preserve_approval_state`、`evidencePolicy=preserve_business_evidence`、`auditPolicy=preserve_audit_state`；偏好关闭只静默页面内提醒，不隐藏真实 reviewerRouting、approval、evidence 或 audit state。
+- `AccountSettingsPanel` 通知偏好文案扩展到 review request / decision 与高风险 approval，不新增后端字段、不改 schema、不接真实通知中心。
+
+涉及文件：
+
+- `frontend/src/api/accountSettings.ts`
+- `frontend/src/features/account-settings/AccountSettingsPanel.tsx`
+- `frontend/src/features/account-settings/accountSettings.test.ts`
+- `CLAUDE.md`
+- `docs/PMFLOW_PRODUCT_DELIVERY_STANDARD.md`
+- `docs/architecture/CODE_REFERENCE_INDEX.md`
+- `docs/architecture/ARCHITECTURE_INVENTORY.md`
+
+验证：
+
+- `cd frontend && npm run test -- src/features/account-settings/accountSettings.test.ts` 通过：`12 passed`。
+- `cd frontend && npm run typecheck` 通过。
+- `cd frontend && npm run build` 通过；Vite 仍提示既有 manual chunk circular warning（`ai-steward / sstc / charts / governance` chunk 环），构建成功。
+
+未完成或风险：
+
+- 本轮只定义 Account Settings 偏好消费合同，不改 Main Flow review request / decision API，不改 Space attention queue。
+- Review 偏好仍只影响页面内提醒表达；不得被 Main Flow 当作业务权限或 evidence/filter 开关。
+
 ### 2026-04-26 / shell-p8-rebaseline-next-plan / done
 
 完成内容：

docs/architecture/ARCHITECTURE_INVENTORY.md

@@ -207,7 +207,7 @@
 - `frontend/src/features/pmflow-os/store.tsx` 当前是 PMFlow OS 共享 truth store：`?projectId=<id>` 时通过 React Query 调用 `frontend/src/api/pmflowOs.ts` 读取真实 `GET /pmflow-os/projects/{project_id}/truth-state` 与 `GET /pmflow-os/projects/{project_id}/execution-summary`，真实模式下项目内 message、`proposed_items` extraction、ChangeItem `accept/edit/defer`、ChangeSet commit、review decision、Execution Handoff create/consume、execution progress writeback、release validation run create、release feedback ingest、单条 iteration recommendation -> ChangeSet draft 与同组 iteration recommendation 批量 -> ChangeSet draft 均调用 `/pmflow-os` 后端并 refetch；只有显式 `?demo=1` 或 `?dataSource=demo` 时才启用本地 mock 演示状态机。真实读取/动作失败会进入错误/空态，不静默 fallback 成 mock 成功。
 - `frontend/src/features/pmflow-os/store.tsx` 仍保留演示用项目内 AI 结构化闭环状态机：`command_idle / ai_extracting / extraction_ready / review_open / writeback_success`。`frontend/src/features/pmflow-os/pages/StructuredExtractionPage.tsx` 是本轮结构化提取页，`ChangeReviewPage.tsx` 是决策与待确认中心，`MemoryWritebackResultPage.tsx` 是项目记忆写入结果页，`WorkGraphPage.tsx` 是项目工作台关系总览与对象投影视图，`ExecutionBridgePage.tsx` 是执行桥上下文包、交接按钮、运行端领取确认、PR/测试与回写状态页；`ReleaseGrowthPage.tsx` 真实模式读取 `execution-summary.releaseGate`、`latestValidationRun` 与 `releaseSignals`，从 branch、commit、PR、test、failed evidence 展示 `可发布 / 阻塞 / 需要人工确认 / 缺少证据` 判断、阻塞原因、下一步动作、发布验证记录和发布后 feedback/revenue/recommendation 信号，缺少发布后信号时显示 empty/warning，不执行发布命令、不展示 mock 发布结果；页面可展示 recommendation quality grouping，把真实 recommendation 单条或同组批量生成下一轮待确认 ChangeSet draft，生成后仍进入 Change Review accept/edit/defer，不自动 commit、不写 Project Memory、不创建正式任务；`ChangeReviewPage.tsx` 会展示 `iteration_recommendation_group` evidence 的来源组、feedback 数、recommendation 数、风险、影响和审查优先级；同时读取 Account notification preference helper，用 `releaseGate` 偏好控制发布门禁强调提醒，用 `failureAlert` 偏好控制失败强调提醒，偏好关闭时只静默提醒表达强度，不隐藏 release evidence、阻塞原因、审计状态、validation run 或 releaseSignals；静态发布/增长原型只保留在显式 demo 模式。A3 已接入后端 truth-state，C1 已接入真实 message/extraction/review 状态机，C2 已接入真实 ChangeSet commit，Phase D 已接入真实 execution-summary/dev-sync，D.2 已接入 `POST /execution-handoffs` 创建 PromptPackage + handoff_created progress event，P1 已接入 `POST /execution-handoffs/{prompt_package_id}/consume` 创建 handoff_consumed progress event 并把 execution status 投影为 coding，Release Growth P1 已接入 execution evidence gate，Release Validation P1 已接入 `POST /release-validation-runs` 创建 `ReleaseValidationRun` 快照，Release Feedback P1 已接入 `POST /release-feedback-ingests` 写入 `FeedbackIngest` 并生成 `IterationRecommendation`，Iteration Loop P1 已接入 `POST /iteration-recommendations/{recommendation_id}/change-set-drafts` 把 recommendation 回流到 Change Review，Iteration Loop P2 已接入 `POST /iteration-recommendation-groups/{group_key}/change-set-drafts` 并在 `releaseSignals.recommendationGroups` 暴露分组/去重/风险/影响合同；当前仍不调用真实 AI 提取，不把 mock 当真实失败 fallback。`ProjectMemoryPage.tsx` 在真实模式下展示后端 `truth_nodes + semantic_facts` 的 `projectMemory` 投影，accepted/edited ChangeItem 只有 commit 成功后才进入 Project Memory。`frontend/src/features/pmflow-os/components/ProjectStructuredLoop.tsx` 提供 `StatusLabel / EvidenceSnippet / ObjectChangeCard / ProjectConversationPanel / StructuredExtractionPanel / ProjectAICopilotPanel` 等闭环组件，并复用契约化 `InlineNotice` 表达“未确认不得写入”的局部提示。
 - PMFlow OS 后端入口位于 `backend/app/api/pmflow_os_api/`，projection service 位于 `backend/app/services/pmflow_os_projection_service.py`，Change Review / commit 服务位于 `backend/app/services/pmflow_change_review_service.py`，Pydantic 合同位于 `backend/app/schemas/pmflow_os.py`；当前聚合 `truth_nodes / tasks / semantic_facts / ai_project_control / dev_sync`，`Thread / Message` 来自 `pmflow_threads / pmflow_thread_messages`，`ChangeSet / ChangeItem / Approval / EvidenceLink` 来自 `backend/app/models/pmflow_change_review.py` 对应真实表。C1 已实现 message、`proposed_items` extraction、ChangeSet detail、ChangeItem `accept/edit/defer`；C2 backend/frontend 已实现 `POST /pmflow-os/change-sets/{change_set_id}/commit` 与真实模式前端接入，默认 atomic，将 `Requirement / Decision / Risk` 写入 `truth_nodes`，将 `Task` 写入 `truth_nodes(node_type='task') + tasks`，高风险项强制 approval gate；D.2 已实现 `POST /pmflow-os/projects/{project_id}/execution-handoffs`，校验 task/repo project 边界，生成/复用 `PromptPackage(package_kind='execution_handoff')` 并写 `ProgressEvent(event_type='handoff_created')` 起点；P1 已实现 `POST /pmflow-os/projects/{project_id}/execution-handoffs/{prompt_package_id}/consume`，校验 execution handoff package 后更新 `PromptPackage.package_payload.latest_handoff.handoff_state=consumed` 并写 `ProgressEvent(event_type='handoff_consumed', derived_task_status='coding')`；Release Growth P1 在 `ExecutionSummaryProjection.releaseGate` 中从 `ProgressEvent` 推导发布门禁状态，失败事件 fail-closed 阻塞发布，无证据返回 empty/warning；Release Validation P1 新增 `POST /pmflow-os/projects/{project_id}/release-validation-runs`，复用现有 `ReleaseValidationRun` 模型固化当前 `releaseGate` 快照、人工决策、证据、阻塞原因和下一步动作，并在 `releaseGate.latestValidationRun` 返回最新记录；Release Feedback P1 新增 `POST /pmflow-os/projects/{project_id}/release-feedback-ingests`，复用现有 `FeedbackIngest / IterationRecommendation`，在 `ExecutionSummaryProjection.releaseSignals` 中返回真实发布后 feedback、revenue event 和 iteration recommendation 读模型；Iteration Loop P1 新增 `POST /pmflow-os/projects/{project_id}/iteration-recommendations/{recommendation_id}/change-set-drafts`，把真实 recommendation 转为 open ChangeSet、pending_review Requirement/Task/Risk/Decision items 与 `iteration_recommendation` evidence，重复调用复用既有 draft 并在 `releaseSignals` 标记 `changeSetCreated/changeSetId`；Iteration Loop P2 新增 `POST /pmflow-os/projects/{project_id}/iteration-recommendation-groups/{group_key}/change-set-drafts`，把同组 recommendation 批量转成一个 open ChangeSet draft 与 `iteration_recommendation_group` evidence，并在 `releaseSignals.recommendations / recommendationGroups` 投影 `groupKey / duplicateOf / mergedCount / impactLevel / riskLevel / suggestedChangeTypes / reviewPriority`；这些步骤都不直接执行本机命令、真实发布命令、外部支付、真实推送、自动 Project Memory commit 或正式任务创建；`ModelDecision / MetricSignal` 在 C2 V1 仍 fail-closed。
-- `frontend/src/features/account-settings/AccountSettingsPanel.tsx` 是 `/me` 设置页实现：桌面端为个人资料摘要 + 分区设置面板，移动端为分组列表 + `MobileBottomSheet` 编辑；当前覆盖个人资料、默认语言、AI 回答深度、证据展示偏好、待确认、执行回写、发布门禁和失败提醒通知偏好，并在通知偏好区展示页面内提醒消费说明、提醒强度和证据展示配置。`frontend/src/api/accountSettings.ts` 是前端合同层；有 token 时优先调用 `backend/app/api/account_settings_api/`，失败时回落浏览器本机暂存；P2 新增 `shouldShowAccountNotification` 与 `getAccountNotificationConsumption`，将四类通知偏好映射为本地 UI 的待确认、Execution Bridge、Release/Growth 和失败提醒显示/静默状态；P3 新增 `getReleaseGateNotificationPreference(settings, event)`，把 Release/Growth 的 `release_gate_* / release_validation_*` 事件映射到 `releaseGate` 偏好，把 `failed_event` 映射到 `failureAlert` 偏好；P5/P6 的 `getPostReleaseNotificationPreference(settings, event)` 把发布后 `feedback_received / revenue_signal / compliance_blocked` 映射到 `releaseGate` 偏好，把 `iteration_recommendation / next_change_review` 映射到 `pendingConfirmation` 偏好和 `change_review` surface，并返回 `spaceReadable / evidencePolicy / reminderPolicy` 供 Main Flow 与 Space 消费；P7 将通知偏好扩展为 `reminderIntensity=silent|normal|prominent` 与 `evidenceDisplay=compact|expanded`，并新增 `getAccountReminderConsumption(settings, event)` 覆盖 `change_review_high_risk / iteration_draft_ready / release_blocked / execution_stalled`，输出 `notificationTransport=in_app_only / evidencePolicy=preserve_business_evidence / auditPolicy=preserve_audit_state`。该合同只控制页面内提醒表达，不代表邮件、桌面推送或系统通知中心已接入；偏好关闭也不得隐藏业务证据、recommendation、ChangeSet、执行状态或审计状态。`backend/app/schemas/account_settings.py` 定义账号偏好合同，`backend/app/services/account_settings_service.py` 当前复用既有 `integrations` 表按 `tenant_id + user_id` 保存 `account_settings_preferences` 配置包，`backend/app/api/router.py` 已挂载该 API；未改用户表、OAuth/JWT/auth core 或 PMFlow OS truth store。
+- `frontend/src/features/account-settings/AccountSettingsPanel.tsx` 是 `/me` 设置页实现：桌面端为个人资料摘要 + 分区设置面板，移动端为分组列表 + `MobileBottomSheet` 编辑；当前覆盖个人资料、默认语言、AI 回答深度、证据展示偏好、待确认、执行回写、发布门禁和失败提醒通知偏好，并在通知偏好区展示页面内提醒消费说明、提醒强度和证据展示配置。`frontend/src/api/accountSettings.ts` 是前端合同层；有 token 时优先调用 `backend/app/api/account_settings_api/`，失败时回落浏览器本机暂存；P2 新增 `shouldShowAccountNotification` 与 `getAccountNotificationConsumption`，将四类通知偏好映射为本地 UI 的待确认、Execution Bridge、Release/Growth 和失败提醒显示/静默状态；P3 新增 `getReleaseGateNotificationPreference(settings, event)`，把 Release/Growth 的 `release_gate_* / release_validation_*` 事件映射到 `releaseGate` 偏好，把 `failed_event` 映射到 `failureAlert` 偏好；P5/P6 的 `getPostReleaseNotificationPreference(settings, event)` 把发布后 `feedback_received / revenue_signal / compliance_blocked` 映射到 `releaseGate` 偏好，把 `iteration_recommendation / next_change_review` 映射到 `pendingConfirmation` 偏好和 `change_review` surface，并返回 `spaceReadable / evidencePolicy / reminderPolicy` 供 Main Flow 与 Space 消费；P7 将通知偏好扩展为 `reminderIntensity=silent|normal|prominent` 与 `evidenceDisplay=compact|expanded`，并新增 `getAccountReminderConsumption(settings, event)` 覆盖 `change_review_high_risk / iteration_draft_ready / release_blocked / execution_stalled`，输出 `notificationTransport=in_app_only / evidencePolicy=preserve_business_evidence / auditPolicy=preserve_audit_state`；P8 新增 `getReviewDecisionNotificationPreference(settings, event)` 覆盖 `review_requested / review_approved / review_changes_requested / review_rejected / high_risk_approval_required`，继续使用 `pendingConfirmation` 偏好和 `change_review` surface，并声明 reviewerRouting、approval、evidence、audit state 均必须保留。该合同只控制页面内提醒表达，不代表邮件、桌面推送或系统通知中心已接入；偏好关闭也不得隐藏业务证据、reviewerRouting、approval、recommendation、ChangeSet、执行状态或审计状态。`backend/app/schemas/account_settings.py` 定义账号偏好合同，`backend/app/services/account_settings_service.py` 当前复用既有 `integrations` 表按 `tenant_id + user_id` 保存 `account_settings_preferences` 配置包，`backend/app/api/router.py` 已挂载该 API；未改用户表、OAuth/JWT/auth core 或 PMFlow OS truth store。
 - `frontend/src/features/pmflow-os/store.tsx` 当前是 PMFlow OS 共享 truth store：`?projectId=<id>` 时通过 React Query 调用 `frontend/src/api/pmflowOs.ts` 读取真实 `GET /pmflow-os/projects/{project_id}/truth-state` 与 `GET /pmflow-os/projects/{project_id}/execution-summary`，真实模式下项目内 message、`proposed_items` extraction、ChangeItem `accept/edit/defer`、ChangeSet commit、review decision、Execution Handoff create/consume、execution progress writeback、release validation run create、release feedback ingest 与 iteration recommendation -> ChangeSet draft 均调用 `/pmflow-os` 后端并 refetch；只有显式 `?demo=1` 或 `?dataSource=demo` 时才启用本地 mock 演示状态机。真实读取/动作失败会进入错误/空态，不静默 fallback 成 mock 成功。
 - `frontend/src/features/pmflow-os/store.tsx` 仍保留演示用项目内 AI 结构化闭环状态机：`command_idle / ai_extracting / extraction_ready / review_open / writeback_success`。`frontend/src/features/pmflow-os/pages/StructuredExtractionPage.tsx` 是本轮结构化提取页，`ChangeReviewPage.tsx` 是决策与待确认中心，`MemoryWritebackResultPage.tsx` 是项目记忆写入结果页，`WorkGraphPage.tsx` 是项目工作台关系总览与对象投影视图，`ExecutionBridgePage.tsx` 是执行桥上下文包、交接按钮、运行端领取确认、PR/测试与回写状态页；`ReleaseGrowthPage.tsx` 真实模式读取 `execution-summary.releaseGate`、`latestValidationRun` 与 `releaseSignals`，从 branch、commit、PR、test、failed evidence 展示 `可发布 / 阻塞 / 需要人工确认 / 缺少证据` 判断、阻塞原因、下一步动作、发布验证记录和发布后 feedback/revenue/recommendation 信号，缺少发布后信号时显示 empty/warning，不执行发布命令、不展示 mock 发布结果；页面可把真实 recommendation 生成下一轮待确认 ChangeSet draft，生成后仍进入 Change Review accept/edit/defer，不自动 commit、不写 Project Memory、不创建正式任务；同时读取 Account notification preference helper，用 `releaseGate` 偏好控制发布门禁强调提醒，用 `failureAlert` 偏好控制失败强调提醒，偏好关闭时只静默提醒表达强度，不隐藏 release evidence、阻塞原因、审计状态、validation run 或 releaseSignals；静态发布/增长原型只保留在显式 demo 模式。A3 已接入后端 truth-state，C1 已接入真实 message/extraction/review 状态机，C2 已接入真实 ChangeSet commit，Phase D 已接入真实 execution-summary/dev-sync，D.2 已接入 `POST /execution-handoffs` 创建 PromptPackage + handoff_created progress event，P1 已接入 `POST /execution-handoffs/{prompt_package_id}/consume` 创建 handoff_consumed progress event 并把 execution status 投影为 coding，Release Growth P1 已接入 execution evidence gate，Release Validation P1 已接入 `POST /release-validation-runs` 创建 `ReleaseValidationRun` 快照，Release Feedback P1 已接入 `POST /release-feedback-ingests` 写入 `FeedbackIngest` 并生成 `IterationRecommendation`，Iteration Loop P1 已接入 `POST /iteration-recommendations/{recommendation_id}/change-set-drafts` 把 recommendation 回流到 Change Review；当前仍不调用真实 AI 提取，不把 mock 当真实失败 fallback。`ProjectMemoryPage.tsx` 在真实模式下展示后端 `truth_nodes + semantic_facts` 的 `projectMemory` 投影，accepted/edited ChangeItem 只有 commit 成功后才进入 Project Memory。`frontend/src/features/pmflow-os/components/ProjectStructuredLoop.tsx` 提供 `StatusLabel / EvidenceSnippet / ObjectChangeCard / ProjectConversationPanel / StructuredExtractionPanel / ProjectAICopilotPanel` 等闭环组件，并复用契约化 `InlineNotice` 表达“未确认不得写入”的局部提示。
 - PMFlow OS 后端入口位于 `backend/app/api/pmflow_os_api/`，projection service 位于 `backend/app/services/pmflow_os_projection_service.py`，Change Review / commit / review decision 服务位于 `backend/app/services/pmflow_change_review_service.py`，Pydantic 合同位于 `backend/app/schemas/pmflow_os.py`；当前聚合 `truth_nodes / tasks / semantic_facts / ai_project_control / dev_sync`，`Thread / Message` 来自 `pmflow_threads / pmflow_thread_messages`，`ChangeSet / ChangeItem / Approval / EvidenceLink` 来自 `backend/app/models/pmflow_change_review.py` 对应真实表。`ProjectTruthState.reviewerRouting` 是 Team layer 的 reviewer routing + decision 读模型：从 open/pending ChangeSet、待审 item 风险、跨对象类型、`iteration_recommendation` evidence、项目成员与 `OWNER / REVIEWER` 角色推导 `{status, warningCode, summary, items}`；item 内含 `sourceType / riskLevel / priority / suggestedReviewer / fallbackReviewerRole / targetUrl / reviewDecision / approvalState / requestedAt / decidedAt / decisionReason`；缺成员、缺角色或缺证据时 fail-closed 给 warning，不虚构 reviewer。P8 新增 `POST /pmflow-os/change-sets/{change_set_id}/review-decisions`，支持 `request_review / approve / request_changes / reject`，`approve / request_changes / reject` 写 `PMFlowApproval` 审计，high-risk approve 后才满足 C2 approval gate，所有 decision 都不自动 commit。C1 已实现 message、`proposed_items` extraction、ChangeSet detail、ChangeItem `accept/edit/defer`；C2 backend/frontend 已实现 `POST /pmflow-os/change-sets/{change_set_id}/commit` 与真实模式前端接入，默认 atomic，将 `Requirement / Decision / Risk` 写入 `truth_nodes`，将 `Task` 写入 `truth_nodes(node_type='task') + tasks`，高风险项强制 approval gate；D.2 已实现 `POST /pmflow-os/projects/{project_id}/execution-handoffs`，校验 task/repo project 边界，生成/复用 `PromptPackage(package_kind='execution_handoff')` 并写 `ProgressEvent(event_type='handoff_created')` 起点；P1 已实现 `POST /pmflow-os/projects/{project_id}/execution-handoffs/{prompt_package_id}/consume`，校验 execution handoff package 后更新 `PromptPackage.package_payload.latest_handoff.handoff_state=consumed` 并写 `ProgressEvent(event_type='handoff_consumed', derived_task_status='coding')`；Release Growth P1 在 `ExecutionSummaryProjection.releaseGate` 中从 `ProgressEvent` 推导发布门禁状态，失败事件 fail-closed 阻塞发布，无证据返回 empty/warning；Release Validation P1 新增 `POST /pmflow-os/projects/{project_id}/release-validation-runs`，复用现有 `ReleaseValidationRun` 模型固化当前 `releaseGate` 快照、人工决策、证据、阻塞原因和下一步动作，并在 `releaseGate.latestValidationRun` 返回最新记录；Release Feedback P1 新增 `POST /pmflow-os/projects/{project_id}/release-feedback-ingests`，复用现有 `FeedbackIngest / IterationRecommendation`，在 `ExecutionSummaryProjection.releaseSignals` 中返回真实发布后 feedback、revenue event 和 iteration recommendation 读模型；Iteration Loop P1 新增 `POST /pmflow-os/projects/{project_id}/iteration-recommendations/{recommendation_id}/change-set-drafts`，把真实 recommendation 转为 open ChangeSet、pending_review Requirement/Task/Risk/Decision items 与 `iteration_recommendation` evidence，重复调用复用既有 draft 并在 `releaseSignals` 标记 `changeSetCreated/changeSetId`；这些步骤都不直接执行本机命令、真实发布命令、外部支付、真实推送、自动 Project Memory commit 或正式任务创建；`ModelDecision / MetricSignal` 在 C2 V1 仍 fail-closed。

docs/architecture/CODE_REFERENCE_INDEX.md

@@ -105,16 +105,16 @@
 - AI Steward handoff 元卡片回归：参考 `frontend/src/components/ai-steward/FloatingQAChat.test.tsx`、`frontend/src/components/ai-steward/QAResponseMetaCard.test.tsx`
 - AI Steward / QA session 前端 contract：参考 `frontend/src/api/aiSteward.ts`
 - PMFlow OS 前端 MVP 产品域：参考 `frontend/src/features/pmflow-os/`
-- 个人空间首页 / 空间层入口前端产品域：参考 `frontend/src/features/personal-space/`、`frontend/src/api/space.ts` 与薄入口 `frontend/src/pages/PersonalSpacePage.tsx`；本地预览路由入口为 `/space`，首屏以 `nextActionQueue` 展示“我的下一步”，并保留继续推进、待我确认、发布关注、发布后反馈关注、下一轮迭代草稿关注、执行中 / AI 正在推进、暂存想法、草案箱与最近项目明细；点击项目主动作进入 `/pmflow-os?projectId=<id>`，待确认项进入 `/change-review?projectId=<id>&changeSetId=<id>`，执行中项进入 `/execution-bridge?projectId=<id>`，发布关注和发布后反馈关注项进入 `/release-growth?projectId=<id>`，已生成 ChangeSet draft 的下一轮建议进入 `/change-review?projectId=<id>&changeSetId=<id>`；Space 只读聚合项目摘要、PMFlow OS `truth-state.releases / execution-summary.releaseGate / execution-summary.releaseSignals`，发布验证、发布后信号或 iteration draft 缺失时显示明确空态，不虚构验证、反馈、收入、ROI、合规、iteration recommendation 或 ChangeSet draft，不直接写 Project Memory、ChangeSet 状态、execution event、ReleaseValidationRun、FeedbackIngest、RevenueEvent 或 ComplianceCheckRun；暂存想法后端只读聚合尚未接入时必须显示 empty/warning，不得用 mock 数据冒充真实内容；空间层共享左侧栏、顶部条与空间用量组件在 `frontend/src/features/personal-space/components/SpaceChrome.tsx`，`/project-launch` 桌面首次新建壳也复用该组件
+- 个人空间首页 / 空间层入口前端产品域：参考 `frontend/src/features/personal-space/`、`frontend/src/api/space.ts` 与薄入口 `frontend/src/pages/PersonalSpacePage.tsx`；本地预览路由入口为 `/space`，首屏以 `nextActionQueue` 展示“我的下一步”，并保留继续推进、待我确认、发布关注、发布后反馈关注、下一轮迭代草稿关注、执行中 / AI 正在推进、暂存想法、草案箱与最近项目明细；点击项目主动作进入 `/pmflow-os?projectId=<id>`，待确认项进入 `/change-review?projectId=<id>&changeSetId=<id>`，review attention 待审项进入 `/change-review?projectId=<id>&changeSetId=<id>`，reviewer 缺失 warning 进入已有 `/team-layer?projectId=<id>`，执行中项进入 `/execution-bridge?projectId=<id>`，发布关注和发布后反馈关注项进入 `/release-growth?projectId=<id>`，已生成 ChangeSet draft 的下一轮建议进入 `/change-review?projectId=<id>&changeSetId=<id>`；Space 只读聚合项目摘要、PMFlow OS `truth-state.reviewerRouting / truth-state.releases / execution-summary.releaseGate / execution-summary.releaseSignals`，reviewerRouting、发布验证、发布后信号或 iteration draft 缺失时显示明确空态，不虚构 reviewer、审查意见、待审 ChangeSet、验证、反馈、收入、ROI、合规、iteration recommendation 或 ChangeSet draft，不直接写 Project Memory、ChangeSet 状态、PMFlowApproval、execution event、ReleaseValidationRun、FeedbackIngest、RevenueEvent 或 ComplianceCheckRun；暂存想法后端只读聚合尚未接入时必须显示 empty/warning，不得用 mock 数据冒充真实内容；空间层共享左侧栏、顶部条与空间用量组件在 `frontend/src/features/personal-space/components/SpaceChrome.tsx`，`/project-launch` 桌面首次新建壳也复用该组件
 - 新项目启动台 / 首次进入页前端产品域：参考 `frontend/src/features/project-launch/` 与薄入口 `frontend/src/pages/ProjectLaunchPage.tsx`；真实模式默认通过 `frontend/src/api/pmflowLaunch.ts` 调用后端 draft/confirm API，只有显式 `?demo=1` 或 `?dataSource=demo` 才启用 `mockData.ts` 本地演示状态机；本地预览路由入口为 `/project-launch`
 - PMFlow OS 共享 truth store 与主链状态动作：参考 `frontend/src/features/pmflow-os/store.tsx`；当前支持 `?projectId=<id>` 走 React Query 读取真实 `truth-state` 与 `execution-summary`，真实模式下 thread message、`proposed_items` extraction、ChangeItem `accept/edit/defer`、ChangeSet commit、review decision、Execution Handoff create/consume、execution progress writeback、release validation run create、release feedback ingest、单条 iteration recommendation -> ChangeSet draft 与同组 iteration recommendation 批量 -> ChangeSet draft 均调后端并 refetch，不本地 promote 入 Project Memory、不伪造 approval、execution event、发布验证记录、发布后信号或下一轮 draft；`?demo=1` 才启用本地 mock 演示状态机和本地动作；项目内 AI 结构化闭环状态机为 `command_idle / ai_extracting / extraction_ready / review_open / writeback_success`
-- Account Settings / `/me` 前端产品域与 P1-P7 偏好合同：参考 `frontend/src/features/account-settings/AccountSettingsPanel.tsx`、`frontend/src/features/pmflow-os/pages/AccountPage.tsx`、`frontend/src/api/accountSettings.ts`、`backend/app/api/account_settings_api/`、`backend/app/schemas/account_settings.py` 与 `backend/app/services/account_settings_service.py`；当前覆盖个人资料、默认语言、AI 回答深度、证据展示偏好、待确认、执行回写、发布门禁和失败提醒通知偏好，移动端使用分组列表与 bottom sheet，账户退出仍复用 `AccountControls.tsx`，不改 OAuth/JWT/auth core；P1 后端合同提供 `GET /account-settings/me` 与 `PUT /account-settings/me`，已由 `backend/app/api/router.py` 挂入核心路由组，按当前 `tenant_id + user_id` 保存账号偏好，前端有 token 时优先账号同步，后端不可用时明确回落 `仅本机暂存 / 保存失败`；P2 在 `frontend/src/api/accountSettings.ts` 提供 `shouldShowAccountNotification` 与 `getAccountNotificationConsumption`，把通知偏好映射为页面内提醒消费模型；P3 新增 `getReleaseGateNotificationPreference(settings, event)` 供 Release/Growth 后续消费：`release_gate_*` 与 `release_validation_*` 使用 `releaseGate` 偏好，`failed_event` 使用 `failureAlert` 偏好；P5/P6 的 `getPostReleaseNotificationPreference(settings, event)` 供发布后反馈与下一轮待确认消费：`feedback_received / revenue_signal / compliance_blocked` 使用 `releaseGate` 偏好，`iteration_recommendation / next_change_review` 使用 `pendingConfirmation` 偏好并落到 `change_review` surface；P7 将每类通知偏好扩展为 `reminderIntensity=silent|normal|prominent` 与 `evidenceDisplay=compact|expanded`，并新增 `getAccountReminderConsumption(settings, event)` 覆盖 `change_review_high_risk / iteration_draft_ready / release_blocked / execution_stalled`，稳定返回 `notificationTransport=in_app_only / evidencePolicy=preserve_business_evidence / auditPolicy=preserve_audit_state`；ReleaseGrowthPage 当前消费 `releaseGate` 与 `failureAlert` 两个偏好，只静默强调型提醒，不隐藏 release evidence、阻塞原因、审计状态、validation run、releaseSignals 或下一轮 ChangeSet draft；这些 helper 只控制本地 UI 提醒消费合同，不代表真实邮件、桌面推送或系统通知中心已接入
+- Account Settings / `/me` 前端产品域与 P1-P8 偏好合同：参考 `frontend/src/features/account-settings/AccountSettingsPanel.tsx`、`frontend/src/features/pmflow-os/pages/AccountPage.tsx`、`frontend/src/api/accountSettings.ts`、`backend/app/api/account_settings_api/`、`backend/app/schemas/account_settings.py` 与 `backend/app/services/account_settings_service.py`；当前覆盖个人资料、默认语言、AI 回答深度、证据展示偏好、待确认、执行回写、发布门禁和失败提醒通知偏好，移动端使用分组列表与 bottom sheet，账户退出仍复用 `AccountControls.tsx`，不改 OAuth/JWT/auth core；P1 后端合同提供 `GET /account-settings/me` 与 `PUT /account-settings/me`，已由 `backend/app/api/router.py` 挂入核心路由组，按当前 `tenant_id + user_id` 保存账号偏好，前端有 token 时优先账号同步，后端不可用时明确回落 `仅本机暂存 / 保存失败`；P2 在 `frontend/src/api/accountSettings.ts` 提供 `shouldShowAccountNotification` 与 `getAccountNotificationConsumption`，把通知偏好映射为页面内提醒消费模型；P3 新增 `getReleaseGateNotificationPreference(settings, event)` 供 Release/Growth 后续消费：`release_gate_*` 与 `release_validation_*` 使用 `releaseGate` 偏好，`failed_event` 使用 `failureAlert` 偏好；P5/P6 的 `getPostReleaseNotificationPreference(settings, event)` 供发布后反馈与下一轮待确认消费：`feedback_received / revenue_signal / compliance_blocked` 使用 `releaseGate` 偏好，`iteration_recommendation / next_change_review` 使用 `pendingConfirmation` 偏好并落到 `change_review` surface；P7 将每类通知偏好扩展为 `reminderIntensity=silent|normal|prominent` 与 `evidenceDisplay=compact|expanded`，并新增 `getAccountReminderConsumption(settings, event)` 覆盖 `change_review_high_risk / iteration_draft_ready / release_blocked / execution_stalled`，稳定返回 `notificationTransport=in_app_only / evidencePolicy=preserve_business_evidence / auditPolicy=preserve_audit_state`；P8 新增 `getReviewDecisionNotificationPreference(settings, event)` 覆盖 `review_requested / review_approved / review_changes_requested / review_rejected / high_risk_approval_required`，统一使用 `pendingConfirmation` 偏好和 `change_review` surface，返回 `reviewerRoutingPolicy=preserve_reviewer_routing / approvalPolicy=preserve_approval_state`，偏好关闭只静默页面内提醒，不隐藏 reviewerRouting、approval、evidence 或 audit state；ReleaseGrowthPage 当前消费 `releaseGate` 与 `failureAlert` 两个偏好，只静默强调型提醒，不隐藏 release evidence、阻塞原因、审计状态、validation run、releaseSignals 或下一轮 ChangeSet draft；这些 helper 只控制本地 UI 提醒消费合同，不代表真实邮件、桌面推送或系统通知中心已接入
 - PMFlow OS 产品页入口：参考 `frontend/src/features/pmflow-os/pages/CommandCenterPage.tsx`、`StructuredExtractionPage.tsx`、`ChangeReviewPage.tsx`、`MemoryWritebackResultPage.tsx`、`WorkGraphPage.tsx`、`ExecutionBridgePage.tsx`、`ReleaseGrowthPage.tsx`、`TeamLayerPage.tsx`、`ProjectMemoryPage.tsx`、`AccountPage.tsx`；`ChangeReviewPage.tsx` 真实模式可对当前 ChangeSet 请求审查、通过、要求修改或拒绝，展示审查状态、建议 reviewer、审查意见和 high-risk approval gate，但不自动 commit；`TeamLayerPage.tsx` 真实模式读取 `state.reviewerRouting` 展示 ready/empty/warning、待审 ChangeSet、来源（下一轮迭代 / AI 提取 / 手动）、风险等级、建议审查人或 fallback role、审查原因、待审 item 数、证据数、审查状态、审查意见、请求/决策时间，并跳转 `/change-review?projectId=<id>&changeSetId=<id>`；`ReleaseGrowthPage.tsx` 真实模式展示 `execution-summary.releaseGate`、execution evidence、阻塞原因、下一步动作、`latestValidationRun` 和 `releaseSignals`，缺证据或缺发布后信号时显示 empty/warning，不展示 mock 发布结果；页面可调用真实 API 创建 release validation run、摄取 release feedback，从真实 recommendation 单条或同组批量生成下一轮待确认 ChangeSet draft，并解释 `iteration_recommendation_group` evidence 的组、反馈、风险、影响和审查优先级；生成后仍进入 Change Review accept/edit/defer，不自动 commit、不写 Project Memory、不执行部署命令、不接外部支付；同时消费 Account notification preference helper，`releaseGate` 关闭时静默发布门禁强调提醒，`failureAlert` 关闭时静默失败强调提醒，所有真实证据和审计状态仍可见；静态高保真发布/增长数据仅保留在显式 demo 模式
 - PMFlow OS 行为组件：参考 `frontend/src/features/pmflow-os/components/ProjectStructuredLoop.tsx`、`ProjectStageRail.tsx`、`ThreadComposer.tsx`、`ExtractionRail.tsx`、`ChangeGroupPanel.tsx`、`ObjectGraphSection.tsx`、`ContextPacketPanel.tsx`、`ExecutionTimeline.tsx`、`ReleaseGatePanel.tsx`、`TeamFeedPanel.tsx`、`ChangeReviewGroup.tsx`、`WorkbenchPanel.tsx`、`ExecutionBridgeCards.tsx`、`PMFlowOsFrame.tsx`、`AccountControls.tsx`、`FeedbackPrimitives.tsx`、`MobileBottomNav.tsx`；其中 `ProjectStructuredLoop.tsx` 承接 `StatusLabel / EvidenceSnippet / ObjectChangeCard / ProjectConversationPanel / StructuredExtractionPanel / ProjectAICopilotPanel`，`PMFlowOsFrame.tsx` 承接项目内面包屑和项目切换器，`AccountControls.tsx` 承接桌面头像菜单、退出登录确认与移动端 bottom sheet，`FeedbackPrimitives.tsx` 承接 `PageBanner / InlineNotice / HumanDecisionBar / ConfirmDialog / MobileBottomSheet`，`MobileBottomNav.tsx` 承接正式应用壳移动端固定底部导航
 - PMFlow OS 原型状态回归测试：参考 `frontend/src/features/pmflow-os/store.test.ts`；真实 API 动作回归参考 `frontend/src/features/pmflow-os/store.api.test.tsx`
 - Space 工作面回归测试：参考 `frontend/src/features/personal-space/PersonalSpacePage.test.tsx`，覆盖空态、导航只读约束、发布/反馈/迭代草案队列，以及 reviewerRouting -> `review_attention` 的 next action 聚合排序与 `/change-review`、`/team-layer` 跳转合同。
 - Project Launch 真实/演示分支回归测试：参考 `frontend/src/features/project-launch/useProjectLaunchState.test.ts`
-- Account Settings 前端合同回归测试：参考 `frontend/src/features/account-settings/accountSettings.test.ts`，覆盖默认偏好、账号同步 fallback、通知偏好消费模型、提醒强度/证据展示合同、Release/Growth 通知消费合同、失败事件映射和缺字段 fallback。
+- Account Settings 前端合同回归测试：参考 `frontend/src/features/account-settings/accountSettings.test.ts`，覆盖默认偏好、账号同步 fallback、通知偏好消费模型、提醒强度/证据展示合同、Release/Growth 通知消费合同、review decision / reviewer request / high-risk approval 偏好合同、失败事件映射和缺字段 fallback。
 - 网页问答显式锚点与 AI Steward URL 构造：参考 `frontend/src/components/ai-steward/qaPageAnchor.ts`
 - Inbox 页面入口：参考 `frontend/src/pages/inbox/`
 - Inbox `plan_mode` 展开卡片与映射：参考 `frontend/src/components/inbox/InboxListItem.tsx`、`frontend/src/lib/inbox.ts`、`frontend/src/api/aiPmo.ts`

frontend/src/api/accountSettings.ts

@@ -13,6 +13,12 @@ export type AccountReminderConsumptionEvent =
   | "iteration_draft_ready"
   | "release_blocked"
   | "execution_stalled";
+export type AccountReviewDecisionNotificationEvent =
+  | "review_requested"
+  | "review_approved"
+  | "review_changes_requested"
+  | "review_rejected"
+  | "high_risk_approval_required";
 export type AccountPostReleaseNotificationEvent =
   | "feedback_received"
   | "revenue_signal"
@@ -85,6 +91,27 @@ export interface AccountReminderConsumptionContract {
   mutedDetail: string;
 }
 
+export interface AccountReviewDecisionNotificationPreference {
+  event: AccountReviewDecisionNotificationEvent;
+  notificationKey: AccountNotificationKey;
+  surface: "change_review";
+  productArea: "Change Review";
+  title: string;
+  reason: string;
+  reminderIntensity: AccountReminderIntensity;
+  evidenceDisplay: AccountNotificationEvidenceDisplay;
+  showInAppReminder: boolean;
+  showProminentReminder: boolean;
+  desktopPreference: boolean;
+  emailDigestPreference: boolean;
+  notificationTransport: "in_app_only";
+  evidencePolicy: "preserve_business_evidence";
+  auditPolicy: "preserve_audit_state";
+  reviewerRoutingPolicy: "preserve_reviewer_routing";
+  approvalPolicy: "preserve_approval_state";
+  mutedDetail: string;
+}
+
 export interface AccountReleaseGateNotificationPreference {
   event: AccountReleaseNotificationEvent;
   notificationKey: AccountNotificationKey;
@@ -146,7 +173,7 @@ interface ApiEnvelope<T> {
 export const accountNotificationLabels: Record<AccountNotificationKey, { title: string; detail: string }> = {
   pendingConfirmation: {
     title: "待确认",
-    detail: "AI 生成草案、变更项或写入前确认需要你拍板时提醒。",
+    detail: "AI 生成草案、review request、review decision 或高风险 approval 需要你拍板时提醒。",
   },
   executionWriteback: {
     title: "执行回写",
@@ -176,7 +203,7 @@ const accountNotificationConsumptionMeta: Record<
   pendingConfirmation: {
     surface: "change_review",
     productArea: "待确认中心",
-    trigger: "AI 生成草案、ChangeSet 待审、写入项目记忆前的人类拍板提醒。",
+    trigger: "AI 生成草案、ChangeSet 待审、review request / decision、高风险 approval 的页面内提醒。",
   },
   executionWriteback: {
     surface: "execution_bridge",
@@ -225,6 +252,32 @@ const reminderConsumptionEventMeta: Record<
   },
 };
 
+const reviewDecisionNotificationEventMeta: Record<
+  AccountReviewDecisionNotificationEvent,
+  { notificationKey: AccountNotificationKey; reason: string }
+> = {
+  review_requested: {
+    notificationKey: "pendingConfirmation",
+    reason: "Reviewer request 已创建、需要审查人进入 Change Review 时使用待确认偏好控制页面内提醒；reviewerRouting 仍按业务页面展示。",
+  },
+  review_approved: {
+    notificationKey: "pendingConfirmation",
+    reason: "Reviewer 已批准 ChangeSet 或审查项时使用待确认偏好控制页面内提醒；approval 审计状态仍必须保留。",
+  },
+  review_changes_requested: {
+    notificationKey: "pendingConfirmation",
+    reason: "Reviewer 要求修改 ChangeSet 或审查项时使用待确认偏好控制页面内提醒；变更请求、证据和审计状态不得被偏好隐藏。",
+  },
+  review_rejected: {
+    notificationKey: "pendingConfirmation",
+    reason: "Reviewer 拒绝 ChangeSet 或审查项时使用待确认偏好控制页面内提醒；拒绝原因、evidence 和 audit state 必须展示。",
+  },
+  high_risk_approval_required: {
+    notificationKey: "pendingConfirmation",
+    reason: "高风险 ChangeSet 需要 approval gate 时使用待确认偏好控制页面内提醒；approval 状态和业务证据仍由 Change Review 真源控制。",
+  },
+};
+
 const releaseNotificationEventMeta: Record<
   AccountReleaseNotificationEvent,
   { notificationKey: AccountNotificationKey; surface: "release_growth" | "system_failure"; reason: string }
@@ -510,6 +563,40 @@ export function getAccountReminderConsumption(
   };
 }
 
+export function getReviewDecisionNotificationPreference(
+  settings: AccountSettings | Partial<AccountSettings> | null | undefined,
+  event: AccountReviewDecisionNotificationEvent
+): AccountReviewDecisionNotificationPreference {
+  const normalized = mergeAccountSettings(createDefaultAccountSettings(), settings || null);
+  const meta = reviewDecisionNotificationEventMeta[event];
+  const preference = normalized.notifications[meta.notificationKey];
+  const reminderIntensity = getNotificationReminderIntensity(preference);
+  const evidenceDisplay = getNotificationEvidenceDisplay(preference);
+  const enabled = reminderIntensity !== "silent" && Boolean(preference.enabled);
+  return {
+    event,
+    notificationKey: meta.notificationKey,
+    surface: "change_review",
+    productArea: "Change Review",
+    title: accountNotificationLabels[meta.notificationKey].title,
+    reason: meta.reason,
+    reminderIntensity,
+    evidenceDisplay,
+    showInAppReminder: enabled,
+    showProminentReminder: enabled && reminderIntensity === "prominent",
+    desktopPreference: enabled && Boolean(preference.desktop),
+    emailDigestPreference: enabled && Boolean(preference.emailDigest),
+    notificationTransport: "in_app_only",
+    evidencePolicy: "preserve_business_evidence",
+    auditPolicy: "preserve_audit_state",
+    reviewerRoutingPolicy: "preserve_reviewer_routing",
+    approvalPolicy: "preserve_approval_state",
+    mutedDetail: enabled
+      ? "仅影响 Change Review 页面内提醒强度和证据展开方式；不接真实邮件、桌面推送或系统通知中心。"
+      : "仅静默页面内提醒；真实 reviewerRouting、approval、evidence 和 audit state 仍必须按业务页面展示。",
+  };
+}
+
 export function getReleaseGateNotificationPreference(
   settings: AccountSettings | Partial<AccountSettings> | null | undefined,
   event: AccountReleaseNotificationEvent = "release_gate_blocked"

frontend/src/features/account-settings/AccountSettingsPanel.tsx

@@ -268,7 +268,7 @@ function DesktopAccountSettings({
               <AiPreferenceFields aiPreferences={draft.aiPreferences} onPatchAi={onPatchAi} />
             </SettingsSection>
 
-            <SettingsSection icon={<Bell className="h-5 w-5" />} title="通知偏好" detail="优先覆盖需要人类拍板、执行回写、发布门禁和失败提醒。">
+            <SettingsSection icon={<Bell className="h-5 w-5" />} title="通知偏好" detail="优先覆盖需要人类拍板、review decision、执行回写、发布门禁和失败提醒。">
               <NotificationFields notifications={draft.notifications} onPatchNotification={onPatchNotification} />
             </SettingsSection>
           </main>
@@ -661,7 +661,7 @@ function NotificationConsumptionPreview({
         <div className="min-w-0">
           <div className="text-sm font-semibold text-slate-950">页面内提醒消费说明</div>
           <p className="mt-1 text-xs leading-5 text-slate-500">
-            这些偏好只控制 PMFlow 页面里的提醒强度和证据展开方式：待确认、执行回写、发布门禁和失败提醒。当前不代表系统级桌面推送、邮件推送或真实通知中心已接入。
+            这些偏好只控制 PMFlow 页面里的提醒强度和证据展开方式：待确认、review request / decision、高风险 approval、执行回写、发布门禁和失败提醒。当前不代表系统级桌面推送、邮件推送或真实通知中心已接入。
           </p>
         </div>
       </div>

frontend/src/features/account-settings/accountSettings.test.ts

@@ -6,6 +6,7 @@ import {
   getAccountSettings,
   getPostReleaseNotificationPreference,
   getReleaseGateNotificationPreference,
+  getReviewDecisionNotificationPreference,
   shouldShowAccountNotification,
   updateAccountSettings,
 } from "@/api/accountSettings";
@@ -162,6 +163,74 @@ describe("account settings api", () => {
     expect(executionStalled.showProminentReminder).toBe(false);
   });
 
+  it("maps review decision events to pending confirmation reminder preferences", () => {
+    const defaults = createDefaultAccountSettings();
+    const legacySettings = {
+      ...defaults,
+      notifications: {
+        ...defaults.notifications,
+        pendingConfirmation: {
+          enabled: true,
+          desktop: true,
+          emailDigest: false,
+        },
+      },
+    };
+    const prominentSettings = {
+      ...defaults,
+      notifications: {
+        ...defaults.notifications,
+        pendingConfirmation: {
+          ...defaults.notifications.pendingConfirmation,
+          reminderIntensity: "prominent" as const,
+          evidenceDisplay: "expanded" as const,
+          desktop: false,
+          emailDigest: true,
+        },
+      },
+    };
+    const silentSettings = {
+      ...defaults,
+      notifications: {
+        ...defaults.notifications,
+        pendingConfirmation: {
+          ...defaults.notifications.pendingConfirmation,
+          enabled: false,
+          desktop: true,
+          emailDigest: true,
+          reminderIntensity: "silent" as const,
+        },
+      },
+    };
+
+    const requested = getReviewDecisionNotificationPreference(legacySettings, "review_requested");
+    const approved = getReviewDecisionNotificationPreference(prominentSettings, "review_approved");
+    const changesRequested = getReviewDecisionNotificationPreference(prominentSettings, "review_changes_requested");
+    const rejected = getReviewDecisionNotificationPreference(silentSettings, "review_rejected");
+    const highRiskApproval = getReviewDecisionNotificationPreference(prominentSettings, "high_risk_approval_required");
+
+    expect(requested.notificationKey).toBe("pendingConfirmation");
+    expect(requested.surface).toBe("change_review");
+    expect(requested.reminderIntensity).toBe("normal");
+    expect(requested.evidenceDisplay).toBe("compact");
+    expect(requested.notificationTransport).toBe("in_app_only");
+    expect(requested.reviewerRoutingPolicy).toBe("preserve_reviewer_routing");
+    expect(requested.approvalPolicy).toBe("preserve_approval_state");
+    expect(approved.showProminentReminder).toBe(true);
+    expect(approved.evidenceDisplay).toBe("expanded");
+    expect(approved.desktopPreference).toBe(false);
+    expect(approved.emailDigestPreference).toBe(true);
+    expect(changesRequested.reason).toContain("要求修改");
+    expect(rejected.showInAppReminder).toBe(false);
+    expect(rejected.desktopPreference).toBe(false);
+    expect(rejected.emailDigestPreference).toBe(false);
+    expect(rejected.mutedDetail).toContain("reviewerRouting");
+    expect(rejected.mutedDetail).toContain("audit state");
+    expect(highRiskApproval.reason).toContain("approval gate");
+    expect(highRiskApproval.evidencePolicy).toBe("preserve_business_evidence");
+    expect(highRiskApproval.auditPolicy).toBe("preserve_audit_state");
+  });
+
   it("maps release gate and release validation events to the releaseGate preference", () => {
     const defaults = createDefaultAccountSettings();
     const settings = {