xiaohongmao-uniapp-sop

name	xiaohongmao-uniapp-sop
description	Use when working on the 小红帽/拼豆 uni-app mini-program in this repository, especially bug fixing, feature iteration, login/detail/publish/payment/membership/download flows, validation evidence, regression review, or handoff.

小红帽/拼豆 Uni-App SOP

Use This First

Before changing this project, read current code and classify the request:

• UI-only: style/layout, no API semantics. Verify with script syntax, build, and screenshot/manual check when possible.
• Runtime bug: login, detail, publish, upload, list, route, loading state. Add or extend scripts/verify-core-experience.mjs before or with the fix.
• High-risk business flow: membership, payment, unlock, download watermark, auth, permissions, schema. Pause after discovery if acceptance rules are not explicit.

Keep each iteration small. If two validation loops reveal unrelated new issues, stop and review whether the task is drifting.

Canonical Paths

• Frontend: laiyangy-xiaobode-site/addons/discover/uniapp
• Frontend API wrapper: laiyangy-xiaobode-site/addons/discover/uniapp/config/api.js
• Frontend common helpers: laiyangy-xiaobode-site/addons/discover/uniapp/config/common.js
• Core verifier: laiyangy-xiaobode-site/addons/discover/uniapp/scripts/verify-core-experience.mjs
• DevTools smoke helper: laiyangy-xiaobode-site/addons/discover/uniapp/scripts/devtools-runtime-smoke.mjs
• Backend controllers: laiyangy-xiaobode-site/application/api/controller/discover
• Evidence docs: docs/verification

Development Loop

1. Read pages.json, touched pages, API wrapper, and backend controller before judging the fix.
2. Define a minimal acceptance check in plain language.
3. For runtime behavior, add/extend fake runtime assertions in verify-core-experience.mjs.
4. Implement the smallest code change that satisfies the acceptance check.
5. Run focused verification, then build if frontend changed.
6. Update docs/verification/uniapp-core-experience-evidence.md only with evidence actually produced.
7. Report remaining gaps separately from verified results.

Required Local Checks

Run the relevant subset after code changes:

node laiyangy-xiaobode-site/addons/discover/uniapp/scripts/verify-core-experience.mjs
node --check laiyangy-xiaobode-site/addons/discover/uniapp/scripts/verify-core-experience.mjs
node --check laiyangy-xiaobode-site/addons/discover/uniapp/scripts/devtools-runtime-smoke.mjs
git diff --check

For frontend changes, also run HBuilderX mp-weixin build:

env \
  VUE_CLI_CONTEXT=/Applications/HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli \
  UNI_INPUT_DIR=/Users/didi/Documents/小红帽项目/laiyangy-xiaobode-site/addons/discover/uniapp \
  UNI_OUTPUT_DIR=/private/tmp/xiaohongmao-mp-weixin-build \
  UNI_PLATFORM=mp-weixin \
  NODE_ENV=production \
  /Applications/HBuilderX.app/Contents/HBuilderX/plugins/node/node \
  /Applications/HBuilderX.app/Contents/HBuilderX/plugins/uniapp-cli/bin/uniapp-cli.js

PHP CLI is not always available in this environment. If php -l cannot run, say so and rely on source-level contract checks plus runtime/manual validation.

Regression Traps

• Login success must return to source route, not hard-code home/user center.
• redirect must be decoded safely and restricted to /pages/.
• Protected APIs can return false synchronously when auth is invalid; pages must release loading/submitting state.
• Public pages may attach optional valid token, but backend must not trust spoofable request viewer_id / user_id.
• Registered pages must not call missing $api.xxx; registered post() wrappers must map to real backend public methods.
• uni.uploadFile uses header, not headers; parse upload response defensively.
• uni.getLocation failure callback is fail, not error.
• Page stack assumptions such as prevPage.$vm can white-screen when opened directly.
• Detail route must preserve is_drawing_post when the source item has it.
• Payment/unlock flows need in-flight locks and retryable refresh after async payment callback.

Current Known Open Issues

Keep the live issue list in docs/verification/remaining-core-issues.md. Do not silently remove an item until its acceptance check has been verified.

High-risk open areas currently include:

• New-member permanent membership purchase and old-member migration availability.
• Image download with watermark.
• Publish post real-runtime error.
• Account profile edit page visual consistency.

Stop Conditions

Pause and ask before changing:

• membership duration/permanent entitlement semantics;
• payment order creation, settlement, refund, idempotency, or unlock rules;
• watermark ownership/visibility rules or server-side file generation;
• database schema or production dependency;
• more than five files in one step;
• any second validation loop that reveals unrelated new failures.