diff --git a/blade-auth/src/main/java/org/springblade/auth/endpoint/OAuth2UserInfoResponseAdvice.java b/blade-auth/src/main/java/org/springblade/auth/endpoint/OAuth2UserInfoResponseAdvice.java
index 3c190cc4..32e1e1e3 100644
--- a/blade-auth/src/main/java/org/springblade/auth/endpoint/OAuth2UserInfoResponseAdvice.java
+++ b/blade-auth/src/main/java/org/springblade/auth/endpoint/OAuth2UserInfoResponseAdvice.java
@@ -30,11 +30,11 @@ import lombok.extern.slf4j.Slf4j;
 import org.springblade.core.oauth2.endpoint.OAuth2TokenEndPoint;
 import org.springblade.core.secure.BladeUser;
 import org.springblade.core.tool.api.R;
-import org.springblade.core.tool.support.Kv;
 import org.springblade.core.tool.utils.BeanUtil;
 import org.springblade.core.tool.utils.Func;
 import org.springblade.system.feign.ISysClient;
 import org.springblade.system.pojo.enums.MpUserIdentity;
+import org.springblade.system.utils.MpUserAuth;
 import org.springframework.core.MethodParameter;
 import org.springframework.http.MediaType;
 import org.springframework.http.converter.HttpMessageConverter;
@@ -74,7 +74,7 @@ public class OAuth2UserInfoResponseAdvice implements ResponseBodyAdvice<Object>
 		if (userInfo == null) {
 			return body;
 		}
-		if (isMpUser(bladeUser)) {
+		if (MpUserAuth.isMpUser(bladeUser)) {
 			// 小程序用户：按身份直接生成权限，不走系统角色菜单
 			userInfo.setPermission(MpUserIdentity.toPermissions(bladeUser.getRoleName()));
 		} else {
@@ -83,17 +83,6 @@ public class OAuth2UserInfoResponseAdvice implements ResponseBodyAdvice<Object>
 		return userInfo;
 	}
 
-	private boolean isMpUser(BladeUser bladeUser) {
-		Kv detail = bladeUser.getDetail();
-		if (detail != null && MpUserIdentity.DETAIL_TYPE.equalsIgnoreCase(Func.toStr(detail.get("type")))) {
-			return true;
-		}
-		// 兼容：无系统角色且 roleName 为小程序身份
-		return Func.isBlank(bladeUser.getRoleId())
-			&& Func.isNotBlank(bladeUser.getRoleName())
-			&& !MpUserIdentity.split(bladeUser.getRoleName()).isEmpty();
-	}
-
 	private List<String> loadPermission(String roleId) {
 		if (Func.isBlank(roleId)) {
 			return Collections.emptyList();
diff --git a/blade-auth/src/main/java/org/springblade/auth/utils/TokenUtil.java b/blade-auth/src/main/java/org/springblade/auth/utils/TokenUtil.java
index 35a61d95..c4380b43 100644
--- a/blade-auth/src/main/java/org/springblade/auth/utils/TokenUtil.java
+++ b/blade-auth/src/main/java/org/springblade/auth/utils/TokenUtil.java
@@ -36,6 +36,7 @@ import org.springblade.system.pojo.entity.MpUserInfo;
 import org.springblade.system.pojo.entity.User;
 import org.springblade.system.pojo.entity.UserInfo;
 import org.springblade.system.pojo.enums.MpUserIdentity;
+import org.springblade.system.utils.MpUserAuth;
 
 /**
  * 认证工具类
@@ -107,10 +108,13 @@ public class TokenUtil {
 		userDetail.setAccount(user.getAccount());
 		userDetail.setPassword(user.getPassword());
 		userDetail.setPhone(user.getPhone());
-		userDetail.setDeptId(user.getDeptId());
-		userDetail.setPostId(user.getPostId());
-		// 小程序用户不绑定系统角色，roleId 留空；身份放入 roleName/authorities
-		userDetail.setRoleId("");
+		// 严格令牌模式要求 deptId/roleId 非空且 >=0；小程序用户用占位值，身份写在 roleName/authorities
+		userDetail.setDeptId(Func.toStr(user.getDeptId(), MpUserAuth.PLACEHOLDER_ID));
+		if (Func.isBlank(userDetail.getDeptId()) || "-1".equals(userDetail.getDeptId())) {
+			userDetail.setDeptId(MpUserAuth.PLACEHOLDER_ID);
+		}
+		userDetail.setPostId(Func.toStr(user.getPostId(), MpUserAuth.PLACEHOLDER_ID));
+		userDetail.setRoleId(MpUserAuth.PLACEHOLDER_ID);
 		userDetail.setRoleName(Func.join(userInfo.getIdentities()));
 		userDetail.setAvatar(user.getAvatar());
 		userDetail.setAuthorities(userInfo.getIdentities());
diff --git a/blade-service-api/blade-user-api/src/main/java/org/springblade/system/utils/MpUserAuth.java b/blade-service-api/blade-user-api/src/main/java/org/springblade/system/utils/MpUserAuth.java
index b1b54e77..d2e6482d 100644
--- a/blade-service-api/blade-user-api/src/main/java/org/springblade/system/utils/MpUserAuth.java
+++ b/blade-service-api/blade-user-api/src/main/java/org/springblade/system/utils/MpUserAuth.java
@@ -35,6 +35,14 @@ import org.springblade.system.pojo.enums.MpUserIdentity;
  */
 public final class MpUserAuth {
 
+	/**
+	 * 严格令牌模式下的占位 ID。
+	 * <p>
+	 * {@code blade.secure.strict-token=true} 时，AuthUtil.userIncomplete 要求 roleId/deptId
+	 * 非空且数值 &gt;= 0；小程序用户不绑定系统角色/部门，用 0 占位避免业务接口 401。
+	 */
+	public static final String PLACEHOLDER_ID = "0";
+
 	private MpUserAuth() {
 	}
 
@@ -56,8 +64,10 @@ public final class MpUserAuth {
 		if (detail != null && MpUserIdentity.DETAIL_TYPE.equalsIgnoreCase(Func.toStr(detail.get("type")))) {
 			return true;
 		}
-		// 兼容：无系统角色且 roleName 为小程序身份
-		return Func.isBlank(bladeUser.getRoleId())
+		// 兼容：无真实系统角色（空或占位 0）且 roleName 为小程序身份
+		String roleId = Func.toStr(bladeUser.getRoleId());
+		boolean noSystemRole = Func.isBlank(roleId) || PLACEHOLDER_ID.equals(roleId);
+		return noSystemRole
 			&& Func.isNotBlank(bladeUser.getRoleName())
 			&& !MpUserIdentity.split(bladeUser.getRoleName()).isEmpty();
 	}
diff --git a/blade-service/blade-transport/src/main/java/org/springblade/transport/controller/ManageWaybillController.java b/blade-service/blade-transport/src/main/java/org/springblade/transport/controller/ManageWaybillController.java
index 6d381639..0b7dda41 100644
--- a/blade-service/blade-transport/src/main/java/org/springblade/transport/controller/ManageWaybillController.java
+++ b/blade-service/blade-transport/src/main/java/org/springblade/transport/controller/ManageWaybillController.java
@@ -30,6 +30,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.AllArgsConstructor;
 import org.springblade.core.boot.ctrl.BladeController;
 import org.springblade.core.tool.api.R;
+import org.springblade.transport.pojo.dto.WaybillPunchRecordSaveRequest;
 import org.springblade.transport.pojo.entity.Waybill;
 import org.springblade.transport.pojo.vo.AdminDriverOptionVO;
 import org.springblade.transport.pojo.vo.AdminHomeStatsVO;
@@ -37,7 +38,9 @@ import org.springblade.transport.pojo.vo.AdminHomeVO;
 import org.springblade.transport.pojo.vo.AdminVehicleOptionVO;
 import org.springblade.transport.pojo.vo.AdminWaybillCardVO;
 import org.springblade.transport.pojo.vo.AdminWaybillDetailVO;
+import org.springblade.transport.pojo.vo.WaybillPunchRecordsVO;
 import org.springblade.transport.service.IManageWaybillService;
+import org.springblade.transport.service.IWaybillService;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -62,6 +65,7 @@ import java.util.List;
 public class ManageWaybillController extends BladeController {
 
 	private final IManageWaybillService manageWaybillService;
+	private final IWaybillService waybillService;
 
 	@GetMapping("/stats")
 	@ApiOperationSupport(order = 1)
@@ -140,4 +144,19 @@ public class ManageWaybillController extends BladeController {
 		return R.data(manageWaybillService.searchVehicles(keyword));
 	}
 
+	@GetMapping("/punch-records")
+	@ApiOperationSupport(order = 9)
+	@Operation(summary = "打卡记录", description = "小程序调度端：仅需登录态；按过程配置返回节点/在途打卡流水")
+	public R<WaybillPunchRecordsVO> punchRecords(
+		@Parameter(description = "运单ID", required = true) @RequestParam Long waybillId) {
+		return R.data(waybillService.listPunchRecords(waybillId));
+	}
+
+	@PostMapping("/punch-record/save")
+	@ApiOperationSupport(order = 10)
+	@Operation(summary = "编辑打卡记录", description = "小程序调度端：补录/订正/取消打卡，仅需登录态")
+	public R savePunchRecord(@RequestBody WaybillPunchRecordSaveRequest request) {
+		return R.status(waybillService.savePunchRecord(request));
+	}
+
 }