docs: bind v2 purchase entry and saved panel readiness #260 #261

Allow up to two consecutive evidence-free PayActivity transition samples after the single safe Back; fail on the third post-Back sample (200ms cadence) to preserve a finite no-click payment boundary.

AGENTS.md

@@ -1,17 +1,11 @@
 # Agent 开发规则
 
-本仓库采用轻量治理的精简单人 DevHarness 工作流：需要工单的任务以 Gitea 工单作为单次需求、变化、实现、测试、提交和验收的事实来源；Gitea Wiki 只维护长期产品、架构、契约、业务规则、安全边界和运行说明；Git 保存源码、迁移、测试、版本绑定资料和 Wiki 的本地镜像。`docs/` 中显式映射的 Markdown 是 Wiki 只读镜像；既有 Wiki 任务归档和 `docs/task/` 仅作历史兼容，只有用户明确要求专项快照时才创建或导出。
+本仓库采用精简的单人 DevHarness 工作流：Gitea 工单是单次任务需求、变化、实现、测试、提交和验收的唯一事实来源；Gitea Wiki 只维护长期产品、架构、契约、业务规则、安全边界和运行说明；Git 保存源码、迁移、测试、版本绑定资料和 Wiki 的本地镜像。`docs/` 中显式映射的 Markdown 是 Wiki 只读镜像；既有 Wiki 任务归档和 `docs/task/` 仅作历史兼容，只有用户明确要求专项快照时才创建或导出。
 
-当前文档规则参考 DevHarness 提交 `ecab899`，但所有模板内容都必须按 GoAuto 事实改写。开始工作前阅读任务涉及目录中的 `AGENTS.md`。不同交付单元规则不同时，在 `server/`、`web/` 或 `android/` 下增加更具体的 `AGENTS.md`；目录越深的规则越具体，但不得削弱上级安全规则。
+当前文档规则参考 DevHarness 提交 `4bbacf4d7fb265984396bb5589c544105043fa0b`，但所有模板内容都必须按 GoAuto 事实改写。开始工作前阅读任务涉及目录中的 `AGENTS.md`。不同交付单元规则不同时，在 `server/`、`web/` 或 `android/` 下增加更具体的 `AGENTS.md`；目录越深的规则越具体，但不得削弱上级安全规则。
 
 [项目档案](docs/00-project-profile.md) 按需阅读，不作为每次任务的固定前置。出现下列情况之一时必须读：需要环境、配置或凭据来源；需要确认目录边界；需要判断子项目与交付单元划分；需要 DevHarness 来源与基线；需要项目专用验收要求。只为查命令不必打开项目档案。涉及采集、采购或设备行为时另读 `docs/03-business-rules-and-glossary.md` 和当前工单。
 
-## 语言与术语
-
-- 用户可以使用中文、英文或合理的中英混合语言交流；默认使用中文分析、回复、编写工单和维护内部项目文档。
-- 代码标识符、命令、参数、路径、文件名、API 名称、协议名、日志和错误原文保持原样；必要时补充简短中文解释。
-- 用户明确要求某次回复或交付物使用其他语言时，按该次要求执行，不改写接口契约或影响搜索和执行的原文。
-
 ## 常用命令
 
 所有命令默认从仓库根目录执行。
@@ -22,7 +16,6 @@
 | 检查模板结构 | `python dev_scripts/harness.py check --strict` |
 | 导出核心 Wiki 镜像 | `python dev_scripts/harness.py sync` |
 | 检查核心 Wiki 镜像 | `python dev_scripts/harness.py sync --check` |
-| 深度检查核心 Wiki 镜像 | `python dev_scripts/harness.py sync --deep-check` |
 | 导出并完整校验 | `python dev_scripts/harness.py sync --verify` |
 | 创建可选任务快照 | `python dev_scripts/harness.py archive 123 "修复登录超时"` |
 | 增量导出已有快照 | `python dev_scripts/harness.py export` |
@@ -47,28 +40,18 @@
 - 测试结果必须真实；未执行或无法覆盖的真机、多设备、云环境和高风险行为必须明确记录。
 - 高风险修改必须停止并等待人工确认：创建订单、权限、安全、并发、数据库迁移、删除数据、发布和其他不可逆操作。
 
-### 项目治理模式与明确授权后的执行
-
-- GoAuto 默认采用轻量治理：文案、注释、格式、局部样式或布局、预期行为明确的小 Bug，以及不改变接口、数据结构、权限和安全边界的单模块低风险调整可以直接实施，无需为了留痕补建工单。完整独立需求、新页面、跨模块功能，以及涉及 API、数据结构、权限、安全、迁移或范围不明确的变化必须建单。
-- 采购、创建订单、权限、安全、并发、数据库迁移、删除数据、发布和其他不可逆操作按高风险任务处理；未取得有效人工授权时必须停止。
-- 当前聊天中用户给出的明确指令，或 Gitea 工单中能够归属于有权人工的明确授权，可以作为执行依据，不要求把同一授权重复复制到工单后再次确认。
-- 授权必须能识别操作、对象和范围；Agent 自动生成的工单、草稿、摘要或对用户意图的转述不能单独构成人工授权。
-- 获得有效授权后，只核对准确目标、授权范围和当前状态等最小必要前提，不得仅因操作不可逆而重复询问或拒绝。
-- 授权不自动覆盖相邻对象或后续任务；环境、对象、范围或影响发生实质变化时必须重新确认。平台自身强制的审批、安全策略或权限限制继续有效。
-
 ## 2. 哪些改动需要工单
 
-完整独立需求、新页面、跨模块功能、范围不明确的变化，以及接口、数据库、权限、并发、状态机或安全边界变化必须先有单元工单。采购、创建订单、数据库迁移、删除数据、发布和其他不可逆操作无论规模大小都必须建单。
+新功能、缺陷修复、重构，以及接口、数据库、权限、并发、状态机、安全或用户界面变化必须先有单元工单。
 
-以下低风险改动在范围明确、容易回退、不改变接口、数据结构、权限或安全边界，且不属于上述高风险事项时可以直接提交：
+以下小改动只有在范围明确、容易回退且不涉及上面的必须建单项时才可以直接提交：
 
 - 只改错别字、注释或文档措辞；
 - 只做格式化、导入排序或不跨文件的内部变量改名；
 - 补充类型标注或文档字符串且不改变行为；
 - 补充不改变产品行为的测试；
 - 删除已经确认无人使用的死代码；
-- 修复预期行为明确、影响局限于单个模块的低风险缺陷；
-- 不改变对外行为、入口、配置和验证方式的局部内部重构；
+- 修复单文件、低风险且只恢复已有明确行为的缺陷；
 - 只修改用户看到的界面显示文案，并且满足本文件「工单与设计证据双门禁」的全部豁免条件。
 
 直接提交仍须保护无关改动、执行受影响范围的最小验证并写清提交说明。有任何不确定，或涉及接口、数据库、状态、权限、安全、并发、用户界面时，必须退回单元工单流程。代码组件名、类名、变量、国际化键、API 字段和数据库字段不是显示文案，不适用豁免。
@@ -201,7 +184,6 @@ Gitea 不可用时，输出完整工单草稿并说明阻塞。未经用户明
 - 提交只包含当前工单相关文件，提交信息引用工单号。
 - 优先运行项目档案记录的格式、单元、契约和集成测试。
 - Windows 环境优先使用当前已配置的 PowerShell；可选择时优先 PowerShell 7 `pwsh.exe`，不得仅为设置编码重复启动一层 PowerShell。
-- Windows 命令不得默认套用 Bash 语法。复杂正则优先使用变量或 `rg -e`；包含引号和换行的脚本正文优先使用单引号 PowerShell here-string；`foreach`、`if` 等语句块保持在同一个 PowerShell 解析上下文中；`rg` 使用真实目录配合 `-g/--glob`，不要把 Bash 风格通配路径作为目录参数。
 - 文本文件读写在命令支持时显式指定 UTF-8；文件解码和控制台输出分别处理，只有出现真实乱码或已知宿主非 UTF-8 时才设置当前进程的输出编码或 Python UTF-8 环境变量。
 - 不得默认使用 `-ExecutionPolicy Bypass`；只有可信 `.ps1` 确实被执行策略阻止且没有更小替代方案时，才对该次进程使用并在工单记录原因。
 - 涉及创建订单、权限、安全、并发、迁移和删除数据属于高风险，真机或正式实施前必须再次等待人工确认。

android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "cn.ilapage.goauto.agent"
         minSdk = 23
         targetSdk = 34
-        versionCode = 51
-        versionName = "0.9.38"
+        versionCode = 88
+        versionName = "0.9.75"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

android/app/src/main/java/cn/ilapage/goauto/agent/MainActivity.kt

@@ -49,6 +49,7 @@ class MainActivity : AppCompatActivity() {
 
     override fun onResume() {
         super.onResume()
+        cn.ilapage.goauto.agent.automation.GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         screenPolicyHandler.removeCallbacks(screenPolicyRefresh)
         screenPolicyHandler.post(screenPolicyRefresh)
     }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/GoAutoAccessibilityService.kt

@@ -18,6 +18,8 @@ import android.util.Log
 import android.view.Display
 import android.view.accessibility.AccessibilityEvent
 import android.view.accessibility.AccessibilityNodeInfo
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubbleController
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePresentation
 import java.util.concurrent.CountDownLatch
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicBoolean
@@ -32,6 +34,9 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         ActivityEvidenceTracker { packageName, className -> isDeclaredActivity(packageName, className) }
     }
     private var accessibilityButtonCallback: AccessibilityButtonController.AccessibilityButtonCallback? = null
+    private val purchaseResultBubble by lazy {
+        PurchaseResultBubbleController(this) { currentPackage() == PDD_PACKAGE }
+    }
 
     override fun onServiceConnected() {
         serviceInfo = serviceInfo.apply {
@@ -48,18 +53,19 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
 
     override fun onAccessibilityEvent(event: AccessibilityEvent?) {
         if (event?.eventType == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {
-            val packageName = event.packageName?.toString()
-            if (packageName != null && packageName != lastForegroundPackage) {
-                lastForegroundPackage = packageName
+            val foregroundPackage = event.packageName?.toString()
+            if (foregroundPackage != null && foregroundPackage != lastForegroundPackage) {
+                lastForegroundPackage = foregroundPackage
                 foregroundRevision.incrementAndGet()
             }
-            if (packageName == PDD_PACKAGE) lastPddForegroundAt.set(SystemClock.elapsedRealtime())
-            activityTracker.observe(packageName, event.className?.toString())
+            if (foregroundPackage == PDD_PACKAGE) lastPddForegroundAt.set(SystemClock.elapsedRealtime())
+            activityTracker.observe(foregroundPackage, event.className?.toString())
         }
     }
     override fun onInterrupt() = Unit
 
     override fun onDestroy() {
+        dismissPurchaseResultBubble()
         unregisterAccessibilityButton()
         if (instance === this) instance = null
         super.onDestroy()
@@ -71,6 +77,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         runCatching {
             val callback = object : AccessibilityButtonController.AccessibilityButtonCallback() {
                 override fun onClicked(controller: AccessibilityButtonController) {
+                    dismissPurchaseResultBubble()
                     AccessibilityButtonPolicy.handleClick(::openAgentPreservingTab)
                 }
             }
@@ -115,6 +122,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
     ).restore(packageName, timeoutMillis)
 
     fun openAgentPreservingTab(): Boolean = runCatching {
+        dismissPurchaseResultBubble()
         startActivity(
             android.content.Intent(this, cn.ilapage.goauto.agent.MainActivity::class.java).apply {
                 addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK or android.content.Intent.FLAG_ACTIVITY_CLEAR_TOP or android.content.Intent.FLAG_ACTIVITY_SINGLE_TOP)
@@ -123,6 +131,14 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         true
     }.getOrDefault(false)
 
+    fun showPurchaseResultBubble(presentation: PurchaseResultBubblePresentation) {
+        purchaseResultBubble.show(presentation)
+    }
+
+    fun dismissPurchaseResultBubble() {
+        purchaseResultBubble.dismiss()
+    }
+
     override fun visibleTexts(): List<String> {
         val root = rootInActiveWindow ?: return emptyList()
         val texts = mutableListOf<String>()
@@ -314,6 +330,42 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }
     }
 
+    override fun clickAddressEntryFresh(target: SnapshotNode): FreshClickOutcome {
+        val root = rootInActiveWindow ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.ROOT_UNAVAILABLE)
+        val indexes = target.path.split('/').mapNotNull(String::toIntOrNull)
+        if (indexes.isEmpty() || indexes.first() != 0 || indexes.size != target.path.split('/').size) {
+            return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        var node = root
+        for (index in indexes.drop(1)) {
+            node = node.getChild(index)
+                ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        val bounds = Rect().also(node::getBoundsInScreen)
+        if (!node.isVisibleToUser || !node.isEnabled ||
+            node.preferredOrDescendantLabel() != target.label ||
+            node.className?.toString() != target.className ||
+            kotlin.math.abs(bounds.centerX() - target.bounds.centerX) > 32 ||
+            kotlin.math.abs(bounds.centerY() - target.bounds.centerY) > 32
+        ) {
+            return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        var ancestorDepth = 0
+        while (!node.isClickable) {
+            node = node.parent ?: return FreshClickOutcome(
+                FreshActionResult.FAILED,
+                FreshClickReason.NO_CLICKABLE_ANCESTOR,
+                clickableAncestorDepth = ancestorDepth,
+            )
+            ancestorDepth++
+        }
+        return if (node.performAction(AccessibilityNodeInfo.ACTION_CLICK)) {
+            FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS, 1, ancestorDepth)
+        } else {
+            FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.ACTION_CLICK_FALSE, 1, ancestorDepth)
+        }
+    }
+
     override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult {
         val root = rootInActiveWindow ?: return FreshActionResult.NOT_FOUND
         val candidates = mutableListOf<AccessibilityNodeInfo>()
@@ -333,31 +385,32 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (bounds.width() < 2 || bounds.height() < 2 || Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
             return FreshActionResult.FAILED
         }
-        val path = Path().apply {
-            moveTo(bounds.centerX().toFloat(), bounds.centerY().toFloat())
-        }
-        val completed = AtomicBoolean(false)
-        val latch = CountDownLatch(1)
-        val queued = dispatchGesture(
-            GestureDescription.Builder().addStroke(GestureDescription.StrokeDescription(path, 0, 80)).build(),
-            object : GestureResultCallback() {
-                override fun onCompleted(gestureDescription: GestureDescription?) {
-                    completed.set(true)
-                    latch.countDown()
-                }
+        return if (dispatchCenterTap(bounds)) FreshActionResult.SUCCESS else FreshActionResult.FAILED
+    }
 
-                override fun onCancelled(gestureDescription: GestureDescription?) {
-                    latch.countDown()
-                }
-            },
-            null,
-        )
-        if (!queued) return FreshActionResult.FAILED
-        return if (latch.await(1_500, TimeUnit.MILLISECONDS) && completed.get()) {
-            FreshActionResult.SUCCESS
-        } else {
-            FreshActionResult.FAILED
+    override fun tapSpecFresh(target: SnapshotNode): FreshActionResult {
+        val width = resources.displayMetrics.widthPixels
+        val height = resources.displayMetrics.heightPixels
+        if (!PurchaseSpecGesturePolicy.isAllowed(target, width, height)) return FreshActionResult.FAILED
+        val root = rootInActiveWindow ?: return FreshActionResult.NOT_FOUND
+        val candidates = mutableListOf<AccessibilityNodeInfo>()
+        walk(root) { node ->
+            val bounds = Rect().also(node::getBoundsInScreen)
+            if (node.isVisibleToUser && node.isEnabled &&
+                node.preferredOrDescendantLabel() == target.label &&
+                node.className?.toString() == target.className &&
+                kotlin.math.abs(bounds.centerX() - target.bounds.centerX) <= 32 &&
+                kotlin.math.abs(bounds.centerY() - target.bounds.centerY) <= 32
+            ) candidates += node
         }
+        if (candidates.isEmpty()) return FreshActionResult.NOT_FOUND
+        if (candidates.size != 1) return FreshActionResult.AMBIGUOUS
+        val bounds = Rect().also(candidates.single()::getBoundsInScreen)
+        val freshTarget = target.copy(bounds = NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom))
+        if (!PurchaseSpecGesturePolicy.isAllowed(freshTarget, width, height)) {
+            return FreshActionResult.FAILED
+        }
+        return if (dispatchCenterTap(bounds)) FreshActionResult.SUCCESS else FreshActionResult.FAILED
     }
 
     override fun inputFresh(target: SnapshotNode, value: String): FreshActionResult {
@@ -381,8 +434,16 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         } else FreshActionResult.FAILED
     }
 
+    private var lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.UNKNOWN
+
+    override fun purchaseSwipeFailureReason(): PurchaseSwipeFailureReason = lastPurchaseSwipeFailure
+
     override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean {
-        val root = rootInActiveWindow ?: return false
+        lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.UNKNOWN
+        val root = rootInActiveWindow ?: run {
+            lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.ROOT_UNAVAILABLE
+            return false
+        }
         val candidates = mutableListOf<AccessibilityNodeInfo>()
         walk(root) { node -> if (node.isVisibleToUser && node.isScrollable) candidates += node }
         val horizontal = direction == SwipeDirection.LEFT || direction == SwipeDirection.RIGHT
@@ -391,23 +452,37 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }
         val target = (directional.ifEmpty { candidates }).maxByOrNull { candidate ->
             Rect().also(candidate::getBoundsInScreen).let { it.width().toLong() * it.height() }
-        } ?: return false
-        return swipeNode(target, direction, durationMs, preferScrollAction = false)
+        } ?: run {
+            lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.NO_SCROLLABLE
+            return false
+        }
+        return swipeNode(target, direction, durationMs, preferScrollAction = false,
+            onFailure = { lastPurchaseSwipeFailure = it })
     }
 
     override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
         val root = rootInActiveWindow ?: return false
-        val matches = mutableListOf<AccessibilityNodeInfo>()
-        walk(root) { node ->
-            val bounds = Rect().also(node::getBoundsInScreen)
-            if (node.isVisibleToUser && node.isEnabled && node.isScrollable &&
-                node.className?.toString() == target.className &&
-                kotlin.math.abs(bounds.centerX() - target.bounds.centerX) <= 32 &&
-                kotlin.math.abs(bounds.centerY() - target.bounds.centerY) <= 32
-            ) matches += node
+        val candidates = mutableListOf<PurchaseScrollCandidate>()
+        val liveNodes = mutableMapOf<String, AccessibilityNodeInfo>()
+        fun visit(node: AccessibilityNodeInfo, path: String) {
+            if (node.isVisibleToUser && node.isEnabled && node.isScrollable) {
+                val bounds = Rect().also(node::getBoundsInScreen)
+                candidates += PurchaseScrollCandidate(
+                    path, node.className?.toString(),
+                    NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom),
+                )
+                liveNodes[path] = node
+            }
+            for (index in 0 until node.childCount) {
+                node.getChild(index)?.let { visit(it, "$path/$index") }
+            }
         }
-        if (matches.size != 1) return false
-        return swipeNode(matches.single(), direction, durationMs, preferScrollAction = false)
+        visit(root, "0")
+        val resolved = PurchaseScrollLocator.locate(
+            PurchaseScrollCandidate(target.path, target.className, target.bounds), candidates,
+        ) ?: return false
+        val current = liveNodes[resolved.path] ?: return false
+        return swipeNode(current, direction, durationMs, preferScrollAction = true)
     }
 
     override fun backPurchase(): Boolean = performGlobalAction(GLOBAL_ACTION_BACK)
@@ -421,9 +496,17 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }.getOrDefault(false)
     }
 
+    private var lastSpecRowSwipeFailure = "none"
+
+    override fun specRowSwipeFailureReason(): String = lastSpecRowSwipeFailure
+
     override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean {
+        lastSpecRowSwipeFailure = "none"
         if (anchor == null) return swipe(SemanticTarget.SPEC_PANEL, direction)
-        val root = rootInActiveWindow ?: return false
+        val root = rootInActiveWindow ?: run {
+            lastSpecRowSwipeFailure = "windowMissing"
+            return false
+        }
         val matches = mutableListOf<AccessibilityNodeInfo>()
         walk(root) { node ->
             val bounds = Rect().also(node::getBoundsInScreen)
@@ -441,6 +524,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         val horizontal = direction == SwipeDirection.LEFT || direction == SwipeDirection.RIGHT
         if (matches.size != 1) {
             if (!SpecSwipeSafety.allowGlobalFallback(direction)) {
+                lastSpecRowSwipeFailure = if (matches.isEmpty()) "anchorMissing" else "anchorAmbiguous"
                 Log.i("GoAutoCollector", "swipe direction=$direction result=blocked reason=anchor-not-unique matches=${matches.size}")
                 return false
             }
@@ -464,19 +548,27 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (anchoredTarget != null) {
             val bounds = Rect().also(anchoredTarget::getBoundsInScreen)
             Log.i("GoAutoCollector", "swipe direction=$direction anchored=true bounds=$bounds class=${anchoredTarget.className}")
-            return swipeNode(
+            val success = swipeNode(
                 anchoredTarget,
                 direction,
                 preferScrollAction = SpecSwipeSafety.preferAccessibilityScrollAction(direction),
             )
+            if (!success) lastSpecRowSwipeFailure = "gestureFailed"
+            return success
         }
         if (!SpecSwipeSafety.allowGlobalFallback(direction)) {
+            lastSpecRowSwipeFailure = "horizontalContainerMissing"
             Log.i("GoAutoCollector", "swipe direction=$direction result=blocked reason=no-anchored-horizontal-container")
             return false
         }
         return swipe(SemanticTarget.SPEC_PANEL, direction)
     }
 
+    override fun swipeSpecRow(target: SnapshotNode, direction: SwipeDirection): Boolean {
+        if (direction != SwipeDirection.LEFT && direction != SwipeDirection.RIGHT) return false
+        return swipeSpec(direction, target)
+    }
+
     override fun pullDownSpecPanel(anchor: SnapshotNode): Boolean {
         if (!anchor.scrollable) return false
         val root = rootInActiveWindow ?: return false
@@ -566,16 +658,21 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         preferScrollAction: Boolean = true,
         downStartPercent: Int = 25,
         downEndPercent: Int = 75,
+        onFailure: (PurchaseSwipeFailureReason) -> Unit = {},
     ): Boolean {
+        fun failed(reason: PurchaseSwipeFailureReason): Boolean {
+            onFailure(reason)
+            return false
+        }
         val bounds = Rect().also(node::getBoundsInScreen)
-        if (bounds.width() < 2 || bounds.height() < 2) return false
+        if (bounds.width() < 2 || bounds.height() < 2) return failed(PurchaseSwipeFailureReason.INVALID_BOUNDS)
         val scrollAction = if (direction == SwipeDirection.UP || direction == SwipeDirection.LEFT) {
             AccessibilityNodeInfo.ACTION_SCROLL_FORWARD
         } else {
             AccessibilityNodeInfo.ACTION_SCROLL_BACKWARD
         }
         if (preferScrollAction && node.performAction(scrollAction)) return true
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) return false
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) return failed(PurchaseSwipeFailureReason.GESTURE_UNSUPPORTED)
         val left = bounds.left + bounds.width() * 25 / 100
         val right = bounds.left + bounds.width() * 75 / 100
         val top = bounds.top + bounds.height() * 25 / 100
@@ -613,8 +710,31 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
             },
             null,
         )
-        if (!queued) return false
-        return latch.await(1500, TimeUnit.MILLISECONDS) && completed.get()
+        if (!queued) return failed(PurchaseSwipeFailureReason.GESTURE_REJECTED)
+        if (!latch.await(1500, TimeUnit.MILLISECONDS)) return failed(PurchaseSwipeFailureReason.GESTURE_TIMEOUT)
+        return completed.get() || failed(PurchaseSwipeFailureReason.GESTURE_CANCELLED)
+    }
+
+    private fun dispatchCenterTap(bounds: Rect): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N || bounds.width() < 2 || bounds.height() < 2) return false
+        val path = Path().apply { moveTo(bounds.centerX().toFloat(), bounds.centerY().toFloat()) }
+        val completed = AtomicBoolean(false)
+        val latch = CountDownLatch(1)
+        val queued = dispatchGesture(
+            GestureDescription.Builder().addStroke(GestureDescription.StrokeDescription(path, 0, 80)).build(),
+            object : GestureResultCallback() {
+                override fun onCompleted(gestureDescription: GestureDescription?) {
+                    completed.set(true)
+                    latch.countDown()
+                }
+
+                override fun onCancelled(gestureDescription: GestureDescription?) {
+                    latch.countDown()
+                }
+            },
+            null,
+        )
+        return queued && latch.await(1_500, TimeUnit.MILLISECONDS) && completed.get()
     }
 
     private fun walk(node: AccessibilityNodeInfo, visit: (AccessibilityNodeInfo) -> Unit) {

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddCollectionReturnNavigator.kt

@@ -0,0 +1,58 @@
+package cn.ilapage.goauto.agent.automation
+
+/** Complete temporary collections only; caller retains the existing task lock. */
+internal class PddCollectionReturnNavigator(
+    private val driver: PddCollectorDriver,
+    private val openAgent: () -> Boolean,
+    private val currentPackage: () -> String?,
+    private val pause: (Long) -> Unit = Thread::sleep,
+) {
+    var reason = "not_started"
+        private set
+    var actions = 0
+        private set
+
+    fun returnToAgent(count: Int): Boolean {
+        actions = 0
+        if (count !in 1..5) { reason = "invalid_count"; return false }
+        try {
+            reason = "count_completed"
+            for (step in 1..count) {
+                if (currentPackage() != PDD) { reason = "left_pdd"; break }
+                val screen = driver.capture()
+                if (screen.packageName != PDD) { reason = "left_pdd"; break }
+                if (screen.activityName.isNullOrBlank() || unsafe(screen)) {
+                    reason = "unsafe_page"
+                    return false
+                }
+                // Recheck after capturing: never send Back to another foreground app.
+                if (currentPackage() != PDD) { reason = "left_pdd"; break }
+                actions++
+                if (!driver.back()) { reason = "back_failed"; break }
+                pause(500)
+            }
+            // Retain risk scenes even if the last Back lands on one.
+            if (currentPackage() == PDD && unsafe(driver.capture())) {
+                reason = "unsafe_page"
+                return false
+            }
+            if (!openAgent()) { reason = "agent_launch_failed"; return false }
+            pause(500)
+            if (currentPackage() != AGENT) { reason = "agent_not_confirmed"; return false }
+            return true
+        } catch (_: Exception) {
+            reason = "navigation_exception"
+            return false
+        }
+    }
+
+    private fun unsafe(screen: UiSnapshot): Boolean =
+        PddPageClassifier.classify(screen.packageName, screen.activityName,
+            screen.nodes.filter { it.visible }.map { it.label }) != null ||
+            screen.nodes.any { it.visible && listOf("订单详情", "订单待支付", "确认付款", "立即支付", "编辑收货地址", "新增收货地址", "地址管理").any(it.label::contains) }
+
+    companion object {
+        private const val PDD = "com.xunmeng.pinduoduo"
+        private const val AGENT = "cn.ilapage.goauto.agent"
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddLaunchFallback.kt

@@ -0,0 +1,8 @@
+package cn.ilapage.goauto.agent.automation
+
+internal object PddLaunchFallback {
+    fun open(preferDirect: Boolean, direct: () -> Boolean, browser: () -> Boolean): Boolean {
+        if (preferDirect && runCatching(direct).getOrDefault(false)) return true
+        return runCatching(browser).getOrDefault(false)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddNavigation.kt

@@ -31,11 +31,21 @@ object PddPageClassifier {
 }
 
 class PddLinkLauncher(private val context: Context) {
-    fun open(url: String): Boolean {
+    fun open(url: String, preferDirect: Boolean = false): Boolean {
         val uri = runCatching { Uri.parse(url) }.getOrNull() ?: return false
         if (uri.scheme !in setOf("http", "https") || !isPddHost(uri.host) || uri.getQueryParameter("goods_id").isNullOrBlank()) {
             return false
         }
+        return PddLaunchFallback.open(preferDirect, direct = {
+            val direct = Intent(Intent.ACTION_VIEW, uri)
+                .setPackage("com.xunmeng.pinduoduo")
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK)
+            context.startActivity(direct)
+            true
+        }, browser = { openBrowser(uri) })
+    }
+
+    private fun openBrowser(uri: Uri): Boolean {
         val base = Intent(Intent.ACTION_VIEW, uri).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
         val browser = BROWSER_PACKAGES.firstOrNull { packageName ->
             runCatching { context.packageManager.getPackageInfo(packageName, 0) }.isSuccess

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddProductDetailCollector.kt

@@ -99,6 +99,8 @@ object PddSoldOutRecoveryDefaults {
     const val SETTLE_MILLIS = 2_000L
 }
 
+data class PurchasePanelContext(val container: SnapshotNode, val exactColor: String)
+
 data class ParsedPddScreen(
     val summary: ProductSummary,
     val dimensions: List<VisibleDimension>,
@@ -123,8 +125,15 @@ data class ParsedPddScreen(
     val hasSelectionSummary: Boolean,
     val hasQuantityControls: Boolean,
     val hasOrderSubmitAction: Boolean,
+    val explicitSpecEntryCount: Int,
+    val nestedSpecEntryCount: Int,
+    val bottomPurchaseEntryCount: Int,
     val problem: PageProblem?,
     val sourceNodes: List<SnapshotNode>,
+    val isPddPackage: Boolean,
+    val hasCloseControl: Boolean = false,
+    val hasPaymentArea: Boolean = false,
+    val purchaseContextMatched: Boolean = false,
 ) {
     fun isTransientSoldOut(
         exactText: String,
@@ -159,6 +168,7 @@ data class ParsedPddScreen(
 }
 
 object PddScreenParser {
+    private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
     private data class SafeSpecEntry(val anchor: SnapshotNode, val clickTarget: SnapshotNode)
     private val pricePattern = Regex("[¥￥]\\s*([0-9]+(?:\\.[0-9]{1,2})?)")
     private val salesPattern = Regex("已拼\\s*[0-9]+(?:\\.[0-9]+)?\\s*(?:万|亿)?\\s*\\+?\\s*(?:件|人)?")
@@ -176,7 +186,7 @@ object PddScreenParser {
     // purchase/order/payment controls must never become collection click targets.
     private val nonConfigurableClickDenylist = listOf("提交订单", "确认订单", "支付", "付款")
 
-    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?): ParsedPddScreen {
+    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?, purchaseContext: PurchasePanelContext? = null, collectionContext: Boolean = false, purchaseEntryContext: Boolean = false): ParsedPddScreen {
         val visibleNodes = snapshot.nodes.filter { it.visible }
         val visible = visibleNodes.mapNotNull { node ->
             val descendants = descendants(node, visibleNodes)
@@ -301,32 +311,108 @@ object PddScreenParser {
         // Opening evidence is intentionally independent from whether the current
         // viewport still exposes a clickable spec value. PDD may hide the only
         // selected value or restore a previously scrolled confirmation panel.
+        val continuedPurchasePanel = snapshot.packageName == PDD_PACKAGE && problem == null &&
+            purchaseContext != null && headedPanelScrollable != null &&
+            headedPanelScrollable.path == purchaseContext.container.path &&
+            headedPanelScrollable.className == purchaseContext.container.className &&
+            kotlin.math.abs(headedPanelScrollable.bounds.left - purchaseContext.container.bounds.left) <= 32 &&
+            kotlin.math.abs(headedPanelScrollable.bounds.right - purchaseContext.container.bounds.right) <= 32 &&
+            minOf(headedPanelScrollable.bounds.bottom, purchaseContext.container.bounds.bottom) >
+                maxOf(headedPanelScrollable.bounds.top, purchaseContext.container.bounds.top)
+        val structuredSelectionPanel = headedPanelScrollable != null &&
+            (headings.size >= 2 || (continuedPurchasePanel && headings.isNotEmpty())) &&
+            dimensions.any { it.values.isNotEmpty() } && hasClose &&
+            hasQuantityControls && hasPaymentArea && hasOrderSubmitAction
+        // Collection can start before any selection summary exists and with only
+        // one dimension visible. Keep this exception out of purchase parsing.
+        val singleDimensionCollectionPanel = collectionContext && purchaseContext == null &&
+            snapshot.packageName == PDD_PACKAGE && problem == null && !hasSelectionSummary &&
+            evidence != null && snapshot.packageName == evidence.packageName &&
+            snapshot.activityName == evidence.activityName &&
+            snapshot.nodes.any { it.visible && it.matches(evidence.selector) } &&
+            boundedScrollables.size == 1 && headedPanelScrollable != null && headings.size == 1 &&
+            dimensions.size == 1 && dimensions.single().values.isNotEmpty() &&
+            hasClose && hasQuantityControls && hasPaymentArea && hasOrderSubmitAction
+        // Only the executor that just activated a safe entry on this same
+        // product Activity can enable this first-view purchase exception.
+        val singleDimensionPurchasePanel = purchaseEntryContext && !collectionContext &&
+            snapshot.packageName == PDD_PACKAGE && !snapshot.activityName.isNullOrBlank() &&
+            goodsId.isNotBlank() && problem == null && !hasSelectionSummary &&
+            boundedScrollables.size == 1 && headedPanelScrollable != null && headings.size == 1 &&
+            dimensions.size == 1 && dimensions.single().values.isNotEmpty() &&
+            hasClose && hasQuantityControls && hasPaymentArea && hasOrderSubmitAction
+        // Some selected-spec panels omit both the "已选" prefix and a confirm
+        // button. Keep the same structural evidence required for checkout.
         val specPanelType = when {
             quickConfirmationEvidence -> SpecPanelType.QUICK_CONFIRMATION
             orderConfirmationEvidence -> SpecPanelType.ORDER_CONFIRMATION
+            structuredSelectionPanel -> SpecPanelType.NORMAL_SCROLLABLE
+            singleDimensionCollectionPanel -> SpecPanelType.NORMAL_SCROLLABLE
+            singleDimensionPurchasePanel -> SpecPanelType.NORMAL_SCROLLABLE
             panelScrollable != null && (hasSelectionSummary || hasSubmitHint || (hasPanelTitle && hasPanelAction)) -> SpecPanelType.NORMAL_SCROLLABLE
             hasSelectionSummary && hasPanelTitle && hasPanelAction -> SpecPanelType.NON_SCROLLABLE_CONFIRMATION
+            // Some PDD builds expose the complete selector as non-scrollable
+            // before a value is selected, so an "已选" summary is absent. Two
+            // parsed dimensions with selectable values plus the unique quantity
+            // controls and lower-page order action remain required; generic
+            // product/review pages cannot satisfy this combined evidence.
+            panelScrollable == null && headings.size >= 2 && dimensions.size >= 2 &&
+                dimensions.sumOf { it.values.size } >= 2 &&
+                hasQuantityControls && hasOrderSubmitAction -> SpecPanelType.NON_SCROLLABLE_CONFIRMATION
             else -> SpecPanelType.UNKNOWN
         }
         val panelOpen = specPanelType != SpecPanelType.UNKNOWN
+        val unprefixedSummary = if (structuredSelectionPanel) {
+            val quantity = quantityInputs.single()
+            val knownColors = (dimensions.filter { it.key == "color" }.flatMap { it.values }.map { it.text } +
+                listOfNotNull(purchaseContext?.exactColor?.takeIf { continuedPurchasePanel && it.isNotBlank() })).distinct()
+            val byPath = visibleNodes.associateBy { it.path }
+            var region = quantity.parentPath?.let(byPath::get)
+            var summary: String? = null
+            while (region != null && region.bounds.bottom <= headedPanelScrollable!!.bounds.top) {
+                val candidates = visible.filter { node ->
+                    node.path.startsWith("${region!!.path}/") && !node.clickable &&
+                        node.className?.endsWith("TextView") == true &&
+                        node.bounds.bottom <= quantity.bounds.top && node.label.length <= 160 &&
+                        knownColors.any { SpecValueNormalizer.summaryHasExactToken(node.label, it) }
+                }.map { it.label }.distinct()
+                if (candidates.isNotEmpty()) {
+                    summary = candidates.singleOrNull()
+                    break
+                }
+                region = region.parentPath?.let(byPath::get)
+            }
+            summary
+        } else null
         val firstHeadingTop = headings.firstOrNull()?.bounds?.top ?: Int.MAX_VALUE
         val price = visible.asSequence()
             .filter { it.bounds.top < firstHeadingTop }
             .mapNotNull { node -> pricePattern.find(node.label)?.groupValues?.get(1)?.let(::priceCent) }
             .firstOrNull()
-        val explicitSpecEntry = if (panelOpen) null else visible
+        val explicitSpecEntries = if (panelOpen) emptyList() else visible
             .filter { it.clickable && isSpecEntry(it.label, config) && !hasReviewContext(it, visibleNodes, config) }
-            .maxByOrNull { it.bounds.top }
-        val bottomSpecEntry = if (panelOpen || explicitSpecEntry != null) null else safeBottomSpecEntry(visibleNodes, visible, config)
-        val candidateSpecEntry = explicitSpecEntry ?: bottomSpecEntry?.anchor
-        val candidateClickTarget = explicitSpecEntry ?: bottomSpecEntry?.clickTarget
+        val explicitSpecEntry = explicitSpecEntries.maxByOrNull { it.bounds.top }
+        val nestedSpecEntries = if (panelOpen || explicitSpecEntry != null) emptyList() else
+            safeNestedSpecEntries(visibleNodes, visible, config)
+        // A nested selection row is accepted only when it is the single safe
+        // candidate. This covers PDD layouts that split “请选择” and the
+        // dimension name across child nodes of one clickable parent, without
+        // turning arbitrary page text into a click target.
+        val nestedSpecEntry = nestedSpecEntries.singleOrNull()
+        val bottomSpecEntries = if (panelOpen || explicitSpecEntry != null || nestedSpecEntry != null) emptyList() else
+            safeBottomSpecEntries(visibleNodes, visible, config)
+        val bottomSpecEntry = bottomSpecEntries.firstOrNull()
+        val candidateSpecEntry = explicitSpecEntry ?: nestedSpecEntry?.anchor ?: bottomSpecEntry?.anchor
+        val candidateClickTarget = explicitSpecEntry ?: nestedSpecEntry?.clickTarget ?: bottomSpecEntry?.clickTarget
         val reviewPageOpen = isReviewPage(visibleNodes, visible, screenHeight, candidateSpecEntry, config)
         val specEntry = candidateSpecEntry.takeUnless { reviewPageOpen }
         val specEntryClickTarget = candidateClickTarget.takeUnless { reviewPageOpen }
         val specEntrySource = when {
             reviewPageOpen -> null
             explicitSpecEntry != null -> "explicit_selection"
-            bottomSpecEntry != null -> "bottom_purchase"
+            nestedSpecEntry != null -> "nested_selection"
+            bottomSpecEntries.size == 1 -> "bottom_purchase"
+            bottomSpecEntry != null -> "bottom_purchase_rightmost"
             else -> null
         }
         val quickConfirmationEntry = if (quickConfirmationEvidence) quickConfirmationSpecEntry(visibleNodes, visible, config) else null
@@ -349,7 +435,7 @@ object PddScreenParser {
             selectedSummary = labels.firstOrNull {
                 val compact = it.replace(" ", "")
                 textAliases.selection.selectedPrefixes.any(compact::startsWith)
-            },
+            } ?: unprefixedSummary,
             priceCent = price,
             specPanelOpen = panelOpen,
             specPanelType = specPanelType,
@@ -368,10 +454,17 @@ object PddScreenParser {
             panelHeadingCount = headings.size,
             panelOptionCount = dimensions.sumOf { it.values.size },
             hasSelectionSummary = hasSelectionSummary,
+            hasCloseControl = hasClose,
+            hasPaymentArea = hasPaymentArea,
+            purchaseContextMatched = continuedPurchasePanel,
             hasQuantityControls = hasQuantityControls,
             hasOrderSubmitAction = hasOrderSubmitAction,
+            explicitSpecEntryCount = explicitSpecEntries.size,
+            nestedSpecEntryCount = nestedSpecEntries.size,
+            bottomPurchaseEntryCount = bottomSpecEntries.size,
             problem = problem,
             sourceNodes = visibleNodes,
+            isPddPackage = snapshot.packageName == PDD_PACKAGE,
         )
     }
 
@@ -458,10 +551,40 @@ object PddScreenParser {
         return hasSpecWord && config.textAliases.selection.specEntryPrefixes.any(compact::startsWith)
     }
 
-    private fun safeBottomSpecEntry(source: List<SnapshotNode>, visible: List<SnapshotNode>, config: PddCollectorConfig): SafeSpecEntry? {
-        val screenWidth = source.maxOfOrNull { it.bounds.right } ?: return null
-        val screenHeight = source.maxOfOrNull { it.bounds.bottom } ?: return null
-        if (screenWidth <= 0 || screenHeight <= 0) return null
+    private fun safeNestedSpecEntries(source: List<SnapshotNode>, visible: List<SnapshotNode>, config: PddCollectorConfig): List<SafeSpecEntry> {
+        val screenHeight = source.maxOfOrNull { it.bounds.bottom } ?: return emptyList()
+        if (screenHeight <= 0) return emptyList()
+        return source.asSequence()
+            .filter { it.visible && it.enabled && it.clickable && it.bounds.width > 0 && it.bounds.height > 0 }
+            // The fixed purchase bar begins at the lower fifth of the screen.
+            // A specs row has no reason to be inside that action-only zone.
+            .filter { it.bounds.centerY.toDouble() < screenHeight * 0.8 }
+            .mapNotNull { candidate ->
+                val context = (listOf(candidate.label) + descendants(candidate, source).map(SnapshotNode::label))
+                    .joinToString("") { it.replace(Regex("\\s+"), "") }
+                if (!isSpecEntryContext(context, config) ||
+                    nonConfigurableClickDenylist.any(context::contains) ||
+                    hasReviewContext(candidate, source, config)
+                ) return@mapNotNull null
+                val anchor = visible.firstOrNull { it.path == candidate.path } ?: candidate
+                SafeSpecEntry(anchor, candidate)
+            }
+            .distinctBy { it.clickTarget.path }
+            .toList()
+    }
+
+    private fun isSpecEntryContext(compact: String, config: PddCollectorConfig): Boolean {
+        if (config.textAliases.review.entryAliases.any(compact::contains)) return false
+        val hasSpecWord = (config.colorAliases + config.sizeAliases +
+            config.textAliases.dimension.exactNames + config.textAliases.dimension.adaptiveAliases)
+            .any(compact::contains)
+        return hasSpecWord && config.textAliases.selection.specEntryPrefixes.any(compact::contains)
+    }
+
+    private fun safeBottomSpecEntries(source: List<SnapshotNode>, visible: List<SnapshotNode>, config: PddCollectorConfig): List<SafeSpecEntry> {
+        val screenWidth = source.maxOfOrNull { it.bounds.right } ?: return emptyList()
+        val screenHeight = source.maxOfOrNull { it.bounds.bottom } ?: return emptyList()
+        if (screenWidth <= 0 || screenHeight <= 0) return emptyList()
         val byPath = source.associateBy(SnapshotNode::path)
         val normalizedByPath = visible.associateBy(SnapshotNode::path)
         val buyWords = config.textAliases.purchase.buyWords
@@ -485,8 +608,10 @@ object PddScreenParser {
                 val normalizedTarget = normalizedByPath[clickTarget.path] ?: return@mapNotNull null
                 SafeSpecEntry(normalizedAnchor, normalizedTarget) to clickTarget.bounds.width.toLong() * clickTarget.bounds.height
             }
-            .minWithOrNull(compareBy<Pair<SafeSpecEntry, Long>> { it.second }.thenByDescending { it.first.clickTarget.bounds.centerX })
-            ?.first
+            .sortedWith(compareByDescending<Pair<SafeSpecEntry, Long>> { it.first.clickTarget.bounds.centerX }.thenBy { it.second })
+            .map { it.first }
+            .distinctBy { it.clickTarget.path }
+            .toList()
     }
 
     private fun hasReviewContext(node: SnapshotNode, source: List<SnapshotNode>, config: PddCollectorConfig): Boolean {
@@ -1660,7 +1785,7 @@ class PddProductDetailCollector(
     }
 
     private fun parse(goodsId: String, config: PddCollectorConfig, evidence: PageEvidence) =
-        PddScreenParser.parse(driver.capture(), config, goodsId, evidence)
+        PddScreenParser.parse(driver.capture(), config, goodsId, evidence, collectionContext = true)
 
     private fun screenSignature(screen: ParsedPddScreen): List<String> = screen.sourceNodes.asSequence()
         .filter(SnapshotNode::visible)

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseLiveAutomation.kt

@@ -32,10 +32,66 @@ class PurchaseLiveException(val code: String, message: String, val actualUnitPri
 class PurchaseLiveAutomation(
     private val driver: PurchaseUiDriver,
     private val pause: (Long) -> Unit = Thread::sleep,
+    private val diagnostic: (String) -> Unit = {},
 ) {
     private var submitAttempted = false
+    private var savedAddressProof: ShippingAddressProof? = null
+    private var savedAddressActivity: String? = null
+    private var structuralSubmitAnchor: SnapshotNode? = null
     var lastOrderReadFailure: PurchaseOrderReadFailure? = null
         private set
+
+    /**
+     * Advances an already verified spec selector to the order confirmation
+     * page. Only the selector's unique exact confirm button is clickable; an
+     * order-submit or payment control can never satisfy this transition.
+     */
+    fun advanceToOrderConfirmation(allowUnclassifiedPanelWithSelectionProof: Boolean = false) {
+        var snapshot = driver.capture()
+        pageProblem(snapshot)
+        if (orderConfirmationReady(snapshot)) return
+        if (snapshot.packageName != PDD_PACKAGE) {
+            fail("PURCHASE_SPEC_CONFIRMATION_NOT_READY", "当前不是拼多多规格页面，未创建订单")
+        }
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        val unclassifiedSelectionPanelWithProof = allowUnclassifiedPanelWithSelectionProof &&
+            screen.specPanelType == SpecPanelType.UNKNOWN &&
+            screen.priceCent != null &&
+            snapshot.nodes.count {
+                it.visible && it.enabled && it.className?.endsWith("EditText") == true && it.label.toLongOrNull() != null
+            } == 1
+        if (
+            screen.specPanelType !in setOf(SpecPanelType.NORMAL_SCROLLABLE, SpecPanelType.NON_SCROLLABLE_CONFIRMATION) &&
+            !unclassifiedSelectionPanelWithProof
+        ) {
+            fail("PURCHASE_SPEC_CONFIRMATION_NOT_READY", "当前规格面板不能安全确认，未创建订单")
+        }
+        val aliases = PurchaseRehearsalExecutor.DEFAULT_COLLECTOR.textAliases.specPanel.confirmAliases
+            .map { it.replace(" ", "") }
+            .toSet()
+        val targets = snapshot.nodes.filter { node ->
+            node.visible && node.enabled && node.clickable && node.label.replace(" ", "") in aliases
+        }.distinctBy { it.path }
+        if (targets.isEmpty()) {
+            fail("PURCHASE_SPEC_CONFIRM_TARGET_MISSING", "没有找到唯一的规格确认按钮，未创建订单")
+        }
+        if (targets.size > 1) {
+            fail("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", "规格确认按钮不唯一，未创建订单")
+        }
+        when (driver.clickFresh(targets.single())) {
+            FreshActionResult.SUCCESS -> Unit
+            FreshActionResult.AMBIGUOUS -> fail("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", "规格确认按钮不唯一，未创建订单")
+            else -> fail("PURCHASE_SPEC_CONFIRM_CLICK_FAILED", "规格确认按钮点击失败，未创建订单")
+        }
+        repeat(SPEC_CONFIRMATION_MAX_SAMPLES) {
+            pause(SPEC_CONFIRMATION_SAMPLE_INTERVAL_MS)
+            snapshot = driver.capture()
+            pageProblem(snapshot)
+            if (orderConfirmationReady(snapshot)) return
+        }
+        fail("PURCHASE_SPEC_CONFIRMATION_UNCONFIRMED", "规格确认后没有进入订单确认页，未创建订单")
+    }
+
     fun updateShippingAddress(addressSuffix: String): ShippingAddressProof {
         if (!addressSuffix.matches(Regex("^_cg[1-9][0-9]*$"))) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "采购任务的地址标记无效")
         var snapshot = driver.capture()
@@ -43,20 +99,43 @@ class PurchaseLiveAutomation(
         var unchangedCount = 0
         for (attempt in 0 until 5) {
             pageProblem(snapshot)
-            val entries = mergedDirect(snapshot.nodes.filter { it.visible && it.enabled && MASKED_PHONE.containsMatchIn(it.label) })
-            if (entries.size == 1) {
-                when (driver.tapPurchaseFresh(entries.single())) {
+            val resolution = resolveAddressEntries(snapshot)
+            if (resolution.addressCardCount > 1 || resolution.tapTargetCount > 1) {
+                fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${resolution.diagnostic()}]")
+            }
+            if (resolution.target != null) {
+                pause(ADDRESS_ENTRY_STABLE_INTERVAL_MS)
+                val stableSnapshot = driver.capture()
+                pageProblem(stableSnapshot)
+                val stableResolution = resolveAddressEntries(stableSnapshot)
+                if (stableResolution.addressCardCount > 1 || stableResolution.tapTargetCount > 1) {
+                    fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${stableResolution.diagnostic()}]")
+                }
+                if (stableResolution.target == null || stableResolution.fingerprint() != resolution.fingerprint()) {
+                    snapshot = stableSnapshot
+                    continue
+                }
+                val target = stableResolution.target
+                val result = when (target.activation) {
+                    AddressEntryActivation.CLICK -> driver.clickAddressEntryFresh(target.node).result
+                    AddressEntryActivation.TAP -> driver.tapPurchaseFresh(target.node)
+                }
+                when (result) {
                     FreshActionResult.SUCCESS -> Unit
-                    FreshActionResult.AMBIGUOUS -> fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单")
-                    else -> fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口点击失败，未创建订单")
+                    FreshActionResult.AMBIGUOUS -> fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${stableResolution.diagnostic()}]")
+                    else -> fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口点击失败，未创建订单 [${stableResolution.diagnostic()}]")
                 }
                 pause(1_000)
                 snapshot = waitFor("PURCHASE_ADDRESS_PANEL_TIMEOUT", "收货地址页面打开超时，未创建订单") {
-                    it.nodes.any { node -> node.visible && node.label.replace(" ", "") == "收货地址" }
+                    it.packageName == PDD_PACKAGE &&
+                        it.nodes.any { node -> node.visible && node.label.replace(" ", "") == "收货地址" } &&
+                        addressModifyTargets(it).size == 1
                 }
                 return editAndVerifyAddress(snapshot, addressSuffix)
             }
-            if (entries.size > 1) fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单")
+            if (resolution.phoneNodeCount > 0) {
+                fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口无法安全定位，未创建订单 [${resolution.diagnostic()}]")
+            }
             val panel = purchasePanelScrollTargets(snapshot)
             if (panel.size != 1) fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "没有找到唯一的规格面板滚动区域，未创建订单")
             val signature = viewportSignature(snapshot, panel.single())
@@ -72,11 +151,167 @@ class PurchaseLiveAutomation(
         fail("PURCHASE_ADDRESS_PANEL_TIMEOUT", "规格面板下拉后仍未找到收货地址，未创建订单")
     }
 
+    private enum class AddressEntryActivation { CLICK, TAP }
+
+    private data class AddressEntryTarget(
+        val node: SnapshotNode,
+        val activation: AddressEntryActivation,
+        val cardKey: String,
+    )
+
+    private data class AddressCardCandidate(
+        val phone: SnapshotNode,
+        val clickableCard: SnapshotNode?,
+        val semanticKey: String?,
+    )
+
+    private data class AddressEntryResolution(
+        val phoneNodeCount: Int,
+        val addressCardCount: Int,
+        val tapTargetCount: Int,
+        val target: AddressEntryTarget?,
+    ) {
+        fun diagnostic(): String =
+            "phoneNodes=$phoneNodeCount;addressCards=$addressCardCount;tapTargets=$tapTargetCount"
+
+        fun fingerprint(): String? = target?.let {
+            listOf(
+                it.activation.name,
+                it.cardKey,
+                it.node.label,
+                it.node.className.orEmpty(),
+                it.node.bounds.left,
+                it.node.bounds.top,
+                it.node.bounds.right,
+                it.node.bounds.bottom,
+            ).joinToString(":")
+        }
+    }
+
+    private fun resolveAddressEntries(snapshot: UiSnapshot): AddressEntryResolution {
+        val phones = snapshot.nodes.filter {
+            it.visible && it.enabled && maskedPhone(it.label) != null
+        }.distinctBy { it.path }
+        if (phones.isEmpty()) return AddressEntryResolution(0, 0, 0, null)
+
+        val byPath = snapshot.nodes.associateBy(SnapshotNode::path)
+        val candidates = phones.map { phone ->
+            val card = nearestClickableAncestor(phone, byPath)
+            AddressCardCandidate(phone, card, card?.let { addressCardSemanticKey(it, snapshot) })
+        }
+        val groups = mutableListOf<MutableList<AddressCardCandidate>>()
+        candidates.forEach { candidate ->
+            val matching = groups.filter { group -> group.any { sameLogicalAddress(it, candidate) } }
+            if (matching.isEmpty()) {
+                groups += mutableListOf(candidate)
+            } else {
+                val primary = matching.first()
+                primary += candidate
+                matching.drop(1).forEach { duplicate ->
+                    primary += duplicate
+                    groups.remove(duplicate)
+                }
+            }
+        }
+
+        val targets = groups.mapIndexed { index, group ->
+            val clickable = group.filter { it.clickableCard != null }
+                .minWithOrNull(compareBy<AddressCardCandidate>({ nodeArea(requireNotNull(it.clickableCard)) }, { it.phone.path }))
+            if (clickable != null) {
+                AddressEntryTarget(clickable.phone, AddressEntryActivation.CLICK, logicalAddressKey(group, index))
+            } else {
+                AddressEntryTarget(group.minBy { nodeArea(it.phone) }.phone, AddressEntryActivation.TAP, logicalAddressKey(group, index))
+            }
+        }
+
+        val actionable = targets.filter { it.node.bounds.width >= 2 && it.node.bounds.height >= 2 }
+        return AddressEntryResolution(
+            phoneNodeCount = phones.size,
+            addressCardCount = targets.size,
+            tapTargetCount = actionable.size,
+            target = actionable.singleOrNull(),
+        )
+    }
+
+    private fun nearestClickableAncestor(
+        source: SnapshotNode,
+        byPath: Map<String, SnapshotNode>,
+    ): SnapshotNode? {
+        var current: SnapshotNode? = source
+        while (current != null) {
+            if (current.clickable && current.visible && current.enabled) return current
+            current = current.parentPath?.let(byPath::get)
+        }
+        return null
+    }
+
+    private fun addressCardSemanticKey(card: SnapshotNode, snapshot: UiSnapshot): String? {
+        val labels = snapshot.nodes.asSequence()
+            .filter { it.visible && (it.path == card.path || it.path.startsWith("${card.path}/")) }
+            .map { normalizeAddressSemantic(it.label) }
+            .filter { it.isNotBlank() && maskedPhone(it) == null && it !in ADDRESS_CARD_GENERIC_LABELS }
+            .distinct()
+            .sorted()
+            .toList()
+        if (labels.none { it.length >= ADDRESS_SEMANTIC_MIN_LENGTH }) return null
+        return labels.joinToString("|")
+    }
+
+    private fun normalizeAddressSemantic(value: String): String = value
+        .replace(Regex("\\s+"), "")
+        .replace("，", ",")
+        .replace("：", ":")
+        .lowercase()
+
+    private fun sameLogicalAddress(first: AddressCardCandidate, second: AddressCardCandidate): Boolean {
+        if (maskedPhone(first.phone.label) != maskedPhone(second.phone.label)) return false
+        if (first.clickableCard?.path != null && first.clickableCard.path == second.clickableCard?.path) return true
+        if (sameAddressRegion(first.phone, second.phone)) return true
+        val firstCard = first.clickableCard
+        val secondCard = second.clickableCard
+        if (firstCard != null && secondCard != null && boundsRepresentSameRegion(firstCard.bounds, secondCard.bounds)) return true
+        return first.semanticKey != null && first.semanticKey == second.semanticKey
+    }
+
+    private fun boundsRepresentSameRegion(first: NodeBounds, second: NodeBounds): Boolean {
+        val overlapWidth = (minOf(first.right, second.right) - maxOf(first.left, second.left)).coerceAtLeast(0)
+        val overlapHeight = (minOf(first.bottom, second.bottom) - maxOf(first.top, second.top)).coerceAtLeast(0)
+        val overlap = overlapWidth.toLong() * overlapHeight
+        val smaller = minOf(first.width.toLong() * first.height, second.width.toLong() * second.height)
+        return smaller > 0 && overlap * 100 >= smaller * ADDRESS_CARD_OVERLAP_PERCENT
+    }
+
+    private fun logicalAddressKey(group: List<AddressCardCandidate>, index: Int): String {
+        val semantic = group.mapNotNull(AddressCardCandidate::semanticKey).distinct().singleOrNull()
+        return semantic?.let { "semantic:$it" } ?: "geometry:$index:${group.minOf { it.phone.bounds.top }}"
+    }
+
+    private fun sameAddressRegion(first: SnapshotNode, second: SnapshotNode): Boolean {
+        if (maskedPhone(first.label) != maskedPhone(second.label)) return false
+        val overlapWidth = (minOf(first.bounds.right, second.bounds.right) - maxOf(first.bounds.left, second.bounds.left)).coerceAtLeast(0)
+        val overlapHeight = (minOf(first.bounds.bottom, second.bounds.bottom) - maxOf(first.bounds.top, second.bounds.top)).coerceAtLeast(0)
+        val overlap = overlapWidth.toLong() * overlapHeight
+        val smaller = minOf(nodeArea(first), nodeArea(second))
+        val containsCenter = (
+            first.bounds.centerX in second.bounds.left..second.bounds.right &&
+                first.bounds.centerY in second.bounds.top..second.bounds.bottom
+            ) || (
+            second.bounds.centerX in first.bounds.left..first.bounds.right &&
+                second.bounds.centerY in first.bounds.top..first.bounds.bottom
+            )
+        return (smaller > 0 && overlap * 100 >= smaller * 50) || containsCenter
+    }
+
+    private fun maskedPhone(value: String): String? = MASKED_PHONE.find(value)?.value
+
+    private fun nodeArea(node: SnapshotNode): Long = node.bounds.width.toLong() * node.bounds.height
+
     fun finalConfirmation(input: PurchaseExecutionInput, address: ShippingAddressProof): FinalConfirmationEvidence {
+        structuralSubmitAnchor = null
         val snapshot = driver.capture()
         pageProblem(snapshot)
         if (snapshot.packageName != PDD_PACKAGE) fail("PURCHASE_CONFIRMATION_LOST", "最终提交前页面已经变化，禁止创建订单")
-        if (!hasFinalSavedAddressEvidence(snapshot, address.expectedAddress, address.suffix)) {
+        if (!hasSavedAddressEvidence(snapshot, address.expectedAddress, address.suffix)) {
             fail("PURCHASE_ADDRESS_UPDATE_FAILED", "收货地址保存后复核失败，未创建订单")
         }
         val submit = finalSubmitTargets(snapshot)
@@ -90,6 +325,7 @@ class PurchaseLiveAutomation(
         if (price !in input.minUnitPriceCent..input.maxUnitPriceCent) fail("PURCHASE_PRICE_OUT_OF_RANGE", "当前商品单价超出允许范围", price)
         val quantities = snapshot.nodes.filter { it.visible && it.enabled && it.className?.endsWith("EditText") == true }.mapNotNull { it.label.toLongOrNull() }
         if (quantities.singleOrNull() != input.quantity) fail("PURCHASE_QUANTITY_MISMATCH", "创建订单前数量复核失败")
+        structuralSubmitAnchor = submit.single().takeIf { legacySubmitTargets(snapshot).isEmpty() }
         return FinalConfirmationEvidence(input.goodsId, input.mappedColor, input.mappedSize, input.quantity, price, address.suffix, snapshot.activityName.orEmpty())
     }
 
@@ -101,6 +337,18 @@ class PurchaseLiveAutomation(
         if (snapshot.packageName != PDD_PACKAGE || targets.size != 1) {
             fail("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", "最终页面或创建订单按钮已变化，禁止创建订单")
         }
+        if (legacySubmitTargets(snapshot).isEmpty() && structuralSubmitAnchor == null) {
+            fail("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", "下单按钮尚未完成最终复核，禁止创建订单")
+        }
+        structuralSubmitAnchor?.let { anchor ->
+            val fresh = targets.single()
+            if (fresh.path != anchor.path || fresh.className != anchor.className || fresh.label != anchor.label ||
+                kotlin.math.abs(fresh.bounds.left - anchor.bounds.left) > 32 ||
+                kotlin.math.abs(fresh.bounds.top - anchor.bounds.top) > 32 ||
+                kotlin.math.abs(fresh.bounds.right - anchor.bounds.right) > 32 ||
+                kotlin.math.abs(fresh.bounds.bottom - anchor.bounds.bottom) > 32
+            ) fail("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", "最终下单按钮已变化，禁止创建订单")
+        }
         submitAttempted = true
         when (driver.clickFresh(targets.single())) {
             FreshActionResult.SUCCESS -> Unit
@@ -117,10 +365,12 @@ class PurchaseLiveAutomation(
             return null
         }
         val labels = linkedSetOf<String>()
-        var backedOutOfPayment = false
+        var paymentBackAttempts = 0
+        var consecutivePaymentSamplesAfterBack = 0
         var backedOutOfChooser = false
         var restoredFromWechat = false
         var pddObservedAfterWechatRestore = false
+        var orderDetailEntryOpened = false
         var wechatRestorePendingSamples = 0
         var consecutiveEmptySnapshots = 0
         repeat(ORDER_RESULT_MAX_SAMPLES) { index ->
@@ -162,24 +412,58 @@ class PurchaseLiveAutomation(
                 return unknown("PURCHASE_ORDER_UNEXPECTED_APP", "核单期间出现未授权应用")
             }
             if (restoredFromWechat) pddObservedAfterWechatRestore = true
-            val paymentVisible = isKnownPddPaymentActivity(snapshot) ||
-                currentLabels.any { label -> PAYMENT_MARKERS.any(label::contains) }
             val orderContextVisible = currentLabels.any { label -> ORDER_CONTEXT_MARKERS.any(label::contains) }
-            if (!paymentVisible && !orderContextVisible) {
+            val unpaidContextVisible = currentLabels.any { label -> UNPAID_MARKERS.any(label::contains) }
+            // PDD can reuse its payment Activity for a read-only unpaid order page.
+            // Visible order-result evidence takes precedence over the Activity name:
+            // it permits only bounded reading gestures below, never a payment click.
+            val paymentVisible = isKnownPddPaymentActivity(snapshot) && !orderContextVisible && !unpaidContextVisible
+            if (paymentVisible) {
+                if (paymentBackAttempts == 0) {
+                    paymentBackAttempts++
+                    if (!driver.backPurchase()) {
+                        return unknown("PURCHASE_ORDER_PAYMENT_BACK_FAILED", "支付页无法安全返回订单详情")
+                    }
+                    pause(500)
+                } else {
+                    consecutivePaymentSamplesAfterBack++
+                    if (consecutivePaymentSamplesAfterBack >= ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES) {
+                        return unknown(
+                            "PURCHASE_ORDER_PAYMENT_REPEATED",
+                            "支付页安全返回后持续无订单证据，已停止自动核单" +
+                                "[paymentBackAttempts=$paymentBackAttempts;" +
+                                "consecutivePaymentSamplesAfterBack=$consecutivePaymentSamplesAfterBack]",
+                        )
+                    }
+                    pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                }
+                return@repeat
+            }
+            consecutivePaymentSamplesAfterBack = 0
+            if (!orderContextVisible && !unpaidContextVisible) {
+                val entries = orderDetailEntryTargets(snapshot)
+                if (entries.size > 1) {
+                    return unknown("PURCHASE_ORDER_DETAIL_ENTRY_AMBIGUOUS", "订单详情入口不唯一，已停止只读核单")
+                }
+                if (entries.size == 1) {
+                    if (orderDetailEntryOpened) {
+                        return unknown("PURCHASE_ORDER_DETAIL_ENTRY_TIMEOUT", "进入订单详情后页面未出现可验证证据")
+                    }
+                    when (driver.clickFresh(entries.single())) {
+                        FreshActionResult.SUCCESS -> Unit
+                        FreshActionResult.AMBIGUOUS -> return unknown("PURCHASE_ORDER_DETAIL_ENTRY_AMBIGUOUS", "订单详情入口不唯一，已停止只读核单")
+                        else -> return unknown("PURCHASE_ORDER_DETAIL_ENTRY_FAILED", "订单详情入口点击失败，已停止只读核单")
+                    }
+                    orderDetailEntryOpened = true
+                    pause(500)
+                    return@repeat
+                }
                 pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
                 return@repeat
             }
             currentLabels.forEach(labels::add)
             parseOrderEvidence(labels)?.let { return it }
-            if (paymentVisible && !backedOutOfPayment) {
-                backedOutOfPayment = true
-                if (!driver.backPurchase()) {
-                    return unknown("PURCHASE_ORDER_PAYMENT_BACK_FAILED", "支付页无法安全返回订单详情")
-                }
-                pause(500)
-            } else if (paymentVisible) {
-                return unknown("PURCHASE_ORDER_PAYMENT_REPEATED", "支付页重复出现，已停止自动核单")
-            } else if (index > 0 && index % 15 == 0) {
+            if (index > 0 && index % ORDER_RESULT_SCROLL_SAMPLE_INTERVAL == 0) {
                 driver.swipePurchase(SwipeDirection.UP, 400)
             }
             pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
@@ -202,12 +486,13 @@ class PurchaseLiveAutomation(
         snapshot.packageName == PDD_PACKAGE && snapshot.activityName in PDD_PAYMENT_ACTIVITIES
 
     private fun editAndVerifyAddress(panel: UiSnapshot, suffix: String): ShippingAddressProof {
+        savedAddressProof = null
+        savedAddressActivity = null
+        structuralSubmitAnchor = null
         val modify = addressModifyTargets(panel)
         if (modify.size != 1) fail("PURCHASE_ADDRESS_EDIT_AMBIGUOUS", "没有找到唯一的地址修改按钮，未创建订单")
-        click(modify.single(), "修改地址")
-        val edit = waitFor("PURCHASE_ADDRESS_EDIT_TIMEOUT", "地址编辑页面打开超时，未创建订单") { snapshot ->
-            snapshot.nodes.any { it.visible && it.label.replace(" ", "").contains("详细地址") }
-        }
+        click(modify.single(), "修改地址", 1_000)
+        val edit = waitForAddressEditorReady()
         val editors = shippingAddressEditors(edit)
         if (editors.size != 1) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "没有找到唯一的详细地址输入框，未创建订单")
         val current = editors.single().label.trim()
@@ -220,15 +505,110 @@ class PurchaseLiveAutomation(
         }
         val save = uniqueClickable(stable, stable.nodes.filter { it.visible && it.enabled && it.label == "保存" })
         if (save.size != 1) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存按钮不唯一，未创建订单")
-        click(save.single(), "保存地址")
-        val savedEvidence = waitForStableAddressEditorExit()
-        if (!hasFinalSavedAddressEvidence(savedEvidence, expected, suffix)) {
-            if (!driver.backPurchase()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存后无法返回订单页面，未创建订单")
-            waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
-                hasFinalSavedAddressEvidence(it, expected, suffix)
+        click(save.single(), "保存地址", 1_000)
+        var savedEvidence = waitForSavedConfirmation(waitForStableAddressEditorExit(), expected, suffix)
+        if (!savedAddressPageReady(savedEvidence, expected, suffix)) {
+            if (isPurchaseConfirmationPanel(savedEvidence)) {
+                savedEvidence = restoreFinalEvidenceInCurrentPanel(savedEvidence, expected, suffix)
+            } else {
+                if (!driver.backPurchase()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存后无法返回订单页面，未创建订单")
+                pause(1_000)
+                val returned = waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
+                    savedAddressPageReady(it, expected, suffix) || isPurchaseConfirmationPanel(it)
+                }
+                val settled = waitForSavedConfirmation(returned, expected, suffix)
+                savedEvidence = if (!savedAddressPageReady(settled, expected, suffix)) {
+                    restoreFinalEvidenceInCurrentPanel(settled, expected, suffix)
+                } else settled
             }
         }
-        return ShippingAddressProof(expected, suffix)
+        val proof = ShippingAddressProof(expected, suffix)
+        savedAddressProof = proof
+        savedAddressActivity = savedEvidence.activityName
+        if (finalSubmitTargets(savedEvidence).size != 1) {
+            fail("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", "地址已保存，但未能识别唯一的下单按钮，未创建订单")
+        }
+        return proof
+    }
+
+    private fun isPurchaseConfirmationPanel(snapshot: UiSnapshot): Boolean {
+        if (snapshot.packageName != PDD_PACKAGE || shippingAddressEditors(snapshot).isNotEmpty()) return false
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        return screen.specPanelType in setOf(
+            SpecPanelType.NORMAL_SCROLLABLE,
+            SpecPanelType.NON_SCROLLABLE_CONFIRMATION,
+            SpecPanelType.ORDER_CONFIRMATION,
+        )
+    }
+
+    /** Wait for late address/footer nodes before deciding to scroll. No device actions here. */
+    private fun waitForSavedConfirmation(initial: UiSnapshot, expected: String, suffix: String): UiSnapshot {
+        var snapshot = initial
+        var readyActivity: String? = null
+        repeat(50) { poll ->
+            pageProblem(snapshot)
+            // A stable address list needs the existing single Back, not a footer wait.
+            if (snapshot.nodes.any { it.visible && it.label == "收货地址" } &&
+                addressModifyTargets(snapshot).size == 1) return snapshot
+            val ready = savedAddressPageReady(snapshot, expected, suffix)
+            if (ready && readyActivity != null && readyActivity == snapshot.activityName) {
+                savedConfirmationDiagnostic(snapshot, expected, suffix, poll + 1)
+                return snapshot
+            }
+            readyActivity = if (ready) snapshot.activityName else null
+            if (poll < 49) {
+                pause(200)
+                snapshot = driver.capture()
+            }
+        }
+        savedConfirmationDiagnostic(snapshot, expected, suffix, 50)
+        return snapshot
+    }
+
+    private fun savedConfirmationDiagnostic(snapshot: UiSnapshot, expected: String, suffix: String, polls: Int) {
+        val address = resolveAddressEntries(snapshot)
+        diagnostic("savedAddressMatched=${hasSavedAddressEvidence(snapshot, expected, suffix)};" +
+            "savedPanelMatched=${savedPurchasePanel(snapshot, expected, suffix) != null};" +
+            "savedLegacySubmitCandidates=${legacySubmitTargets(snapshot).size};" +
+            "savedAddressCards=${address.addressCardCount};savedAddressTargets=${address.tapTargetCount};" +
+            "savedScrollCandidates=${savedAddressPanelScrollTargets(snapshot).size};savedConfirmationPolls=$polls")
+    }
+
+    private fun restoreFinalEvidenceInCurrentPanel(
+        initial: UiSnapshot,
+        expected: String,
+        suffix: String,
+    ): UiSnapshot {
+        var snapshot = initial
+        var previousSignature: String? = null
+        repeat(ADDRESS_CONFIRMATION_SCROLL_LIMIT) { attempt ->
+            if (savedAddressPageReady(snapshot, expected, suffix)) return snapshot
+            if (!isPurchaseConfirmationPanel(snapshot)) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后采购面板发生变化，未创建订单")
+            }
+            val panels = savedAddressPanelScrollTargets(snapshot)
+            if (panels.size != 1) {
+                savedConfirmationDiagnostic(snapshot, expected, suffix, 0)
+                val reason = if (panels.isEmpty()) "未找到可用的规格面板滚动区域" else "找到多个规格面板滚动区域"
+                fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "地址保存后${reason}，未创建订单")
+            }
+            val panel = panels.single()
+            val signature = viewportSignature(snapshot, panel)
+            if (signature == previousSignature) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板未找到完整订单确认信息，未创建订单")
+            }
+            previousSignature = signature
+            if (!driver.swipePurchaseIn(panel, SwipeDirection.DOWN, 350)) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板无法定位订单确认信息，未创建订单")
+            }
+            if (attempt < ADDRESS_CONFIRMATION_SCROLL_LIMIT - 1) pause(ADDRESS_CONFIRMATION_SCROLL_INTERVAL_MS)
+            snapshot = driver.capture()
+            pageProblem(snapshot)
+        }
+        if (!savedAddressPageReady(snapshot, expected, suffix)) {
+            fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板未找到完整订单确认信息，未创建订单")
+        }
+        return snapshot
     }
 
     private fun hasSavedAddressEvidence(snapshot: UiSnapshot, expected: String, suffix: String): Boolean {
@@ -245,8 +625,9 @@ class PurchaseLiveAutomation(
         return suffixMatches.size == 1
     }
 
-    private fun hasFinalSavedAddressEvidence(snapshot: UiSnapshot, expected: String, suffix: String): Boolean =
-        hasSavedAddressEvidence(snapshot, expected, suffix) && finalSubmitTargets(snapshot).size == 1
+    private fun savedAddressPageReady(snapshot: UiSnapshot, expected: String, suffix: String): Boolean =
+        hasSavedAddressEvidence(snapshot, expected, suffix) &&
+            (legacySubmitTargets(snapshot).isNotEmpty() || savedPurchasePanel(snapshot, expected, suffix) != null)
 
     private fun waitForStableAddressEditorExit(): UiSnapshot {
         var consecutiveExits = 0
@@ -279,6 +660,20 @@ class PurchaseLiveAutomation(
         fail(code, message)
     }
 
+    private fun savedAddressPanelScrollTargets(snapshot: UiSnapshot): List<SnapshotNode> {
+        val panel = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+            .specPanelContainer ?: return purchasePanelScrollTargets(snapshot)
+        val screenWidth = snapshot.nodes.maxOfOrNull { it.bounds.right }?.coerceAtLeast(1) ?: 1
+        val screenHeight = snapshot.nodes.maxOfOrNull { it.bounds.bottom }?.coerceAtLeast(1) ?: 1
+        return snapshot.nodes.filter { node ->
+            node.visible && node.enabled && node.scrollable &&
+                node.bounds.width * 100 >= screenWidth * 60 &&
+                node.bounds.height * 100 >= screenHeight * 20 &&
+                node.bounds.left >= panel.bounds.left && node.bounds.right <= panel.bounds.right &&
+                node.bounds.top >= panel.bounds.top && node.bounds.bottom <= panel.bounds.bottom
+        }.distinctBy { it.path }
+    }
+
     private fun purchasePanelScrollTargets(snapshot: UiSnapshot): List<SnapshotNode> {
         val screenWidth = snapshot.nodes.maxOfOrNull { it.bounds.right }?.coerceAtLeast(1) ?: 1
         val screenHeight = snapshot.nodes.maxOfOrNull { it.bounds.bottom }?.coerceAtLeast(1) ?: 1
@@ -293,7 +688,7 @@ class PurchaseLiveAutomation(
     private fun viewportSignature(snapshot: UiSnapshot, panel: SnapshotNode): String = snapshot.nodes
         .filter { node -> node.visible && inside(node.bounds, panel.bounds) }
         .joinToString("|") { node ->
-            listOf(node.className.orEmpty(), node.bounds.left, node.bounds.top, node.bounds.right, node.bounds.bottom, node.clickable, node.scrollable).joinToString(":")
+            listOf(node.path, node.className.orEmpty(), node.bounds.left, node.bounds.top, node.bounds.right, node.bounds.bottom, node.clickable, node.scrollable).joinToString(":")
         }
 
     private fun inside(child: NodeBounds, parent: NodeBounds): Boolean =
@@ -357,20 +752,128 @@ class PurchaseLiveAutomation(
         }.distinctBy { it.path }
     }
 
-    private fun click(node: SnapshotNode, label: String) {
+    private fun waitForAddressEditorReady(): UiSnapshot {
+        var previous: SnapshotNode? = null
+        var previousActivity: String? = null
+        var count = 0
+        repeat(50) { poll ->
+            val snapshot = driver.capture()
+            pageProblem(snapshot)
+            val editors = if (snapshot.packageName == PDD_PACKAGE) shippingAddressEditors(snapshot) else emptyList()
+            count = editors.size
+            diagnostic("addressEditorCandidates=$count;addressEditorPolls=${poll + 1}")
+            val editor = editors.singleOrNull()
+            if (editor != null && previous != null && snapshot.activityName == previousActivity &&
+                editor.path == previous!!.path && editor.bounds == previous!!.bounds && editor.label == previous!!.label) return snapshot
+            previous = editor
+            previousActivity = snapshot.activityName
+            pause(200)
+        }
+        fail("PURCHASE_ADDRESS_UPDATE_FAILED", "详细地址输入框未稳定就绪，未创建订单 [candidates=$count]")
+    }
+
+    private fun click(node: SnapshotNode, label: String, settleMillis: Long = 500) {
         when (driver.clickFresh(node)) {
             FreshActionResult.SUCCESS -> Unit
             FreshActionResult.AMBIGUOUS -> fail("RULE_AMBIGUOUS", "$label 不唯一")
             else -> fail("RULE_ACTION_FAILED", "$label 点击失败")
         }
-        pause(500)
+        pause(settleMillis)
     }
 
-    private fun finalSubmitTargets(snapshot: UiSnapshot): List<SnapshotNode> = uniqueClickable(
+    private fun legacySubmitTargets(snapshot: UiSnapshot): List<SnapshotNode> = uniqueClickable(
         snapshot,
         snapshot.nodes.filter { node -> node.visible && node.enabled && FINAL_SUBMIT_MARKERS.any { node.label == it || node.label.startsWith(it) } },
     )
 
+    /** Only the just-saved address flow may use a footer whose display copy is unknown. */
+    private fun finalSubmitTargets(snapshot: UiSnapshot): List<SnapshotNode> {
+        val legacy = legacySubmitTargets(snapshot)
+        if (legacy.isNotEmpty()) return legacy
+        val proof = savedAddressProof ?: return emptyList()
+        if (snapshot.activityName != savedAddressActivity) return emptyList()
+        val panel = savedPurchasePanel(snapshot, proof.expectedAddress, proof.suffix) ?: return emptyList()
+        val visible = snapshot.nodes.filter { it.visible }
+        val byPath = visible.associateBy(SnapshotNode::path)
+        val candidates = visible.filter { node ->
+            node.path.startsWith("${panel.path}/") && node.enabled && node.clickable && !node.scrollable &&
+                node.bounds.width >= panel.bounds.width / 5 && node.bounds.height >= 2 &&
+                node.bounds.height <= panel.bounds.height / 4 &&
+                node.bounds.bottom <= panel.bounds.bottom &&
+                node.bounds.bottom >= panel.bounds.bottom - panel.bounds.height / 20 &&
+                node.bounds.left >= panel.bounds.left && node.bounds.right <= panel.bounds.right
+        }.filter { node ->
+            // A spec option at the scroll edge is not a fixed footer action.
+            var parent = node.parentPath?.let(byPath::get)
+            var inScroller = false
+            while (parent != null && parent.path != panel.path) {
+                if (parent.scrollable) inScroller = true
+                parent = parent.parentPath?.let(byPath::get)
+            }
+            !inScroller && parent?.path == panel.path
+        }
+        val independent = candidates.filter { parent ->
+            candidates.none { it.path.startsWith("${parent.path}/") }
+        }
+        // Do not silently choose one of several footer actions by text or price.
+        if (independent.size != 1) return emptyList()
+        val button = independent.single()
+        val content = visible.filter { it.path == button.path || it.path.startsWith("${button.path}/") }
+        val labels = content.map { it.label.replace(" ", "") }
+        if (labels.any { label -> STRUCTURAL_ACTION_DENY.any(label::contains) } ||
+            labels.none { FOOTER_PRICE.containsMatchIn(it) } ||
+            labels.none { FOOTER_PRICE.replace(it, "").any(Char::isLetter) }
+        ) return emptyList()
+        // Keep the original text anchor; clickFresh reacquires it and its nearest clickable parent.
+        return listOfNotNull(content.firstOrNull {
+            it.enabled && it.label.isNotBlank() && nearestClickableAncestor(it, byPath)?.path == button.path
+        })
+    }
+
+    private fun savedPurchasePanel(snapshot: UiSnapshot, expected: String, suffix: String): SnapshotNode? {
+        if (snapshot.packageName != PDD_PACKAGE || snapshot.activityName.isNullOrBlank() ||
+            isKnownPddPaymentActivity(snapshot) || !hasSavedAddressEvidence(snapshot, expected, suffix)
+        ) return null
+        val visible = snapshot.nodes.filter { it.visible }
+        if (visible.any { node -> STRUCTURAL_PAGE_DENY.any(node.label::contains) }) return null
+        val resolution = resolveAddressEntries(snapshot)
+        if (resolution.addressCardCount != 1 || resolution.tapTargetCount != 1) return null
+        val address = resolution.target?.node ?: return null
+        val quantities = visible.filter { it.enabled && it.className?.endsWith("EditText") == true && (it.label.toLongOrNull() ?: 0) > 0 }
+        val summaries = visible.filter { it.label.replace(" ", "").startsWith("已选") }
+        val evidence = quantities.singleOrNull() ?: summaries.singleOrNull() ?: return null
+        val byPath = visible.associateBy(SnapshotNode::path)
+        val screenHeight = visible.maxOfOrNull { it.bounds.bottom } ?: return null
+        val screenWidth = visible.maxOfOrNull { it.bounds.right } ?: return null
+        var common = address.parentPath?.let(byPath::get)
+        while (common != null) {
+            if (evidence.path.startsWith("${common.path}/")) {
+                // Nearest common ancestor is the whole popup, not its inner spec RecyclerView.
+                return common.takeIf {
+                    !it.scrollable && it.bounds.width >= screenWidth * 3 / 5 &&
+                        it.bounds.height > 0 && it.bounds.height < screenHeight * 95 / 100
+                }
+            }
+            common = common.parentPath?.let(byPath::get)
+        }
+        return null
+    }
+
+    private fun orderConfirmationReady(snapshot: UiSnapshot): Boolean {
+        if (snapshot.packageName != PDD_PACKAGE) return false
+        if (snapshot.nodes.any { it.visible && it.enabled && MASKED_PHONE.containsMatchIn(it.label) }) return true
+        return PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null).specPanelType ==
+            SpecPanelType.ORDER_CONFIRMATION
+    }
+
+    /** A post-submit navigation target is allowed only when it is one exact, non-payment PDD order-detail entry. */
+    private fun orderDetailEntryTargets(snapshot: UiSnapshot): List<SnapshotNode> = uniqueClickable(
+        snapshot,
+        snapshot.nodes.filter { node ->
+            node.visible && node.enabled && node.label in ORDER_DETAIL_ENTRY_MARKERS
+        },
+    )
+
     private fun pageProblem(snapshot: UiSnapshot) {
         val labels = snapshot.nodes.filter { it.visible }.map { it.label }
         PddPageClassifier.classify(snapshot.packageName, snapshot.activityName, labels)?.let { fail(it.code, it.message) }
@@ -419,8 +922,12 @@ class PurchaseLiveAutomation(
         const val WECHAT_PACKAGE = "com.tencent.mm"
         val MASKED_PHONE = Regex("(?<![0-9])[0-9]{3}\\*{4}[0-9]{4}(?![0-9])")
         val FINAL_SUBMIT_MARKERS = listOf("提交订单", "现在买，仅", "确认购买")
+        val FOOTER_PRICE = Regex("(?:[¥￥]\\s*\\d+(?:\\.\\d{1,2})?|\\d+(?:\\.\\d{1,2})?\\s*元)")
+        val STRUCTURAL_ACTION_DENY = listOf("支付", "付款", "先用后付", "收货", "地址", "修改", "保存", "取消", "返回", "关闭", "客服", "收藏", "订单详情", "查看订单")
+        val STRUCTURAL_PAGE_DENY = listOf("立即支付", "确认支付", "输入支付密码", "待付款", "待支付", "订单编号", "订单号", "订单详情", "修改收货地址", "选择收货地址")
         val PAYMENT_MARKERS = listOf("立即支付", "确认支付", "输入支付密码")
         val UNPAID_MARKERS = listOf("待付款", "待支付", "去支付")
+        val ORDER_DETAIL_ENTRY_MARKERS = setOf("查看订单", "订单详情")
         val ORDER_CONTEXT_MARKERS = listOf("订单编号", "订单号", "下单时间", "创建时间")
         val ORDER_NO = Regex("(?:订单编号|订单号)\\s*[:：]?\\s*([A-Za-z0-9-]{6,64})")
         val ORDER_TIME = Regex("(?:下单时间|创建时间)\\s*[:：]?\\s*(20[0-9]{2}[-/.年][0-9]{1,2}[-/.月][0-9]{1,2}日?\\s+[0-9]{1,2}:[0-9]{2}(?::[0-9]{2})?)")
@@ -435,6 +942,16 @@ class PurchaseLiveAutomation(
         const val ORDER_RESULT_MAX_SAMPLES = 60
         const val ORDER_RESULT_MAX_EMPTY_SAMPLES = 15
         const val ORDER_RESULT_WECHAT_RESTORE_MAX_SAMPLES = 15
+        const val ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES = 3
+        const val ORDER_RESULT_SCROLL_SAMPLE_INTERVAL = 15
         const val ORDER_RESULT_SAMPLE_INTERVAL_MS = 200L
+        const val SPEC_CONFIRMATION_MAX_SAMPLES = 20
+        const val SPEC_CONFIRMATION_SAMPLE_INTERVAL_MS = 100L
+        const val ADDRESS_ENTRY_STABLE_INTERVAL_MS = 200L
+        const val ADDRESS_CARD_OVERLAP_PERCENT = 70
+        const val ADDRESS_SEMANTIC_MIN_LENGTH = 4
+        val ADDRESS_CARD_GENERIC_LABELS = setOf("收货地址", "修改", "默认地址", "默认")
+        const val ADDRESS_CONFIRMATION_SCROLL_LIMIT = 5
+        const val ADDRESS_CONFIRMATION_SCROLL_INTERVAL_MS = 500L
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseScrollLocator.kt

@@ -0,0 +1,24 @@
+package cn.ilapage.goauto.agent.automation
+
+internal data class PurchaseScrollCandidate(
+    val path: String,
+    val className: String?,
+    val bounds: NodeBounds,
+)
+
+internal object PurchaseScrollLocator {
+    fun locate(target: PurchaseScrollCandidate, candidates: List<PurchaseScrollCandidate>): PurchaseScrollCandidate? {
+        val compatible = candidates.filter {
+            it.className == target.className && boundsMatch(it.bounds, target.bounds)
+        }
+        val samePath = compatible.filter { it.path == target.path }
+        if (samePath.isNotEmpty()) return samePath.singleOrNull()
+        return compatible.singleOrNull()
+    }
+
+    private fun boundsMatch(a: NodeBounds, b: NodeBounds): Boolean =
+        kotlin.math.abs(a.left - b.left) <= 32 &&
+            kotlin.math.abs(a.top - b.top) <= 32 &&
+            kotlin.math.abs(a.right - b.right) <= 32 &&
+            kotlin.math.abs(a.bottom - b.bottom) <= 32
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/SelectedColorCard.kt

@@ -0,0 +1,43 @@
+package cn.ilapage.goauto.agent.automation
+
+/** A narrow exception for one selected text option duplicated by its card/image. */
+internal object SelectedColorCard {
+    fun confirms(target: String, values: List<VisibleSpecValue>, source: List<SnapshotNode>): Boolean {
+        val exact = values.filter { it.text == target }.singleOrNull() ?: return false
+        if (!exact.node.selected && !exact.node.checked) return false
+        val byPath = source.associateBy { it.path }
+        fun contains(outer: NodeBounds, inner: NodeBounds) =
+            inner.width > 0 && inner.height > 0 && inner.left >= outer.left && inner.top >= outer.top &&
+                inner.right <= outer.right && inner.bottom <= outer.bottom
+        fun cardFor(node: SnapshotNode): SnapshotNode? {
+            var current = node
+            val seen = mutableSetOf<String>()
+            while (seen.add(current.path)) {
+                if (current.scrollable || !current.visible || !current.enabled) return null
+                val parent = current.parentPath?.let(byPath::get) ?: return null
+                if (parent.scrollable) {
+                    return current.takeIf {
+                        it.clickable && it.className == "android.view.ViewGroup" &&
+                            contains(parent.bounds, it.bounds) && contains(it.bounds, node.bounds)
+                    }
+                }
+                current = parent
+            }
+            return null
+        }
+        val card = cardFor(exact.node) ?: return false
+        // The parser may have deduplicated identical labels across cards. Check
+        // the source as well before treating a selected duplicate as harmless.
+        if (source.any { node ->
+                node.visible && node.enabled && node.clickable &&
+                    SpecValueNormalizer.normalizeColor(node.label) == target &&
+                    cardFor(node)?.let { it.path != card.path } == true
+            }) return false
+        return values.filter { it.text != target && (it.node.selected || it.node.checked) }.all { other ->
+            val node = other.node
+            // Never merge another textual option, adjacent card, or scroll container.
+            (node.path == card.path || node.className == "android.widget.ImageView") &&
+                cardFor(node)?.path == card.path && contains(card.bounds, node.bounds)
+        }
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/network/AgentApiClient.kt

@@ -226,6 +226,26 @@ class AgentApiClient(private val serverUrl: String) {
         )
     }
 
+    fun recoverRegistration(info: DeviceInfo, token: String?, recoveryCode: String): RegistrationResult {
+        require(recoveryCode.isNotBlank()) { "请输入管理员恢复码" }
+        val payload = JSONObject()
+            .put("requestId", UUID.randomUUID().toString())
+            .put("installId", info.installId)
+            .put("name", info.name)
+            .put("manufacturer", info.manufacturer)
+            .put("model", info.model)
+            .put("androidVersion", info.androidVersion)
+            .put("agentVersion", info.agentVersion)
+            .put("pddVersion", info.pddVersion)
+            .put("capabilities", JSONArray(info.capabilities))
+        val data = post("/api/agent/v1/register", payload, token, recoveryCode).getJSONObject("data")
+        return RegistrationResult(
+            deviceId = data.getLong("deviceId"),
+            deviceToken = data.optString("deviceToken").takeIf { it.isNotBlank() },
+            heartbeatIntervalSeconds = data.optInt("heartbeatIntervalSeconds", 15),
+        )
+    }
+
     fun heartbeat(token: String, currentTaskId: Long?, capabilities: List<String> = emptyList()): HeartbeatResult {
         val payload = JSONObject()
             .put("requestId", UUID.randomUUID().toString())
@@ -590,11 +610,11 @@ class AgentApiClient(private val serverUrl: String) {
         leaseVersion = data.getLong("leaseVersion"),
     )
 
-    private fun post(path: String, payload: JSONObject, token: String?): JSONObject {
-        return requireNotNull(request("POST", path, payload, token))
+    private fun post(path: String, payload: JSONObject, token: String?, recoveryCode: String? = null): JSONObject {
+        return requireNotNull(request("POST", path, payload, token, recoveryCode))
     }
 
-    private fun request(method: String, path: String, payload: JSONObject?, token: String?): JSONObject? {
+    private fun request(method: String, path: String, payload: JSONObject?, token: String?, recoveryCode: String? = null): JSONObject? {
         val connection = (URL(serverUrl + path).openConnection() as HttpURLConnection).apply {
             requestMethod = method
             connectTimeout = 10_000
@@ -605,6 +625,7 @@ class AgentApiClient(private val serverUrl: String) {
             setRequestProperty("Accept", "application/json")
             setRequestProperty("Cache-Control", "no-store")
             if (!token.isNullOrBlank()) setRequestProperty("Authorization", "Bearer $token")
+            if (!recoveryCode.isNullOrBlank()) setRequestProperty("X-GoAuto-Device-Recovery-Code", recoveryCode)
         }
         try {
             if (payload != null) {

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/PurchaseDiagnosticStore.kt

@@ -0,0 +1,94 @@
+package cn.ilapage.goauto.agent.persistence
+
+import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.FreshClickReason
+import java.io.File
+import org.json.JSONObject
+
+data class PurchaseDiagnosticContext(
+    val taskId: Long,
+    val attemptId: String,
+    val deviceId: Long,
+    val ruleHash: String,
+    val agentVersion: String,
+    val phase: String,
+)
+
+/** Private, bounded diagnostics only. Neither raw evidence nor write errors escape this store. */
+class PurchaseDiagnosticStore(private val directory: File, private val now: () -> Long = System::currentTimeMillis) {
+    @Synchronized
+    fun record(context: PurchaseDiagnosticContext, elapsedMs: Long, evidence: String): Boolean = runCatching {
+        require(context.taskId > 0 && context.deviceId > 0 && ID.matches(context.attemptId))
+        require(HASH.matches(context.ruleHash) && VERSION.matches(context.agentVersion))
+        require(context.phase in setOf("purchase", "spec_probe"))
+        val fields = sanitize(evidence)
+        if (fields.length() == 0) return false
+        val timestamp = now()
+        val line = JSONObject().put("taskId", context.taskId).put("attemptId", context.attemptId)
+            .put("deviceId", context.deviceId).put("ruleHash", context.ruleHash)
+            .put("agentVersion", context.agentVersion).put("phase", context.phase)
+            .put("timestamp", timestamp).put("elapsedMs", elapsedMs.coerceAtLeast(0))
+            .put("evidence", fields).toString()
+        check(directory.isDirectory || directory.mkdirs())
+        val file = File(directory, "${context.taskId}_${context.attemptId}.jsonl")
+        file.appendText(line + "\n", Charsets.UTF_8)
+        val lines = file.readLines(Charsets.UTF_8)
+        if (lines.size > MAX_EVENTS) file.writeText(lines.takeLast(MAX_EVENTS).joinToString("\n", postfix = "\n"), Charsets.UTF_8)
+        file.setLastModified(timestamp)
+        prune(timestamp)
+        true
+    }.getOrDefault(false)
+
+    @Synchronized
+    fun prune(timestamp: Long = now()) {
+        runCatching {
+            val files = directory.listFiles()?.filter { it.isFile && FILE_NAME.matches(it.name) }.orEmpty()
+            files.filter { it.lastModified() < timestamp - RETENTION_MS }.forEach { it.delete() }
+            files.filter(File::exists).sortedWith(compareByDescending<File> { it.lastModified() }.thenBy { it.name })
+                .drop(MAX_ATTEMPTS).forEach { it.delete() }
+        }
+    }
+
+    companion object {
+        const val MAX_ATTEMPTS = 5
+        const val MAX_EVENTS = 128
+        const val RETENTION_MS = 7L * 24 * 60 * 60 * 1000
+        private val ID = Regex("[A-Za-z0-9-]{1,80}")
+        private val HASH = Regex("[0-9a-f]{64}")
+        private val VERSION = Regex("[0-9]+\\.[0-9]+\\.[0-9]+")
+        private val FILE_NAME = Regex("[1-9][0-9]*_[A-Za-z0-9-]{1,80}\\.jsonl")
+        private val numbers = setOf("specEntryCandidates", "explicit", "nested", "bottomPurchase", "entryReadyWaitPolls",
+            "entryReadyWaitMillis", "scrollables", "headings", "options", "entryWaitPolls", "entryWaitMillis",
+            "addressEditorCandidates", "addressEditorPolls", "savedLegacySubmitCandidates", "savedAddressCards",
+            "savedAddressTargets", "savedScrollCandidates", "savedConfirmationPolls")
+        private val booleans = setOf("panelAlreadyOpen", "reviewPage", "pageEvidence", "pageChanged", "summary", "quantity",
+            "orderAction", "closeControl", "paymentArea", "savedAddressMatched", "savedPanelMatched")
+        private val enums = mapOf(
+            "event" to setOf("started"),
+            "entrySource" to setOf("unknown", "explicit_selection", "nested_selection", "bottom_purchase", "bottom_purchase_rightmost"),
+            "entryClick" to FreshActionResult.values().map { it.name }.toSet(),
+            "entryReason" to FreshClickReason.values().map { it.name }.toSet(),
+            "gesture" to FreshActionResult.values().map { it.name }.toSet(),
+            "entryRecovery" to setOf("rejected", "attempted"),
+            "type" to setOf("UNKNOWN", "NORMAL_SCROLLABLE", "NON_SCROLLABLE_CONFIRMATION", "ORDER_CONFIRMATION", "QUICK_CONFIRMATION"),
+            "reason" to setOf("identity_missing", "identity_changed", "product_context_missing", "page_problem", "panel_open",
+                "close_control", "payment_area", "order_action", "quantity_controls", "selection_summary", "title_missing",
+                "title_changed", "entry_missing", "entry_source_missing", "entry_source_changed", "entry_label_changed",
+                "entry_ambiguous", "rule_alias_mismatch", "entry_unavailable", "eligible"),
+        )
+
+        internal fun sanitize(evidence: String): JSONObject {
+            val result = JSONObject()
+            evidence.take(4096).split(';').take(40).forEach { part ->
+                val key = part.substringBefore('=')
+                val value = part.substringAfter('=', "")
+                when {
+                    key in numbers && value.matches(Regex("[0-9]{1,8}")) -> result.put(key, value.toLong())
+                    key in booleans && value in setOf("true", "false") -> result.put(key, value == "true")
+                    value in enums[key].orEmpty() -> result.put(key, value)
+                }
+            }
+            return result
+        }
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentForegroundService.kt

@@ -18,6 +18,10 @@ import android.os.PowerManager
 import android.os.SystemClock
 import android.util.Log
 import cn.ilapage.goauto.agent.BuildConfig
+import cn.ilapage.goauto.agent.automation.PddCollectionReturnNavigator
+import cn.ilapage.goauto.agent.persistence.PurchaseDiagnosticContext
+import cn.ilapage.goauto.agent.persistence.PurchaseDiagnosticStore
+import java.io.File
 import cn.ilapage.goauto.agent.ClipboardRelayActivity
 import cn.ilapage.goauto.agent.MainActivity
 import cn.ilapage.goauto.agent.R
@@ -57,6 +61,7 @@ import cn.ilapage.goauto.agent.persistence.AgentDiagnosticEvent
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticReason
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticStage
 import cn.ilapage.goauto.agent.persistence.SafeAgentDiagnosticRecorder
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePolicy
 import org.json.JSONArray
 import org.json.JSONObject
 import java.util.concurrent.Executors
@@ -90,6 +95,7 @@ class AgentForegroundService : Service() {
     private lateinit var settingsStore: AgentSettingsStore
     private lateinit var stateStore: AgentStateStore
     private lateinit var purchaseStore: PurchaseTaskStore
+    private lateinit var purchaseDiagnostics: PurchaseDiagnosticStore
     private lateinit var diagnosticStore: AgentDiagnosticStore
     private lateinit var diagnosticRecorder: SafeAgentDiagnosticRecorder
     private lateinit var connectivityManager: ConnectivityManager
@@ -108,6 +114,8 @@ class AgentForegroundService : Service() {
         // Wake locks and cooldown tickets are process-local. Never restore a stale UI flag.
         stateStore.setKeepScreenOn(false)
         purchaseStore = PurchaseTaskStore(this)
+        purchaseDiagnostics = PurchaseDiagnosticStore(File(filesDir, "purchase_diagnostics"))
+        runCatching { diagnosticExecutor.execute { purchaseDiagnostics.prune() } }
         diagnosticStore = AgentDiagnosticStore(this)
         diagnosticRecorder = SafeAgentDiagnosticRecorder(
             persist = { event ->
@@ -187,11 +195,12 @@ class AgentForegroundService : Service() {
 
             if (!registeredThisProcess.get()) {
                 val registration = api.register(deviceInfo(), credentials?.token)
-                if (credentials == null) {
+                if (registration.deviceToken != null) {
                     val issuedToken = registration.deviceToken
-                        ?: error("注册请求已处理，但未返回新 Token；请联系管理员重新签发")
                     identityStore.saveCredentials(registration.deviceId, issuedToken)
                     credentials = identityStore.credentials() ?: error("设备凭据保存失败")
+                } else if (credentials == null) {
+                    error("注册请求已处理，但未返回新 Token；请联系管理员重新签发")
                 } else {
                     check(registration.deviceId == credentials.deviceId) { "服务端设备身份与本地不一致" }
                 }
@@ -254,13 +263,20 @@ class AgentForegroundService : Service() {
         flushPurchaseOutbox(api, token)
         val collectionCooldown = activeCollectionCooldown()
         val purchaseTask = api.nextPurchaseTask(token)
-        when (TaskDispatchPolicy.decide(purchaseTask != null, collectionCooldown != null)) {
+        when (TaskDispatchPolicy.decide(purchaseTask?.status, collectionCooldown != null)) {
             TaskDispatchDecision.RUN_PURCHASE -> {
                 cancelIdleReturn("收到新的采购任务")
                 releaseCollectionCooldownWakeLock()
                 schedulePurchaseTask(api, requireNotNull(purchaseTask), token)
                 return MANUAL_PURCHASE_TASK
             }
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH -> {
+                val waitingTask = requireNotNull(purchaseTask)
+                cancelIdleReturn("等待采购规格匹配")
+                stateStore.update("ONLINE", "采购任务 #${waitingTask.taskId} 正在匹配规格", tokenStored = true)
+                updateNotification("采购任务 #${waitingTask.taskId} 等待规格匹配")
+                return MANUAL_PURCHASE_MATCH_PENDING
+            }
             TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN -> {
                 val ticket = requireNotNull(collectionCooldown)
                 showCollectionCooldown(ticket)
@@ -341,11 +357,16 @@ class AgentForegroundService : Service() {
                 }
                 runningTaskId.set(task.taskId)
                 stateStore.setActiveTask(task.taskId, "collection")
-                val outcome = executeTask(api, task, credentials.token)
+                val continuous = ContinuousCollectionPolicy.applies(
+                    settingsStore.continuousCollection(), task.source, task.attemptNumber, task.replacementOriginType,
+                )
+                val outcome = executeTask(api, task, credentials.token, continuous)
                 publishCurrentPageResult(
                     task.taskId,
                     if (outcome.successful) {
-                        if (task.replacementOriginType.isNotBlank()) {
+                        if (continuous) {
+                            outcome.message ?: "采集已结束，请查看采集记录。"
+                        } else if (task.replacementOriginType.isNotBlank()) {
                             "已替换，正在匹配规格"
                         } else {
                             "临时采集任务 #${task.taskId} 已结束，请查看采集记录。"
@@ -433,8 +454,10 @@ class AgentForegroundService : Service() {
     }
 
     private fun executePurchaseTask(api: AgentApiClient, initial: PurchaseAgentTask, token: String) {
+        GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         var resultSafelyStored = false
+        val lastStep = AtomicReference("started")
         try {
             val claimed = if (initial.status == "pending") {
                 api.claimPurchaseTask(initial.taskId, UUID.randomUUID().toString(), token)
@@ -467,11 +490,29 @@ class AgentForegroundService : Service() {
                     if (accessibility == null) {
                         PurchaseExecutionOutcome("failed", "ACCESSIBILITY_NOT_READY", "GoAuto 无障碍服务未开启")
                     } else {
+                        val diagnosticDeviceId = runCatching { identityStore.credentials()?.deviceId ?: 0L }.getOrDefault(0L)
+                        val diagnosticAttempt = task.taskAttemptId.takeIf { it.matches(Regex("^[a-zA-Z0-9-]{1,80}$")) } ?: "invalid"
+                        val diagnosticContext = PurchaseDiagnosticContext(task.taskId, task.taskAttemptId, diagnosticDeviceId,
+                            snapshotHash, BuildConfig.VERSION_NAME, task.phase)
+                        val diagnosticStarted = SystemClock.elapsedRealtime()
+                        val recordDiagnostic: (String) -> Unit = { evidence ->
+                            val elapsed = SystemClock.elapsedRealtime() - diagnosticStarted
+                            runCatching { diagnosticExecutor.execute { purchaseDiagnostics.record(diagnosticContext, elapsed, evidence) } }
+                            Unit
+                        }
+                        recordDiagnostic("event=started")
                         PurchaseRehearsalExecutor(
                             driver = accessibility,
-                            openLink = { PddLinkLauncher(this).open(it) },
+                            openLink = { PddLinkLauncher(this).open(it, preferDirect = true) },
                             probeSpecs = { collectPurchaseProbe(accessibility, task, parsedRule) },
-                            stepChanged = { step -> purchaseStore.updateStep(task.taskId, task.taskAttemptId, step) },
+                            stepChanged = { step ->
+                                lastStep.set(step)
+                                purchaseStore.updateStep(task.taskId, task.taskAttemptId, step)
+                            },
+                            panelDiagnostic = { evidence ->
+                                recordDiagnostic(evidence)
+                                Log.i("GoAutoPurchasePanel", "task=${task.taskId};attempt=$diagnosticAttempt;device=$diagnosticDeviceId;rule=$snapshotHash;$evidence")
+                            },
                             beforeOrderSubmit = { evidence ->
                                 val boundaryRequestId = UUID.randomUUID().toString()
                                 val finalEvidence = JSONObject()
@@ -511,6 +552,14 @@ class AgentForegroundService : Service() {
             val payload = purchaseResultPayload(requestId, task.taskAttemptId, outcome)
             purchaseStore.completeAndEnqueue(task.taskId, task.taskAttemptId, requestId, payload)
             resultSafelyStored = true
+            PurchaseResultBubblePolicy.create(
+                taskId = task.taskId,
+                resultType = outcome.resultType,
+                lastStep = lastStep.get(),
+                resultMessage = outcome.message,
+            )?.let { presentation ->
+                GoAutoAccessibilityService.instance?.showPurchaseResultBubble(presentation)
+            }
             beginIdleReturnCooldown()
             flushPurchaseOutbox(api, token)
             val message = if (outcome.resultType == "failed") "${outcome.errorCode}：${outcome.message}" else outcome.message
@@ -608,10 +657,29 @@ class AgentForegroundService : Service() {
         api: AgentApiClient,
         initialTask: cn.ilapage.goauto.agent.network.AgentTask,
         token: String,
+        continuous: Boolean = false,
     ): TaskExecutionSummary {
+        GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         return try {
-            executeTaskWhileAwake(api, initialTask, token)
+            val returnCount = settingsStore.continuousReturnCount()
+            val outcome = executeTaskWhileAwake(api, initialTask, token, continuous)
+            if (!continuous) outcome else {
+                cancelIdleReturn("连续采集保留 PDD 页面")
+                ContinuousCollectionPolicy.finish(continuous, outcome) {
+                    val driver = GoAutoAccessibilityService.instance ?: return@finish false
+                    val navigator = PddCollectionReturnNavigator(driver, driver::openAgentPreservingTab, driver::currentPackage)
+                    val returned = navigator.returnToAgent(returnCount)
+                    runCatching {
+                        val hash = java.security.MessageDigest.getInstance("SHA-256")
+                            .digest(initialTask.ruleSnapshot.toByteArray(Charsets.UTF_8)).joinToString("") { "%02x".format(it) }
+                        Log.i("GoAutoCollector", "task=${initialTask.taskId};attempt=${initialTask.attemptNumber};device=${stateStore.read().deviceId};rule=$hash;continuousReturn=$returned;configuredBacks=$returnCount;reason=${navigator.reason};actions=${navigator.actions}")
+                    }
+                    returned
+                }.also { result ->
+                    if (result.successful) runCatching { stateStore.update("ONLINE", result.message.orEmpty(), tokenStored = true) }
+                }
+            }
         } finally {
             releaseTaskWakeLock()
         }
@@ -621,6 +689,7 @@ class AgentForegroundService : Service() {
         api: AgentApiClient,
         initialTask: cn.ilapage.goauto.agent.network.AgentTask,
         token: String,
+        continuous: Boolean = false,
     ): TaskExecutionSummary {
         var started = initialTask.status == "running"
         var resultSafelySubmitted = false
@@ -727,25 +796,25 @@ class AgentForegroundService : Service() {
                 }
             }
             stateStore.update("ONLINE", "任务 #${task.taskId} 已提交：${result.status}", tokenStored = true)
-            beginPostCollectionCooldowns()
-            TaskExecutionSummary(successful = true)
+            beginPostCollectionCooldowns(returnToAgent = !continuous)
+            TaskExecutionSummary(successful = true, resultStatus = result.status)
         } catch (error: TaskFailure) {
             if (started) {
                 resultSafelySubmitted = failSafely(api, initialTask.taskId, token, error.code, error.message ?: "采集失败")
-                if (resultSafelySubmitted) beginPostCollectionCooldowns()
+                if (resultSafelySubmitted) beginPostCollectionCooldowns(returnToAgent = !continuous)
             }
             TaskExecutionSummary(false, error.code, error.message)
         } catch (error: AgentApiException) {
             if (error.code == "REPLACEMENT_ACTIVATION_FAILED") {
                 resultSafelySubmitted = true
-                beginPostCollectionCooldowns()
+                beginPostCollectionCooldowns(returnToAgent = !continuous)
             }
             stateStore.update("TASK_ERROR", "${error.code}：${error.message}", tokenStored = true)
             TaskExecutionSummary(false, error.code, error.message)
         } catch (error: Exception) {
             if (started) {
                 resultSafelySubmitted = failSafely(api, initialTask.taskId, token, "AGENT_EXECUTION_ERROR", error.message ?: "Android 执行异常")
-                if (resultSafelySubmitted) beginPostCollectionCooldowns()
+                if (resultSafelySubmitted) beginPostCollectionCooldowns(returnToAgent = !continuous)
             }
             TaskExecutionSummary(false, "AGENT_EXECUTION_ERROR", error.message)
         } finally {
@@ -804,8 +873,8 @@ class AgentForegroundService : Service() {
         executor.schedule(::triggerSync, IdleReturnCoordinator.DEFAULT_COOLDOWN_MILLIS, TimeUnit.MILLISECONDS)
     }
 
-    private fun beginPostCollectionCooldowns() {
-        beginIdleReturnCooldown()
+    private fun beginPostCollectionCooldowns(returnToAgent: Boolean = true) {
+        if (returnToAgent) beginIdleReturnCooldown() else cancelIdleReturn("连续采集不自动返回 Agent")
         val ticket = CollectionCooldownPolicy.arm(
             System.currentTimeMillis(),
             settingsStore.collectionIntervalRange(),
@@ -1057,6 +1126,7 @@ class AgentForegroundService : Service() {
         const val MANUAL_EMPTY = "empty"
         const val MANUAL_COLLECTION_TASK = "collection_task"
         const val MANUAL_PURCHASE_TASK = "purchase_task"
+        const val MANUAL_PURCHASE_MATCH_PENDING = "purchase_match_pending"
         const val MANUAL_BUSY = "busy"
         const val MANUAL_CONFIG_REQUIRED = "config_required"
         const val MANUAL_AUTH_ERROR = "auth_error"
@@ -1123,9 +1193,3 @@ class AgentForegroundService : Service() {
 }
 
 private class TaskFailure(val code: String, message: String) : Exception(message)
-
-private data class TaskExecutionSummary(
-    val successful: Boolean,
-    val code: String? = null,
-    val message: String? = null,
-)

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentStateStore.kt

@@ -1,6 +1,7 @@
 package cn.ilapage.goauto.agent.service
 
 import android.content.Context
+import android.content.SharedPreferences
 import cn.ilapage.goauto.agent.BuildConfig
 import cn.ilapage.goauto.agent.network.ServerUrlPolicy
 import kotlin.random.Random
@@ -99,26 +100,52 @@ internal object CollectionCooldownPolicy {
 
 internal enum class TaskDispatchDecision {
     RUN_PURCHASE,
+    WAIT_FOR_PURCHASE_MATCH,
     WAIT_FOR_COLLECTION_COOLDOWN,
     CHECK_COLLECTION,
 }
 
 internal object TaskDispatchPolicy {
-    fun decide(purchaseAvailable: Boolean, collectionCooldownActive: Boolean): TaskDispatchDecision = when {
-        purchaseAvailable -> TaskDispatchDecision.RUN_PURCHASE
+    fun decide(purchaseStatus: String?, collectionCooldownActive: Boolean): TaskDispatchDecision = when {
+        purchaseStatus == "spec_probe_pending" -> TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH
+        purchaseStatus != null -> TaskDispatchDecision.RUN_PURCHASE
         collectionCooldownActive -> TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN
         else -> TaskDispatchDecision.CHECK_COLLECTION
     }
 }
 
-class AgentSettingsStore(context: Context) {
-    private val preferences = context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE)
+class AgentSettingsStore internal constructor(private val preferences: SharedPreferences) {
+    constructor(context: Context) : this(context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE))
 
     fun serverUrl(): String = preferences.getString(SERVER_URL, null)
         ?: BuildConfig.DEFAULT_SERVER_URL.takeIf { it.isNotBlank() }.orEmpty()
 
     fun deviceName(): String = preferences.getString(DEVICE_NAME, "").orEmpty()
 
+    fun continuousCollection(): Boolean = runCatching { preferences.getBoolean(CONTINUOUS_COLLECTION, false) }.getOrDefault(false)
+
+    fun continuousReturnCount(): Int = runCatching {
+        preferences.getInt(CONTINUOUS_RETURN_COUNT, 3).takeIf { it in 1..5 } ?: 3
+    }.getOrDefault(3)
+
+    fun saveContinuousReturnCount(count: Int) {
+        require(count in 1..5) { "返回次数须为 1～5 次" }
+        val previous = continuousReturnCount()
+        if (!preferences.edit().putInt(CONTINUOUS_RETURN_COUNT, count).commit()) {
+            preferences.edit().putInt(CONTINUOUS_RETURN_COUNT, previous).commit()
+            error("返回次数未保存，请重试")
+        }
+    }
+
+    fun saveContinuousCollection(enabled: Boolean) {
+        val previous = continuousCollection()
+        if (!preferences.edit().putBoolean(CONTINUOUS_COLLECTION, enabled).commit()) {
+            // SharedPreferences also updates memory on failed disk commits; restore the displayed value.
+            preferences.edit().putBoolean(CONTINUOUS_COLLECTION, previous).commit()
+            error("连续采集设置未保存，请重试")
+        }
+    }
+
     fun historyDays(): Int = HistoryRangePolicy.stored(preferences.getInt(HISTORY_DAYS, 7))
 
     fun collectionIntervalRange(): CollectionIntervalRange {
@@ -175,6 +202,8 @@ class AgentSettingsStore(context: Context) {
         const val PREFERENCES = "goauto_agent_settings"
         const val SERVER_URL = "server_url"
         const val DEVICE_NAME = "device_name"
+        const val CONTINUOUS_COLLECTION = "continuous_collection"
+        const val CONTINUOUS_RETURN_COUNT = "continuous_collection_return_count"
         const val HISTORY_DAYS = "history_days"
         const val COLLECTION_INTERVAL_SECONDS = "collection_interval_seconds"
         const val COLLECTION_INTERVAL_START_SECONDS = "collection_interval_start_seconds"

android/app/src/main/java/cn/ilapage/goauto/agent/service/ContinuousCollectionPolicy.kt

@@ -0,0 +1,27 @@
+package cn.ilapage.goauto.agent.service
+
+/** Only the foreground, newly requested temporary collection opts in. */
+internal object ContinuousCollectionPolicy {
+    fun applies(enabled: Boolean, source: String, attemptNumber: Int, replacementOrigin: String): Boolean =
+        enabled && source == "agent_current_page" && attemptNumber == 1 && replacementOrigin.isBlank()
+
+    fun shouldReturn(enabledForTask: Boolean, submitted: Boolean, status: String?): Boolean =
+        enabledForTask && submitted && status == "completed"
+
+    fun finish(enabledForTask: Boolean, outcome: TaskExecutionSummary, navigate: () -> Boolean): TaskExecutionSummary {
+        if (!enabledForTask || !outcome.successful) return outcome
+        if (!shouldReturn(enabledForTask, outcome.successful, outcome.resultStatus)) {
+            return outcome.copy(message = "采集部分成功，已保留现场，请查看采集记录。")
+        }
+        val returned = runCatching(navigate).getOrDefault(false)
+        return outcome.copy(message = if (returned) "采集已完成，返回操作已结束，已切回 Agent。"
+            else "采集已完成，自动返回未完成，请手动处理当前页面并打开 Agent。")
+    }
+}
+
+internal data class TaskExecutionSummary(
+    val successful: Boolean,
+    val code: String? = null,
+    val message: String? = null,
+    val resultStatus: String? = null,
+)

android/app/src/main/java/cn/ilapage/goauto/agent/ui/AgentSettingsFragment.kt

@@ -34,6 +34,7 @@ import cn.ilapage.goauto.agent.update.AgentAppUpdateManager
 import cn.ilapage.goauto.agent.update.UpdateCheckResult
 import com.google.android.material.button.MaterialButton
 import com.google.android.material.dialog.MaterialAlertDialogBuilder
+import com.google.android.material.switchmaterial.SwitchMaterial
 import com.google.android.material.textfield.TextInputEditText
 import com.google.android.material.textfield.TextInputLayout
 import java.util.concurrent.Executors
@@ -64,6 +65,10 @@ class AgentSettingsFragment : Fragment() {
     private lateinit var collectionIntervalEndLayout: TextInputLayout
     private lateinit var collectionIntervalEndInput: TextInputEditText
     private lateinit var collectionIntervalFeedback: TextView
+    private lateinit var continuousCollectionSwitch: SwitchMaterial
+    private lateinit var continuousReturnCountButton: MaterialButton
+    private lateinit var continuousCollectionFeedback: TextView
+    private var refreshingContinuousCollection = false
     private lateinit var historyDaysLayout: TextInputLayout
     private lateinit var historyDaysInput: TextInputEditText
     private lateinit var historySyncButton: MaterialButton
@@ -257,6 +262,69 @@ class AgentSettingsFragment : Fragment() {
                 collectionIntervalFeedback.setPadding(0, context.dp(8), 0, 0)
                 addView(collectionIntervalFeedback)
             }))
+            addView(context.card(context.cardColumn().apply {
+                continuousCollectionSwitch = SwitchMaterial(context).apply {
+                    // Use the switch style supplied by our MaterialComponents (M2) theme.
+                    showText = false
+                    textOn = "开启"
+                    textOff = "关闭"
+                    isClickable = true
+                    isFocusable = true
+                    text = "连续采集"
+                    textSize = 18f
+                    setTextColor(context.getColor(R.color.agent_text))
+                    minHeight = context.dp(48)
+                    isChecked = settingsStore.continuousCollection()
+                    setOnCheckedChangeListener { _, enabled ->
+                        if (!refreshingContinuousCollection) {
+                            val current = stateStore.read()
+                            val result = runCatching {
+                                check(current.code != "BUSY" && current.currentTaskId == null) { "任务结束后可修改" }
+                                settingsStore.saveContinuousCollection(enabled)
+                            }
+                            refreshingContinuousCollection = true
+                            isChecked = settingsStore.continuousCollection()
+                            refreshingContinuousCollection = false
+                            continuousCollectionFeedback.text = result.fold(
+                                onSuccess = { "" },
+                                onFailure = { "未保存：${it.message ?: "请重试"}" },
+                            )
+                            continuousCollectionFeedback.visibility = if (continuousCollectionFeedback.text.isEmpty()) View.GONE else View.VISIBLE
+                            refreshContinuousReturnCount()
+                        }
+                    }
+                }
+                addView(continuousCollectionSwitch, fullWidth())
+                continuousReturnCountButton = MaterialButton(context, null, com.google.android.material.R.attr.materialButtonOutlinedStyle).apply {
+                    minHeight = context.dp(48)
+                    setTextColor(context.getColor(R.color.agent_text))
+                    setOnClickListener {
+                        MaterialAlertDialogBuilder(context)
+                            .setTitle("返回次数")
+                            .setSingleChoiceItems(arrayOf("1 次", "2 次", "3 次", "4 次", "5 次"), settingsStore.continuousReturnCount() - 1) { dialog, which ->
+                                val result = runCatching {
+                                    val current = stateStore.read()
+                                    check(current.code != "BUSY" && current.currentTaskId == null) { "任务结束后可修改" }
+                                    check(settingsStore.continuousCollection()) { "请先开启连续采集" }
+                                    settingsStore.saveContinuousReturnCount(which + 1)
+                                }
+                                continuousCollectionFeedback.text = result.fold(onSuccess = { "" }, onFailure = { "未保存：${it.message ?: "请重试"}" })
+                                continuousCollectionFeedback.visibility = if (result.isSuccess) View.GONE else View.VISIBLE
+                                refreshContinuousReturnCount()
+                                dialog.dismiss()
+                            }
+                            .setNegativeButton("取消", null)
+                            .show()
+                    }
+                }
+                addView(continuousReturnCountButton, fullWidth(8))
+                refreshContinuousReturnCount()
+                continuousCollectionFeedback = context.label("", 14f, context.getColor(R.color.agent_text_muted)).apply {
+                    visibility = View.GONE
+                    accessibilityLiveRegion = View.ACCESSIBILITY_LIVE_REGION_POLITE
+                }
+                addView(continuousCollectionFeedback, fullWidth(8))
+            }))
             addView(context.card(context.cardColumn().apply {
                 addView(context.label("任务记录", 18f, context.getColor(R.color.agent_text), true))
                 val syncRow = LinearLayout(context).apply {
@@ -654,11 +722,23 @@ class AgentSettingsFragment : Fragment() {
         return normalizedUrl
     }
 
+    private fun refreshContinuousReturnCount() {
+        val current = stateStore.read()
+        continuousReturnCountButton.text = "返回次数：${settingsStore.continuousReturnCount()} 次"
+        continuousReturnCountButton.visibility = if (settingsStore.continuousCollection()) View.VISIBLE else View.GONE
+        continuousReturnCountButton.isEnabled = current.code != "BUSY" && current.currentTaskId == null
+    }
+
     private fun refreshDiagnostics() {
         if (!isAdded || view == null) return
         val context = requireContext()
         val state = stateStore.read()
         val busy = state.code == "BUSY" || state.currentTaskId != null
+        continuousCollectionSwitch.isEnabled = !busy
+        refreshContinuousReturnCount()
+        if (busy) continuousCollectionFeedback.text = "任务结束后可修改"
+        else if (continuousCollectionFeedback.text == "任务结束后可修改") continuousCollectionFeedback.text = ""
+        continuousCollectionFeedback.visibility = if (continuousCollectionFeedback.text.isEmpty()) View.GONE else View.VISIBLE
         if (busy && updateDownloading) updateCancelled.set(true)
         val editable = SettingsAvailabilityResolver.editable(state.code, state.currentTaskId, testing)
         serverInput.isEnabled = editable

android/app/src/main/java/cn/ilapage/goauto/agent/ui/PurchaseResultBubbleController.kt

@@ -0,0 +1,114 @@
+package cn.ilapage.goauto.agent.ui
+
+import android.content.Context
+import android.graphics.PixelFormat
+import android.graphics.drawable.GradientDrawable
+import android.os.Handler
+import android.os.Looper
+import android.view.Gravity
+import android.view.View
+import android.view.ViewGroup
+import android.view.WindowManager
+import android.widget.LinearLayout
+import android.widget.TextView
+import cn.ilapage.goauto.agent.R
+
+class PurchaseResultBubbleController(
+    private val context: Context,
+    private val canShow: () -> Boolean,
+) {
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private val windowManager = context.getSystemService(WindowManager::class.java)
+    private val session = PurchaseResultBubbleSession()
+    private var bubbleView: View? = null
+
+    fun show(presentation: PurchaseResultBubblePresentation) {
+        val revision = session.replace()
+        mainHandler.post {
+            if (!session.isCurrent(revision)) return@post
+            removeCurrentView()
+            if (!canShow()) return@post
+            val view = buildView(presentation)
+            runCatching { windowManager.addView(view, layoutParams()) }
+                .onSuccess {
+                    bubbleView = view
+                    mainHandler.postDelayed({
+                        if (session.isCurrent(revision)) {
+                            session.dismiss()
+                            removeCurrentView()
+                        }
+                    }, presentation.durationMillis)
+                }
+        }
+    }
+
+    fun dismiss() {
+        session.dismiss()
+        mainHandler.post(::removeCurrentView)
+    }
+
+    private fun buildView(presentation: PurchaseResultBubblePresentation): View {
+        val horizontalPadding = context.dp(16)
+        val verticalPadding = context.dp(12)
+        return LinearLayout(context).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(horizontalPadding, verticalPadding, horizontalPadding, verticalPadding)
+            elevation = context.dp(8).toFloat()
+            background = GradientDrawable().apply {
+                cornerRadius = context.dp(16).toFloat()
+                setColor(context.getColor(if (presentation.isFailure) R.color.purchase_result_failure_background else R.color.purchase_result_success_background))
+            }
+            contentDescription = "${presentation.title}。${presentation.message}"
+            importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_YES
+            descendantFocusability = ViewGroup.FOCUS_BLOCK_DESCENDANTS
+            addView(TextView(context).apply {
+                text = presentation.title
+                setTextColor(context.getColor(R.color.purchase_result_text))
+                textSize = 14f
+                setTypeface(typeface, android.graphics.Typeface.BOLD)
+                maxLines = 2
+                importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_NO
+            }, LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.WRAP_CONTENT))
+            addView(TextView(context).apply {
+                text = presentation.message
+                setTextColor(context.getColor(R.color.purchase_result_text_secondary))
+                textSize = 13f
+                maxLines = 3
+                importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_NO
+            }, LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.WRAP_CONTENT).apply {
+                topMargin = context.dp(4)
+            })
+        }
+    }
+
+    private fun layoutParams(): WindowManager.LayoutParams {
+        val availableWidth = context.resources.displayMetrics.widthPixels - context.dp(32)
+        return WindowManager.LayoutParams(
+            availableWidth.coerceAtMost(context.dp(360)),
+            WindowManager.LayoutParams.WRAP_CONTENT,
+            WindowManager.LayoutParams.TYPE_ACCESSIBILITY_OVERLAY,
+            WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE or
+                WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE or
+                WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL,
+            PixelFormat.TRANSLUCENT,
+        ).apply {
+            gravity = Gravity.TOP or Gravity.CENTER_HORIZONTAL
+            y = context.statusBarHeight() + context.dp(8)
+            windowAnimations = android.R.style.Animation_Toast
+        }
+    }
+
+    private fun removeCurrentView() {
+        val view = bubbleView ?: return
+        bubbleView = null
+        runCatching { windowManager.removeViewImmediate(view) }
+    }
+
+    private fun Context.dp(value: Int): Int = (value * resources.displayMetrics.density).toInt()
+
+    @Suppress("DiscouragedApi")
+    private fun Context.statusBarHeight(): Int {
+        val resourceId = resources.getIdentifier("status_bar_height", "dimen", "android")
+        return if (resourceId > 0) resources.getDimensionPixelSize(resourceId) else dp(24)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/PurchaseResultBubblePolicy.kt

@@ -0,0 +1,86 @@
+package cn.ilapage.goauto.agent.ui
+
+data class PurchaseResultBubblePresentation(
+    val title: String,
+    val message: String,
+    val isFailure: Boolean,
+    val durationMillis: Long,
+)
+
+object PurchaseResultBubblePolicy {
+    const val SUCCESS_DURATION_MILLIS = 3_000L
+    const val FAILURE_DURATION_MILLIS = 8_000L
+    private const val MAX_MESSAGE_LENGTH = 96
+
+    private val stepLabels = mapOf(
+        "started" to "准备采购",
+        "openProduct" to "打开商品",
+        "verifyProduct" to "核对商品",
+        "openSpecPanel" to "打开规格面板",
+        "selectSpec" to "选择颜色与尺码",
+        "setQuantity" to "设置数量",
+        "verifyUnitPrice" to "核对价格",
+        "verifyOrderSummary" to "核对订单",
+        "probeSpecs" to "采集规格",
+        "updateShippingAddress" to "更新收货地址",
+        "createOrder" to "创建待付款订单",
+        "order_submit_started" to "创建待付款订单",
+        "readOrderResult" to "读取订单编号和下单时间",
+    )
+
+    fun create(
+        taskId: Long,
+        resultType: String,
+        lastStep: String?,
+        resultMessage: String?,
+    ): PurchaseResultBubblePresentation? {
+        if (resultType == "spec_probe_completed") return null
+        val failure = resultType == "failed" || resultType == "order_result_unknown"
+        if (failure) {
+            val label = stepLabels[lastStep] ?: "处理采购任务"
+            return PurchaseResultBubblePresentation(
+                title = if (resultType == "order_result_unknown") "CG-$taskId 待人工核对｜$label" else "CG-$taskId 失败于：$label",
+                message = sanitize(resultMessage, "采购失败，请返回 Agent 查看详情"),
+                isFailure = true,
+                durationMillis = FAILURE_DURATION_MILLIS,
+            )
+        }
+        val successMessage = when (resultType) {
+            "order_created" -> "已获取订单编号和下单时间"
+            "rehearsal_completed" -> "商品、规格、数量和价格复核完成"
+            else -> sanitize(resultMessage, "采购结果已安全保存")
+        }
+        return PurchaseResultBubblePresentation(
+            title = "CG-$taskId 采购完成",
+            message = successMessage,
+            isFailure = false,
+            durationMillis = SUCCESS_DURATION_MILLIS,
+        )
+    }
+
+    private fun sanitize(value: String?, fallback: String): String {
+        val normalized = value.orEmpty()
+            .replace(Regex("https?://\\S+", RegexOption.IGNORE_CASE), "[链接已隐藏]")
+            .replace(Regex("(?i)(token|authorization|cookie)\\s*[:=]\\s*\\S+")) { match ->
+                "${match.groupValues[1]}=[已隐藏]"
+            }
+            .replace(Regex("[\\r\\n\\t]+"), " ")
+            .replace(Regex("\\s{2,}"), " ")
+            .trim()
+            .ifBlank { fallback }
+        return normalized.take(MAX_MESSAGE_LENGTH)
+    }
+}
+
+class PurchaseResultBubbleSession {
+    private var revision = 0L
+
+    @Synchronized
+    fun replace(): Long = ++revision
+
+    @Synchronized
+    fun dismiss(): Long = ++revision
+
+    @Synchronized
+    fun isCurrent(candidate: Long): Boolean = candidate == revision
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/TaskHistoryFragment.kt

@@ -36,8 +36,6 @@ import cn.ilapage.goauto.agent.network.HistoryPage
 import cn.ilapage.goauto.agent.network.HistoryColorImage
 import cn.ilapage.goauto.agent.network.PurchaseHistoryDetail
 import cn.ilapage.goauto.agent.network.PurchaseHistoryItem
-import cn.ilapage.goauto.agent.network.PurchaseResetResult
-import cn.ilapage.goauto.agent.network.PurchaseRetryResult
 import cn.ilapage.goauto.agent.persistence.TaskHistoryCache
 import cn.ilapage.goauto.agent.service.AgentForegroundService
 import cn.ilapage.goauto.agent.service.AgentSettingsStore
@@ -85,10 +83,12 @@ internal object CollectionResetPolicy {
 internal object PurchaseRetryPolicy {
     fun showsAction(status: String, retryable: Boolean): Boolean = status == "failed" && retryable
 
+    fun usesInPlaceReset(continuing: Boolean): Boolean = !continuing
+
     fun confirmationMessage(continuing: Boolean = false): String = if (continuing) {
         "替代商品已完成匹配。系统会保留原任务并创建一笔新采购任务；可能创建拼多多待付款订单，但不会支付。"
     } else {
-        "将使用服务端最新采购规则重跑当前任务，任务号和商品、规格、价格快照不变；可能创建拼多多待付款订单，但不会支付。"
+        "系统会复用原采购任务并开始新一次执行，使用当前有效采购规则，商品和规格等任务快照保持不变；可能创建拼多多待付款订单，但不会支付。"
     }
 }
 
@@ -748,7 +748,7 @@ class TaskHistoryFragment : Fragment() {
                 contentDescription = "重试采购任务 CG-${task.taskId}"
                 setOnClickListener { confirmPurchaseRetry(task) }
             }, collectionCardParams())
-            resultColumn.addView(context.centeredMessage("重试边界", "复用当前任务并刷新采购规则；不会执行支付。"))
+            resultColumn.addView(context.centeredMessage("重试边界", "复用当前任务并新增一次执行；使用当前有效采购规则，商品和规格快照不变，不会执行支付。"))
         } else if (!replacementInProgress && task.status == "failed") {
             val reason = task.retryDisabledReason?.takeIf(String::isNotBlank) ?: "请在管理端核对任务状态。"
             resultColumn.addView(context.centeredMessage("不可重试", reason))
@@ -866,22 +866,25 @@ class TaskHistoryFragment : Fragment() {
         val generation = ++requestGeneration
         showLoading(if (continuing) "正在提交继续采购请求…" else "正在提交重试请求…")
         Thread {
-            runCatching {
+            runCatching<Unit> {
                 val client = AgentApiClient(serverUrl)
                 val requestId = UUID.randomUUID().toString()
-                if (continuing) client.retryPurchaseTask(taskId, requestId, credentials.token)
-                else client.resetPurchaseTask(taskId, requestId, credentials.token)
-            }
-                .onSuccess { result ->
+                if (PurchaseRetryPolicy.usesInPlaceReset(continuing)) {
+                    val result = client.resetPurchaseTask(taskId, requestId, credentials.token)
                     resultColumn.post {
                         if (!isAdded || generation != requestGeneration) return@post
                         AgentForegroundService.start(requireContext())
-                        when (result) {
-                            is PurchaseRetryResult -> showPurchaseRetrySuccess(result.sourceTaskNo, result.taskNo, result.taskId)
-                            is PurchaseResetResult -> showPurchaseResetSuccess(result.taskNo, result.taskId, result.attemptNumber)
-                        }
+                        showPurchaseResetSuccess(result.taskNo, result.taskId, result.attemptNumber)
+                    }
+                } else {
+                    val result = client.retryPurchaseTask(taskId, requestId, credentials.token)
+                    resultColumn.post {
+                        if (!isAdded || generation != requestGeneration) return@post
+                        AgentForegroundService.start(requireContext())
+                        showPurchaseRetrySuccess(result.sourceTaskNo, result.taskNo, result.taskId)
                     }
                 }
+            }
                 .onFailure { error ->
                     resultColumn.post {
                         if (isAdded && generation == requestGeneration) {
@@ -892,14 +895,14 @@ class TaskHistoryFragment : Fragment() {
         }.start()
     }
 
-    private fun showPurchaseRetrySuccess(sourceTaskNo: String, taskNo: String, taskId: Long) {
+    private fun showPurchaseResetSuccess(taskNo: String, taskId: Long, attemptNumber: Int) {
         resultColumn.removeAllViews()
         resultColumn.addView(requireContext().centeredMessage(
-            "已创建新任务 $taskNo",
-            "旧任务 $sourceTaskNo 已保留。新任务将由当前设备按正常队列执行；系统不会支付。",
+            "$taskNo 已进入第 $attemptNumber 次执行",
+            "原采购任务已复用，并将由当前设备按正常队列执行；系统不会支付。",
         ))
         resultColumn.addView(MaterialButton(requireContext()).apply {
-            text = "查看新任务"
+            text = "查看当前任务"
             minimumHeight = requireContext().dp(48)
             setOnClickListener { loadPurchaseDetail(taskId) }
         }, collectionCardParams())
@@ -910,14 +913,14 @@ class TaskHistoryFragment : Fragment() {
         }, collectionCardParams())
     }
 
-    private fun showPurchaseResetSuccess(taskNo: String, taskId: Long, attemptNumber: Int) {
+    private fun showPurchaseRetrySuccess(sourceTaskNo: String, taskNo: String, taskId: Long) {
         resultColumn.removeAllViews()
         resultColumn.addView(requireContext().centeredMessage(
-            "已加入重试队列 $taskNo",
-            "任务号保持不变，将使用最新采购规则进行第 $attemptNumber 次尝试；系统不会支付。",
+            "已创建新任务 $taskNo",
+            "旧任务 $sourceTaskNo 已保留。新任务将由当前设备按正常队列执行；系统不会支付。",
         ))
         resultColumn.addView(MaterialButton(requireContext()).apply {
-            text = "查看当前任务"
+            text = "查看新任务"
             minimumHeight = requireContext().dp(48)
             setOnClickListener { loadPurchaseDetail(taskId) }
         }, collectionCardParams())

android/app/src/main/res/values/colors.xml

@@ -8,4 +8,8 @@
     <color name="agent_text_muted">#CBD5E1</color>
     <color name="agent_warning">#FBBF24</color>
     <color name="agent_error">#F87171</color>
+    <color name="purchase_result_success_background">#166534</color>
+    <color name="purchase_result_failure_background">#991B1B</color>
+    <color name="purchase_result_text">#FFFFFF</color>
+    <color name="purchase_result_text_secondary">#F1F5F9</color>
 </resources>

android/app/src/test/java/cn/ilapage/goauto/agent/CollectionCooldownPolicyTest.kt

@@ -86,15 +86,19 @@ class CollectionCooldownPolicyTest {
     fun `purchase keeps priority while collection waits for cooldown`() {
         assertEquals(
             TaskDispatchDecision.RUN_PURCHASE,
-            TaskDispatchPolicy.decide(purchaseAvailable = true, collectionCooldownActive = true),
+            TaskDispatchPolicy.decide(purchaseStatus = "pending", collectionCooldownActive = true),
+        )
+        assertEquals(
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH,
+            TaskDispatchPolicy.decide(purchaseStatus = "spec_probe_pending", collectionCooldownActive = true),
         )
         assertEquals(
             TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN,
-            TaskDispatchPolicy.decide(purchaseAvailable = false, collectionCooldownActive = true),
+            TaskDispatchPolicy.decide(purchaseStatus = null, collectionCooldownActive = true),
         )
         assertEquals(
             TaskDispatchDecision.CHECK_COLLECTION,
-            TaskDispatchPolicy.decide(purchaseAvailable = false, collectionCooldownActive = false),
+            TaskDispatchPolicy.decide(purchaseStatus = null, collectionCooldownActive = false),
         )
     }
 }

android/app/src/test/java/cn/ilapage/goauto/agent/ContinuousCollectionSettingsTest.kt

@@ -0,0 +1,82 @@
+package cn.ilapage.goauto.agent
+
+import android.content.SharedPreferences
+import cn.ilapage.goauto.agent.service.AgentSettingsStore
+import java.lang.reflect.Proxy
+import org.junit.Assert.*
+import org.junit.Test
+
+class ContinuousCollectionSettingsTest {
+    @Test fun `default off persists and survives store recreation`() {
+        val disk = MemoryPreferences()
+        val store = AgentSettingsStore(disk.preferences)
+        assertFalse(store.continuousCollection())
+        store.saveContinuousCollection(true)
+        assertTrue(AgentSettingsStore(disk.preferences).continuousCollection())
+        store.saveContinuousCollection(false)
+        assertFalse(AgentSettingsStore(disk.preferences).continuousCollection())
+    }
+
+    @Test fun `failed disk commit restores previous in memory preference`() {
+        val disk = MemoryPreferences()
+        val store = AgentSettingsStore(disk.preferences)
+        store.saveContinuousCollection(true)
+        disk.failNextCommit = true
+        assertTrue(runCatching { store.saveContinuousCollection(false) }.isFailure)
+        assertTrue(store.continuousCollection())
+        assertTrue(AgentSettingsStore(disk.preferences).continuousCollection())
+    }
+
+    @Test fun `return count defaults three and persists valid bounds`() {
+        val disk = MemoryPreferences()
+        val store = AgentSettingsStore(disk.preferences)
+        assertEquals(3, store.continuousReturnCount())
+        for (count in 1..5) {
+            store.saveContinuousReturnCount(count)
+            assertEquals(count, AgentSettingsStore(disk.preferences).continuousReturnCount())
+        }
+        for (count in listOf(0, 6)) {
+            assertTrue(runCatching { store.saveContinuousReturnCount(count) }.isFailure)
+            assertEquals(5, store.continuousReturnCount())
+        }
+    }
+
+    @Test fun `return count failed write restores previous and invalid stored value defaults`() {
+        val disk = MemoryPreferences()
+        val store = AgentSettingsStore(disk.preferences)
+        store.saveContinuousReturnCount(2)
+        disk.failNextCommit = true
+        assertTrue(runCatching { store.saveContinuousReturnCount(4) }.isFailure)
+        assertEquals(2, AgentSettingsStore(disk.preferences).continuousReturnCount())
+        disk.preferences.edit().putInt("continuous_collection_return_count", 99).commit()
+        assertEquals(3, store.continuousReturnCount())
+    }
+
+    private class MemoryPreferences {
+        private val values = mutableMapOf<String, Any>()
+        var failNextCommit = false
+        val preferences = Proxy.newProxyInstance(SharedPreferences::class.java.classLoader, arrayOf(SharedPreferences::class.java)) { _, method, args ->
+            when (method.name) {
+                "getBoolean", "getInt" -> values[args!![0] as String] ?: args[1]
+                "edit" -> editor()
+                else -> error("Unexpected preference access ${method.name}")
+            }
+        } as SharedPreferences
+
+        private fun editor(): SharedPreferences.Editor {
+            val pending = mutableMapOf<String, Any>()
+            return Proxy.newProxyInstance(SharedPreferences.Editor::class.java.classLoader, arrayOf(SharedPreferences.Editor::class.java)) { proxy, method, args ->
+                when (method.name) {
+                    "putBoolean", "putInt" -> { pending[args!![0] as String] = args[1]; proxy }
+                    "commit" -> {
+                        values.putAll(pending)
+                        val success = !failNextCommit
+                        failNextCommit = false
+                        success
+                    }
+                    else -> error("Unexpected preference edit ${method.name}")
+                }
+            } as SharedPreferences.Editor
+        }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/ContinuousCollectionTest.kt

@@ -0,0 +1,163 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.service.ContinuousCollectionPolicy
+import cn.ilapage.goauto.agent.service.TaskExecutionSummary
+import org.junit.Assert.*
+import org.junit.Test
+
+class ContinuousCollectionTest {
+    private val complete = TaskExecutionSummary(true, resultStatus = "completed")
+
+    @Test fun `only new ordinary temporary collection participates`() {
+        assertTrue(ContinuousCollectionPolicy.applies(true, "agent_current_page", 1, ""))
+        assertFalse(ContinuousCollectionPolicy.applies(false, "agent_current_page", 1, ""))
+        for (source in listOf("admin", "purchase")) assertFalse(ContinuousCollectionPolicy.applies(true, source, 1, ""))
+        assertFalse(ContinuousCollectionPolicy.applies(true, "agent_current_page", 2, ""))
+        for (origin in listOf("collection", "purchase")) assertFalse(ContinuousCollectionPolicy.applies(true, "agent_current_page", 1, origin))
+    }
+
+    @Test fun `only acknowledged complete result can navigate`() {
+        for (status in listOf("completed_partial", "failed", "running", null)) assertFalse(ContinuousCollectionPolicy.shouldReturn(true, true, status))
+        assertFalse(ContinuousCollectionPolicy.shouldReturn(true, false, "completed"))
+        assertFalse(ContinuousCollectionPolicy.shouldReturn(false, true, "completed"))
+        assertTrue(ContinuousCollectionPolicy.shouldReturn(true, true, "completed"))
+    }
+
+    @Test fun `failure partial and disabled never invoke navigation`() {
+        val failed = TaskExecutionSummary(false, "failed", "failure")
+        assertEquals(failed, ContinuousCollectionPolicy.finish(true, failed) { error("unexpected") })
+        assertEquals(complete, ContinuousCollectionPolicy.finish(false, complete) { error("unexpected") })
+        val partial = ContinuousCollectionPolicy.finish(true, complete.copy(resultStatus = "completed_partial")) { error("unexpected") }
+        assertTrue(partial.message!!.contains("保留现场"))
+    }
+
+    @Test fun `navigation failure never rewrites collection success`() {
+        for (navigate in listOf<() -> Boolean>({ false }, { error("failure") })) {
+            val result = ContinuousCollectionPolicy.finish(true, complete, navigate)
+            assertTrue(result.successful)
+            assertEquals(complete.code, result.code)
+            assertEquals("completed", result.resultStatus)
+            assertTrue(result.message!!.contains("手动"))
+        }
+        val success = ContinuousCollectionPolicy.finish(true, complete) { true }
+        assertTrue(success.message!!.contains("已切回 Agent"))
+        assertFalse(success.message!!.contains("首页"))
+    }
+
+    @Test fun `configured counts send exact backs even when page is unchanged`() {
+        for (count in 1..5) {
+            val d = Driver()
+            val waits = mutableListOf<Long>()
+            val navigator = d.navigator { waits += it }
+            assertTrue(navigator.returnToAgent(count))
+            assertEquals(count, d.backs)
+            assertEquals(count, navigator.actions)
+            assertEquals(1, d.opens)
+            assertEquals(List(count + 1) { 500L }, waits)
+            assertEquals("count_completed", navigator.reason)
+        }
+    }
+
+    @Test fun `invalid counts do not navigate`() {
+        for (count in listOf(-1, 0, 6, Int.MAX_VALUE)) {
+            val d = Driver()
+            assertFalse(d.navigator().returnToAgent(count))
+            assertEquals(0, d.backs + d.opens)
+        }
+    }
+
+    @Test fun `leaving pdd stops remaining backs and returns to agent`() {
+        val d = Driver().apply { leaveAfter = 1 }
+        val navigator = d.navigator()
+        assertTrue(navigator.returnToAgent(3))
+        assertEquals(1, d.backs)
+        assertEquals(1, d.opens)
+        assertEquals("left_pdd", navigator.reason)
+    }
+
+    @Test fun `already outside pdd sends no back`() {
+        val d = Driver().apply { pkg = "launcher" }
+        assertTrue(d.navigator().returnToAgent(3))
+        assertEquals(0, d.backs)
+        assertEquals(1, d.opens)
+    }
+
+    @Test fun `back failure stops without retry but can return to agent`() {
+        val d = Driver().apply { backSuccess = false }
+        val navigator = d.navigator()
+        assertTrue(navigator.returnToAgent(3))
+        assertEquals(1, d.backs)
+        assertEquals("back_failed", navigator.reason)
+    }
+
+    @Test fun `risk pages preserve scene including after last back`() {
+        for (after in listOf(0, 1)) {
+            val d = Driver().apply { riskAfter = after }
+            val navigator = d.navigator()
+            assertFalse(navigator.returnToAgent(1))
+            assertEquals(after, d.backs)
+            assertEquals(0, d.opens)
+            assertEquals("unsafe_page", navigator.reason)
+        }
+    }
+
+    @Test fun `switching foreground during capture never sends back to other app`() {
+        val d = Driver().apply { changeDuringCapture = true }
+        assertTrue(d.navigator().returnToAgent(3))
+        assertEquals(0, d.backs)
+    }
+
+    @Test fun `agent launch and foreground confirmation failures are explicit`() {
+        for (launch in listOf(false, true)) {
+            val d = Driver().apply { launchSuccess = launch; confirmAgent = false }
+            val navigator = d.navigator()
+            assertFalse(navigator.returnToAgent(1))
+            assertEquals(if (launch) "agent_not_confirmed" else "agent_launch_failed", navigator.reason)
+        }
+    }
+
+    @Test fun `missing activity or capture exception does not send back`() {
+        for (throws in listOf(false, true)) {
+            val d = Driver().apply { missingActivity = true; throwCapture = throws }
+            assertFalse(d.navigator().returnToAgent(3))
+            assertEquals(0, d.backs + d.opens)
+        }
+    }
+
+    private class Driver : PddCollectorDriver {
+        var pkg = "com.xunmeng.pinduoduo"
+        var backs = 0
+        var opens = 0
+        var leaveAfter = Int.MAX_VALUE
+        var riskAfter = Int.MAX_VALUE
+        var backSuccess = true
+        var launchSuccess = true
+        var confirmAgent = true
+        var missingActivity = false
+        var throwCapture = false
+        var changeDuringCapture = false
+        fun navigator(pause: (Long) -> Unit = {}) = PddCollectionReturnNavigator(this, {
+            opens++
+            if (launchSuccess && confirmAgent) pkg = "cn.ilapage.goauto.agent"
+            launchSuccess
+        }, { pkg }, pause)
+        override fun capture(): UiSnapshot {
+            if (throwCapture) error("capture failed")
+            val snapshot = UiSnapshot(pkg, if (missingActivity) null else "PddActivity", if (backs >= riskAfter) listOf(
+                SnapshotNode("risk", null, "订单详情", null, null, "android.widget.TextView", NodeBounds(0, 0, 100, 100),
+                    false, false, false, false, true, true),
+            ) else emptyList())
+            if (changeDuringCapture) pkg = "launcher"
+            return snapshot
+        }
+        override fun back(): Boolean {
+            backs++
+            if (backs >= leaveAfter) pkg = "launcher"
+            return backSuccess
+        }
+        override fun clickFresh(target: SnapshotNode) = error("must not click page controls")
+        override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?) = error("must not swipe")
+        override fun pullDownGoodsPage() = error("must not pull down")
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PddLaunchFallbackTest.kt

@@ -0,0 +1,25 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.PddLaunchFallback
+import org.junit.Assert.*
+import org.junit.Test
+
+class PddLaunchFallbackTest {
+    @Test fun directSuccessDoesNotStartBrowser() {
+        assertTrue(PddLaunchFallback.open(true, { true }, { error("browser must not start") }))
+    }
+    @Test fun missingHandlerFallsBackOnce() {
+        var browserCalls = 0
+        assertTrue(PddLaunchFallback.open(true, { throw IllegalStateException("no handler") }, { browserCalls++; true }))
+        assertEquals(1, browserCalls)
+    }
+    @Test fun rejectedDirectLaunchFallsBack() {
+        assertTrue(PddLaunchFallback.open(true, { false }, { true }))
+        assertFalse(PddLaunchFallback.open(true, { false }, { false }))
+    }
+    @Test fun collectionKeepsBrowserEntry() {
+        var directCalls = 0
+        assertTrue(PddLaunchFallback.open(false, { directCalls++; true }, { true }))
+        assertEquals(0, directCalls)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PddProductDetailCollectorTest.kt

@@ -11,6 +11,7 @@ import cn.ilapage.goauto.agent.automation.PddCollectorConfig
 import cn.ilapage.goauto.agent.automation.PddCollectorDriver
 import cn.ilapage.goauto.agent.automation.PddProductDetailCollector
 import cn.ilapage.goauto.agent.automation.PddScreenParser
+import cn.ilapage.goauto.agent.automation.PurchasePanelContext
 import cn.ilapage.goauto.agent.automation.SnapshotNode
 import cn.ilapage.goauto.agent.automation.SpecPanelType
 import cn.ilapage.goauto.agent.automation.SwipeDirection
@@ -26,6 +27,122 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PddProductDetailCollectorTest {
+    @Test fun `purchase entry can recognize one heading only with combined structure`() {
+        val snapshot = singleDimensionPanel()
+        assertFalse(PddScreenParser.parse(snapshot, config(), GOODS_ID, null).specPanelOpen)
+        assertEquals(SpecPanelType.NORMAL_SCROLLABLE,
+            PddScreenParser.parse(snapshot, config(), GOODS_ID, null, purchaseEntryContext = true).specPanelType)
+        for (missing in listOf("close", "plus", "minus", "info/quantity", "payment", "submit", "scroll/color-title", "scroll/color")) {
+            val changed = snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == missing })
+            assertFalse(missing, PddScreenParser.parse(changed, config(), GOODS_ID, null, purchaseEntryContext = true).specPanelOpen)
+        }
+        assertFalse(PddScreenParser.parse(snapshot.copy(packageName = "other"), config(), GOODS_ID, null, purchaseEntryContext = true).specPanelOpen)
+        assertFalse(PddScreenParser.parse(snapshot.copy(activityName = null), config(), GOODS_ID, null, purchaseEntryContext = true).specPanelOpen)
+        assertFalse(PddScreenParser.parse(snapshot, config(), "", null, purchaseEntryContext = true).specPanelOpen)
+    }
+
+    private fun singleDimensionPanel(): UiSnapshot {
+        val snapshot = prefixlessPanel()
+        return snapshot.copy(nodes = snapshot.nodes.filterNot {
+            it.path.startsWith("scroll/size") || it.path == "info/summary"
+        }.map {
+            if (it.path == "root") it.copy(resourceId = "android:id/content", className = "android.widget.FrameLayout") else it
+        })
+    }
+
+    @Test fun `single dimension without summary is recognized only during collection`() {
+        for (heading in listOf("颜色分类", "尺码")) {
+            val snapshot = singleDimensionPanel().let { original ->
+                original.copy(nodes = original.nodes.map {
+                    if (it.path == "scroll/color-title") it.copy(text = heading) else it
+                })
+            }
+            assertFalse(PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence()).specPanelOpen)
+            val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence(), collectionContext = true)
+            assertEquals(SpecPanelType.NORMAL_SCROLLABLE, parsed.specPanelType)
+            assertEquals("scroll", parsed.specPanelContainer?.path)
+            assertEquals(1, parsed.dimensions.size)
+            assertEquals(null, parsed.selectedSummary)
+            assertFalse(parsed.hasSelectionSummary)
+        }
+    }
+
+    @Test fun `single dimension collection requires all structural and page evidence`() {
+        val snapshot = singleDimensionPanel()
+        for (missing in listOf("close", "plus", "minus", "info/quantity", "payment", "submit", "scroll/color-title", "scroll/color", "root")) {
+            val changed = snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == missing })
+            assertFalse(missing, PddScreenParser.parse(changed, config(), GOODS_ID, evidence(), collectionContext = true).specPanelOpen)
+        }
+        val secondScroll = node("other-scroll", "", 0, 500, 1080, 700, scrollable = true)
+        val secondSubmit = node("other-submit", "提交订单", 10, 2200, 300, 2300, clickable = true)
+        for (changed in listOf(
+            snapshot.copy(nodes = snapshot.nodes + secondScroll),
+            snapshot.copy(nodes = snapshot.nodes + secondSubmit),
+            snapshot.copy(packageName = "example.other"),
+            snapshot.copy(activityName = "example.OtherActivity"),
+            snapshot.copy(nodes = snapshot.nodes + node("captcha", "请完成安全验证", 0, 0, 600, 100)),
+        )) {
+            assertFalse(PddScreenParser.parse(changed, config(), GOODS_ID, evidence(), collectionContext = true).specPanelOpen)
+        }
+        assertFalse(PddScreenParser.parse(snapshot, config(), GOODS_ID, null, collectionContext = true).specPanelOpen)
+    }
+
+    private fun prefixlessPanel(): UiSnapshot = UiSnapshot(PDD_PACKAGE, ACTIVITY, listOf(
+        node("root", "", 0, 0, 1080, 2376),
+        node("close", "关闭", 970, 270, 1050, 350, clickable = true),
+        node("info", "", 0, 770, 1080, 1157),
+        node("info/summary", "米白色（有里布） 2XL 建议131到150斤", 396, 878, 1053, 992, parentPath = "info"),
+        node("info/quantity", "1", 480, 1046, 561, 1121, className = "android.widget.EditText", parentPath = "info"),
+        node("minus", "减少数量", 396, 1046, 470, 1121, clickable = true),
+        node("plus", "增加数量", 570, 1046, 645, 1121, clickable = true),
+        node("scroll", "", 0, 1294, 1080, 2079, scrollable = true),
+        node("scroll/color-title", "颜色分类", 36, 1319, 216, 1380, parentPath = "scroll"),
+        node("scroll/color", "米白色（有里布）", 36, 1405, 352, 1808, clickable = true, selected = true, parentPath = "scroll"),
+        node("scroll/size-title", "尺码", 36, 1858, 126, 1911, parentPath = "scroll"),
+        node("scroll/size", "XL 建议111到130斤", 36, 1930, 440, 2015, clickable = true, parentPath = "scroll"),
+        node("payment", "微信支付", 112, 2100, 929, 2157),
+        node("submit", "提交订单", 375, 2225, 705, 2284, clickable = true),
+    ))
+
+    @Test fun `prefixless selected panel retains structural recognition and product summary`() {
+        val parsed = PddScreenParser.parse(prefixlessPanel(), config(), GOODS_ID, evidence())
+        assertEquals(SpecPanelType.NORMAL_SCROLLABLE, parsed.specPanelType)
+        assertEquals("米白色（有里布） 2XL 建议131到150斤", parsed.selectedSummary)
+    }
+
+    @Test fun `prefixless panel requires quantity and order evidence`() {
+        for (missing in listOf("plus", "submit", "payment")) {
+            val snapshot = prefixlessPanel()
+            val parsed = PddScreenParser.parse(snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == missing }), config(), GOODS_ID, evidence())
+            assertFalse(parsed.specPanelOpen)
+            assertEquals(null, parsed.selectedSummary)
+        }
+    }
+
+    @Test fun `ambiguous product summaries are not used`() {
+        val snapshot = prefixlessPanel()
+        val extra = node("info/other", "米白色（有里布） XL 建议111到130斤", 396, 800, 1053, 870, parentPath = "info")
+        val parsed = PddScreenParser.parse(snapshot.copy(nodes = snapshot.nodes + extra), config(), GOODS_ID, evidence())
+        assertEquals(null, parsed.selectedSummary)
+    }
+
+    @Test fun `scrolling away color heading and options preserves known purchase panel and summary`() {
+        val initial = prefixlessPanel()
+        val opened = PddScreenParser.parse(initial, config(), GOODS_ID, evidence())
+        val context = PurchasePanelContext(requireNotNull(opened.specPanelContainer), "米白色（有里布）")
+        val scrolled = initial.copy(nodes = initial.nodes.filterNot { it.path.startsWith("scroll/color") })
+        val continued = PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence(), context)
+        assertEquals(1, continued.panelHeadingCount)
+        assertTrue(continued.specPanelOpen)
+        assertEquals("米白色（有里布） 2XL 建议131到150斤", continued.selectedSummary)
+        assertTrue(continued.dimensions.none { it.key == "color" })
+        assertFalse(PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence()).specPanelOpen)
+        assertFalse(PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence(),
+            context.copy(container = context.container.copy(path = "other"))).specPanelOpen)
+        assertFalse(PddScreenParser.parse(scrolled.copy(nodes = scrolled.nodes.filterNot { it.path == "submit" }),
+            config(), GOODS_ID, evidence(), context).specPanelOpen)
+    }
+
     @Test
     fun `parser removes only trailing size price and keeps raw evidence`() {
         val snapshot = UiSnapshot(
@@ -367,6 +484,64 @@ class PddProductDetailCollectorTest {
         assertEquals("bottom_purchase", parsed.specEntrySource)
     }
 
+    @Test
+    fun bottomPurchaseEntriesPreferRightmostCandidate() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("buy-left", "单独购买", 446, 2000, 685, 2160, clickable = true),
+                node("buy-right", "发起拼单", 685, 2000, 1080, 2160, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("buy-right", parsed.specEntry?.path)
+        assertEquals("buy-right", parsed.specEntryClickTarget?.path)
+        assertEquals("bottom_purchase_rightmost", parsed.specEntrySource)
+        assertEquals(2, parsed.bottomPurchaseEntryCount)
+    }
+
+    @Test
+    fun equallyRightmostBottomPurchaseEntriesPreferSmallerArea() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("buy-large", "发起拼单", 685, 2000, 1080, 2160, clickable = true),
+                node("buy-small", "立即购买", 785, 2000, 980, 2140, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("buy-small", parsed.specEntry?.path)
+        assertEquals("bottom_purchase_rightmost", parsed.specEntrySource)
+    }
+
+    @Test
+    fun bottomPurchaseCandidatesStillExcludeReviewOrderAndPaymentContexts() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("reviews", "商品评价", 446, 1900, 685, 2160, clickable = true),
+                node("reviews/buy", "购买", 480, 2000, 650, 2100, parentPath = "reviews"),
+                node("order", "购买并提交订单", 685, 2000, 880, 2160, clickable = true),
+                node("payment", "购买后立即支付", 880, 2000, 1080, 2160, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals(null, parsed.specEntry)
+        assertEquals(0, parsed.bottomPurchaseEntryCount)
+    }
+
     @Test
     fun bottomPurchaseInsideReviewCardIsNeverSpecEntry() {
         val snapshot = UiSnapshot(
@@ -571,6 +746,74 @@ class PddProductDetailCollectorTest {
         assertTrue(parsed.dimensions.isEmpty())
     }
 
+    @Test
+    fun nonScrollableSelectorWithTwoDimensionsDoesNotRequireInitialSelectedSummary() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("color-heading", "颜色", 20, 420, 300, 470),
+                node("color", "豹纹", 20, 490, 300, 550, clickable = true),
+                node("size-heading", "尺码", 20, 650, 300, 700),
+                node("size", "均码", 20, 720, 300, 780, clickable = true),
+                node("quantity", "1", 480, 1400, 600, 1480, className = "android.widget.EditText"),
+                node("decrease", "减少数量", 360, 1400, 470, 1480, clickable = true),
+                node("increase", "增加数量", 610, 1400, 720, 1480, clickable = true),
+                node("order", "提交订单", 20, 1900, 1060, 2100, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertTrue(parsed.specPanelOpen)
+        assertEquals(SpecPanelType.NON_SCROLLABLE_CONFIRMATION, parsed.specPanelType)
+        assertFalse(parsed.hasSelectionSummary)
+        assertEquals(2, parsed.dimensions.size)
+        assertEquals(2, parsed.panelOptionCount)
+    }
+
+    @Test
+    fun nestedSelectionRowCombinesPrefixAndDimensionBeforeChoosingClickableParent() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("selection-row", "", 20, 720, 1060, 860, clickable = true),
+                node("selection-row/prefix", "请选择", 48, 750, 220, 810, parentPath = "selection-row"),
+                node("selection-row/dimension", "颜色分类", 240, 750, 480, 810, parentPath = "selection-row"),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("selection-row", parsed.specEntry?.path)
+        assertEquals("selection-row", parsed.specEntryClickTarget?.path)
+        assertEquals("nested_selection", parsed.specEntrySource)
+        assertEquals(1, parsed.nestedSpecEntryCount)
+    }
+
+    @Test
+    fun nestedSelectionSemanticsNeverAcceptsOrderOrPaymentContainer() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("unsafe", "", 20, 720, 1060, 860, clickable = true),
+                node("unsafe/prefix", "请选择", 48, 750, 220, 810, parentPath = "unsafe"),
+                node("unsafe/dimension", "颜色", 240, 750, 480, 810, parentPath = "unsafe"),
+                node("unsafe/order", "提交订单", 700, 750, 1020, 810, parentPath = "unsafe"),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals(null, parsed.specEntry)
+        assertEquals(0, parsed.nestedSpecEntryCount)
+    }
+
     @Test
     fun genericQuantityAndBuyControlsDoNotProveQuickConfirmation() {
         val snapshot = UiSnapshot(

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseLiveAutomationTest.kt

@@ -1,6 +1,8 @@
 package cn.ilapage.goauto.agent
 
 import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.FreshClickOutcome
+import cn.ilapage.goauto.agent.automation.FreshClickReason
 import cn.ilapage.goauto.agent.automation.NodeBounds
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
 import cn.ilapage.goauto.agent.automation.PurchaseLiveAutomation
@@ -16,6 +18,288 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PurchaseLiveAutomationTest {
+    @Test fun `address editor waits for loaded unique stable input after one second transitions`() {
+        val driver = LiveDriver()
+        var polls = 0
+        driver.editTransform = { snapshot ->
+            polls++
+            when (polls) {
+                1 -> snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == "editor-address" })
+                2 -> snapshot.copy(nodes = snapshot.nodes.map { if (it.path == "editor-address") it.copy(text = "") else it })
+                else -> snapshot
+            }
+        }
+        val pauses = mutableListOf<Long>()
+        PurchaseLiveAutomation(driver, pause = { pauses += it }).updateShippingAddress("_cg81")
+        assertTrue(polls >= 4)
+        assertEquals("editor-address", driver.lastInputTargetPath)
+        assertEquals(4, pauses.count { it == 1_000L })
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test fun `persistently ambiguous address editors never receive input`() {
+        val driver = LiveDriver()
+        driver.editTransform = { snapshot -> snapshot.copy(nodes = snapshot.nodes + snapshot.nodes.single { it.path == "editor-address" }.copy(path = "duplicate-editor")) }
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg81") }.exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_ADDRESS_UPDATE_FAILED", error.code)
+        assertTrue(error.message!!.contains("candidates=2"))
+        assertEquals(null, driver.lastInputTargetPath)
+        assertFalse(driver.clicked.contains("保存地址"))
+    }
+
+    @Test
+    fun `non scrollable saved panel waits for late address nodes without back or swipe`() {
+        val driver = LiveDriver(savedStructuredFooter = "复购价，")
+        var polls = 0
+        driver.structuredTransform = { s ->
+            polls++
+            s.copy(nodes = s.nodes.filterNot {
+                it.path.startsWith("root/popup/specs") ||
+                    (polls < 8 && it.path.startsWith("root/popup/address"))
+            })
+        }
+        val logs = mutableListOf<String>()
+        val automation = PurchaseLiveAutomation(driver, pause = {}, diagnostic = logs::add)
+        val proof = automation.updateShippingAddress("_cg81")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), proof)
+        assertTrue(polls >= 9)
+        assertEquals(0, driver.scopedSwipes)
+        assertEquals(0, driver.backCount)
+        assertEquals(0, driver.submitClicks)
+        assertTrue(logs.any { it.contains("savedAddressMatched=true") && it.contains("savedScrollCandidates=0") })
+        assertFalse(logs.any { it.contains("_cg81") || it.contains("138") })
+    }
+
+    @Test
+    fun `saved address recognizes split dynamic footer outside spec scroller without a swipe`() {
+        for (label in listOf("复购价，", "专享优惠，")) {
+            val driver = LiveDriver(savedStructuredFooter = label)
+            val automation = PurchaseLiveAutomation(driver, pause = {})
+            val proof = automation.updateShippingAddress("_cg81")
+            automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), proof)
+            automation.submitOrderOnce()
+            assertEquals(1, driver.submitClicks)
+            assertEquals(0, driver.scopedSwipes)
+            assertEquals(0, driver.backCount)
+            assertTrue(driver.clicked.contains(label))
+            assertEquals("PURCHASE_SUBMIT_ALREADY_ATTEMPTED",
+                (runCatching { automation.submitOrderOnce() }.exceptionOrNull() as PurchaseLiveException).code)
+        }
+    }
+
+    @Test
+    fun `one back from address transition can recognize dynamic footer`() {
+        val driver = LiveDriver(savedStructuredFooter = "复购价，", savedTransitionWithoutLegacyContext = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val proof = automation.updateShippingAddress("_cg81")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), proof)
+        assertEquals(1, driver.backCount)
+        assertEquals(0, driver.scopedSwipes)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `saved address with missing ambiguous price only or payment footer reports button failure without scrolling`() {
+        val mutations: List<(UiSnapshot) -> UiSnapshot> = listOf(
+            { s -> s.copy(nodes = s.nodes.filterNot { it.path.startsWith("root/popup/footer") }) },
+            { s -> s.copy(nodes = s.nodes + s.nodes.filter { it.path.startsWith("root/popup/footer") }.map {
+                it.copy(path = it.path.replace("footer", "second-footer"), parentPath = it.parentPath?.replace("footer", "second-footer"))
+            }) },
+            { s -> s.copy(nodes = s.nodes.filterNot { it.path == "root/popup/footer/label" }) },
+            { s -> s.copy(nodes = s.nodes.map { if (it.path == "root/popup/footer") it.copy(clickable = false) else it }) },
+            { s -> s.copy(nodes = s.nodes.map { if (it.path == "root/popup/footer/label") it.copy(text = "去付款") else it }) },
+            { s -> s.copy(nodes = s.nodes.map { if (it.path == "root/popup/footer") it.copy(enabled = false) else it }) },
+        )
+        for (mutation in mutations) {
+            val driver = LiveDriver(savedStructuredFooter = "复购价，")
+            driver.structuredTransform = mutation
+            val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg81") }
+                .exceptionOrNull() as PurchaseLiveException
+            assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error.code)
+            assertEquals(0, driver.scopedSwipes)
+            assertEquals(0, driver.backCount)
+            assertEquals(0, driver.submitClicks)
+        }
+    }
+
+    @Test
+    fun `legacy submit labels retain priority over structure`() {
+        for (label in listOf("提交订单", "现在买，仅20元", "确认购买")) {
+            val driver = LiveDriver(savedStructuredFooter = label)
+            val automation = PurchaseLiveAutomation(driver, pause = {})
+            val proof = automation.updateShippingAddress("_cg81")
+            automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), proof)
+            automation.submitOrderOnce()
+            assertEquals(1, driver.submitClicks)
+            assertEquals(0, driver.scopedSwipes)
+        }
+    }
+
+    @Test
+    fun `structural footer cannot bypass final spec quantity price or address verification`() {
+        val cases = listOf(
+            input().copy(mappedColor = "白色") to "PURCHASE_SPEC_NOT_MATCHED",
+            input().copy(quantity = 3) to "PURCHASE_QUANTITY_MISMATCH",
+            input().copy(maxUnitPriceCent = 100) to "PURCHASE_PRICE_OUT_OF_RANGE",
+        )
+        for ((request, code) in cases) {
+            val driver = LiveDriver(savedStructuredFooter = "复购价，")
+            val automation = PurchaseLiveAutomation(driver, pause = {})
+            val proof = automation.updateShippingAddress("_cg81")
+            val error = runCatching { automation.finalConfirmation(request.copy(addressSuffix = "_cg81"), proof) }
+                .exceptionOrNull() as PurchaseLiveException
+            assertEquals(code, error.code)
+            assertEquals(0, driver.submitClicks)
+        }
+        val driver = LiveDriver(savedStructuredFooter = "复购价，")
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val proof = automation.updateShippingAddress("_cg81")
+        driver.structuredTransform = { s -> s.copy(nodes = s.nodes.filterNot { it.path.endsWith("/address/detail") }) }
+        assertEquals("PURCHASE_ADDRESS_UPDATE_FAILED",
+            (runCatching { automation.finalConfirmation(input(), proof) }.exceptionOrNull() as PurchaseLiveException).code)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `structural footer needs this execution saved address and unchanged page at submission`() {
+        val driver = LiveDriver(savedStructuredFooter = "复购价，")
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val proof = automation.updateShippingAddress("_cg81")
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS",
+            (runCatching { automation.submitOrderOnce() }.exceptionOrNull() as PurchaseLiveException).code)
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS",
+            (runCatching { PurchaseLiveAutomation(driver, pause = {}).finalConfirmation(input(), proof) }
+                .exceptionOrNull() as PurchaseLiveException).code)
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), proof)
+        driver.structuredTransform = { s -> s.copy(nodes = s.nodes.map {
+            if (it.path.endsWith("footer/label")) it.copy(text = "另一操作") else it
+        }) }
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS",
+            (runCatching { automation.submitOrderOnce() }.exceptionOrNull() as PurchaseLiveException).code)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `footer duplicate text nodes remain one action and external overlays are not candidates`() {
+        val driver = LiveDriver(savedStructuredFooter = "复购价，")
+        driver.structuredTransform = { s -> s.copy(nodes = s.nodes + listOf(
+            s.nodes.first { it.path == "root/popup/footer/label" }.copy(
+                path = "root/popup/footer/duplicate-label", bounds = NodeBounds(760, 2203, 950, 2262)),
+            s.nodes.first { it.path == "root/popup/footer" }.copy(path = "root/overlay", parentPath = "root", text = "悬浮按钮"),
+        )) }
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val proof = automation.updateShippingAddress("_cg81")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), proof)
+        automation.submitOrderOnce()
+        assertEquals(1, driver.submitClicks)
+        assertFalse(driver.clicked.contains("悬浮按钮"))
+    }
+
+    @Test
+    fun `failed revalidation clears structural submit authorization`() {
+        val driver = LiveDriver(savedStructuredFooter = "复购价，")
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val proof = automation.updateShippingAddress("_cg81")
+        automation.finalConfirmation(input(), proof)
+        assertTrue(runCatching { automation.finalConfirmation(input().copy(quantity = 3), proof) }.isFailure)
+        assertTrue(runCatching { automation.submitOrderOnce() }.isFailure)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `address alone full page ancestor and order or payment pages cannot authorize structural footer`() {
+        val mutations: List<(UiSnapshot) -> UiSnapshot> = listOf(
+            { s -> s.copy(nodes = s.nodes.filterNot { it.path.endsWith("/quantity") || it.path.endsWith("/selected") }) },
+            { s -> s.copy(nodes = s.nodes.map { if (it.path == "root/popup") it.copy(bounds = NodeBounds(0, 0, 1080, 2354)) else it }) },
+            { s -> s.copy(activityName = "com.xunmeng.pinduoduo.app_pay.core.PayActivity") },
+            { s -> s.copy(packageName = "example.other") },
+            { s -> s.copy(nodes = s.nodes.map { if (it.path.endsWith("/selected")) it.copy(text = "订单详情") else it }) },
+        )
+        for (mutation in mutations) {
+            val driver = LiveDriver(savedStructuredFooter = "复购价，")
+            val automation = PurchaseLiveAutomation(driver, pause = {})
+            val proof = automation.updateShippingAddress("_cg81")
+            driver.structuredTransform = mutation
+            assertTrue(runCatching { automation.finalConfirmation(input(), proof) }.isFailure)
+            assertEquals(0, driver.submitClicks)
+        }
+    }
+
+    @Test
+    fun `verified spec panel advances through one exact confirm target`() {
+        val driver = SpecConfirmationDriver()
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation()
+
+        assertEquals(listOf("确定"), driver.clicked)
+        assertEquals("order", driver.page)
+    }
+
+    @Test
+    fun `ambiguous missing and unchanged spec confirmation stop safely`() {
+        val ambiguous = SpecConfirmationDriver(confirmLabels = listOf("确定", "确认"))
+        val ambiguousError = runCatching { PurchaseLiveAutomation(ambiguous, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", ambiguousError.code)
+        assertTrue(ambiguous.clicked.isEmpty())
+
+        val missing = SpecConfirmationDriver(confirmLabels = emptyList(), specPanelScrollable = true)
+        val missingError = runCatching { PurchaseLiveAutomation(missing, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRM_TARGET_MISSING", missingError.code)
+        assertTrue(missing.clicked.isEmpty())
+
+        val unchanged = SpecConfirmationDriver(advanceAfterClick = false)
+        val unchangedError = runCatching { PurchaseLiveAutomation(unchanged, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_UNCONFIRMED", unchangedError.code)
+        assertEquals(listOf("确定"), unchanged.clicked)
+    }
+
+    @Test
+    fun `existing order confirmation does not click submit or payment controls`() {
+        val driver = SpecConfirmationDriver(startOnOrderPage = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation()
+
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `recorded exact selections allow one unique confirm on an unclassified pdd panel`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation(
+            allowUnclassifiedPanelWithSelectionProof = true,
+        )
+
+        assertEquals(listOf("确定"), driver.clicked)
+        assertEquals("order", driver.page)
+    }
+
+    @Test
+    fun `unclassified pdd panel without recorded selections remains blocked`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `recorded selections never authorize a generic unclassified pdd dialog`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true, unclassifiedHasPurchaseEvidence = false)
+        val error = runCatching {
+            PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation(
+                allowUnclassifiedPanelWithSelectionProof = true,
+            )
+        }.exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
     @Test
     fun `address is retagged verified and final order button can only be clicked once`() {
         val driver = LiveDriver()
@@ -64,6 +348,97 @@ class PurchaseLiveAutomationTest {
         assertEquals(0, driver.submitClicks)
     }
 
+    @Test
+    fun `saved address back into short spec panel restores without aspect ratio restriction`() {
+        val driver = LiveDriver(savedTransitionWithoutLegacyContext = true, backReturnsToSpecPanel = true,
+            savedPanelBounds = NodeBounds(0, 400, 1080, 1325))
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg81")
+
+        assertEquals("_cg81", automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), address).addressSuffix)
+        assertEquals(1, driver.backCount)
+        assertEquals(1, driver.scopedSwipes)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `short saved spec panel still stops when unchanged`() {
+        val driver = LiveDriver(saveReturnsToSpecPanel = true, savedSpecPanelRecoveryStuck = true,
+            savedPanelBounds = NodeBounds(0, 400, 1080, 1325))
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg81") }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertEquals(0, driver.backCount)
+        assertTrue(driver.scopedSwipes in 1..5)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `missing and duplicate saved panel scroll regions fail distinctly without gestures`() {
+        for (count in listOf(0, 2)) {
+            val driver = LiveDriver(saveReturnsToSpecPanel = true, savedPanelScrollCount = count)
+            val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg81") }
+                .exceptionOrNull() as PurchaseLiveException
+            assertEquals("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", error.code)
+            assertTrue(error.message.orEmpty().contains(if (count == 0) "未找到可用" else "找到多个"))
+            assertEquals(0, driver.scopedSwipes)
+            assertEquals(0, driver.submitClicks)
+        }
+    }
+
+    @Test
+    fun `saved address back into spec panel restores final evidence with one back`() {
+        val driver = LiveDriver(savedTransitionWithoutLegacyContext = true, backReturnsToSpecPanel = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+
+        val address = automation.updateShippingAddress("_cg81")
+        val final = automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), address)
+
+        assertEquals("_cg81", final.addressSuffix)
+        assertEquals(1, driver.backCount)
+        assertEquals(1, driver.scopedSwipes)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `saved address back into stuck spec panel fails without another back or submit`() {
+        val driver = LiveDriver(savedTransitionWithoutLegacyContext = true, backReturnsToSpecPanel = true,
+            savedSpecPanelRecoveryStuck = true)
+
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg81") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertEquals(1, driver.backCount)
+        assertTrue(driver.scopedSwipes in 1..5)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `saved address returning to spec panel is recovered without pressing back`() {
+        val driver = LiveDriver(saveReturnsToSpecPanel = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+
+        val address = automation.updateShippingAddress("_cg91")
+        val final = automation.finalConfirmation(input().copy(addressSuffix = "_cg91"), address)
+
+        assertEquals("_cg91", final.addressSuffix)
+        assertEquals(0, driver.backCount)
+        assertEquals(1, driver.scopedSwipes)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `saved address stuck on spec panel fails without backing out or submitting`() {
+        val driver = LiveDriver(saveReturnsToSpecPanel = true, savedSpecPanelRecoveryStuck = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg92") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertEquals(0, driver.backCount)
+        assertEquals(0, driver.submitClicks)
+    }
+
     @Test
     fun `edit field containing suffix cannot impersonate post save evidence`() {
         val driver = LiveDriver(saveStaysInEdit = true)
@@ -120,6 +495,122 @@ class PurchaseLiveAutomationTest {
         assertFalse(driver.clicked.any { it.startsWith("微信") || it.contains("支付") })
     }
 
+    @Test
+    fun `payment page returns to folded unpaid order detail and scrolls to read evidence`() {
+        val driver = LiveDriver(chooserAfterSubmit = true, orderEvidenceBelowFold = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg54")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg54"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(2, driver.postSubmitBackCount)
+        assertEquals(1, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `successful order page enters the unique order detail before reading the result`() {
+        val driver = LiveDriver(orderDetailEntryAfterSubmit = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg56")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg56"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(1, driver.orderDetailEntryClicks)
+        assertEquals("order", driver.currentPage)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `order detail entered from success page scrolls only to reveal folded result evidence`() {
+        val driver = LiveDriver(orderDetailEntryAfterSubmit = true, orderDetailEvidenceBelowFold = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg58")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg58"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(1, driver.orderDetailEntryClicks)
+        assertEquals(1, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `unpaid order evidence on reused payment activity scrolls read only instead of backing out`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = listOf("order-folded-payment-activity"))
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg59")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg59"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(0, driver.postSubmitBackCount)
+        assertEquals(1, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `ambiguous order detail entries stop without navigating`() {
+        val driver = LiveDriver(orderDetailEntryAfterSubmit = true, duplicateOrderDetailEntry = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg57")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg57"), address)
+        automation.submitOrderOnce()
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals("PURCHASE_ORDER_DETAIL_ENTRY_AMBIGUOUS", automation.lastOrderReadFailure?.code)
+        assertEquals(0, driver.orderDetailEntryClicks)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `payment transition frame after safe back reaches unpaid order evidence without payment clicks`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = listOf("payment", "payment", "order"))
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg55")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg55"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals("2026-08-21T02:30:00Z", order?.submittedAt)
+        assertEquals(1, driver.postSubmitBackCount)
+        assertEquals(0, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `continuous payment activity still stops at bounded post back samples without payment clicks`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = List(4) { "payment" })
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg55")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg55"), address)
+        automation.submitOrderOnce()
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals("PURCHASE_ORDER_PAYMENT_REPEATED", automation.lastOrderReadFailure?.code)
+        assertEquals(
+            "支付页安全返回后持续无订单证据，已停止自动核单" +
+                "[paymentBackAttempts=1;consecutivePaymentSamplesAfterBack=3]",
+            automation.lastOrderReadFailure?.message,
+        )
+        assertEquals(4, driver.postSubmitCaptureCount)
+        assertEquals(1, driver.postSubmitBackCount)
+        assertEquals(0, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
     @Test
     fun `WeChat login is not touched and PDD is restored once before reading order detail`() {
         val driver = LiveDriver(wechatLoginAfterSubmit = true)
@@ -283,6 +774,52 @@ class PurchaseLiveAutomationTest {
         assertTrue(driver.clicked.isEmpty())
     }
 
+    @Test
+    fun `duplicate masked phone nodes in one clickable address card are activated once`() {
+        val driver = LiveDriver(duplicatePhoneNodesSameCard = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94")
+
+        assertEquals(1, driver.clicked.count { it == "138****5678" })
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `duplicate semantic address cards in separate accessibility trees are activated once`() {
+        val driver = LiveDriver(duplicateSemanticAddressCards = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94")
+
+        assertEquals(1, driver.addressPathClicks)
+        assertEquals(1, driver.clicked.count { it == "138****5678" })
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `two independent address cards remain ambiguous without any click`() {
+        val driver = LiveDriver(duplicateAddressCards = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg95") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", error.code)
+        assertTrue(error.message.orEmpty().contains("phoneNodes=2;addressCards=2;tapTargets=2"))
+        assertFalse(error.message.orEmpty().contains("138"))
+        assertTrue(driver.clicked.isEmpty())
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `address entry path drift fails without fallback tap`() {
+        val driver = LiveDriver(duplicatePhoneNodesSameCard = true, addressEntryPathUnavailable = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_ENTRY_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+        assertEquals(1, driver.addressPathClicks)
+        assertEquals(0, driver.addressTaps)
+    }
+
     private fun input() = PurchaseExecutionInput(
         taskId = 11,
         executionMode = "live",
@@ -297,6 +834,78 @@ class PurchaseLiveAutomationTest {
         addressSuffix = "_cg11",
     )
 
+    private class SpecConfirmationDriver(
+        private val confirmLabels: List<String> = listOf("确定"),
+        private val advanceAfterClick: Boolean = true,
+        private val specPanelScrollable: Boolean = false,
+        private val unclassifiedSpecPanel: Boolean = false,
+        private val unclassifiedHasPurchaseEvidence: Boolean = true,
+        startOnOrderPage: Boolean = false,
+    ) : PurchaseUiDriver {
+        var page = if (startOnOrderPage) "order" else "spec"
+        val clicked = mutableListOf<String>()
+
+        override fun capture(): UiSnapshot = if (page == "order") {
+            snapshot(listOf(
+                node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)),
+                node("scroll", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 2100)),
+                node("summary", "已选 黑色 均码"),
+                node("quantity", "1", className = "android.widget.EditText"),
+                node("phone", "138****5678"),
+                node("submit", "提交订单", clickable = true),
+                node("payment", "微信支付"),
+            ))
+        } else {
+            snapshot(buildList {
+                add(node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)))
+                if (unclassifiedSpecPanel) {
+                    if (unclassifiedHasPurchaseEvidence) {
+                        add(node("price", "¥20.00"))
+                        add(node("quantity", "1", className = "android.widget.EditText"))
+                    }
+                    confirmLabels.forEachIndexed { index, label -> add(node("confirm-$index", label, clickable = true)) }
+                    return@buildList
+                }
+                if (specPanelScrollable) {
+                    add(node("scroll", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 1500)))
+                }
+                add(node("title", "确认款式"))
+                add(node("summary", "已选 黑色 均码"))
+                val parent = "scroll".takeIf { specPanelScrollable }
+                val prefix = if (specPanelScrollable) "scroll/" else ""
+                add(node("${prefix}color-heading", "颜色分类", parentPath = parent))
+                add(node("${prefix}color", "黑色", clickable = true, parentPath = parent))
+                add(node("${prefix}size-heading", "尺码", parentPath = parent))
+                add(node("${prefix}size", "均码", clickable = true, parentPath = parent))
+                add(node("quantity", "1", className = "android.widget.EditText"))
+                confirmLabels.forEachIndexed { index, label -> add(node("confirm-$index", label, clickable = true)) }
+            })
+        }
+
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicked += target.label
+            if (advanceAfterClick && target.label in confirmLabels) page = "order"
+            return FreshActionResult.SUCCESS
+        }
+
+        override fun tapPurchaseFresh(target: SnapshotNode) = FreshActionResult.FAILED
+        override fun inputFresh(target: SnapshotNode, value: String) = FreshActionResult.FAILED
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long) = false
+        override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long) = false
+        override fun backPurchase() = false
+
+        private fun snapshot(nodes: List<SnapshotNode>) = UiSnapshot(PDD, ACTIVITY, nodes)
+        private fun node(
+            path: String,
+            text: String,
+            clickable: Boolean = false,
+            scrollable: Boolean = false,
+            className: String = "android.widget.TextView",
+            bounds: NodeBounds = NodeBounds(20, 100, 900, 180),
+            parentPath: String? = null,
+        ) = SnapshotNode(path, parentPath, text, null, null, className, bounds, clickable, scrollable, false, false, true, true)
+    }
+
     private class LiveDriver(
         private val addressClipped: Boolean = false,
         private val duplicatePanels: Boolean = false,
@@ -308,8 +917,22 @@ class PurchaseLiveAutomationTest {
         private val saveStaysInEdit: Boolean = false,
         private val savedTransitionWithoutLegacyContext: Boolean = false,
         private val savedTransitionHidesSuffix: Boolean = false,
+        private val saveReturnsToSpecPanel: Boolean = false,
+        private val backReturnsToSpecPanel: Boolean = false,
+        private val savedPanelBounds: NodeBounds = NodeBounds(0, 400, 1080, 2100),
+        private val savedPanelScrollCount: Int = 1,
+        private val savedSpecPanelRecoveryStuck: Boolean = false,
+        private val savedStructuredFooter: String? = null,
+        private val duplicatePhoneNodesSameCard: Boolean = false,
+        private val duplicateSemanticAddressCards: Boolean = false,
+        private val duplicateAddressCards: Boolean = false,
+        private val addressEntryPathUnavailable: Boolean = false,
         private val wechatLoginAfterSubmit: Boolean = false,
         private val wechatRestoreStuck: Boolean = false,
+        private val orderEvidenceBelowFold: Boolean = false,
+        private val orderDetailEntryAfterSubmit: Boolean = false,
+        private val orderDetailEvidenceBelowFold: Boolean = false,
+        private val duplicateOrderDetailEntry: Boolean = false,
         postSubmitCaptureSequence: List<String> = emptyList(),
     ) : PurchaseUiDriver {
         private var page = "confirmation"
@@ -322,22 +945,42 @@ class PurchaseLiveAutomationTest {
         var scopedSwipes = 0
         var genericSwipes = 0
         var addressTaps = 0
+        var addressPathClicks = 0
         var lastInputTargetPath: String? = null
         var backCount = 0
         var postSubmitBackCount = 0
         var pddRestoreCount = 0
+        var orderDetailEntryClicks = 0
         var postSubmitCaptureCount = 0
         val currentPage: String get() = page
+        var structuredTransform: (UiSnapshot) -> UiSnapshot = { it }
+        var editTransform: (UiSnapshot) -> UiSnapshot = { it }
 
         override fun capture(): UiSnapshot {
             if (submitClicks > 0) {
                 postSubmitCaptureCount++
                 if (pendingPostSubmitPages.isNotEmpty()) page = pendingPostSubmitPages.removeAt(0)
             }
-            return currentSnapshot()
+            return currentSnapshot().let { if (page == "structured") structuredTransform(it) else if (page == "edit") editTransform(it) else it }
         }
 
         private fun currentSnapshot(): UiSnapshot = when (page) {
+            "structured" -> snapshot(listOf(
+                node("root", "", bounds = NodeBounds(0, 0, 1080, 2354)),
+                node("root/popup", "", clickable = true, parentPath = "root", bounds = NodeBounds(0, 366, 1080, 2306)),
+                node("root/popup/address", "", clickable = true, parentPath = "root/popup", bounds = NodeBounds(0, 400, 1080, 530)),
+                node("root/popup/address/phone", "138****5678", parentPath = "root/popup/address", bounds = NodeBounds(30, 400, 400, 450)),
+                node("root/popup/address/detail", address, parentPath = "root/popup/address", bounds = NodeBounds(30, 456, 1000, 505)),
+                node("root/popup/price", "¥20.00", parentPath = "root/popup", bounds = NodeBounds(396, 620, 700, 690)),
+                node("root/popup/selected", "已选 黑色 XL", parentPath = "root/popup", bounds = NodeBounds(396, 731, 1053, 845)),
+                node("root/popup/quantity", "2", className = "android.widget.EditText", parentPath = "root/popup", bounds = NodeBounds(462, 881, 540, 959)),
+                node("root/popup/specs", "", scrollable = true, className = "androidx.recyclerview.widget.RecyclerView", parentPath = "root/popup", bounds = NodeBounds(0, 1132, 1080, 2057)),
+                node("root/popup/specs/color", "颜色分类", parentPath = "root/popup/specs", bounds = NodeBounds(36, 1157, 287, 1218)),
+                node("root/popup/payment-method", "微信支付", clickable = true, parentPath = "root/popup", bounds = NodeBounds(0, 2057, 1080, 2156)),
+                node("root/popup/footer", "", clickable = true, className = "android.widget.FrameLayout", parentPath = "root/popup", bounds = NodeBounds(0, 2159, 1080, 2306)),
+                node("root/popup/footer/label", requireNotNull(savedStructuredFooter), parentPath = "root/popup/footer", bounds = NodeBounds(353, 2203, 557, 2262)),
+                node("root/popup/footer/amount", "20.00元", parentPath = "root/popup/footer", bounds = NodeBounds(557, 2203, 727, 2262)),
+            ))
             "panel" -> snapshot(listOf(
                 node("title", "收货地址"),
                 node("modify-parent", "", clickable = true),
@@ -358,8 +1001,37 @@ class PurchaseLiveAutomationTest {
                 node("transition-title", "选择收货信息"),
                 node("address-summary", if (savedTransitionHidesSuffix) "已保存的收货信息" else address.substring(address.lastIndexOf("_cg"))),
             ))
+            "post-save-spec" -> snapshot(listOf(
+                node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)),
+                node("panel", "", scrollable = true, bounds = savedPanelBounds),
+                node("panel-title", "确认款式", bounds = NodeBounds(20, 396, 300, 430)),
+                node("panel/price", "¥20.00", parentPath = "panel", bounds = NodeBounds(20, 460, 300, 520)),
+                node("panel/selected", "已选 黑色 XL", parentPath = "panel", bounds = NodeBounds(20, 540, 700, 600)),
+                node("panel/color-heading", "颜色分类", parentPath = "panel", bounds = NodeBounds(20, 650, 300, 700)),
+                node("panel/color", "黑色", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 720, 220, 790)),
+                node("panel/size-heading", "尺码", parentPath = "panel", bounds = NodeBounds(20, 850, 300, 900)),
+                node("panel/size", "XL", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 920, 220, 990)),
+                node("panel/quantity", "2", className = "android.widget.EditText", parentPath = "panel", bounds = NodeBounds(400, 1050, 600, 1120)),
+                node("panel/confirm", "确定", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 1200, 500, 1280)),
+                node("submit-parent", "", clickable = true, bounds = NodeBounds(20, 1900, 1000, 2100)),
+                node("submit", "提交订单", parentPath = "submit-parent", bounds = NodeBounds(520, 1940, 980, 2040)),
+            ).map { if (it.path == "panel" && savedPanelScrollCount == 0) it.copy(enabled = false) else it } +
+                if (savedPanelScrollCount > 1) listOf(node("panel/duplicate", "", scrollable = true, bounds = savedPanelBounds, parentPath = "panel")) else emptyList())
             "order" -> snapshot(listOf(node("status", "待付款"), node("order", "订单号：PDD-202608210001"), node("time", "下单时间：2026-08-21 10:30:00"), node("pay", "立即支付", clickable = true)))
+            "order-folded" -> snapshot(listOf(node("status", "待付款"), node("pay", "立即支付", clickable = true)))
+            "order-folded-payment-activity" -> UiSnapshot(PDD, "com.xunmeng.pinduoduo.app_pay.core.PayActivity", listOf(
+                node("status", "待付款"), node("pay", "立即支付", clickable = true),
+            ))
             "order-no-time" -> snapshot(listOf(node("status", "待付款"), node("order", "订单号：PDD-202608210001"), node("pay", "去支付", clickable = true)))
+            "success" -> snapshot(buildList {
+                add(node("success-title", "购买成功"))
+                add(node("detail-parent", "", clickable = true))
+                add(node("detail", "查看订单", parentPath = "detail-parent"))
+                if (duplicateOrderDetailEntry) {
+                    add(node("detail-parent-2", "", clickable = true))
+                    add(node("detail-2", "订单详情", parentPath = "detail-parent-2"))
+                }
+            })
             "chooser" -> UiSnapshot(if (trustedChooser) "android" else "example.untrusted", "com.android.internal.app.ChooserActivity", listOf(
                 node("chooser-title", "选择要使用的应用"), node("wechat-1", "微信"), node("wechat-2", "微信分身"),
             ))
@@ -378,7 +1050,30 @@ class PurchaseLiveAutomationTest {
                 )
                 if (duplicatePanels) nodes += node("panel2", "", scrollable = true, bounds = NodeBounds(0, 500, 1080, 2000))
                 if (addressVisible) {
-                    nodes += node("phone", "138****5678")
+                    when {
+                        duplicateSemanticAddressCards -> {
+                            nodes += node("address-layer-a", "", clickable = true, bounds = NodeBounds(0, 620, 1080, 840))
+                            nodes += node("address-layer-a/phone", "138****5678", parentPath = "address-layer-a", bounds = NodeBounds(20, 650, 400, 710))
+                            nodes += node("address-layer-a/detail", "广东省广州市天园街道骏景花园", parentPath = "address-layer-a", bounds = NodeBounds(20, 720, 900, 790))
+                            nodes += node("address-layer-b", "", clickable = true, bounds = NodeBounds(0, 900, 1080, 1120))
+                            nodes += node("address-layer-b/phone", "138****5678", parentPath = "address-layer-b", bounds = NodeBounds(20, 930, 400, 990))
+                            nodes += node("address-layer-b/detail", "广东省广州市天园街道骏景花园", parentPath = "address-layer-b", bounds = NodeBounds(20, 1000, 900, 1070))
+                        }
+                        duplicateAddressCards -> {
+                            nodes += node("address-card-a", "", clickable = true, bounds = NodeBounds(0, 620, 1080, 820))
+                            nodes += node("address-card-a/phone", "138****5678", parentPath = "address-card-a", bounds = NodeBounds(20, 650, 400, 710))
+                            nodes += node("address-card-a/detail", "广东省广州市天园街道一号", parentPath = "address-card-a", bounds = NodeBounds(20, 720, 900, 780))
+                            nodes += node("address-card-b", "", clickable = true, bounds = NodeBounds(0, 840, 1080, 1040))
+                            nodes += node("address-card-b/phone", "138****5678", parentPath = "address-card-b", bounds = NodeBounds(20, 870, 400, 930))
+                            nodes += node("address-card-b/detail", "广东省广州市天园街道二号", parentPath = "address-card-b", bounds = NodeBounds(20, 940, 900, 1000))
+                        }
+                        duplicatePhoneNodesSameCard -> {
+                            nodes += node("address-card", "", clickable = true, bounds = NodeBounds(0, 620, 1080, 900))
+                            nodes += node("address-card/phone-a", "138****5678", parentPath = "address-card", bounds = NodeBounds(20, 650, 400, 710))
+                            nodes += node("address-card/phone-b", "138****5678", parentPath = "address-card", bounds = NodeBounds(20, 720, 440, 790))
+                        }
+                        else -> nodes += node("phone", "138****5678")
+                    }
                     val suffixStart = address.lastIndexOf("_cg")
                     val addressBody = if (suffixStart >= 0) address.substring(0, suffixStart) else address
                     val addressSuffix = if (suffixStart >= 0) address.substring(suffixStart) else ""
@@ -400,22 +1095,47 @@ class PurchaseLiveAutomationTest {
 
         override fun clickFresh(target: SnapshotNode): FreshActionResult {
             clicked += target.label
+            if (target.path == "root/popup/footer/label") {
+                submitClicks++
+                page = "order"
+                return FreshActionResult.SUCCESS
+            }
             when (target.label) {
                 "138****5678" -> page = "panel"
                 "修改" -> page = "edit"
-                "保存" -> if (!saveStaysInEdit) page = if (savedTransitionWithoutLegacyContext) "saved-transition" else "panel"
+                "保存" -> if (!saveStaysInEdit) {
+                    page = when {
+                        saveReturnsToSpecPanel -> "post-save-spec"
+                        savedTransitionWithoutLegacyContext -> "saved-transition"
+                        savedStructuredFooter != null -> "structured"
+                        else -> "panel"
+                    }
+                }
                 "提交订单" -> {
                     submitClicks++
                     page = when {
                         chooserAfterSubmit -> "chooser"
                         wechatLoginAfterSubmit -> "wechat-login"
+                        orderDetailEntryAfterSubmit -> "success"
                         else -> "order"
                     }
                 }
+                "查看订单", "订单详情" -> {
+                    orderDetailEntryClicks++
+                    page = if (orderDetailEvidenceBelowFold) "order-folded" else "order"
+                }
             }
             return FreshActionResult.SUCCESS
         }
 
+        override fun clickAddressEntryFresh(target: SnapshotNode): FreshClickOutcome {
+            addressPathClicks++
+            if (addressEntryPathUnavailable) {
+                return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+            }
+            return FreshClickOutcome(clickFresh(target), FreshClickReason.SUCCESS, 1, 1)
+        }
+
         override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult {
             addressTaps++
             clicked += target.label
@@ -428,10 +1148,15 @@ class PurchaseLiveAutomationTest {
             address = value
             return FreshActionResult.SUCCESS
         }
-        override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean { genericSwipes++; return true }
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean {
+            genericSwipes++
+            if (page in setOf("order-folded", "order-folded-payment-activity") && direction == SwipeDirection.UP) page = "order"
+            return true
+        }
         override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
             scopedSwipes++
             if (target.path == "panel" && direction == SwipeDirection.DOWN) addressVisible = true
+            if (page == "post-save-spec" && direction == SwipeDirection.DOWN && !savedSpecPanelRecoveryStuck) page = "confirmation"
             return true
         }
         override fun backPurchase(): Boolean {
@@ -439,7 +1164,8 @@ class PurchaseLiveAutomationTest {
             if (page == "chooser" || page == "payment") postSubmitBackCount++
             page = when (page) {
                 "chooser" -> "payment"
-                "payment" -> "order"
+                "payment" -> if (orderEvidenceBelowFold) "order-folded" else "order"
+                "saved-transition" -> if (savedStructuredFooter != null) "structured" else if (backReturnsToSpecPanel) "post-save-spec" else "confirmation"
                 else -> "confirmation"
             }
             return true

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseResultBubblePolicyTest.kt

@@ -0,0 +1,72 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePolicy
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubbleSession
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PurchaseResultBubblePolicyTest {
+    @Test
+    fun `spec probe does not display a final result bubble`() {
+        assertNull(PurchaseResultBubblePolicy.create(69, "spec_probe_completed", "probeSpecs", "规格已回传"))
+    }
+
+    @Test
+    fun `failure includes the real step and sanitized reason for eight seconds`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            69,
+            "failed",
+            "selectSpec",
+            "没有找到精确规格\n请重试 token=secret-value",
+        ))
+
+        assertEquals("CG-69 失败于：选择颜色与尺码", result.title)
+        assertEquals("没有找到精确规格 请重试 token=[已隐藏]", result.message)
+        assertTrue(result.isFailure)
+        assertEquals(8_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `unknown order result is presented as a failure requiring manual check`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            70,
+            "order_result_unknown",
+            "readOrderResult",
+            "无法确认订单是否创建，请人工检查",
+        ))
+
+        assertEquals("CG-70 待人工核对｜读取订单编号和下单时间", result.title)
+        assertTrue(result.isFailure)
+        assertEquals(8_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `successful order uses a short factual summary for three seconds`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            71,
+            "order_created",
+            "readOrderResult",
+            "ignored",
+        ))
+
+        assertEquals("CG-71 采购完成", result.title)
+        assertEquals("已获取订单编号和下单时间", result.message)
+        assertFalse(result.isFailure)
+        assertEquals(3_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `new result and dismiss invalidate an older scheduled bubble`() {
+        val session = PurchaseResultBubbleSession()
+        val first = session.replace()
+        val second = session.replace()
+        assertFalse(session.isCurrent(first))
+        assertTrue(session.isCurrent(second))
+
+        session.dismiss()
+        assertFalse(session.isCurrent(second))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseRetryPolicyTest.kt

@@ -16,18 +16,22 @@ class PurchaseRetryPolicyTest {
     }
 
     @Test
-    fun `retry confirmation explains same task latest rule and no payment`() {
+    fun `ordinary retry uses same task new attempt and no payment`() {
         val message = PurchaseRetryPolicy.confirmationMessage()
-        assertTrue(message.contains("当前任务"))
-        assertTrue(message.contains("最新采购规则"))
-        assertFalse(message.contains("新采购任务"))
+        assertTrue(PurchaseRetryPolicy.usesInPlaceReset(continuing = false))
+        assertTrue(message.contains("复用原采购任务"))
+        assertTrue(message.contains("新一次执行"))
+        assertTrue(message.contains("当前有效采购规则"))
+        assertTrue(message.contains("任务快照保持不变"))
         assertTrue(message.contains("待付款订单"))
         assertTrue(message.contains("不会支付"))
+        assertFalse(message.contains("新采购任务"))
     }
 
     @Test
     fun `continue confirmation remains a new purchase task`() {
         val message = PurchaseRetryPolicy.confirmationMessage(continuing = true)
+        assertFalse(PurchaseRetryPolicy.usesInPlaceReset(continuing = true))
         assertTrue(message.contains("新采购任务"))
         assertTrue(message.contains("替代商品"))
         assertTrue(message.contains("不会支付"))

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseScrollLocatorTest.kt

@@ -0,0 +1,39 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.NodeBounds
+import cn.ilapage.goauto.agent.automation.PurchaseScrollCandidate
+import cn.ilapage.goauto.agent.automation.PurchaseScrollLocator
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class PurchaseScrollLocatorTest {
+    private val outer = PurchaseScrollCandidate("0/1", "RecyclerView", NodeBounds(0, 1038, 1080, 2079))
+    private val inner = PurchaseScrollCandidate("0/1/0", "RecyclerView", NodeBounds(36, 1149, 1080, 2007))
+
+    @Test fun nestedContainersWithNearbyCentersResolveOuter() {
+        assertEquals(outer, PurchaseScrollLocator.locate(outer, listOf(inner, outer)))
+    }
+
+    @Test fun pathDisambiguatesIdenticalBounds() {
+        val nested = outer.copy(path = "0/1/0")
+        assertEquals(outer, PurchaseScrollLocator.locate(outer, listOf(nested, outer)))
+    }
+
+    @Test fun changedPathRequiresUniqueFullBoundsMatch() {
+        val moved = outer.copy(path = "0/2")
+        assertEquals(moved, PurchaseScrollLocator.locate(outer, listOf(inner, moved)))
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(moved, moved.copy(path = "0/3"))))
+    }
+
+    @Test fun reusedPathWithDifferentGeometryIsRejected() {
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(inner.copy(path = outer.path))))
+    }
+
+    @Test fun classAndAllEdgesAreValidated() {
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(outer.copy(className = "ScrollView"))))
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(
+            outer.copy(bounds = NodeBounds(0, 1138, 1080, 1979)),
+        )))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/SelectedColorCardTest.kt

@@ -0,0 +1,47 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import org.junit.Assert.*
+import org.junit.Test
+
+class SelectedColorCardTest {
+    private val target = "黑色两件套 19"
+    private fun node(path: String, parent: String?, label: String, kind: String, selected: Boolean = true,
+                     scrollable: Boolean = false) = SnapshotNode(path, parent, label, null, null, kind,
+        NodeBounds(0, 0, 300, 400), !scrollable, scrollable, selected, false, true, true)
+    private val scroll = node("s", null, "", "androidx.recyclerview.widget.RecyclerView", false, true)
+    private val card = node("s/c", "s", "黑色两件套 199", "android.view.ViewGroup")
+    private val image = node("s/c/i", "s/c", "黑色两件套 199", "android.widget.ImageView")
+    private val text = node("s/c/t", "s/c", target, "android.widget.TextView")
+    private fun check(nodes: List<SnapshotNode>, candidates: List<SnapshotNode> = nodes.filter { it != scroll }) =
+        SelectedColorCard.confirms(target, candidates.map { VisibleSpecValue(it.label, true, it) }, nodes)
+
+    @Test fun `selected target and own card image duplicates are one selection`() {
+        assertTrue(check(listOf(scroll, card, image, text)))
+    }
+    @Test fun `another selected card remains conflict`() {
+        val other = card.copy(path = "s/other")
+        assertFalse(check(listOf(scroll, card, image, text, other)))
+    }
+    @Test fun `two exact targets are not merged`() {
+        val otherCard = card.copy(path = "s/other", selected = false)
+        val otherText = text.copy(path = "s/other/t", parentPath = otherCard.path)
+        assertFalse(check(listOf(scroll, card, image, text, otherCard, otherText)))
+        assertFalse(check(listOf(scroll, card, image, text, otherCard, otherText), listOf(card, image, text)))
+    }
+    @Test fun `unselected target cannot borrow selection from its container`() {
+        assertFalse(check(listOf(scroll, card, image, text.copy(selected = false))))
+    }
+    @Test fun `scrollable or missing card boundary cannot merge`() {
+        assertFalse(check(listOf(scroll, card.copy(scrollable = true), image, text)))
+        assertFalse(check(listOf(card, image, text)))
+        assertFalse(check(listOf(scroll, card.copy(clickable = false), image, text)))
+    }
+    @Test fun `different text sibling is not treated as image duplicate`() {
+        assertFalse(check(listOf(scroll, card, text, image.copy(className = "android.widget.TextView"))))
+    }
+    @Test fun `out of card bounds and parent cycle are rejected`() {
+        assertFalse(check(listOf(scroll, card, image.copy(bounds = NodeBounds(0, 0, 301, 400)), text)))
+        assertFalse(check(listOf(scroll, card.copy(parentPath = text.path), image, text)))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/persistence/PurchaseDiagnosticStoreTest.kt

@@ -0,0 +1,92 @@
+package cn.ilapage.goauto.agent.persistence
+
+import java.io.File
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TemporaryFolder
+
+class PurchaseDiagnosticStoreTest {
+    @get:Rule val temporary = TemporaryFolder()
+    private val context = PurchaseDiagnosticContext(81, "attempt-14", 7, "a".repeat(64), "0.9.67", "purchase")
+
+    @Test fun `only known structural fields and fixed values survive`() {
+        val output = PurchaseDiagnosticStore.sanitize(
+            "entryClick=SUCCESS;entryRecovery=rejected;reason=title_changed;summary=false;options=20;" +
+                "title=敏感标题;address=测试地址;token=secret;entrySource=private-value;gesture=private-value;" +
+                "quantity=private-value;scrollables=-1;unknown=private-value",
+        )
+        assertEquals(5, output.length())
+        assertEquals("title_changed", output.getString("reason"))
+        assertFalse(output.getBoolean("summary"))
+        assertFalse(output.toString().contains("private"))
+        assertFalse(output.toString().contains("secret"))
+        assertEquals(0, PurchaseDiagnosticStore.sanitize("reason=测试地址;entryReason=secret").length())
+    }
+
+    @Test fun `events persist across store recreation with identity and elapsed time`() {
+        val dir = temporary.newFolder()
+        assertTrue(PurchaseDiagnosticStore(dir) { 1000 }.record(context, 2300,
+            "entryRecovery=rejected;reason=close_control;entryWaitPolls=30;entryWaitMillis=2900;closeControl=true"))
+        assertTrue(PurchaseDiagnosticStore(dir) { 2000 }.record(context, 2500, "entryClick=SUCCESS"))
+        val lines = dir.listFiles()!!.single().readLines()
+        assertEquals(2, lines.size)
+        val entry = JSONObject(lines.first())
+        assertEquals(81, entry.getLong("taskId"))
+        assertEquals("attempt-14", entry.getString("attemptId"))
+        assertEquals(7, entry.getLong("deviceId"))
+        assertEquals(context.ruleHash, entry.getString("ruleHash"))
+        assertEquals(2300, entry.getLong("elapsedMs"))
+        assertEquals("0.9.67", entry.getString("agentVersion"))
+        assertEquals("close_control", entry.getJSONObject("evidence").getString("reason"))
+    }
+
+    @Test fun `saved confirmation diagnostics retain only bounded scalars`() {
+        val fields = PurchaseDiagnosticStore.sanitize("savedAddressMatched=false;savedPanelMatched=true;" +
+            "savedLegacySubmitCandidates=0;savedAddressCards=1;savedAddressTargets=1;" +
+            "savedScrollCandidates=0;savedConfirmationPolls=50;savedAddress=secret;" +
+            "savedAddressMatched=secret;savedScrollCandidates=-1")
+        assertEquals(7, fields.length())
+        assertFalse(fields.getBoolean("savedAddressMatched"))
+        assertEquals(50, fields.getInt("savedConfirmationPolls"))
+        assertFalse(fields.toString().contains("secret"))
+    }
+
+    @Test fun `retains last five attempts and last 128 events including failure`() {
+        val dir = temporary.newFolder()
+        var time = 1000L
+        val store = PurchaseDiagnosticStore(dir) { time++ }
+        repeat(7) { store.record(context.copy(attemptId = "attempt-$it"), 0, "event=started") }
+        assertEquals(5, dir.listFiles()!!.size)
+        assertFalse(File(dir, "81_attempt-0.jsonl").exists())
+        repeat(150) { store.record(context, it.toLong(), "entryWaitPolls=$it") }
+        store.record(context, 999, "entryRecovery=rejected;reason=entry_label_changed")
+        val lines = File(dir, "81_attempt-14.jsonl").readLines()
+        assertEquals(128, lines.size)
+        assertEquals("entry_label_changed", JSONObject(lines.last()).getJSONObject("evidence").getString("reason"))
+        assertEquals(5, dir.listFiles()!!.size)
+    }
+
+    @Test fun `expiry deletes only owned files and can run at startup`() {
+        val dir = temporary.newFolder()
+        PurchaseDiagnosticStore(dir) { 1000 }.record(context, 0, "event=started")
+        File(dir, "unrelated.txt").writeText("preserve")
+        File(dir, "unrelated.txt").setLastModified(1000)
+        PurchaseDiagnosticStore(dir) { PurchaseDiagnosticStore.RETENTION_MS + 1001 }.prune()
+        assertEquals(listOf("unrelated.txt"), dir.listFiles()!!.map { it.name })
+    }
+
+    @Test fun `invalid context and filesystem failures never throw`() {
+        val store = PurchaseDiagnosticStore(temporary.newFile())
+        assertFalse(store.record(context, 1, "event=started"))
+        store.prune()
+        val dir = temporary.newFolder()
+        val validStore = PurchaseDiagnosticStore(dir)
+        assertFalse(validStore.record(context.copy(attemptId = "../outside"), 1, "event=started"))
+        assertFalse(validStore.record(context.copy(ruleHash = "secret"), 1, "event=started"))
+        assertFalse(validStore.record(context.copy(phase = "secret"), 1, "event=started"))
+        assertFalse(validStore.record(context, 1, "unknown=secret"))
+        assertTrue(dir.listFiles()!!.isEmpty())
+    }
+}

dev_scripts/harness.py

@@ -67,7 +67,6 @@ CORE_DOCUMENT_REQUIREMENTS = {
     ),
     "docs/00-project-profile.md": (
         "## 基本信息",
-        "## 项目治理模式",
         "## 建设基线",
         "## 交付单元",
         "## 文档事实来源",
@@ -75,7 +74,6 @@ CORE_DOCUMENT_REQUIREMENTS = {
         "## 当前阶段",
     ),
     "docs/01-workflow.md": (
-        "## 语言与术语",
         "## 事实来源",
         "## 权威源与事实边界",
         "## Gitea 交互与工单最小读取",
@@ -104,7 +102,6 @@ CORE_DOCUMENT_REQUIREMENTS = {
     ),
     "docs/04-local-development-and-verification.md": (
         "## Windows PowerShell 与 UTF-8",
-        "### PowerShell 语法与外部命令",
         "## 通用检查",
         "## 服务端验证",
         "## Web 验证",
@@ -274,14 +271,9 @@ def check_agent_efficiency_rules(errors: list[str], root: Path = ROOT) -> None:
         "#### 明确停止条件",
         "单元任务是唯一正式实施单位",
         "高风险修改必须停止",
-        "### 项目治理模式与明确授权后的执行",
-        "默认采用轻量治理",
-        "不能单独构成人工授权",
-        "不得仅因操作不可逆而重复询问或拒绝",
-        "平台自身强制的审批、安全策略或权限限制继续有效",
         "用户没有明确验收通过前不得关闭",
         "只有长期事实变化时才更新 Wiki",
-        "需要工单的任务以 Gitea 工单作为单次需求、变化、实现、测试、提交和验收的事实来源",
+        "Gitea 工单是单次任务需求、变化、实现、测试、提交和验收的唯一事实来源",
         "Wiki 同步由长期事实变化触发，不由任务完成触发",
         "标准流程不创建 Wiki 任务归档",
         "工单默认只在开始实施、集中回写待验收、验收关闭三个节点更新",
@@ -297,11 +289,6 @@ def check_agent_efficiency_rules(errors: list[str], root: Path = ROOT) -> None:
         "不得把模板自带的本地 `docs/` 当作新项目 Wiki 已初始化的证据",
         "提交只包含当前工单相关文件",
         "不得仅为设置编码重复启动一层 PowerShell",
-        "不得默认套用 Bash",
-        "复杂正则优先使用变量或 `rg -e`",
-        "单引号 PowerShell here-string",
-        "`foreach`、`if` 等语句块",
-        "使用真实目录配合 `-g/--glob`",
         "文件解码和控制台输出分别处理",
         "不得默认使用 `-ExecutionPolicy Bypass`",
         "### 工单与设计证据双门禁",
@@ -329,9 +316,6 @@ def check_agent_efficiency_rules(errors: list[str], root: Path = ROOT) -> None:
         "不得臆造用户原话",
         "不复制完整聊天",
         "Gitea 工单全文不导出到仓库",
-        "用户可以使用中文、英文或合理的中英混合语言交流",
-        "默认使用中文分析、回复、编写工单和维护内部项目文档",
-        "日志和错误原文保持原样",
     )
     for section in missing_sections(content, required):
         errors.append(f"AGENTS.md 缺少：{section}")
@@ -578,47 +562,32 @@ def run_check(args: argparse.Namespace) -> int:
 
 
 def run_sync(args: argparse.Namespace) -> int:
-    """同步核心镜像；--verify 复用本轮完整读取完成初始化验证。"""
+    """--verify 依次执行导出、结构检查和一致性校验，替代原来的三条命令。"""
 
     if args.verify:
-        try:
-            config = load_config(Path(args.config).resolve())
-            messages = sync_all(
-                config, WikiClient(config), check=False, deep_check=True
-            )
-        except WikiDocsError as exc:
-            print(f"错误：{exc}")
-            return 1
-        for message in messages:
-            print(message)
-        code = run_check(argparse.Namespace(strict=True))
-        if code != 0:
-            print("错误：结构检查未通过，已停止")
-            return code
-        print("Wiki 镜像初始化验证通过")
+        steps = (
+            ("同步", lambda: run_sync(
+                argparse.Namespace(check=False, verify=False, config=args.config))),
+            ("结构检查", lambda: run_check(argparse.Namespace(strict=True))),
+            ("一致性校验", lambda: run_sync(
+                argparse.Namespace(check=True, verify=False, config=args.config))),
+        )
+        for name, step in steps:
+            code = step()
+            if code != 0:
+                print(f"错误：{name}未通过，已停止")
+                return code
         return 0
 
     try:
         config = load_config(Path(args.config).resolve())
-        deep_check = getattr(args, "deep_check", False)
-        messages = sync_all(
-            config,
-            WikiClient(config),
-            check=args.check or deep_check,
-            deep_check=deep_check,
-        )
+        messages = sync_all(config, WikiClient(config), check=args.check)
     except WikiDocsError as exc:
         print(f"错误：{exc}")
         return 1
     for message in messages:
         print(message)
-    print(
-        "Wiki 镜像深度检查通过"
-        if deep_check
-        else "Wiki 镜像检查通过"
-        if args.check
-        else "Wiki 镜像同步完成"
-    )
+    print("Wiki 镜像检查通过" if args.check else "Wiki 镜像同步完成")
     return 0
 
 
@@ -683,21 +652,13 @@ def main() -> int:
     p_check.set_defaults(func=run_check)
 
     p_sync = sub.add_parser("sync", help="从 Gitea Wiki 单向同步核心 docs 镜像")
-    sync_mode = p_sync.add_mutually_exclusive_group()
-    sync_mode.add_argument(
-        "--check",
-        action="store_true",
-        help="按 revision 快速检查 Wiki 与镜像，不写文件",
+    p_sync.add_argument(
+        "--check", action="store_true", help="只检查 Wiki 与镜像是否一致，不写文件"
     )
-    sync_mode.add_argument(
-        "--deep-check",
-        action="store_true",
-        help="下载全部 Wiki 正文并逐页检查镜像，不写文件",
-    )
-    sync_mode.add_argument(
+    p_sync.add_argument(
         "--verify",
         action="store_true",
-        help="完整读取并导出 Wiki，再执行 check --strict 初始化验证",
+        help="依次执行导出、check --strict 和一致性校验",
     )
     p_sync.add_argument(
         "--config", default=str(DEFAULT_CONFIG), help="Wiki 页面映射 JSON 文件"

dev_scripts/wiki_docs.py

@@ -8,7 +8,6 @@ import os
 import re
 import subprocess
 import tempfile
-import time
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path, PurePosixPath
@@ -27,7 +26,6 @@ HEADER_PATTERN = re.compile(
     rf"{re.escape(MIRROR_END)}\n\n(?P<body>.*)\Z",
     re.DOTALL,
 )
-RATE_LIMIT_RETRY_DELAYS = (1.0, 2.0, 4.0)
 
 
 class WikiDocsError(RuntimeError):
@@ -144,33 +142,11 @@ class WikiClient:
             data = json.dumps(payload, ensure_ascii=False).encode("utf-8")
             headers["Content-Type"] = "application/json"
         request = Request(url, data=data, headers=headers, method=method)
-        request_error: HTTPError | URLError | None = None
-        body = b""
-        for attempt in range(len(RATE_LIMIT_RETRY_DELAYS) + 1):
-            try:
-                with urlopen(request, timeout=30) as response:
-                    body = response.read()
-                request_error = None
-                break
-            except HTTPError as exc:
-                if (
-                    method == "GET"
-                    and exc.code == 429
-                    and attempt < len(RATE_LIMIT_RETRY_DELAYS)
-                ):
-                    exc.close()
-                    time.sleep(RATE_LIMIT_RETRY_DELAYS[attempt])
-                    continue
-                request_error = exc
-                break
-            except URLError as exc:
-                request_error = exc
-                break
-        else:  # pragma: no cover - for 循环必定通过成功或异常分支退出
-            raise WikiDocsError(f"Gitea API {method} {api_path} 请求失败")
-
-        if isinstance(request_error, HTTPError):
-            if self.token and method == "GET" and request_error.code in {401, 403, 404}:
+        try:
+            with urlopen(request, timeout=30) as response:
+                body = response.read()
+        except HTTPError as exc:
+            if self.token and method == "GET" and exc.code in {401, 403, 404}:
                 # 公共仓库可能可匿名读取，而当前 shell 中的通用令牌属于
                 # 另一个实例或已失效。只对只读请求安全降级为匿名访问。
                 anonymous_headers = {"Accept": "application/json"}
@@ -191,13 +167,12 @@ class WikiClient:
                         f"无法连接 Gitea：{anonymous_exc.reason}"
                     ) from anonymous_exc
             else:
-                detail = request_error.read().decode("utf-8", errors="replace")
+                detail = exc.read().decode("utf-8", errors="replace")
                 raise WikiDocsError(
-                    f"Gitea API {method} {api_path} 返回 "
-                    f"{request_error.code}: {detail}"
-                ) from request_error
-        elif isinstance(request_error, URLError):
-            raise WikiDocsError(f"无法连接 Gitea：{request_error.reason}") from request_error
+                    f"Gitea API {method} {api_path} 返回 {exc.code}: {detail}"
+                ) from exc
+        except URLError as exc:
+            raise WikiDocsError(f"无法连接 Gitea：{exc.reason}") from exc
         if not body:
             return None
         try:
@@ -406,73 +381,8 @@ def check_mirror(mapping: Mapping, page: WikiPage, path: Path) -> list[str]:
     return errors
 
 
-def _metadata_revision(metadata: dict[str, Any]) -> str | None:
-    last_commit = metadata.get("last_commit")
-    revision = last_commit.get("sha") if isinstance(last_commit, dict) else None
-    return revision if isinstance(revision, str) and revision else None
-
-
-def _find_page_metadata(
-    pages: list[dict[str, Any]], page_name: str
-) -> dict[str, Any]:
-    metadata = next(
-        (
-            item
-            for item in pages
-            if item.get("title") == page_name or item.get("sub_url") == page_name
-        ),
-        None,
-    )
-    if metadata is None:
-        raise WikiDocsError(
-            f"Wiki 页面不存在：{page_name}；不会自动删除或重命名本地镜像"
-        )
-    return metadata
-
-
-def _metadata_identity(
-    config: Config, metadata: dict[str, Any], fallback_title: str
-) -> tuple[str, str] | None:
-    title = metadata.get("title")
-    sub_url = metadata.get("sub_url")
-    if not isinstance(title, str) or not title:
-        title = fallback_title
-    if not isinstance(sub_url, str) or not sub_url:
-        return None
-    url = (
-        f"{config.gitea_url}/{quote(config.owner, safe='')}/"
-        f"{quote(config.repository, safe='')}/wiki/{quote(sub_url, safe='%')}"
-    )
-    return title, url
-
-
-def _local_revision(
-    path: Path, *, expected_title: str, expected_url: str
-) -> str | None:
-    if not path.is_file():
-        return None
-    try:
-        metadata, _body = parse_mirror(path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeDecodeError, WikiDocsError):
-        return None
-    if (
-        metadata.get("wiki_page") != expected_title
-        or metadata.get("wiki_url") != expected_url
-        or not metadata.get("synchronized_at")
-    ):
-        return None
-    revision = metadata.get("wiki_revision")
-    return revision if revision else None
-
-
-def sync_all(
-    config: Config,
-    client: WikiClient,
-    *,
-    check: bool = False,
-    deep_check: bool = False,
-) -> list[str]:
-    """检查或写入所有显式映射；写入前先完成全部远端读取。"""
+def sync_all(config: Config, client: WikiClient, *, check: bool = False) -> list[str]:
+    """检查或写入所有显式映射；绝不处理映射外的文件。"""
 
     if not check:
         dirty = dirty_mirror_paths(config)
@@ -482,43 +392,10 @@ def sync_all(
                 "已映射的本地镜像存在未提交改动，已停止以防覆盖：\n" + details
             )
 
-    pages = client.list_pages()
-    resolved: list[tuple[Mapping, Path, WikiPage | None, str | None]] = []
-    for mapping in config.mappings:
-        metadata = _find_page_metadata(pages, mapping.page)
-        target = ROOT / PurePosixPath(mapping.path)
-        remote_revision = _metadata_revision(metadata)
-        identity = _metadata_identity(config, metadata, mapping.page)
-        local_revision = (
-            _local_revision(
-                target, expected_title=identity[0], expected_url=identity[1]
-            )
-            if identity is not None
-            else None
-        )
-        if not deep_check and remote_revision and local_revision == remote_revision:
-            action = "一致" if check else "无变化"
-            resolved.append(
-                (
-                    mapping,
-                    target,
-                    None,
-                    f"{action}：{mapping.path} <- "
-                    f"{mapping.page}@{remote_revision[:12]}",
-                )
-            )
-            continue
-
-        page = client.get_page_from_metadata(metadata, mapping.page)
-        resolved.append((mapping, target, page, None))
-
     messages: list[str] = []
-    for mapping, target, page, skip_message in resolved:
-        if skip_message is not None:
-            messages.append(skip_message)
-            continue
-        if page is None:  # pragma: no cover - resolved 元组由上面的单一路径构造
-            raise WikiDocsError(f"Wiki 页面未解析：{mapping.page}")
+    for mapping in config.mappings:
+        page = client.get_page(mapping.page)
+        target = ROOT / PurePosixPath(mapping.path)
         if check:
             errors = check_mirror(mapping, page, target)
             if errors:

docs/00-project-profile.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Project-Profile
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Project-Profile.-
-wiki_revision: 7468b9fbdd4d0bbbb9a73580c22ec868b3085753
-synchronized_at: 2026-09-05T04:06:47Z
+wiki_revision: 3b78360779ae520f1ff9e51be3118a04cd549f51
+synchronized_at: 2026-09-07T09:27:40Z
 <!-- gitea-wiki-mirror:end -->
 
 # 项目档案
@@ -61,6 +61,7 @@ GoAuto 默认采用轻量治理：文案、注释、格式、局部样式或布
 ## 环境与凭据
 
 - 服务端正式环境默认必须使用 HTTPS。仅当管理员接受 Device Token、任务内容和执行结果明文传输风险，并显式设置 `GOAUTO_ALLOW_INSECURE_AGENT_HTTP=true` 时，Agent `/api/agent/v1/**` 可通过 HTTP；管理端和第三方服务不因此放宽。
+- #237 客户端密钥例外（用户 2026-09-07 明确接受风险）：提交 `71f7751` 起，管理员密钥管理及 `/api/client/v1` 默认兼容 HTTP/HTTPS，无开关；HTTP 明文传输密钥及业务数据，建议优先 HTTPS。实际迁移部署仍须单独授权；此例外不改变其他第三方服务的安全边界。
 - 每台设备使用独立 Device Token；Token 只存安全配置，不进入仓库。
 - PDD 账号密码、Cookie、验证码和用户个人数据不得进入日志。
 - 根目录 `gitea.env` 是本机工单访问配置，已被 Git 忽略。

docs/01-workflow.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Development-Workflow
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Development-Workflow.-
 wiki_revision: 62ddbe4469740c02ce4a6ca2fd1966a89a79322f
-synchronized_at: 2026-09-05T04:06:53Z
+synchronized_at: 2026-09-05T07:16:44Z
 <!-- gitea-wiki-mirror:end -->
 
 # 开发工作流

docs/02-architecture-and-code-map.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Architecture-and-Code-Map
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+wiki_revision: c314a2c5a1334ec05bce1740646b4f9da8e91cdd
+synchronized_at: 2026-09-10T08:57:57Z
 <!-- gitea-wiki-mirror:end -->
 
 # 架构与代码地图
@@ -68,6 +68,8 @@ Android Portal/Agent
 | `pdd_account` | 可选的账号调度引用，只保存名称和状态，不保存凭据 |
 | `purchase_task` | 商品外键和不可变快照、执行模式、状态/租约 guard、价格边界、订单、人工支付复核、物流与回填事实 |
 | `purchase_task_attempt` | `task_id + attempt_id` 幂等执行记录、阶段、规则哈希、固化规格决策和结构化错误 |
+
+> #241 新增：`server/app/goauto/purchase/order_backfill.go` 与 `order_backfill_handler.go` 提供 `POST /api/agent/v1/purchase-tasks/order-backfill`（Device Token 鉴权，逐条事务、逐条结果）；`server/app/goauto/models/purchase_order_guard.go` 在 `PurchaseTask.BeforeSave` 上全局强制订单号唯一，以 `purchase_rule_setting` 单例行串行化订单号分配，避免新增唯一索引迁移；`purchasecontract.ParseAddressSuffix` 为 `AddressSuffix` 的反解，通过回比而非负向前瞻实现（Go RE2 不支持前瞻）。
 | `ai_matching_setting` | 唯一单例的启用状态、OpenAI-compatible Base URL、模型、超时、内部部署明文 API Key 和更新人；仅管理员设置接口可以读取该字段 |
 
 `collection_task` 的状态仅为 `pending`、`running`、`completed`、`completed_partial`、`failed`。设备身份和心跳表属于 Agent 领取任务的必要基础，不承载 PDD 业务数据。
@@ -333,3 +335,118 @@ PddProductDetailCollector
 - `GET /api/v1/sysjob/:id/execution-logs` 由 `server/app/jobs/service/execution_log.go`、`apis/execution_log.go` 和 `router/sys_job.go` 提供任务级分页、状态与开始时间过滤；沿用隐藏菜单 `JobLog` 的角色菜单绑定和精确 GET 权限。Web 入口为 `web/src/views/schedule/index.vue` 的单选“日志”按钮，详情页为 `web/src/views/schedule/log.vue`。
 - 执行历史明确不保存任务参数、AI Provider 地址或密钥、第三方原始响应和业务原始载荷；当前不提供删除、保留期限自动化、WebSocket 实时流或立即执行动作。
 - 追加迁移为 `server/cmd/migrate/migration/version-local/1788357000000_sys_job_execution_log.go`：创建执行历史表、登记只读 API、关联 `JobLog` 菜单，并只给迁移前已绑定该菜单的角色补充精确 Casbin 权限。
+
+## 客户端密钥访问架构（#237）
+
+代码基线 `71f7751`（含用户确认的默认 HTTP/HTTPS 兼容），2026-09-07 完成 Server/Web 代码与隔离测试；本机迁移、管理员菜单写入与 Server/Web 启动已于 2026-09-07 授权完成，真实 HTTP 管理列表和模块目录加载通过；线上仍未部署。
+
+- `server/app/goauto/clientkey` 管理独立密钥、授权及审计；`clientapi/routes.go` 的显式 Inventory 将 `/api/client/v1` 映射到既有业务处理器，绝不转发任意 Admin 路由。
+- `clientapi/gateway.go` 默认接受 HTTP 与 HTTPS，无协议开关或转发协议头门禁，按 Bearer 密钥、模块及能力顺序校验，每次请求读取数据库，无授权缓存。`common/clientprincipal` 传递独立客户端身份，不生成或伪装管理员 JWT。
+- `client_api_key` 保存名称、随机 256 位密钥的 SHA-256 摘要、前缀、授权 JSON、启用状态、版本、创建/修改人和最后使用时间；完整密钥仅创建响应一次返回。`client_api_key_audit` 保存管理变更和客户端请求元数据，不保存请求正文、查询参数、响应正文或凭据。
+- 编辑与停用采用启用状态和 version 条件更新，并与变更审计同事务提交；冲突返回 409。业务执行前先持久化请求审计意图，失败则不执行业务。完成后更新状态；更新失败或进程中断可能留下 status=0，表示结果待核对，不能据此自动重放。
+- 部分既有业务操作人字段使用该密钥最近授权管理员的 ID 兼容现有外键；实际调用方以独立审计的 key_id 为准，不能把业务字段当成人工操作证据。
+- Admin 页面 `web/src/views/goauto/client-keys/index.vue` 复用创建/编辑授权弹窗；菜单位于“采采管理”，仅管理员可见。新追加迁移 `1788798000000_client_api_key.go` 创建两表及管理员菜单，不改 Android。
+
+## 采购规格面板预滑动兼容（#238）
+
+代码基线 `58a6c1c`，Android 0.9.60 / versionCode 73（构建完成不等同于已安装/发布）。`PurchaseRehearsalExecutor.applyPostAction` 对 `openSpecPanel.swipeAfter` 只兼容解析、不执行机械预滑动，`waitAfterMs` 保留；首趟继续原 `probeSpecs` 遍历，第二趟继续原 `selectSpec` 精确查找与容器内有界滚动。其他动作的后置滑动仍沿用既有执行语义，失败不会被统一忽略。
+
+`GoAutoAccessibilityService.swipePurchase` 的失败分类由 `PurchaseSwipeFailureReason` 枚举提供；共享 `swipeNode` 仅增加可选分类回调，不改变手势目标、轨迹、1500ms 回调等待或其他调用者行为。`GoAutoPurchasePanel` 日志经 `AgentForegroundService` 关联 task、attempt、device 与规则快照哈希，新增预滑动跳过/必需滑动失败标量；不记录节点文字、坐标、原始控件树、截图或凭据。
+
+Server/Web、数据库和任务快照不变；旧 APK 仍有预滑动行为，必须更新 Agent 才生效。相关验证在 `PurchaseRehearsalExecutorTest`，Android 全量测试与 APK 构建入口不变。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；代码已实现不代表当前线上已部署。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+入口为 `SyncWithShopSnapshot → loadDailyList → importSyncPage`；`server/app/goauto/sybimport/sync_page.go` 封装页事务和提交后计数；`import_handler.go` 判定终态，`sync_run.go` 保存及筛选，Web 复用 `web/src/views/goauto/syb-sync-runs/index.vue`。
+
+## Android 连续临时采集收尾（#250）
+
+当前实现绑定 `37e8b56`（Agent 0.9.72 / 85），用户确认 v5 按次数返回后切回 Agent。仅 Android，无 Admin/API/权限/数据库迁移；取代 v1～v4 首页导航。
+
+- `AgentSettingsFragment` 在采集间隔后复用卡片和 SwitchMaterial；仅开启显示“返回次数”按钮，Material 单选框选择 1～5 次（默认 3），立即保存或取消。成功无常驻反馈，错误/忙碌显示原因。任务忙碌禁用，弹窗选定时再检查。
+- `AgentSettingsStore` 在私有 `goauto_agent_settings` 保存 `continuous_collection`（false）与 `continuous_collection_return_count`（3）；次数越界或读取错误回落 3，写入失败恢复旧值，无网络加载。
+- `requestCurrentPageCollection` 保留原范围判断；`executeTask` 在采集开始固定次数。`executeTaskWhileAwake` 提交结果、结束图片上传后返回 resultStatus；`ContinuousCollectionPolicy.finish` 仅对完整确认成功调用新 `PddCollectionReturnNavigator`。失败/部分成功不导航。冷却间隔不变，连续模式不启动旧 idle-return。
+- 删除 `PddCollectionHomeNavigator` 和专属首页/搜索层判据。新导航器仅使用 capture/back、当前包名、openAgentPreservingTab；1～5 次 Back，每次后 500ms，前台离开 PDD 终止剩余 Back；保留风险场景停止。最后打开 Agent 并等待 500ms 验证包名，不验证 PDD 首页。仍在原任务互斥与唤醒锁范围内完成，结束后原 finally 释放。
+- `GoAutoCollector` 日志关联 taskId、attemptNumber、deviceId、规则快照 SHA-256；记录 continuousReturn、configuredBacks、固定 reason 和 actions。原因含 count_completed、left_pdd、back_failed、unsafe_page、agent_launch_failed、agent_not_confirmed、navigation_exception、invalid_count；actions 为 Back 尝试数，不代表最终页面。无节点文字、树、截图或个人数据落盘；不扩大采购诊断存储。
+- `ContinuousCollectionTest` 覆盖范围/终态、1～5 次、无变化仍按次数、前台变化、风险、动作/启动失败、包名确认和异常；`ContinuousCollectionSettingsTest` 覆盖开关与次数持久化、默认/越界/写入失败。`:app:testDebugUnitTest :app:assembleDebug` 376 项通过。旧首页专属测试随旧行为替换，新版未安装，UI 大字体/横屏、多设备和完整采集真机链路尚未验证。
+
+## SYB 存疑规格候选解析（#251）
+
+实现绑定 `64b4205`，仅 Server `app/goauto/sybimport`；无 API 字段、数据库迁移、权限、并发模式或 UI 变化。
+
+- `parse_candidates.go: ParseWithCandidates` 先运行原 `Parse`，仅 uncertain 时解码并校验已存 SpecsJSON；复用 `closedShopeeCandidates` 提取颜色/尺码封闭候选，拒绝未知有值角色/重复角色。完整候选组合与原文归一比较唯一时确认，其他情况返回原 ParseResult。
+- `ApplyDetail` 在加载既有蝦皮商品后、写入规格前调用；`Reparse` 在保留人工/AI 确认保护后加载关联候选调用。新增 ParseResult 私有 matchedCandidates 标记，使 `mergeParsedSpec` 对已经存在的候选直接返回，避免按维度名重复合并或改变映射。
+- #198 `ProcessSpecAIParseRun → Reparse` 自然接入确定性优化，仍需 AI 的记录沿用原后续步骤，不新增异步任务/Provider 调用/接口。
+- 验证 `go test ./app/goauto/sybimport ./app/goauto/aimatching ./app/goauto/shopeeproduct ./app/goauto/purchase` 和 `go build ./...` 通过；新增候选正反/格式/组合色/单维度、歧义/空值、同步重解析一致、人工保护及无需调用 AI 测试。AI 原有置信度/失败重试测试改用仍需语义理解的合成输入，继续验证原分支。
+- 本轮只使用本地测试数据与 httptest AI，未触发真实 SYB 同步、外部 AI、采购、数据库迁移或服务重启；线上及历史数据效果尚待授权验证。
+
+
+## 蝦皮详情匹配等待与回读（#254）
+
+实现绑定 `9088e6b`（2026-09-10，分支 fix/254-match-loading）；已通过合成数据测试，尚未合并 main 或发布线上。
+
+- Server `shopeeproduct.Service.DetailWithAutoMatchBudget` 为详情 GET 附加派生的整次匹配预算，不返回 Provider、Key 等配置。`AutoMatchMappings` 读取 AI 设置 T，使用 2T+10 秒的单个父 context；颜色、尺码、保存及结果回读共用剩余时间。初始配置读取也受有界 context 约束，读取耗时从后续预算扣除。
+- 批量定时匹配调用内部 `autoMatchMappings` 并继续使用原 MaxProviderTimeout=600 秒，不随本次详情入口调整；候选建议与其他 AI 功能不改。
+- Web `ShopeeProductDetailDrawer` 在提交前以普通 GET 刷新商品与预算，仅 auto-match POST 使用 (2T+20) 秒超时。准备失败/缺少预算时不发 POST；旧 Server 必须先更新，不能只发布新版 Web。
+- 加载状态同时绑定商品加载代次和操作序号。关闭/切换立即结束该页面等待状态；同商品重开读取详情，旧响应/旧 finally 不得污染新操作。匹配期间禁止在当前抽屉编辑映射，原人工草稿放弃确认保留。
+- POST 未正常返回时只回读详情及关联 PDD，不自动重发 POST；回读失败结束转圈并保留刷新入口。GET 沿用单请求10秒超时，完整结果回读最多两次串行 GET，不是无限等待。
+- 验证：Go shopeeproduct/aimatching/clientapi 测试与 go build；Web `node --test tests/unit/shopee-match-lifecycle.test.cjs`，Playwright shopee-match-lifecycle 与 shopee-pdd-picker，受影响 ESLint 与 build:prod。
+
+
+## SYB 行内一键关联最近采集（#253）
+
+实现绑定 `b1594dc`，2026-09-10；分支 feat/253-one-click-link，包含 #254 依赖。已完成合成数据测试及构建，未合并 main、未部署，不代表当前线上已具备此能力。
+
+- Web `syb-products/index.vue` 在“去关联”旁增加“一键关联＋下拉箭头”，共享 `quick-link.js` 页面级状态。`quick-link-device-preference.js` 按当前浏览器来源、API环境、用户ID保存设备ID，独立于批量采购偏好；不存密钥或商品数据。首次主动作选机继续原行，箭头选机只保存偏好。
+- Server `shopeeproduct/latest_collection.go` 复用 LinkPDD 的可选 Admin 模式。短事务核对 SYB→Shopee、未关联/规格版本、设备状态，选择并锁定最新 completed/completed_partial 的 agent_current_page 任务及其 PDD；仅完整采集、active且有可用颜色或尺码时更新，WHERE pdd_product_id IS NULL 不覆盖其他操作者的关联。响应保留该事务产生的规格版本及来源task/device/PDD，不能用后续GET替换冻结上下文再自动匹配。
+- 不新增表、迁移、路由或权限对账。原手动关联/替换请求不变；共享 Handler 明确拒绝 Client API 使用此跨模块模式，不能借 Shopee-only write grant 读取 SYB/设备上下文。来源任务原规则快照不改，taskId 可回溯既有采集证据。
+- 关联后读取现有采购准备；需要人工确认或不具备AI资格时停止自动链路并保留关联，其他情况调用原 AutoMatchMappings，沿用 #254 动态预算及原事务保存/上下文冲突保护。最后刷新实际处理阶段，不调用创建采购/订单接口。
+- 运行期间冻结行、商品、手机；前端重复主动作禁用，切换偏好仍只影响未来操作。卸载或 keep-alive deactivated 令旧操作失效，禁止旧回调继续下一步；不声称已经取消服务端在途写入。异常仅有限GET回读和刷新，不自动重发POST。
+- 验证命令：Server `go test -p 1 ./...`、`go build ./...`；Web `node --test tests/unit/syb-quick-link.test.cjs tests/unit/shopee-match-lifecycle.test.cjs`、`pnpm exec playwright test tests/e2e/syb-quick-link.spec.ts tests/e2e/shopee-match-lifecycle.spec.ts --workers=1`、受影响文件 ESLint、`pnpm build:prod`。SQLite 单连接并发测试不代替生产 MySQL 行锁验收；真实AI、生产数据、跨设备人工闭环待验证。
+
+## SYB 行内一键替换（#258）
+
+实现绑定 `2b01974`；部署与验收见 #258 发布证据。本节补充 #253，不改变原未关联入口。
+
+- `syb-products/quick-link.js` 复用分体按钮、设备偏好和匹配/回读流程；已关联且允许处理阶段时同位置显示一键替换。先只读预览，固定任务、目标商品及规格版本；不同商品一次确认，同商品不重绑。
+- `shopeeproduct/latest_collection.go` 在原 latestCollection 增加可选 replacement 模式。预览和提交均短事务锁定 SYB、Shopee、原PDD、设备、来源采集与目标PDD，核对旧关联及上下文。提交按预览 taskId 读取，不重新挑选后来采集的商品。
+- Admin 路由注入 `purchase.ValidateQuickReplacement`，在事务内复用采购准备数据集及处理阶段计算，不调用 AI。缺少校验函数拒绝替换；客户端密钥不注入且仍拒绝 latestCollection。无新路由、权限、表或迁移。
+- 关联完成后才执行现有 AI 匹配，不在数据库事务中等待 Provider；同一 SYB 正式采购创建与替换共用 SYB 行锁。历史采购快照不变。SQLite 合成测试覆盖冲突与串行并发请求，不能替代生产 MySQL 多连接锁验收。
+
+## 辅助信息缺失的采集关联（#259）
+
+实现绑定 `e467706`，仅 Server；部署/验收见 #259。替代 #253/#258 中“部分完成一律拒绝”的限制，不改变 completed 原有路径。
+
+- completed_partial 的 missing 必须是非空合法列表且仅包含 salesText、shopName、reviewCount，才进入辅助信息兼容检查；title、规格/价格缺失、遍历截断、SKU数量上限及未知原因仍拒绝。
+- `shopeeproduct/partial_collection.go` 核对本次 task 的维度和值、可售SKU的完整标记/规格引用/非负价格、本次颜色价格，以及当前档案可选值由本次有效SKU覆盖，不能借旧档案合并残留的规格或价格通过。真实单维度允许，不虚构另一维度；本次明确报告缺少规格仍拒绝。
+- 一键关联、替换预览及确认提交共用验证。失败沿用409 LATEST_COLLECTION_UNAVAILABLE及现有提示，不回退更早采集、不换手机。状态 completed_partial 和 missing 原样保留；辅助字段缺失仍可在任务详情查看。
+- 无接口字段、数据库迁移、Android/Web或权限变更；普通人工关联与采购/AI资格不变。不将“允许关联”视为“已匹配或已采购”。
+
+## 采购单标题面板与地址就绪等待（#260、#261）
+
+实现绑定 #260 `3c1ffa4`（执行器回归测试 `7de4318`）、#261 `5ea07f1`，Android 0.9.74 / versionCode87，基于0.9.73。安装及真实采购验收以工单证据为准；不代表 main 的 Android 已整合这些分支。
+
+- 采购仅在安全规格入口点击返回SUCCESS后，记录本次页面包名/Activity作为内存上下文；开始新执行或页面身份改变时清除。`PddScreenParser` 的新增 purchaseEntryContext 默认关闭，仅该采购执行器传入；普通解析和采集原判定保留。
+- 当前仍为同一PDD Activity、商品ID非空、没有页面风险、没有选中摘要，且唯一有标题规格滚动区、一个维度有值，同时具有关闭、数量、支付展示区域与下单操作证据时，单标题可识别为NORMAL_SCROLLABLE。只是允许进入既有精确规格探测/选择，不执行下单或付款，不全局认可UNKNOWN，不增加入口重复点击或滑动。
+- 地址入口点击原有1000ms保留；地址列表等待增加唯一修改目标要求。点击修改和保存由500ms改为1000ms，其他通用动作间隔不变，无新配置项。
+- 修改后不再只见“详细地址”文字就立即写入。最多50次、每次间隔200ms读取（不含读取耗时），检查PDD页面风险；唯一可见启用有内容的详细地址EditText，连续两次路径、边界、内容及Activity相同才继续原输入流程。始终零个/多个或不稳定时失败，不取第一个候选。
+- 输入内容生成、输入后回读、保存后退出及返回规格面板、最终复核和单次下单边界不变。新增本机脱敏诊断 addressEditorCandidates / addressEditorPolls 两个整数，与task/attempt/device/ruleHash关联；不记录地址内容、原始树或整屏截图。
+- 仅Android；无Server/Web、共享API字段、数据库迁移或权限变化。真实采购、地址写入及订单创建不作为自动安装验证，不执行付款。
+
+### v2 商品入口补点与地址返回等待（#260、#261）
+
+2026-09-10 实现绑定 #260 `713111d`、#261 `d0a82f3`，Android 0.9.75 / versionCode88；真实采购效果以工单验收为准，非 main 合并声明。
+
+- 入口恢复不再把全页面支付方式展示文案单独视为支付页。当前包名/Activity、商品标题和安全入口必须与点击前一致，入口唯一且可用；已打开面板、关闭控件、数量、选中摘要、订单操作、风险/评价页面仍拒绝恢复。支付 Activity 或明确支付、订单、地址文本继续阻止补点。仅允许既有一次重新定位后的规格入口中心手势，随后仍验证面板，不循环、不扩展到地址保存或下单。
+- 保存地址后的确认读取、必要时一次返回后的确认读取，增加最多50次、间隔200ms的有界就绪检查，页面捕获耗时另计。连续两次同一Activity满足原地址回读与确认面板条件后继续；完整信息不要求滚动区域。已明确到地址列表时保留原返回路径，不等待列表出现下单按钮；返回后增加1000ms缓冲。
+- 就绪检查不修改原地址回读和结构下单入口规则；超时后只对既有识别的面板、唯一可用滚动区域执行原有有限滚动。零/多个区域仍失败，不凭地址入口或未知底部节点授权下单。最终精确规格、数量、价格、地址与单次下单边界不变。
+- 私有采购诊断新增布尔 savedAddressMatched、savedPanelMatched；整数 savedLegacySubmitCandidates、savedAddressCards、savedAddressTargets、savedScrollCandidates、savedConfirmationPolls。只记录标量并绑定task/attempt/device/ruleHash，不保存地址、原始树或整屏图。
+- CG109 v1现场读取未达到空闲状态，不能确认原失败具体缺哪项证据；v2覆盖迟到确认节点及可观测性，不将合成测试通过冒充真机修复验收。无Server/Web/API/迁移/权限变化，不需要服务器重启。

docs/03-business-rules-and-glossary.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Business-Rules-and-Glossary
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Business-Rules-and-Glossary.-
-wiki_revision: f8a2e64acaf245066d55d4a0f1e928d672712270
-synchronized_at: 2026-09-05T04:13:06Z
+wiki_revision: 756b861e9db598a75c7793b54df5b908384252b6
+synchronized_at: 2026-09-10T08:58:00Z
 <!-- gitea-wiki-mirror:end -->
 
 # 业务规则与术语
@@ -37,6 +37,8 @@ synchronized_at: 2026-09-05T04:13:06Z
 - PDD 重新采集或更换关联后，目标规格仍存在则映射继续有效；目标规格消失时详情标记“已失效”，服务端拒绝保存不存在的目标，采购预检和创建也拒绝使用失效映射并提示重新选择。
 - 批量软删除逐条校验引用（虾皮商品被 SYB 明细或采购任务引用时不可删除）并逐条返回结果；已删除商品默认不出现在列表，可筛选查看并恢复。
 
+- #257：蝦皮颜色与尺码建议/一键匹配先保留仍有效的已确认映射，再复用相同标准化比较：简体、空白、全半角与大小写统一。颜色标准化后仅命中一个当前可选 PDD 候选时，不调用 AI，建议标为 matched，一键匹配按既有流程保存 exact_match + confirmed；未命中或多个不同候选标准化后相同，仍走原 AI 与置信度/候选校验。只转换比较键，蝦皮/PDD 原规格名不改，映射目标保存 PDD 原始候选名称；不引入颜色同义词猜测、不自动重算历史映射。
+
 ## SYB 商品明细
 
 - 一行对应 SYB 一条明确的商品/颜色/尺码/数量明细；唯一键为「蝦皮订单号 `code` + 来源明细 `id`」组合，不是全局唯一 ID（未在多货运单样本中验证过全局唯一性）。
@@ -58,6 +60,13 @@ synchronized_at: 2026-09-05T04:13:06Z
 - 对采购人员展示的阶段固定为：待人工处理、未关联 PDD、PDD 待采集、PDD 采集中、PDD 采集失败、规格待匹配、可创建采购、已创建任务、采购成功、待人工核对。
 - 主阶段优先级为：待人工核对 → 采购成功 → 已创建任务 → 待人工处理 → 未关联 PDD → PDD 待采集/采集中/采集失败 → 规格待匹配 → 可创建采购。每行只显示一个阶段和对应下一步。
 - “待人工核对”表示订单结果不明确，必须先人工核查并禁止自动重试；“采购成功”表示已取得 PDD 订单号和下单时间，不代表已经支付。
+- 一个 PDD 订单号只能属于一个采购任务，该唯一性在采购任务保存路径上全局强制（#241）。人工处理结果未知、取消及 lifecycle 保存路径撞号时返回 `PURCHASE_ORDER_NUMBER_ALREADY_USED`，提示订单号已属于哪个任务，由采购员人工核对，不静默覆盖原值。
+- 不可逆边界之后的 `order_created` 结果回传是上述规则的例外：此时 PDD 真单已创建，发现订单号已属于其他任务时不回滚、不判失败，而是把任务降级为 `order_result_unknown`，冲突订单号以「读到订单号 X，但该号已属于任务 CG-yy」保存在任务与 attempt 的 `error_message`，`pdd_order_no` 留空以维持唯一性，保留下单时间与不可逆时间，进入既有人工处理结果未知通道。首要目标是保住「真单已存在」这一事实，不制造无记录的真实订单。
+- Agent 可按收货地址后缀 `_cg<任务号>` 批量回填订单号与下单时间（#241）。
+- Agent 侧回填为**人工触发的只读扫描**（#242）：入口在采购记录页搜索按钮右侧，输入天数（默认 2）后确认启动。天数口径为滚动 N×24 小时，基准是页面读到的下单时间。采集、采购、回填三者互斥，复用既有任务互斥锁并加原子防重入，忙碌时拒绝启动而不排队、不抢占。
+- 回填扫描不假设订单列表有序：只有连续观察到至少 5 单且下单时间严格递减、期间无缺失时间时，才允许「超过指定时间即停止」；一旦出现时间回升或缺失，改为扫至内部上限并明确标记「未完整扫描」，不得把不完整结果显示为已扫完。内部上限用于限制设备占用，不作为用户可配置的门禁。
+- 回填扫描全程只读：确认收货、申请退款、催发货、去支付、立即支付、提交订单、付款、退款、取消订单、再次购买、删除订单永久排除为点击目标；点击目标必须自身可点、子树不含上述词，且不与任何含上述词的可见控件几何重叠；不得按固定坐标盲点。遇登录、验证码或风控立即停止并报告。
+- 解析不出规范后缀的订单一律跳过，其订单数据不缓存、不上传、不入日志；上传载荷只含后缀、订单号与可选下单时间。本地缓存只采纳服务端确认的事实，并区分页面读到的真实时间与 `irreversible_at` 回落估算值。后缀只承载任务号，请求不含地址全文或收件人信息；只允许回填该设备自己的正式采购任务；页面下单时间优先，缺失时回落该任务的 `irreversible_at` 并标记时间来源，两者皆空则该条失败。
 - 已失败、已取消或演练完成的旧采购任务不单独占用主阶段；当前数据仍满足条件时恢复显示“可创建采购”，旧任务继续在采购管理留痕和按既有规则处理。
 - 未选择处理阶段时，商品列表仍先返回，当前页阶段和采购准备继续异步批量读取且不调用 AI Provider；选择阶段筛选时，服务端必须先对完整查询结果派生并筛选阶段，再计算总数和分页，不能只过滤当前页。
 
@@ -67,13 +76,13 @@ synchronized_at: 2026-09-05T04:13:06Z
 - 版本迁移会对历史存活店铺回填 `normalized_name = Normalize(display_name)`；回填只改匹配键且可重复执行。若两个存活店铺回填后会得到同一键，迁移必须整体失败并保留原数据，管理员先人工消除歧义后再执行，不能静默合并、删除或改变店铺启用状态。
 - 店铺可以从 SYB 真实货运单列表发现，也允许管理员手工补充。只有管理员可以新增、改名、启停和软删除，采购员等其他角色只读。
 - 没有任何启用店铺时，导入必须在读取凭据、建立会话、验证码 OCR 和任意 SYB 网络请求之前失败，并给出“请先启用店铺”的可读提示。
-- 同步必须先拉取并校验当天原始全量列表的总数、分页和唯一 ID，再按本次同步开始时固定的启用店铺快照过滤；过滤不能降低完整性校验的请求范围或容量上限。
+- 同步先预检全范围总数及上限，每页校验原始列表条数、合法 ID 和重复，再按冻结店铺快照获取明细并页事务保存；整日结束核对总数。过滤不能降低完整性校验范围，已保存不能冒充整日完整（#239，c6a962d，已于 2026-09-08 随 d403f3b 部署线上）。
 - 只有列表与明细响应的店铺名都非空且命中启用快照时才允许写入。明细店铺名为空、变化为未启用店铺或无法匹配时跳过，并计入跳过数量。
 - 停用或软删除店铺只影响后续导入，不删除历史 SYB 商品、虾皮商品或任务数据。已有错误导入数据的清理必须先给出精确 SQL 和影响行数，再由用户单独确认。
 
 ## SYB 后台导入记录
 
-- 导入由管理员创建，创建成功后立即转入后台执行；页面关闭不取消任务。采购员等其他已登录角色可以查看同步记录，不能开始导入。
+- 导入允许管理员和采购员（purchaser）创建，创建成功后立即转入后台执行；页面关闭不取消任务。其他已登录角色只能查看同步记录，不能开始导入（#236）。
 - 系统同一时刻只运行一个 SYB 导入任务。`syb_sync_run` 的唯一执行槽负责跨进程互斥，内存锁减少同一进程内的竞争；服务重启后遗留的执行中记录标记为“已中断”。
 - 导入失败或中断时保留已写入商品，记录明确的失败原因和已处理进度；重新导入相同范围按「订单号 + 明细 ID」覆盖，不产生重复商品。
 - 创建同步记录时冻结本次启用店铺的规范化匹配集合、展示名称快照及 SHA-256 哈希；后台执行必须只使用这一份快照，不得在开始后重新读取 `syb_shop`。同步详情保存并返回快照可用标记、快照店铺名称、哈希及各店铺“已导入/已跳过”数量。#212 之前的历史记录只有哈希和统计，明确标记为无完整快照。上述记录不保存账号、密码、Cookie、Token、验证码图片或 SYB 原始响应。
@@ -97,6 +106,8 @@ synchronized_at: 2026-09-05T04:13:06Z
 - PDD 完整规格选择器若无主滚动容器且尚未选择规格而没有已选摘要，仍可识别为非滚动规格面板，但必须同时出现至少两个已解析维度、至少两个可选项、唯一数量控件和唯一底部订单动作；缺少其中任一强证据时保持未识别。该订单动作仍仅作页面证据，永久禁止点击。
 - Agent 可扩展，但规则必须按任务类型授权：采集规则不能创建订单，采购规则只能使用独立审核的创建订单能力。当前项目不实现支付动作、入口或测试；支付、下单和订单相关文字可以作为只读页面证据配置，但不得成为点击目标。后续支付能力必须单独评估并至少具备显式能力位、服务端开关、单笔金额上限和人工授权。
 
+- #256（Android 0.9.73，实现 43703e0）：采集执行器可识别无“已选/请选择”摘要且当前仅一个规格标题的滚动规格面板。必须匹配 PDD 包名、任务详情 Activity 与选择器，无登录/验证等异常，并同时具备唯一有界规格滚动区域、唯一标题及非空候选、关闭、唯一数量输入/增减、支付区和唯一下方提交订单只读动作；缺失任一证据仍拒绝。此分支只由采集上下文启用，不生成虚假选中摘要，采购与其他解析调用维持原条件。订单动作仍仅作只读证据，采集绝不点击。
+
 ## 采集任务
 
 - 任务与结果共用 `collection_task` 主表，不建立独立 `collection_result` 主表。
@@ -168,7 +179,7 @@ synchronized_at: 2026-09-05T04:13:06Z
 
 - 管理端固定支持 `admin`（管理员）和 `purchaser`（采购员）两类业务角色；用户必须绑定一个存在且启用的角色，`role_id=0` 或停用角色不能创建或保存。
 - 采购员可读取设备状态，维护 PDD/虾皮商品和规格映射，查看与修正 SYB 商品，读取 SYB 店铺及同步记录，读取采集规则，创建/重置/删除采集任务，并创建、查看、重试及人工处理采购任务。
-- 仅管理员可管理用户、角色、菜单、接口、部门和岗位；停用设备或吊销 Device Token；新增、改名、启停、删除或发现 SYB 店铺；手动启动 SYB 同步；新增、编辑或删除采集规则；保存或测试 AI Provider 配置。
+- 仅管理员可管理用户、角色、菜单、接口、部门和岗位；停用设备或吊销 Device Token；新增、改名、启停、删除或发现 SYB 店铺；新增、编辑或删除采集规则；保存或测试 AI Provider 配置。
 - AI 规格匹配菜单对采购员硬排除：采购员不显示该菜单，角色配置也不能为采购员选中该模块；既有 API 权限不变，仍只允许读取是否启用，不得读取 Provider 地址、模型、API Key，也不得保存或测试。
 - GoAuto 菜单由代码维护的模块定义幂等写入系统菜单和菜单/API 关联；迁移只为采购员追加首次引入且默认开放的模块，不会把采购员人工取消勾选的既有模块重新加回。
 - 采购员 Casbin API 白名单由代码权限矩阵全量重建，不从角色菜单勾选反推；减少权限时旧策略必须删除。菜单勾选只控制可见模块，不能扩大采购员 API 权限。
@@ -230,7 +241,7 @@ synchronized_at: 2026-09-05T04:13:06Z
 - 定时任务失败时明确记录失败原因，不自动重试。服务重启后由既有启动恢复逻辑处理遗留的运行中记录。
 - 单次同步内部的 SYB 只读请求（货运单总数、列表和明细）遇到暂时网络故障、5xx 或异常响应时最多执行 3 次，分别退避 1 秒、2 秒，单次 HTTP 总超时 60 秒；这不等于失败任务自动重试。明确未登录、业务失败、数据完整性错误以及任何写操作均不自动重试。
 - SYB 商品页不再提供“导入”和“同步记录”快捷按钮，也不查询、展示或轮询同步状态；后台同步成功、失败或中断均不在商品页弹出消息，商品数据由用户主动查询或刷新获取。
-- 独立“SYB 同步记录”页面是同步结果的唯一 Web 展示位置，保留运行状态、进度、数量、失败原因和店铺统计；go-admin 定时任务中的 `GoAutoSYBHourlySync` 提供“执行记录”入口。管理员可在同步记录页人工发起覆盖昨天和今天的同步，采购员只读；人工与定时同步共用导入服务、执行记录和互斥，不排队、不并发，也不立即重试。
+- 独立“SYB 同步记录”页面是同步结果的唯一 Web 展示位置，保留运行状态、进度、数量、失败原因和店铺统计；go-admin 定时任务中的 `GoAutoSYBHourlySync` 提供“执行记录”入口。管理员和采购员可在同步记录页人工发起覆盖昨天和今天的同步，其他角色只读（#236）；人工与定时同步共用导入服务、执行记录和互斥，不排队、不并发，也不立即重试。
 
 
 ## cmautobuy 商品导入
@@ -257,13 +268,13 @@ synchronized_at: 2026-09-05T04:13:06Z
 ## Agent 受控重试采购
 
 - 当前设备只可重试自身最近 30 天内、服务端标记 `retryable=true` 的正式采购失败任务；列表和详情都只能发起单任务重试，不支持多选、批量或自动重试。
-- 普通“重试采购”调用既有 `AgentRetry → BatchRetry → Create`：原失败任务及其商品、目标规格、执行规格、价格和执行记录保持不可变；服务端根据当前 SYB、虾皮/PDD 档案、当前采购规则和当前设备创建不同 `purchase_task.id` 的新任务。
-- 新 SYB 采购任务继续遵循 #215 的强制当次规格探测，首趟不得直接使用历史任务的规格决策；当前档案、规则、价格、设备或能力门禁不通过时拒绝创建，旧任务保持失败状态。
+- 普通“重试采购”调用就地 `/reset`：复用原 `purchase_task.id`，只新增 attempt；新 attempt 使用当前有效采购规则和最新版 Agent 代码，商品、目标规格、执行规格、数量、价格、地址及既有规格决策等业务快照保持不变。
+- 就地重试不恢复已经消耗的真机规格探测资格；目标规格存在但对应执行规格为空时必须拒绝，不能进入正式采购阶段。需要按替代商品或已变化业务规格重新决策时，必须走明确的新任务流程。
 - 已出现 `order_submit_started` 证据，或存在不可逆时间、订单提交请求、PDD 订单号、下单时间的任务一律拒绝重试，并提示走既有“授权重新采购”流程，防止重复下单。
-- `requestId` 按“来源任务 + 请求”幂等；相同请求重放返回同一新任务，不重复创建。
-- Android 只在服务端 `retryable=true` 且状态为 `failed` 时显示普通“重试采购”。确认和成功反馈必须说明旧任务保留、新任务读取当前档案和规则、可能创建待付款订单且系统不会支付。
-- 历史兼容的就地 `/reset` 服务端入口不得把“目标规格存在但对应执行规格为空”的任务恢复到正式采购阶段；此类异常快照必须拒绝，并提示创建新任务。Android 普通重试不再调用该入口。
-- 替代商品匹配完成后的“继续采购”和 Admin 批量重试继续使用同一新任务语义；取消订单、修改既有订单和支付仍禁止。真机重试可能进入创建待付款订单流程，执行前必须再次取得人工授权。
+- `requestId` 按“任务 + 重置请求”幂等；相同请求重放返回同一 task ID 和 attempt，不重复递增。
+- Android 只在服务端 `retryable=true` 且状态为 `failed` 时显示普通“重试采购”。确认和成功反馈必须说明复用原任务、新增一次执行、使用当前规则但业务快照不变、可能创建待付款订单且系统不会支付。
+- `/reset` 不得把“目标规格存在但对应执行规格为空”的任务恢复到正式采购阶段；此类异常快照必须拒绝，并提示使用明确的新任务流程。
+- 替代商品匹配完成后的“继续采购”继续调用 `AgentRetry → BatchRetry → Create`，按当前档案创建不同 task ID；Admin 批量重试也保持新任务语义。取消订单、修改既有订单和支付仍禁止。真机重试可能进入创建待付款订单流程，执行前必须再次取得人工授权。
 
 ## Agent 状态页手动检查任务
 
@@ -341,7 +352,7 @@ synchronized_at: 2026-09-05T04:13:06Z
 
 ## SYB 采购强制当次规格探测（#215）
 
-- 每个新 SYB 采购任务固定执行“首趟只读探测 → 服务端确定性优先/必要时 AI → 固化任务级精确规格 → 第二趟正式采购”。首趟只打开一次浏览器商品链接；匹配期间当前设备保留给同一任务，不领取其他采购或采集任务；第二趟复用 PDD 当前页，不再次打开链接，也不严格核验标题、goodsId 或页面指纹，但仍要求 PDD 包名与商品/规格/订单页面结构安全证据。已有长期映射只作商品档案事实，不直接进入任务执行规格。
+- 每个新 SYB 采购任务固定执行“首趟只读探测 → 服务端确定性优先/必要时 AI → 固化任务级精确规格 → 第二趟正式采购”。首趟只打开一次浏览器商品链接；匹配期间当前设备保留给同一任务，不领取其他采购或采集任务。连续进入第二趟且当前仍有 PDD 商品页或规格面板强证据时复用当前页、不再次打开链接；手动同任务重试，或当前处于 Agent、其他应用及缺少上述强证据时，重新打开任务固化的商品 URL。复用或重开均不严格核验标题、goodsId 或页面指纹，但仍要求 PDD 包名与商品/规格/订单页面结构安全证据。已有长期映射只作商品档案事实，不直接进入任务执行规格。
 - 首趟候选与 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和幂等结果哈希关联；第二趟失败不得回到首趟循环探测。备货 `stock/direct_select` 没有 SYB 目标规格，继续使用用户逐字选择的档案规格，不进入本规则。
 - 候选和 Provider 结果仅保存颜色、尺码原始标签及结构化决策，不保存控件树、整屏截图、账号、地址、订单或支付数据；付款仍永久禁止。
 
@@ -397,7 +408,7 @@ synchronized_at: 2026-09-05T04:13:06Z
 
 - 规格入口与精确规格选择统一按“重新定位唯一目标 → 执行一次无障碍点击 → 读取新页面验证”执行；不得复用旧无障碍节点，不选择相近规格，也不在多候选时默认点击第一个。
 - 无障碍点击后页面完全无变化时，只允许对解析器已确认的安全规格入口或服务端下发且唯一命中的精确规格执行一次中心手势兜底。目标必须可见、启用、边界有效，手势后仍须以规格面板强证据或精确选中证据确认结果。
-- 页面发生变化但规格面板强证据不足时，不再继续手势或猜测页面，明确失败并只记录面板类型、候选数量和证据布尔值等无敏感标量。原始控件树、节点文字集合和整屏截图仍不得保存或上传。
+- 页面发生变化但规格面板强证据不足时，默认明确失败；#243 的同商品页安全入口恢复是限定例外：确认包/Activity 未变、商品标题非空且未变、入口来源与语义未变，无面板、关闭、数量、已选、支付、订单或页面异常信号时，重新定位入口并最多执行一次受控手势。整页普通动态节点变化不单独阻断该恢复；入口缺失或显式/嵌套入口歧义仍拒绝。商品标题一致是当前上下文约束，不宣称已从页面核验 goods_id。诊断只记录入口来源、点击结果/原因、恢复结果和面板数量/布尔等无敏感标量。原始控件树、节点文字集合和整屏截图仍不得保存或上传。
 - 规格已处于精确选中状态时不得重复点击。规格查找只在解析器唯一识别的规格面板容器内有限滚动，每次滚动后重新定位容器与目标；容器缺失、歧义、到边或验证失败均 fail-closed。
 - 中心手势兜底不得用于修改/保存地址、创建或提交订单、订单详情入口以及任何支付/付款目标；正式创建订单的一次性不可逆门禁与永久禁止支付规则不变。
 ## PDD 商品反向关联与继续订单采购（#161）
@@ -429,3 +440,163 @@ synchronized_at: 2026-09-05T04:13:06Z
 - 管理员可在设备管理对未停用设备发起“重置设备身份”。此动作不删除设备记录、不改变设备 ID、能力或已绑定的待领取任务；它立即使旧 Token 无效，并只生成一次、有效期 10 分钟的恢复码。
 - 恢复码仅显示给发起操作的管理员一次，服务端只保存摘要；不得进入列表、日志、任务记录、Android 持久化或普通接口。手机操作员必须在同一安装实例的 Agent 设置中手动输入。
 - 服务端只接受同一 `installId`、未过期且尚未使用的恢复码完成重新注册，成功后签发新 Token 并使恢复码失效。过期、重复使用、installId 不符或停用均明确失败；不能通过清空数据、直接改库或“吊销 Token”恢复原任务归属。
+
+- 自 #223 起，任务创建时把与冻结 SYB 目标对应的已确认商品规格映射保存为不可变的探测指导快照，但仍不得跳过首趟真机探测。探测完成后，每个角色先验证快照映射能否按既有规范化规则唯一对应当次候选，能对应时固化当次候选原文；不能对应时只对该未解决角色执行确定性匹配，仍无结果才调用 AI。已解决角色不重复交给 AI，任一最终值仍必须逐字属于当次候选；历史映射失效、规范化后歧义或角色不符时不得复用。候选完整但无法决策时提示“已采集到当前规格，但未能确定颜色或尺码映射”，不再误报候选不存在。
+
+## 采购商品深链入口（#232）
+
+- Android 采购新任务（含探测与人工重试）打开商品时，优先使用指定 PDD 包名的 ACTION_VIEW，并设置 NEW_TASK 与 CLEAR_TASK，以清理旧任务栈后交付该任务链接。清理的是 Activity 返回历史，不是清除应用数据或强制停止进程。
+- 直接启动失败（包括无可处理 Activity）时回退既有浏览器入口；启动请求被接受后仍由执行器验证稳定商品页面，停留首页不会仅因启动成功而判定完成。
+- 清栈不用于改地址后返回、下单后回到 PDD、订单核查；采集入口继续使用既有浏览器流程，避免绕过规则中的浏览器步骤。
+- 当前通用商品页面结构验证不能独立证明页面 goods_id；解析结果携带的任务 goodsId 不是页面回读证据。首次直接深链上线仍需以实际目标商品真机核对，ADB 实验不替代 Agent 上下文验证。
+## SYB 批量采购设备偏好（#233）
+
+- SYB 商品页“批量创建采购任务”按当前登录用户 ID、当前浏览器来源与 API 环境记住最近一次设备选择；主动清空也记忆为不指定设备。只保存设备 ID，不保存 Token、账号凭据或订单信息。
+- 弹窗打开后先按现有在线/可选/采购能力条件加载设备，再恢复选择并以相同设备预检。记忆设备当前不可用时保留偏好并提示用户重新选择或明确清空，不静默切换设备或自动领取。
+- 预检加载中、失败或记忆设备不可用时不能提交；过期预检结果不覆盖新的设备选择。服务端原有设备及采购资格校验不变。
+- 偏好只作用于此入口，不影响采集、其他创建入口和采购重试。浏览器存储失败时仍允许手动操作；刷新或关闭再打开浏览器可恢复，清理浏览器数据或沿用现有退出登录清理存储行为后需重新选择。
+
+## 客户端密钥与可编辑模块授权（#237）
+
+以下为提交 `71f7751` 已实现的规则；2026-09-07 本机已迁移并验证管理页面可用，2026-09-08 已随 d403f3b 完成线上迁移与部署，真实客户端密钥执行闭环尚未验证。
+
+- 仅管理员创建、查看、编辑授权或停用密钥。首版不提供密钥改名、到期、轮换、恢复启用、删除或任意接口授权。
+- 模块选择复用“采集采购/采采管理”现有 12 个业务模块；分组勾选只影响当前子模块，新菜单不会自动获得授权。客户端密钥管理、系统账号权限及支付不在可授权模块中。
+- 勾选模块默认只读，至少保留一个模块。读写仅开放清单中的普通写操作；同步、采集、采购、删除、导入、重解析、匹配、回写及切换当前采购规则分别独立授权，默认关闭。没有普通写接口的模块不允许勾选读写。
+- 编辑既有密钥不会更换密钥，名称和前缀只读；移除模块同时移除其动作。取消保留原授权；失败保留输入；版本冲突要求刷新重开。停用不可编辑或恢复。
+- 保存后新请求按最新授权校验，已经通过校验的在途请求可能完成，不追溯回滚。模块授权不是行级、店铺级或租户隔离，授予读取即允许读取该模块明确接口可返回的业务范围。
+- 用户于 2026-09-07 明确接受明文风险：密钥管理及客户端接口默认兼容 HTTP/HTTPS，无需开关。HTTP 会明文传输密钥与业务数据，建议优先使用 HTTPS；兼容不改变管理员身份与模块授权边界。
+- 客户端与 Admin 登录 JWT、Agent Device Token 独立。响应排除凭据及原始载荷字段；AI 设置只返回 enabled，不开放 Provider 配置读写或连接测试。设备仅开放列表，不开放身份重置、令牌或解锁接口。
+- 执行动作复用既有业务门禁、幂等参数及状态机；客户端采购 batch-retry 沿用 Admin 原有语义，不等同于 Agent 就地 reset。授权重采购、支付复核、取消订单等未列入接口不开放；永久禁止付款。
+- 创建响应丢失时不可找回完整密钥，应核对列表并停用可能已创建的记录，再明确创建新密钥，不能盲目自动重试。完整密钥只在创建结果弹窗内存中显示，关闭或离开页面清空，不写浏览器持久存储。
+
+## 打开采购规格面板后按需滚动（#238）
+
+- Android 0.9.60 / versionCode 73，代码 `58a6c1c` 起，规则 `openSpecPanel.swipeAfter` 保留格式校验与旧快照兼容，但不执行打开面板后的固定次数预滑动；不以“必须滑两次成功”作为进入规格探测/选择的条件。动作后的 `waitAfterMs` 仍生效。
+- 首趟规格探测和第二趟精确选择仍使用各自既有的按需横向/纵向、有界与稳定终止策略。取消预滑动不等于不探测隐藏规格，也不等于只看首屏。目标不存在、歧义、页面证据不足或必要的有界查找失败时仍明确失败。
+- 此调整覆盖所有已经安全识别打开的面板，不再仅特判 NON_SCROLLABLE_CONFIRMATION；不弱化面板验证、精确选中、地址、价格、任务租约、创建订单边界或禁止支付规则。
+- 其他动作的后置滑动沿用原行为，必需滑动失败仍返回 RULE_ACTION_FAILED。旧规则 JSON 不回写、不迁移；原任务 ID、历史 attempt、商品与规格快照不变。旧 APK 行为不变，需升级 Agent；本单未改线上规则或执行 CG68 真机采购。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；2026-09-08 已随 d403f3b 部署线上，未手动触发真实同步验收；#240 上游尾页超时尚未修复。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+
+## 商品页动态变化下的采购入口恢复（#243）
+
+实现 ec8b14a，Android 0.9.61/versionCode 74；已构建、未安装或真机验收。规格探测和正式采购共用入口函数，面板已打开时不新增点击；仍在同一商品上下文且安全入口存在时，一次重新定位手势恢复不再依赖整页完全静止。手势后仍未打开则报告入口无效果，不循环点击。恢复不能用于地址、创建订单、支付或未知面板，不修改面板分类器及正式下单边界。CG82/CG85 原首次点击未生效的底层原因尚待新日志和授权真机验证。
+
+
+## 同一颜色卡片重复选中节点（#244）
+
+实现 93aab6a，Android 0.9.62/versionCode 75；已构建并授权覆盖安装，真实采购效果待验收。仅在颜色维度完整精确目标已选中、但存在非目标已选候选时，识别同一卡片重复表达：卡片必须是滚动容器直接子级的可点击非滚动 android.view.ViewGroup，节点父链明确、可见启用且边界包含；其他冲突节点仅可为该卡片自身或其中的 ImageView。另一文字选项、另一张卡片、多个精确目标、目标未选中、父链/边界不明均不适用例外。额外核对内存源节点以拒绝被解析器按同名去重隐藏的跨卡片目标；不保存原始树。
+
+不删除规格数字、不模糊匹配、不改变通用解析器、尺码确认、摘要兜底、入口/滚动/地址/价格/创建订单。没有非目标选中冲突时继续原判断；仅把同卡片容器/图片的重复选中表达从冲突中排除，不新增点击。
+
+
+## 精确规格不可用与入口恢复诊断（#245）
+
+实现 ca815c3，Android 0.9.63/versionCode 76；已通过单元测试并构建，未安装、未进行真实采购验收。入口恢复沿用 #243 条件，拒绝时通过 entryRecovery=rejected;reason=<固定原因码> 区分页面身份、商品上下文、面板/支付区域、数量/摘要、标题、入口来源/文案、歧义、规则别名及可用性；不放宽条件，不新增点击。
+
+在规格面板识别出唯一完整精确候选且 available=false 时，立即返回既有 PURCHASE_SPEC_SAFE_TARGET_MISSING，提示目标颜色/尺码已售罄或当前不可选，未创建订单；已选中目标同样不能绕过不可用检查。只记录 dimension 和 exact_target_unavailable 固定结构证据，不记录规格原文或原始树。原有纵向与横向定位在此条件下本就停止，不能将本改动描述为修复“已识别售罄仍继续搜索”。未识别精确候选时继续既有有界搜索，不推断售罄，不替换规格；解析器、匹配规则、滚动预算、地址与下单流程不变。
+
+## 改地址返回后的动态提交按钮（#248）
+
+实现绑定 `c80c746`，Android 0.9.66 / versionCode 79；已通过 353 项 Android 单元测试并构建，尚未安装或进行真实采购验收。
+
+- 地址回读与最终提交按钮定位分开判断。旧“提交订单”“现在买，仅”“确认购买”识别继续优先；存在旧文案候选但歧义时不使用结构补充选择其中一个。地址确实缺失时保留既有有限恢复；地址及采购面板上下文已确认后，不因底部按钮文字变化而滚动规格列表。按钮缺失或不唯一使用 `PURCHASE_SUBMIT_TARGET_AMBIGUOUS` 提示按钮问题，不误报地址保存超时。
+- 结构补充只属于当前执行器中已完成地址修改后的返回流程，不能由其他页面或旧执行的地址证明启用。当前须为 PDD、地址后缀按既有规则回读唯一、地址入口唯一，并存在唯一数量输入或已选摘要；通过地址入口与该证据的最近共同祖先确定整个采购弹层，不把颜色/尺码滚动区域当成弹层。排除全屏大祖先、地址编辑、已知支付 Activity 及订单结果/支付页面，后续定位要求 Activity 与地址返回时一致。
+- 旧文案无候选时，只接受弹层底部固定区域内一个独立、可见启用、非滚动的可点击容器；不在规格滚动区内选择按钮，不取控件树末项，不使用固定屏幕点击坐标。文字与人民币金额子节点合并为一个按钮；支持如“复购价，”及非支付展示文字变化，但单独价格、多个操作按钮或支付/付款/地址/返回等非提交动作均不放行。
+- 地址返回检查、最终复核和提交共用目标定位。结构路径保留原文字节点为重新定位锚点，由已有无障碍点击重新查找其可点击父级；不新增下单手势兜底。最终复核成功后才允许该结构路径提交；提交前再次检查路径、类别、文字与边界，发生变化即停止；复核失败清除本地结构提交锚点。
+- 既有规格、数量、价格和地址复核，任务租约、服务端/本地不可逆边界及单次提交规则不变。结构识别不支持支付，不增加采购员操作、配置或审批；不改变 Admin、接口、数据库、规则 JSON、通用解析器及滑动执行器。原始控件树、整屏截图、地址全文和凭据不得落盘或上传。
+
+## 临时采集连续模式（#250）
+
+当前实现绑定 `37e8b56`，Agent 0.9.72 / versionCode 85。2026-09-09 用户批准 v5：按配置次数返回后切回 Agent，替代此前“识别并停留 PDD 首页”的方案；不保证 PDD 最终停在首页。代码、376 项 Android 单测及 Debug 构建通过，新版设置与完整真机闭环待验收。
+
+- 连续采集默认关闭，本机即时保存，失败恢复原值；开启后显示返回次数选择，1～5 次、默认 3，取消不改，写入失败恢复旧值。任务忙碌时开关和次数均禁用，选择提交时再次检查；无新增权限。只用于本次人工新建普通临时采集（source=agent_current_page、attemptNumber=1、无替换来源），Admin 下发、重试、替代与采购不参与。
+- 单任务执行开始固定返回次数。完整 completed、服务端提交确认且既有图片上传流程结束后，执行有限 Back，每次后等待 500ms；不要求识别商品/搜索/相机/首页，也不要求画面发生变化。图片上传仍沿用既有非致命行为，不因收尾更改结果。
+- 每次 Back 前检查前台仍为 PDD，读取页面后再次检查；离开 PDD 则停止余下 Back。次数完成、离开 PDD 或 Back 动作失败后，尝试打开 Agent 保持原 Tab，等待 500ms 并验证前台包名。动作失败不重试，不把请求启动成功直接当作切回成功。
+- 沿用风险页安全边界：登录/验证码/风控、地址编辑、订单详情或支付等证据时保留现场，不发送 Back 或强行切回；Activity 缺失、读取异常明确停止。以上例外不引入首页门禁。
+- 导航在原任务互斥和唤醒锁内完成，不变更租约/调度。返回失败只显示人工处理提示，不把成功采集改为失败或自动重采。
+- 失败、部分成功、提交未确认保留现场，不运行返回步骤，也不触发旧空闲返回倒计时。关闭开关保持原流程，采集间隔不变。
+- 不自动拍照、搜索或创建下一任务，不涉及采购/订单/付款；不使用深链、浏览器、OCR/VLM 或坐标兜底。
+
+## SYB 存疑规格候选核对（#251）
+
+实现绑定 `64b4205`，基线 main `fdd26af`；2026-09-09 代码与本地测试/构建通过，未部署、未重跑生产历史数据。
+
+- 原 Parse 的成功与失败行为不变，仅 uncertain 明细增加既有蝦皮规格候选核对。比较完整原文，沿用【备注】清理，允许全角逗号、逗号两侧空白及连续空白归一；颜色尺码可正序或倒序，使用逗号或空白分隔，只有唯一完整组合才改为 success。返回既有候选标签，不改写标签，不删除加号、不截断体重说明、不做近似匹配。
+- 单规格只有在候选确实仅包含该角色时通过；有两个角色时不能用单值补猜另一个角色。空/损坏候选、校验不通过、同角色多维、未知有值维度、多种组合或归一化碰撞，均保留原结果。候选必须已存在，不能用本次待确认输入生成候选再自我证明。
+- 同步入库 ApplyDetail、手动 Reparse 共用；成功核对不再次合并规格，因此不新增重复维度、不覆盖已有映射。人工确认仍优先，默认 Reparse 跳过人工与 AI 已确认值；原文保留。
+- #198 批处理原本先 Reparse，所以可直接复用本优化：能确定的不用调用 AI；仍不确定的按原 AI 流程处理。没有新增调度、调用额度或同步等待，不自动开启已有任务。
+- 不取消 uncertain/failed 状态，不改变采购可信度/可采购规则，不实现一键关联 PDD。部署后新同步或显式重新解析会使用新逻辑；本次没有执行生产批量更新。
+
+
+## 蝦皮详情匹配等待与回读（#254）
+
+实现绑定 `9088e6b`（2026-09-10，分支 fix/254-match-loading）；已通过合成数据测试，尚未合并 main 或发布线上。
+
+- AI 设置中的 timeoutSeconds=T 仍是单次 Provider 请求的上限。详情一键匹配的整次预算为 2T+10 秒，浏览器 POST 等待上限为 2T+20 秒；例如 T=60 时130/140秒，T=180时370/380秒。只保留现有一个 AI 设置入口，不新增时间配置框，也不自动改变管理员已保存的 T。
+- 超时上限不是固定等待。颜色/尺码串行执行且共用整次预算；正常部分匹配仍按原事务保存合格结果，AI异常在保存前返回时不提交本轮新映射。既有置信度、候选、人工确认映射保护和采购资格不变。
+- 前端超时、关闭或切换详情不代表后端已取消、未保存或已回滚；必须以回读结果为准，无法回读显示结果未确认，不自动重复匹配、不自动创建采购。
+- 单商品详情的成功/失败/超时/关闭重开都必须结束失效的等待状态；旧请求不得覆盖新商品或新操作。匹配进行期间本抽屉不能人工改映射，已有未保存草稿仍按原确认流程处理。
+- UI匹配提示的等待上限仅指POST，不含提交前GET及结果核对GET；结果核对也有限时，不能让失败提示再次陷入无限转圈。
+
+
+## SYB 行内一键关联最近采集（#253）
+
+实现绑定 `b1594dc`，2026-09-10；分支 feat/253-one-click-link，包含 #254 依赖。已完成合成数据测试及构建，未合并 main、未部署，不代表当前线上已具备此能力。
+
+- 未关联 PDD 且既有处理阶段提供“去关联”的 SYB 行可用一键关联；原人工入口不删除。首次点击选择采集手机后继续当前行，后续使用记忆手机；小箭头查看/切换手机，保存只修改全行共用偏好。取消不改变偏好、不执行关联。与批量采购设备选择互不影响。
+- 以所选手机的临时采集 source=agent_current_page 为范围，从 completed、completed_partial 中按 finished_at DESC、id DESC 取最新一条；失败/待执行/执行中不参与。最新为部分成功或商品停用、无可用规格时明确停止，不回退更旧商品，不切换其他手机。离线手机允许使用已有成功结果，停用或已删除手机需要重新选择。
+- 主动作开始冻结行、蝦皮商品和设备；服务端关联事务固定来源采集任务、PDD商品与规格版本。仅未关联时自动写入，已有或被其他操作改变的关联不覆盖。关联作用于蝦皮商品，因此共用该蝦皮档案的其他 SYB 明细也受影响；切换手机不会重绑已有商品，也不会改变在途操作。
+- 先保存关联，再复用现有颜色/尺码自动匹配及保存。有效已确认映射保留；普通部分匹配保存合格结果，AI故障不提交本轮新映射，但已保存关联保留。后续可从“去匹配”或详情人工继续。failed 且无人工/AI确认时不能自动跳过人工解析；uncertain 不统一拦截，仍以原采购准备规则为准。
+- 操作完成不保证立即可采购，必须刷新现有处理阶段；缺规格、缺映射、解析需确认或其他原资格不满足时继续显示真实待处理阶段。不自动创建采购任务、不下单、不支付。
+- 请求超时/网络中断只做有限回读，不重复提交；读回失败明确结果未确认，避免无限转圈。离开页面不代表后端停止或回滚。普通用户沿用现有采购员权限，无新管理员专属开关。
+
+## SYB 已关联商品的一键替换（#258）
+
+实现绑定 `2b01974`；部署与验收见 #258 发布证据。
+
+- 复用一键关联及小箭头的位置，保留原查看 PDD 商品。PDD 待采集、采集失败、停用或缺价格的对应处理阶段可替换；采集中、已创建/运行采购、成功或结果未知不开放。服务端提交时再次检查，不能只相信按钮。
+- 复用每用户/浏览器/API环境的手机偏好；首次选择继续当前行，小箭头仅切换偏好。预览仅选所选手机最新 completed/completed_partial 临时采集，部分成功或不可用不回退旧商品。确认后固定来源任务和目标，不改用新采集；来源状态、设备、目标规格或旧关联改变时拒绝。
+- 不同商品显示一次确认，包含旧/新商品、手机和共享蝦皮档案影响；取消不写入。同商品不弹替换确认且不重写关联，只继续匹配。共享该蝦皮档案的 SYB 明细使用新关联，历史采购任务快照不改。
+- 沿用既有更换关联和有效映射检查，再复用自动匹配保存。部分匹配、AI失败或解析需人工处理时保留已保存关联，显示真实处理阶段，不保证立即可采购、不自动创建采购。
+- 网络异常只有限回读，区分目标商品、仍为原商品和其他关联，不把“已有某个关联”误报为本次替换成功；不自动重发写请求。没有新增后台作业、订单或付款操作。
+
+## 辅助信息缺失的采集关联（#259）
+
+实现绑定 `e467706`，仅 Server；部署/验收见 #259。替代 #253/#258 中“部分完成一律拒绝”的限制，不改变 completed 原有路径。
+
+- completed_partial 的 missing 必须是非空合法列表且仅包含 salesText、shopName、reviewCount，才进入辅助信息兼容检查；title、规格/价格缺失、遍历截断、SKU数量上限及未知原因仍拒绝。
+- `shopeeproduct/partial_collection.go` 核对本次 task 的维度和值、可售SKU的完整标记/规格引用/非负价格、本次颜色价格，以及当前档案可选值由本次有效SKU覆盖，不能借旧档案合并残留的规格或价格通过。真实单维度允许，不虚构另一维度；本次明确报告缺少规格仍拒绝。
+- 一键关联、替换预览及确认提交共用验证。失败沿用409 LATEST_COLLECTION_UNAVAILABLE及现有提示，不回退更早采集、不换手机。状态 completed_partial 和 missing 原样保留；辅助字段缺失仍可在任务详情查看。
+- 无接口字段、数据库迁移、Android/Web或权限变更；普通人工关联与采购/AI资格不变。不将“允许关联”视为“已匹配或已采购”。
+
+## 采购单标题面板与地址就绪等待（#260、#261）
+
+实现绑定 #260 `3c1ffa4`（执行器回归测试 `7de4318`）、#261 `5ea07f1`，Android 0.9.74 / versionCode87，基于0.9.73。安装及真实采购验收以工单证据为准；不代表 main 的 Android 已整合这些分支。
+
+- 采购仅在安全规格入口点击返回SUCCESS后，记录本次页面包名/Activity作为内存上下文；开始新执行或页面身份改变时清除。`PddScreenParser` 的新增 purchaseEntryContext 默认关闭，仅该采购执行器传入；普通解析和采集原判定保留。
+- 当前仍为同一PDD Activity、商品ID非空、没有页面风险、没有选中摘要，且唯一有标题规格滚动区、一个维度有值，同时具有关闭、数量、支付展示区域与下单操作证据时，单标题可识别为NORMAL_SCROLLABLE。只是允许进入既有精确规格探测/选择，不执行下单或付款，不全局认可UNKNOWN，不增加入口重复点击或滑动。
+- 地址入口点击原有1000ms保留；地址列表等待增加唯一修改目标要求。点击修改和保存由500ms改为1000ms，其他通用动作间隔不变，无新配置项。
+- 修改后不再只见“详细地址”文字就立即写入。最多50次、每次间隔200ms读取（不含读取耗时），检查PDD页面风险；唯一可见启用有内容的详细地址EditText，连续两次路径、边界、内容及Activity相同才继续原输入流程。始终零个/多个或不稳定时失败，不取第一个候选。
+- 输入内容生成、输入后回读、保存后退出及返回规格面板、最终复核和单次下单边界不变。新增本机脱敏诊断 addressEditorCandidates / addressEditorPolls 两个整数，与task/attempt/device/ruleHash关联；不记录地址内容、原始树或整屏截图。
+- 仅Android；无Server/Web、共享API字段、数据库迁移或权限变化。真实采购、地址写入及订单创建不作为自动安装验证，不执行付款。
+
+### v2 商品入口补点与地址返回等待（#260、#261）
+
+2026-09-10 实现绑定 #260 `713111d`、#261 `d0a82f3`，Android 0.9.75 / versionCode88；真实采购效果以工单验收为准，非 main 合并声明。
+
+- 入口恢复不再把全页面支付方式展示文案单独视为支付页。当前包名/Activity、商品标题和安全入口必须与点击前一致，入口唯一且可用；已打开面板、关闭控件、数量、选中摘要、订单操作、风险/评价页面仍拒绝恢复。支付 Activity 或明确支付、订单、地址文本继续阻止补点。仅允许既有一次重新定位后的规格入口中心手势，随后仍验证面板，不循环、不扩展到地址保存或下单。
+- 保存地址后的确认读取、必要时一次返回后的确认读取，增加最多50次、间隔200ms的有界就绪检查，页面捕获耗时另计。连续两次同一Activity满足原地址回读与确认面板条件后继续；完整信息不要求滚动区域。已明确到地址列表时保留原返回路径，不等待列表出现下单按钮；返回后增加1000ms缓冲。
+- 就绪检查不修改原地址回读和结构下单入口规则；超时后只对既有识别的面板、唯一可用滚动区域执行原有有限滚动。零/多个区域仍失败，不凭地址入口或未知底部节点授权下单。最终精确规格、数量、价格、地址与单次下单边界不变。
+- 私有采购诊断新增布尔 savedAddressMatched、savedPanelMatched；整数 savedLegacySubmitCandidates、savedAddressCards、savedAddressTargets、savedScrollCandidates、savedConfirmationPolls。只记录标量并绑定task/attempt/device/ruleHash，不保存地址、原始树或整屏图。
+- CG109 v1现场读取未达到空闲状态，不能确认原失败具体缺哪项证据；v2覆盖迟到确认节点及可观测性，不将合成测试通过冒充真机修复验收。无Server/Web/API/迁移/权限变化，不需要服务器重启。

docs/04-local-development-and-verification.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Local-Development-and-Verification
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Local-Development-and-Verification.-
 wiki_revision: 835494c4a63a1494601658561fde1ab76657be3d
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-05T07:17:05Z
 <!-- gitea-wiki-mirror:end -->
 
 # 本地开发与验证

docs/05-common-changes.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Common-Changes
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Common-Changes.-
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-04T11:30:12Z
 <!-- gitea-wiki-mirror:end -->
 
 # 常见修改指南

docs/06-troubleshooting.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Troubleshooting
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Troubleshooting
-wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+wiki_revision: 18744477bfd17f396e8c76ec7a2fcc6720acdf6f
+synchronized_at: 2026-09-09T03:16:51Z
 <!-- gitea-wiki-mirror:end -->
 
 # 故障排查
@@ -85,3 +85,22 @@ sqlite3 -readonly agent-diagnostics.db "SELECT task_id,reason,color_row_count,co
 ```
 
 读取时记录设备、Agent 版本、任务号和规则快照；工单只回写查询得到的脱敏聚合数值。读取完成后删除本地导出副本。正式 APK 若不允许 `run-as`，停止排查并确认安全的只读诊断出口，不通过放宽应用安全配置或上传完整数据库绕过。
+
+## Android 采购规格入口本地诊断（#249）
+
+实现绑定 `99faf5a`，Agent `0.9.67`（versionCode 80）。单元测试与 Debug 构建已通过，新增版本真机留存/读取尚待验证；本节不属于上文既有实测结论。
+
+采购执行器启动后，在应用私有 `files/purchase_diagnostics/<taskId>_<attemptId>.jsonl` 保存白名单结构化入口诊断。元数据包含 taskId、attemptId、deviceId、agentVersion、phase、ruleHash（当前任务规则快照 SHA-256）、timestamp 和 elapsedMs。现有任务接口只有 attemptId，没有 attemptNumber；用 attemptId 对照服务端历史，不推算重试序号。
+
+证据仅包含入口来源枚举、候选数、点击结果/原因枚举、等待轮数、面板结构布尔值/计数，以及受控恢复是否执行及固定拒绝原因。没有商品标题、规格原文、地址、手机号、Cookie、Token、链接、原始控件树或截图。entryWaitMillis 是该等待循环累计的计划等待量；elapsedMs 才是自本次采购执行器诊断起点计量的实际耗时，timestamp 是后台写入时间。
+
+复用现有单线程诊断队列异步写入，写入/排队失败不改变采购结果；不新增点击、滑动、等待或采购门禁。最多保留最近 5 个 attempt 文件、每文件最后 128 条事件，超过 7 天的文件在服务启动或下次写入时清理。异常断电或存储故障仍可能丢失诊断，不能将日志缺失当成动作未执行；不上传 Admin，不增加服务端接口。
+
+仅对允许 run-as 的 Debug APK，在设备已连接且选定准确序列号后只读提取：
+
+```powershell
+adb -s <device-serial> shell run-as cn.ilapage.goauto.agent ls files/purchase_diagnostics
+adb -s <device-serial> exec-out run-as cn.ilapage.goauto.agent cat files/purchase_diagnostics/<taskId>_<attemptId>.jsonl
+```
+
+先列出文件，再读取本次任务/attempt 的准确文件名；不得扩大为导出所有应用数据或完整数据库。新版安装前的失败不会补生成日志；需要用户授权后重试才能产生新证据。Release 若禁止 run-as 则停止，不更改权限绕过；首版没有导出界面。该功能用于确定拒绝分支，并不代表已经修复对应采购故障。

docs/07-mvp-requirements.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Product-Requirements-Overview
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Product-Requirements-Overview.-
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-04T11:30:20Z
 <!-- gitea-wiki-mirror:end -->
 
 # 产品需求总览与当前 MVP

docs/08-agent-api-contract.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Android-Agent-API-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Android-Agent-API-Contract.-
-wiki_revision: 08a65eb49d3d1091f0be30e6f6d1a9372f6e5b37
-synchronized_at: 2026-09-05T04:13:06Z
+wiki_revision: 49dec4c35da793a32822a82e00f3b657757b6d44
+synchronized_at: 2026-09-07T13:35:25Z
 <!-- gitea-wiki-mirror:end -->
 
 # MVP 共享 API 契约
@@ -75,7 +75,7 @@ POST /api/admin/v1/syb-products/reparse-batch
 PATCH /api/admin/v1/syb-products/{productId}/correction
 ```
 
-`import` 仅允许管理员调用。请求体提交 `dateFrom`、`dateTo` 后创建持久化后台任务并立即以 `202` 返回 `runId` 和 `status=running`；关闭弹窗、刷新或离开页面不影响任务。没有启用店铺时必须在读取凭据、登录、验证码 OCR 和任意 SYB 网络请求之前返回 `422`。任意时刻只能有一条 `running` 记录，内存锁与数据库唯一执行槽共同阻止单进程和跨进程重复导入；冲突时返回正在执行任务的日期范围。
+`import` 允许已认证的管理员（admin）和采购员（purchaser）调用（#236），仍须通过 Casbin 权限校验；其他角色返回 403。采购员的 POST 权限由既有启动权限对账写入，不需要新增数据库迁移。操作人取已认证 claims，不接受客户端冒名。请求体提交 `dateFrom`、`dateTo` 后创建持久化后台任务并立即以 `202` 返回 `runId` 和 `status=running`；关闭弹窗、刷新或离开页面不影响任务。没有启用店铺时必须在读取凭据、登录、验证码 OCR 和任意 SYB 网络请求之前返回 `422`。任意时刻只能有一条 `running` 记录，内存锁与数据库唯一执行槽共同阻止单进程和跨进程重复导入；冲突时返回正在执行任务的日期范围。
 
 `sync-runs` 列表支持 `page`、`pageSize`、`status`、`dateFrom`、`dateTo`，详情返回日期范围、状态（`running` / `succeeded` / `failed` / `interrupted`）、处理天数、货运单/明细/新增/覆盖数量、店铺准入与跳过数量、店铺筛选快照哈希、按店铺的 `accepted` / `skipped` 统计、操作人和起止时间。列表和详情对已登录角色只读开放。服务启动时遗留的 `running` 任务改为 `interrupted`；中途失败或中断已经写入的数据保留，重新导入仍按唯一键覆盖。
 
@@ -472,7 +472,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 |---|---:|---:|---:|---:|
 | `openProduct` | 是 | 是 | 是 | 否 |
 | `verifyProduct` | 是 | 是 | 否 | 否 |
-| `openSpecPanel` | 是 | 是 | 是 | 否 |
+| `openSpecPanel` | 是 | 是 | 兼容读取、不执行（0.9.60+，见 #238） | 否 |
 | `selectSpec` | 是 | 是 | 是 | 否 |
 | `setQuantity` | 是 | 是 | 否 | 否 |
 | `verifyUnitPrice` | 是 | 是 | 否 | 否 |
@@ -486,7 +486,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 - 文字候选按控件文字或内容描述**精确匹配**；候选合并后必须唯一命中。点击动作只允许点击唯一文字节点或其最近的可点击父容器，不允许模糊匹配、猜测相近候选、改点兄弟节点。
 - 动作 `textAliases` 不能包含地址修改、创建/提交订单、订单号或支付相关文字，防止用安全 action 绕过危险动作类型和能力门禁。只读识别字段使用独立校验：允许订单和支付证据，仍拒绝修改地址、收货地址，并沿用各字段声明的数量、长度、去重和空白限制。
 - `waitAfterMs` 表示动作成功后的等待时间，范围为 0～30000 毫秒；省略时为 0。
-- `swipeAfter` 表示动作成功后执行一个有限滑动计划。`direction` 只能为 `up` / `down` / `left` / `right`，`count` 为 1～10，`durationMs` 为 100～2000，`intervalMs` 为 0～5000 且省略时为 0。
+- `swipeAfter` 通常表示动作成功后执行一个有限滑动计划；Android 0.9.60+ 的 `openSpecPanel` 例外，只兼容读取而不执行预滑动（见 #238）。`direction` 只能为 `up` / `down` / `left` / `right`，`count` 为 1～10，`durationMs` 为 100～2000，`intervalMs` 为 0～5000 且省略时为 0。
 - 未在矩阵中授权的 action/参数组合、未知字段、空候选和越界值一律拒绝。`updateShippingAddress`、`createOrder`、`readOrderResult` 等正式动作在其独立高风险契约完成前不接受上述参数。
 - 旧的仅含 `actions[].type` 的规则继续有效：候选使用 Agent 内置语义，等待为 0，不执行动作后滑动。
 - 服务端保存创建任务时收到的完整原始规则快照；规则后来更新为规则 B，不会改变已有任务中的规则 A 快照。
@@ -535,11 +535,11 @@ Admin 列表与详情由 #35 实现；#67 增加 `shopeeOrderNoSnapshot` 的列
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/order-submit-started` | 创建订单前先落不可逆标记；演练任务和 `spec_probe` attempt 永远拒绝 |
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/result` | 请求体携带 `taskAttemptId` 和 `requestId`；幂等提交演练、规格探测、订单或失败结果 |
 
-自 #215 起，新建 SYB 采购任务不再从 PDD 档案创建持久匹配工作项，也不在首次派发前调用外部 AI；部署前已存在的 `purchase_spec_match_work_item` 继续按原状态兼容处理。新任务首次 `start` 固定得到 `phase=spec_probe`，Android 通过浏览器打开任务链接一次并经既有结果字段回传当次候选；匹配成功后的第二次 `start` 才得到 `phase=purchase` 和服务端固化的精确 PDD 原始标签。第二阶段直接复用首趟保留的 PDD 页面，不再次打开浏览器链接，也不以标题、goodsId 或页面指纹做严格同页校验；仍必须通过 PDD 包名和商品/规格/订单页面结构安全证据。Android 不接收 AI 配置或自由决策权限。
+自 #215 起，新建 SYB 采购任务不再从 PDD 档案创建持久匹配工作项，也不在首次派发前调用外部 AI；部署前已存在的 `purchase_spec_match_work_item` 继续按原状态兼容处理。新任务首次 `start` 固定得到 `phase=spec_probe`，Android 通过浏览器打开任务链接一次并经既有结果字段回传当次候选；匹配成功后的第二次 `start` 才得到 `phase=purchase` 和服务端固化的精确 PDD 原始标签。连续第二阶段仅在当前 PDD 页面仍有商品页或规格面板强证据时复用首趟页面、不再次打开浏览器链接；手动同任务重试，或当前为 Agent、其他应用及缺少上述强证据时，Android 重新打开任务 `urlSnapshot`。两种路径都不以标题、goodsId 或页面指纹做严格同页校验，仍必须通过 PDD 包名和商品/规格/订单页面结构安全证据。Android 不接收 AI 配置或自由决策权限。
 
 结果提交至少关联 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和结构化结果。相同 attempt 的相同结果重复提交返回同一事实；不同内容拒绝覆盖。每个新 SYB 采购任务的第一趟只读遍历当次 PDD 规格面板并提交颜色、尺码原始候选，随后释放数据库租约和已知账号运行守卫并进入 `spec_probe_pending`，但服务端调度与 Agent 必须把当前设备保留给同一采购流程：`next` 返回该等待任务，Agent 只轮询等待，不领取其他采购或采集任务。服务端只以任务冻结的 SYB 目标和当次候选先做繁简、空白/全半角/大小写及公斤/斤的唯一确定性匹配，仍无唯一结果才调用 AI。AI 的颜色和尺码必须逐字属于当次对应候选，否则按无匹配失败。第二趟只会收到服务端固化的精确 PDD 原始标签；Agent 复用首趟仍打开的页面，只在已打开的规格面板内做有限纵向滑动，每次重新读取节点并按完整规范化文字精确点击，连续没有新证据或达到上限即停止。尺码的任务目标与页面值在选择边界使用同一安全尾价规范化；不改写任务快照，规范化为空、仍含货币符号或多个原始候选折叠为同一值时安全失败。
 
-任务 payload 的必传布尔字段 `specResolutionAllowed` 是 Android 是否可以提交规格探测的唯一资格事实。新建 `taskType=syb_order` 任务必须由声明 `purchase.spec-probe.v1` 的规则创建，初始 `SpecDecisionRequestID` 为空且 `specSource=unresolved`，首趟返回 `true`；当次决策固化后返回 `false`。`stock`、`direct_select`、已固化规格决策、能力缺失及其他组合均返回 `false`。历史兼容的就地 `/reset` 保留 `SpecDecisionRequestID`、目标规格、映射规格和规格决策快照，不能恢复探测资格；映射不完整时必须拒绝，不能进入正式采购阶段。普通 Agent 重试创建新任务并重新取得一次探测资格。Android 不得根据映射是否非空、错误文字或本地判断扩大资格。
+任务 payload 的必传布尔字段 `specResolutionAllowed` 是 Android 是否可以提交规格探测的唯一资格事实。新建 `taskType=syb_order` 任务必须由声明 `purchase.spec-probe.v1` 的规则创建，初始 `SpecDecisionRequestID` 为空且 `specSource=unresolved`，首趟返回 `true`；当次决策固化后返回 `false`。`stock`、`direct_select`、已固化规格决策、能力缺失及其他组合均返回 `false`。普通 Agent 重试使用就地 `/reset`，保留 `SpecDecisionRequestID`、目标规格、映射规格和规格决策快照，不能恢复探测资格；映射不完整时必须拒绝，不能进入正式采购阶段。只有替代商品“继续采购”或 Admin 批量重试创建的新任务才按 #215 重新取得一次探测资格。Android 不得根据映射是否非空、错误文字或本地判断扩大资格。
 
 Android 规格失败使用五个稳定阶段：`PURCHASE_SPEC_TARGET_NOT_VISIBLE`、`PURCHASE_SPEC_TARGET_AMBIGUOUS`、`PURCHASE_SPEC_SAFE_TARGET_MISSING`、`PURCHASE_SPEC_CLICK_FAILED` 和 `PURCHASE_SPEC_SELECTION_UNCONFIRMED`。`PURCHASE_SPEC_CLICK_FAILED` 的 `errorMessage` 只允许稳定子原因 `root_unavailable`、`target_stale`、`no_clickable_ancestor`、`action_click_false` 或 `unknown`；其他阶段的消息不得包含规格原文、坐标、控件树或截图。只有 `PURCHASE_SPEC_TARGET_NOT_VISIBLE && specResolutionAllowed=true` 可以提交规格探测，其他四态直接提交真实失败，服务端原样保留稳定阶段/子原因。旧 Agent 在资格已用尽后再次提交 `spec_probe_completed` 时，服务端以 `PURCHASE_SPEC_REPROBE_REJECTED` fail-closed，释放租约并保留第一次规格决策，不再冒充新的选择根因或再次派发。无匹配、候选不完整、歧义或 Provider 异常同样使任务失败。`order_result_unknown` 只允许管理员或采购员人工解除，永不自动重派。
 
@@ -617,9 +617,9 @@ Content-Type: application/json
 - 响应返回 `taskId`、`attemptNumber`、`status` 和可选的 `replayed`，不返回规则快照、URL、Token、控件树或截图。
 - 设备离线、任务非终态、设备忙、规则不可用或同商品存在活动任务时返回明确冲突，不支持离线排队。
 
-## Agent 受控采购重试（#95、#157、#217）
+## Agent 受控采购重试（#95、#157、#217、#225）
 
-普通失败任务的“重试采购”和替代商品匹配完成后的“继续采购”统一调用新任务接口：
+替代商品匹配完成后的“继续采购”调用新任务接口；普通失败任务的“重试采购”使用下方同任务重置接口：
 
 ```http
 POST /api/agent/v1/purchase-tasks/{taskId}/retry
@@ -647,11 +647,11 @@ Content-Type: application/json
 - 来源任务不得存在 `irreversibleAt`、`orderSubmitRequestId`、PDD 订单号或下单时间。已有任何不可逆证据时返回 `PURCHASE_RETRY_UNSAFE`，提示走“授权重新采购”，不得创建新任务。
 - `AgentRetry → BatchRetry → Create` 保留来源失败任务并创建不同 `purchase_task.id` 的新任务；新任务重新读取当前 SYB、虾皮/PDD 档案、当前采购规则、价格保护和设备能力，重新生成地址后缀，不继承来源任务的旧规格决策。
 - 新 SYB 任务按 #215 固定从 `spec_probe` 开始。相同 `requestId` 重放返回同一新任务且 `replayed=true`；不同 requestId 再次请求受同一 SYB 商品最新任务和设备并发门禁约束。
-- Android 只在服务端 `retryable=true` 且状态为 `failed` 时显示普通“重试采购”；确认文案和成功反馈必须说明原任务保留、新任务使用当前档案与规则、可能产生待付款订单且系统不会支付。
+- 本新任务接口只供替代商品“继续采购”；确认和成功反馈必须说明保留来源任务、按当前替代商品档案创建新任务、可能产生待付款订单且系统不会支付。
 - 规则无效、当前档案或价格不合格、设备离线/忙、能力不匹配、任务状态变化或同一 SYB 商品已有更新任务时，服务端明确拒绝且不得部分创建。
 - Admin 批量重试继续使用相同的新任务语义；替代商品“继续采购”仍在 AgentRetry 前额外验证替换分项与继续采购资格。
 
-历史兼容的就地重置接口仍保留，但 Android 普通重试不再调用：
+普通失败任务的“重试采购”调用同任务重置接口：
 
 ```http
 POST /api/agent/v1/purchase-tasks/{taskId}/reset
@@ -661,8 +661,8 @@ Content-Type: application/json
 {"requestId":"<uuid>"}
 ```
 
-- `/reset` 只允许安全失败、无不可逆证据且不存在更新任务的原任务；它保留原业务快照并刷新当前规则。
-- 目标颜色存在但映射颜色为空，或目标尺码存在但映射尺码为空时，必须返回 `PURCHASE_SPEC_MAPPING_REQUIRED`，不得创建 `purchase` attempt 或下发正式采购 payload。
+- `/reset` 只允许当前设备的安全失败任务且不得存在不可逆证据或更新任务；它复用原 `purchase_task.id`、新增 attempt、刷新当前有效规则，并保持商品、目标/执行规格、数量、价格、地址和规格决策等业务快照不变。
+- 目标颜色存在但映射颜色为空，或目标尺码存在但映射尺码为空时，必须返回 `PURCHASE_SPEC_MAPPING_REQUIRED`，不得创建 `purchase` attempt 或下发正式采购 payload。相同 `requestId` 重放返回同一 task ID 和 attempt，不重复递增；Android 必须明确提示复用原任务和新的 attempt 序号。
 - 两个入口都不执行支付。真机调用可能创建待付款订单，必须先取得人工授权。
 
 ## Agent 任务记录范围与同步（#99）
@@ -865,3 +865,113 @@ X-GoAuto-Device-Recovery-Code: <one-time-code>
 仅管理员可以对未停用的既有设备发起身份重置。服务端立即使旧 Device Token 无效，并生成 10 分钟内仅能使用一次的恢复码；恢复码只在该管理员操作的响应中返回一次，服务端仅保存不可逆摘要，管理端设备列表、日志、任务接口和 Android 本地持久化均不得保存或返回原文。管理员将恢复码经受控人工渠道输入同一安装实例的 Agent 设置页。
 
 Agent 携带既有 Token（可已失效）及恢复码重新调用注册接口。服务端必须同时校验同一 `installId`、未停用状态、恢复码摘要、未过期和未使用；成功后使用原 `deviceId` 写入新 Token 摘要并返回一次新 Token，清除恢复码摘要和有效期。旧 Token 与恢复码都立即失效，已分配的 pending 采集或采购任务保持原 `deviceId`，不创建替代设备记录。缺少或错误恢复码仍为 `DEVICE_INSTALL_ID_CONFLICT`；过期码为 `DEVICE_RECOVERY_EXPIRED`；停用设备为 `DEVICE_DISABLED`。
+
+自 #223 起，新建 SYB 任务在保持 `mappedColor` / `mappedSize` 为空和首趟 `spec_probe` 不变的同时，把创建时与目标规格对应的 confirmed 商品映射冻结为仅供服务端决策的指导快照。服务端收到当次候选后按角色验证该快照：只有规范化后唯一对应当次候选时才复用，并固化当次候选原文；否则该角色继续执行确定性匹配，仍未解决才把该角色及其封闭候选交给 AI。已解决角色不得重复发送给 AI，最终颜色和尺码仍须逐字属于各自当次候选。任务决策快照通过 `roleSources` 记录每个角色的 `manual_mapping` / `exact_match` / `ai_match` 来源；任务级 `specSource` 使用现有枚举汇总，不新增 Agent 决策权限。
+
+## 客户端 API 与管理员密钥管理（#237）
+
+实现基线 `71f7751`；以下接口已通过隔离测试；2026-09-07 本机 MySQL 迁移及管理员通过 HTTP 读取列表、模块目录已验证，真实密钥创建/编辑/停用及业务访问仍未联调，线上尚未部署。Android 接口不变。
+
+### 管理接口
+
+前缀 `/api/admin/v1/client-keys`，要求 Admin JWT 和 admin 角色，默认接受 HTTP/HTTPS，响应 `Cache-Control: no-store`。
+
+| 方法与相对路径 | 输入 | 成功 data |
+|---|---|---|
+| GET 空路径 | page，固定每页 20 | items、total、page、pageSize |
+| GET /modules | 无 | 模块数组：key、title、group、writable、actions |
+| POST 空路径 | name（1～80 字符）、grants | key 元数据与仅本次返回的 secret |
+| PATCH /:keyId/grants | version、grants | 更新后的元数据 |
+| POST /:keyId/disable | version | 停用后的元数据 |
+
+授权示例：`{"module":"pdd_products","write":false,"actions":[]}`；grants 为非空数组。元数据包括 id、name、prefix、enabled、version、grants、createdBy、updatedBy、createdAt、updatedAt、lastUsedAt，不返回摘要或完整密钥。管理请求只接受单个 JSON 对象、拒绝未知字段、最大 64 KiB。成功 code=200；无效输入 422、不存在 404、授权版本冲突或已停用 409。
+
+### 客户端访问与错误语义
+
+- 前缀 `/api/client/v1`，只接受 `Authorization: Bearer <客户端密钥>`，不接受 Cookie 或 URL 凭据，不与 JWT、Device Token 通用。
+- 根据用户 2026-09-07 的明确确认，管理与客户端接口在所有环境默认接受 HTTP/HTTPS，不设置协议开关，也不依赖 X-Forwarded-Proto 或 GOAUTO_TRUST_FORWARDED_PROTO。HTTP 明文传输密钥及业务数据，优先使用 HTTPS；不影响其他接口各自的协议要求。
+- 不再因 HTTP 返回 426；401 为缺失、无效或停用密钥；403 为模块/动作未授权；400 为查询参数携带凭据；503 为认证或审计暂不可用。业务错误沿用各既有接口。
+- 一般请求体最大 16 MiB；响应只支持有限 JSON（32 MiB），递归过滤凭据与原始载荷字段。不支持直接流式/二进制文件接口。响应不可序列化或超限时返回 502；业务可能已执行，必须先核对结果，不要自动重试。
+- 通过密钥认证的请求由服务端生成 `X-Client-Request-Id` 关联审计；它不是业务幂等键，原业务接口要求的 requestId 等字段仍须提供。允许请求必须先落审计意图；完成状态更新失败可留下 status=0。无效密钥没有 key_id 关联审计；拒绝授权的 403 审计为尽力记录。
+- GET `/ai-matching-settings` 只返回 `data.enabled`。POST `/ai-matching-settings/resolve` 接受 targetColor、targetSize、colors、sizes；每组最多 200 项，每个值最多 255 字符，总请求最大 64 KiB；确定性优先，必要时使用当前 Provider，返回 mappedColor、mappedSize、source；不保存映射、不创建任务，无法可靠匹配返回 422 安全提示。
+
+### 明确开放的接口清单
+
+下表路径均相对 `/api/client/v1`；普通业务请求字段沿用本文对应 Admin 业务契约。read=选中模块，write=模块读写，其他值均需 actions 逐项授权。没有列出的 Admin 接口不能用客户端密钥调用；新增 Admin 路由不会自动开放。
+
+| 方法 | 路径 | 模块键 | 能力 |
+|---|---|---|---|
+| POST | `/ai-matching-settings/resolve` | ai_matching | match |
+| GET | `/devices` | devices | read |
+| GET | `/pdd-products` | pdd_products | read |
+| GET | `/pdd-products/:productId` | pdd_products | read |
+| POST | `/pdd-products` | pdd_products | write |
+| PATCH | `/pdd-products/:productId` | pdd_products | write |
+| GET | `/shopee-products` | shopee_products | read |
+| GET | `/shopee-products/:productId` | shopee_products | read |
+| POST | `/shopee-products` | shopee_products | write |
+| PATCH | `/shopee-products/:productId` | shopee_products | write |
+| POST | `/shopee-products/:productId/link-pdd` | shopee_products | write |
+| POST | `/shopee-products/:productId/specs/values` | shopee_products | write |
+| PUT | `/shopee-products/:productId/specs/mapping` | shopee_products | write |
+| DELETE | `/shopee-products/:productId/specs/values` | shopee_products | delete |
+| DELETE | `/shopee-products/:productId/specs/mapping` | shopee_products | delete |
+| POST | `/shopee-products/batch-delete` | shopee_products | delete |
+| POST | `/shopee-products/:productId/specs/mapping/auto-match` | shopee_products | match |
+| POST | `/shopee-products/:productId/specs/mapping/confirm` | shopee_products | match |
+| GET | `/syb-products` | syb_products | read |
+| GET | `/syb-products/:productId` | syb_products | read |
+| PATCH | `/syb-products/:productId/correction` | syb_products | write |
+| POST | `/syb-products/:productId/reparse` | syb_products | reparse |
+| POST | `/syb-products/reparse-batch` | syb_products | reparse |
+| GET | `/syb-products/sync-runs` | syb_sync_runs | read |
+| GET | `/syb-products/sync-runs/:runId` | syb_sync_runs | read |
+| POST | `/syb-products/import` | syb_sync_runs | sync |
+| GET | `/syb-inner-codes` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/:recordId` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/match-jobs/:jobId` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/apply-batches/:batchId` | syb_inner_codes | read |
+| POST | `/syb-inner-codes/rematch` | syb_inner_codes | match |
+| POST | `/syb-inner-codes/import` | syb_inner_codes | import |
+| POST | `/syb-inner-codes/batch-delete` | syb_inner_codes | delete |
+| POST | `/syb-inner-codes/apply-preview` | syb_inner_codes | writeback |
+| POST | `/syb-inner-codes/apply` | syb_inner_codes | writeback |
+| POST | `/syb-inner-codes/:recordId/recheck` | syb_inner_codes | match |
+| GET | `/syb-shops` | syb_shops | read |
+| POST | `/syb-shops` | syb_shops | write |
+| PATCH | `/syb-shops/:shopId/name` | syb_shops | write |
+| PATCH | `/syb-shops/:shopId/enabled` | syb_shops | write |
+| DELETE | `/syb-shops/:shopId` | syb_shops | delete |
+| GET | `/collection-rules` | collection_rules | read |
+| POST | `/collection-rules` | collection_rules | write |
+| PATCH | `/collection-rules/:ruleId` | collection_rules | write |
+| DELETE | `/collection-rules/:ruleId` | collection_rules | delete |
+| GET | `/purchase-rules` | purchase_rules | read |
+| GET | `/purchase-rules/current` | purchase_rules | read |
+| POST | `/purchase-rules` | purchase_rules | write |
+| PATCH | `/purchase-rules/:ruleId` | purchase_rules | write |
+| DELETE | `/purchase-rules/:ruleId` | purchase_rules | delete |
+| PUT | `/purchase-rules/current` | purchase_rules | activate |
+| GET | `/collection-tasks` | collection_tasks | read |
+| GET | `/collection-tasks/:taskId` | collection_tasks | read |
+| POST | `/collection-tasks` | collection_tasks | collect |
+| POST | `/collection-tasks/batch` | collection_tasks | collect |
+| POST | `/collection-tasks/:taskId/reset` | collection_tasks | collect |
+| DELETE | `/collection-tasks/:taskId` | collection_tasks | delete |
+| GET | `/purchase-tasks` | purchase_tasks | read |
+| GET | `/purchase-tasks/:taskId` | purchase_tasks | read |
+| POST | `/purchase-tasks/batch-preview` | purchase_tasks | purchase |
+| POST | `/purchase-tasks` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/batch` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/batch-retry` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/stock` | purchase_tasks | purchase |
+| GET | `/ai-matching-settings` | ai_matching | read |
+
+### openSpecPanel 后置滑动兼容与诊断（#238）
+
+版本边界：Android 0.9.60 / versionCode 73，代码 `58a6c1c`。不修改 JSON schema、能力标识、任务接口或已有快照哈希。`openSpecPanel.swipeAfter` 仍按 direction/count/durationMs/intervalMs 原约束校验；解析成功后不执行该准备性滑动，`waitAfterMs` 保留。其他动作后置滑动沿用旧执行语义。旧 Server 可继续下发原快照；旧 APK 仍按原策略执行，不能将本契约描述当作旧设备已获得兼容。
+
+规格探测与精确选择自行负责按需有界滚动，原始候选、精确点击和选中复核不变。跳过预滑动不作为规格探测成功或订单创建证据。
+
+本地 `GoAutoPurchasePanel` 脱敏结构日志关联 task、attempt、device、rule（规则 SHA-256），不上传原始页面。新增事件：`postSwipe=skipped;action=openSpecPanel;reason=spec_panel_on_demand;panel=<枚举>`；其他必需滑动失败为 `postSwipe=failed;action=<动作枚举>;direction=<方向枚举>;swipeIndex=<本动作内第几次滑动>;reason=<固定分类>`。
+固定失败分类：unknown、root_unavailable、no_scrollable、invalid_bounds、gesture_unsupported、gesture_rejected、gesture_cancelled、gesture_timeout。日志不含规格值、节点文本、坐标、地址、订单、凭据、原始树或截图；结果错误码仍为 RULE_ACTION_FAILED，现有结果提交字段不变。

docs/09-delivery-issues.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Delivery-Issues
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Delivery-Issues.-
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-04T11:30:28Z
 <!-- gitea-wiki-mirror:end -->
 
 # 当前 MVP 交付工单索引

docs/10-real-device-acceptance.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: OnePlus-Real-Device-Acceptance
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/OnePlus-Real-Device-Acceptance.-
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-04T11:30:32Z
 <!-- gitea-wiki-mirror:end -->
 
 # 一加真机验收记录

docs/11-pdd-detail-rule-migration-analysis.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: PDD-Detail-Rule-Migration-Analysis
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/PDD-Detail-Rule-Migration-Analysis.-
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-04T11:30:37Z
 <!-- gitea-wiki-mirror:end -->
 
 # PDD 商品详情采集规则迁移分析

docs/12-syb-erp-interface.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: SYB-ERP-Interface-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/SYB-ERP-Interface-Contract.-
-wiki_revision: ad9adc22e69e48c9a8fd87d7121066eecca55fd6
-synchronized_at: 2026-09-05T04:13:06Z
+wiki_revision: a4f4ab200af052bab7ffbabe267238528bcd7cf9
+synchronized_at: 2026-09-07T07:02:57Z
 <!-- gitea-wiki-mirror:end -->
 
 # 12 顺云宝（SYB）ERP 接口契约
@@ -228,9 +228,20 @@ Admin 默认 `max_matches = 10000`，可以在配置中调整；上限针对整
 读取完整明细并按既有 upsert 保存，但本次同步仍记为失败、明确提示当天未形成
 稳定快照且不推进游标，下一次继续覆盖今天。任何尝试都不得突破 `max_matches`；
 网络/业务错误、非法 ID 或不完整明细不属于可放宽的快照漂移。
+`[必须，#235]` 当天跨页重复 ID 纳入上述最多 3 次列表快照尝试（含首次），
+不增加另一层重试次数。发现跨页重复后丢弃本次列表，从预检总数和第一页重新开始，
+使用全新 ID 集合；最后一次仍重复时直接失败，不得去重后按成功或降级数据保存。
+已经完成的历史日期保持其已有结果，不重复拉取；历史日期重复不适用此恢复。
+每页先检查非法 ID 和页内重复，再检查跨页重叠；同页同时存在页内重复和跨页重叠时
+仍作为硬错误停止。原有总数漂移/短页的合法唯一列表降级保存条件保持不变。
+重复诊断只记录日期、当天尝试序号、首次/当前页码与行号、start、pageSize、
+expectedTotal 和已获取唯一数量，不记录真实重复 ID、原始响应或个人数据。
 
 ### 4.4 统一日期范围同步与覆盖游标
 
+GoAuto 同步记录页的立即同步允许管理员和采购员（purchaser）使用（#236），固定覆盖昨天和今天；其他已登录角色仅可查看记录。复用既有同步互斥、日期校验、启用店铺筛选及操作人审计，不授予店铺配置、凭据或定时任务管理权限。权限代码发布并完成启动对账后生效。
+
+
 页面只有一个同步入口，操作员确认工具条上的开始日和结束日后发起。首次打开页面
 固定默认昨天到今天，不因 `last_synced_at` 更早而自动扩大范围；需要补历史缺口时
 由操作员明确选择日期，单次仍不得超过 31 天。

docs/13-deployment-and-operations.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-and-Operations
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-and-Operations.-
-wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+wiki_revision: f951dbc8b6a555cbf8f44cda073910406ba55191
+synchronized_at: 2026-09-07T09:43:56Z
 <!-- gitea-wiki-mirror:end -->
 
 # 部署与运维
@@ -70,3 +70,26 @@ Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、
 - 服务启动会将上次进程遗留的 `running` 执行记录标记为 `interrupted`。该恢复依赖当前线上每个数据库只运行一个调度器实例；扩展为多调度器前必须另建工单引入实例租约，不能直接复用此判断。
 - 排错从 Admin 定时任务页单选任务后进入“日志”，按状态和开始时间查询。记录只含稳定错误码和脱敏摘要；需要定位细节时查看受控服务日志，不得把任务参数、Provider 配置/响应、密钥或业务原始数据复制进执行历史。
 - 当前没有执行历史删除接口和自动保留策略；删除定时任务不删除历史。数据库容量治理需要另建工单评估。#198 的 `GoAutoSYBSpecAIParse` 在 #199 发布和迁移后仍保持关闭，启用必须由管理员另行确认。
+
+## 客户端密钥部署与验证（#237）
+
+实现基线 `71f7751`；2026-09-07 已按用户授权完成本机 MySQL 迁移、管理员菜单写入和 Server/Web 构建重启；管理页面 HTTP 列表与模块加载已验证。线上仍未部署。
+
+- 发布前须单独授权追加迁移 `server/cmd/migrate/migration/version-local/1788798000000_client_api_key.go`，按既有迁移流程创建 client_api_key、client_api_key_audit 和“采采管理/客户端密钥”管理员菜单。前置父菜单必须存在；不应以赋予普通用户管理员角色代替迁移或权限核验。
+- 用户于 2026-09-07 明确确认默认兼容 HTTP/HTTPS、不设开关并接受明文风险；部署本版本并执行迁移后，现有 `http://185.216.248.75:9527` 可以使用客户端密钥管理及客户端 API。本机已部署验证，不能据此宣称线上已经可用。HTTP 会明文传输密钥和业务数据，仍建议使用 HTTPS。
+- 客户端密钥功能不依赖 GOAUTO_TRUST_FORWARDED_PROTO、X-Forwarded-Proto 或 Agent HTTP 例外。既有其他路由的协议和代理配置保持不变；不伪造协议头，不新增明文放行开关。
+- 代理、APM、应用日志均不得记录 Authorization、创建响应 secret 或原始业务载荷。应用对两类客户端密钥路由跳过旧请求/响应正文日志，使用专用元数据审计；实际代理日志脱敏仍须部署验收。
+- 请求审计 status=0 可能表示在途、进程中断或结果审计更新失败；先按请求关联号核对业务结果，不自动重试采购、采集、同步等操作。停用阻止后续认证，不保证取消已开始的业务操作。
+- 隔离验证：Server `go test ./app/goauto/clientkey ./app/goauto/clientapi ./cmd/migrate/migration/version-local`；Web `pnpm exec jest tests/unit/client-keys.spec.js --runInBand` 与 `pnpm run build:prod`。浏览器模拟入口 `/tests/fixtures/client-keys.html` 仅由本地 Vite 开发服务承载，使用内存模拟请求和无效示例密钥，不连接真实数据库，不证明线上鉴权已验收。
+- 真实部署验收须另行验证实际 HTTP/HTTPS 入口、管理员创建/编辑/停用、普通用户拒绝、读写/独立动作隔离、停用后的后续请求拒绝及日志无密钥；任何真实业务执行继续按独立授权范围进行。
+
+
+## Windows 本机运行目录与 #237 迁移验证（2026-09-07）
+
+- Supervisor 实际配置 `D:/supervisor/programs/goauto.conf`；程序仅 `goauto-admin-api` 和 `goauto-admin-ui`。从已有干净工作区 `D:/OPC/goauto-worktrees/main-runtime` 的 main 分支运行；源码运行基线 `ac3c63e`，版本化启动模板更新提交 `9a10d82`。
+- 原目录 `D:/OPC/goauto` 的用户改动保持原样；本机敏感配置继续读取 `D:/OPC/goauto/config.yaml`，不复制凭据到运行工作区或版本库。数据库 `127.0.0.1:3307/goauto`，API `http://127.0.0.1:8010`，Web `http://127.0.0.1:9527`。
+- API 命令：`pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml" -SkipMigration`；Web 同目录 `scripts/start-web.ps1` 与相同 ConfigPath。已验证无需 ExecutionPolicy Bypass。
+- 真实迁移必须单独授权并先确认唯一待执行版本；常驻 API 加 `-SkipMigration`，日常重启不自动执行未来待审核迁移。#237 迁移 `1788798000000_client_api_key.go` 已执行，sys_migration 记录 `1788798000000`、两张密钥表及管理员菜单已回读；其他角色未新增菜单关联。任务启停状态未改。
+- 范围明确的服务控制：`D:/supervisor/supervisord.exe -c D:/supervisor/supervisord.conf ctl status goauto-admin-api goauto-admin-ui`，启动/停止/重启将 status 分别替换为 start/stop/restart。不得为了 GoAuto 重启整个 Supervisor 或其他项目。配置内容变化后需重新读取配置；本次调用 `supervisor.reloadConfig`，再对上述两个程序定向 start，已通过进程命令行核对新目录。
+- 日志：`D:/supervisor/logs/goauto-admin-api.log`、`D:/supervisor/logs/goauto-admin-ui.log`；对外分享只能保留脱敏结构摘要。迁移输出不得暴露凭据或业务原文。
+- 管理员刷新页面后可进入 `http://127.0.0.1:9527/#/client-keys/index`；菜单缓存未更新时重新登录。已验证列表空态、创建弹窗加载 12 模块及 HTTP 风险提示；未实际创建密钥，真实客户端读写及停用闭环仍待范围明确的验证。线上 GoAuto/Nginx 未重启或发布。

docs/README.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Home
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Home
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:06:45Z
+synchronized_at: 2026-09-04T11:29:34Z
 <!-- gitea-wiki-mirror:end -->
 
 # GoAuto 文档中心

docs/templates/deployment.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-Template
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-Template.-
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-04T11:30:41Z
 <!-- gitea-wiki-mirror:end -->
 
 # 部署文档模板

docs/templates/task-archive.md

@@ -3,7 +3,7 @@ generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Task-Archive-Template
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Task-Archive-Template.-
 wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
-synchronized_at: 2026-09-05T04:13:06Z
+synchronized_at: 2026-09-04T11:30:46Z
 <!-- gitea-wiki-mirror:end -->
 
 > 本模板只用于用户明确要求的专项历史快照或读取既有归档，不属于标准任务闭环。单次任务的唯一事实来源是 Gitea 工单；不要为了完成普通任务创建本页面，也不要自动导出到 `docs/task/`。

scripts/supervisor/goauto.conf

@@ -1,6 +1,6 @@
 [program:goauto-admin-api]
-command=pwsh.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "D:/OPC/goauto/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
-directory=D:/OPC/goauto
+command=pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml" -SkipMigration
+directory=D:/OPC/goauto-worktrees/main-runtime
 autostart=true
 autorestart=true
 startsecs=3
@@ -14,8 +14,8 @@ stdout_logfile_maxbytes=50MB
 stdout_logfile_backups=5
 
 [program:goauto-admin-ui]
-command=pwsh.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "D:/OPC/goauto/scripts/start-web.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
-directory=D:/OPC/goauto
+command=pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-web.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
+directory=D:/OPC/goauto-worktrees/main-runtime
 autostart=true
 autorestart=true
 startsecs=3

server/app/admin/router/init_router.go

@@ -1,6 +1,7 @@
 package router
 
 import (
+	goautoclientapi "go-admin/app/goauto/clientapi"
 	"os"
 
 	"github.com/gin-gonic/gin"
@@ -53,6 +54,7 @@ func InitRouter() {
 
 	// 注册 GoAuto Agent 与设备管理路由。
 	goautodevice.InitRouter(r, authMiddleware)
+	goautoclientapi.InitRouter(r, authMiddleware)
 	goautoapprelease.InitRouter(r, authMiddleware)
 	goautoaimatching.InitRouter(r, authMiddleware)
 	goautotask.InitRouter(r, authMiddleware)

server/app/goauto/access/purchaser.go

@@ -56,7 +56,7 @@ var AdminAPIs = []APIPermission{
 	{"重新解析 SYB 商品", "/api/admin/v1/syb-products/:productId/reparse", "POST", true},
 	{"批量重新解析 SYB 商品", "/api/admin/v1/syb-products/reparse-batch", "POST", true},
 	{"人工修正 SYB 商品", "/api/admin/v1/syb-products/:productId/correction", "PATCH", true},
-	{"手动同步 SYB 商品", "/api/admin/v1/syb-products/import", "POST", false},
+	{"手动同步 SYB 商品", "/api/admin/v1/syb-products/import", "POST", true},
 	{"查看 SYB 同步记录", "/api/admin/v1/syb-products/sync-runs", "GET", true},
 	{"查看 SYB 同步详情", "/api/admin/v1/syb-products/sync-runs/:runId", "GET", true},
 

server/app/goauto/access/purchaser_test.go

@@ -16,7 +16,7 @@ func TestPurchaserPermissionMatrixHasNoDuplicates(t *testing.T) {
 func TestPurchaserExcludesAdministratorOperations(t *testing.T) {
 	denied := map[string]bool{
 		"POST /api/admin/v1/devices/:deviceId/disable":         true,
-		"POST /api/admin/v1/syb-products/import":               true,
+		"POST /api/admin/v1/syb-shops/discover":                true,
 		"POST /api/admin/v1/collection-rules":                  true,
 		"PUT /api/admin/v1/ai-matching-settings":               true,
 		"POST /api/admin/v1/shopee-spec-auto-match/runs":       true,

server/app/goauto/access/reconcile_test.go

@@ -55,7 +55,9 @@ func TestReconcilePurchaserPermissions(t *testing.T) {
 	}
 
 	assertPolicyCount(t, db, "custom-role", "/custom", "GET", 1)
-	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-products/import", "POST", 0)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-products/import", "POST", 1)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-shops/discover", "POST", 0)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-shops", "POST", 0)
 }
 
 func TestReconcilePurchaserPermissionsRemovesOnlyStalePurchaserGrant(t *testing.T) {

server/app/goauto/aimatching/types.go

@@ -53,11 +53,12 @@ type CandidateSnapshot struct {
 }
 
 type DecisionSnapshot struct {
-	Source     string            `json:"source"`
-	Provider   string            `json:"provider,omitempty"`
-	Model      string            `json:"model,omitempty"`
-	Candidates CandidateSnapshot `json:"candidates"`
-	Matched    struct {
+	Source      string            `json:"source"`
+	Provider    string            `json:"provider,omitempty"`
+	Model       string            `json:"model,omitempty"`
+	Candidates  CandidateSnapshot `json:"candidates"`
+	RoleSources map[string]string `json:"roleSources,omitempty"`
+	Matched     struct {
 		Color string `json:"color,omitempty"`
 		Size  string `json:"size,omitempty"`
 	} `json:"matched"`

server/app/goauto/apprelease/apk_test.go

@@ -18,7 +18,7 @@ func TestParseBuiltAgentAPKWhenAvailable(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if metadata.VersionCode != 49 || metadata.VersionName != "0.9.36" {
+	if metadata.VersionCode != 54 || metadata.VersionName != "0.9.41" {
 		t.Fatalf("metadata=%+v", metadata)
 	}
 }

server/app/goauto/clientapi/gateway.go

@@ -0,0 +1,158 @@
+package clientapi
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/common/clientprincipal"
+	"gorm.io/gorm"
+)
+
+// Both HTTP and HTTPS are supported by explicit operator decision (#237).
+// Transport does not grant identity or permissions; secrets remain non-cacheable.
+func NoStore(c *gin.Context) {
+	c.Header("Cache-Control", "no-store")
+	c.Next()
+}
+func Gate(db *gorm.DB, e Endpoint) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Cache-Control", "no-store")
+		deny := func(status int, message string) {
+			c.AbortWithStatusJSON(status, gin.H{"code": status, "message": message})
+		}
+		// Never accept a credential supplied through a URL or cookie fallback.
+		for k := range c.Request.URL.Query() {
+			if sensitive(k) || strings.EqualFold(k, "token") {
+				deny(400, "密钥只能通过 Authorization 请求头发送")
+				return
+			}
+		}
+		header := strings.Fields(c.GetHeader("Authorization"))
+		if len(header) != 2 || !strings.EqualFold(header[0], "Bearer") {
+			deny(401, "需要客户端密钥")
+			return
+		}
+		connection := db
+		var err error
+		if connection == nil {
+			connection, err = pkg.GetOrm(c)
+		}
+		if err != nil || connection == nil {
+			deny(503, "客户端认证暂不可用")
+			return
+		}
+		key, err := (clientkey.Service{DB: connection}).Authenticate(c.Request.Context(), header[1])
+		if err != nil {
+			if errors.Is(err, clientkey.ErrCredential) {
+				deny(401, "客户端密钥无效或已停用")
+			} else {
+				deny(503, "客户端认证暂不可用")
+			}
+			return
+		}
+		random := make([]byte, 16)
+		if _, err = rand.Read(random); err != nil {
+			deny(503, "审计暂不可用")
+			return
+		}
+		requestID := hex.EncodeToString(random)
+		c.Header("X-Client-Request-Id", requestID)
+		record := clientkey.Audit{KeyID: key.ID, Event: "request", RequestID: requestID, Method: e.Method, Route: "/api/client/v1" + e.Path}
+		if !key.Allows(e.Module, e.Capability) {
+			record.Status = 403
+			_ = connection.Create(&record).Error
+			deny(403, "密钥未授权此模块或执行动作")
+			return
+		}
+		// The intent must be durable before any business handler can run.
+		if err = connection.WithContext(c.Request.Context()).Create(&record).Error; err != nil {
+			deny(503, "审计暂不可用，未执行操作")
+			return
+		}
+		clientprincipal.Set(c, clientprincipal.Identity{KeyID: key.ID, RequestID: requestID, AuthorizedBy: key.UpdatedBy})
+		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 16<<20)
+		original := c.Writer
+		buffer := &responseBuffer{ResponseWriter: original, status: 200}
+		c.Writer = buffer
+		defer func() { c.Writer = original }()
+		c.Next()
+		c.Writer = original
+		status := buffer.status
+		var value any
+		if buffer.overflow || json.Unmarshal(buffer.body.Bytes(), &value) != nil {
+			status = 502
+			value = gin.H{"code": 502, "message": "无法生成客户端响应，请先核对操作结果，不要自动重试"}
+		} else {
+			value = redact(value)
+		}
+		auditCtx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		_ = connection.WithContext(auditCtx).Model(&clientkey.Audit{}).Where("id = ?", record.ID).Update("status", status).Error
+		now := time.Now().UTC()
+		_ = connection.WithContext(auditCtx).Model(&clientkey.Key{}).Where("id = ?", key.ID).UpdateColumn("last_used_at", now).Error
+		c.JSON(status, value)
+	}
+}
+
+type responseBuffer struct {
+	gin.ResponseWriter
+	body     bytes.Buffer
+	status   int
+	overflow bool
+}
+
+func (w *responseBuffer) WriteHeader(status int) { w.status = status }
+func (w *responseBuffer) WriteHeaderNow()        {}
+func (w *responseBuffer) Status() int            { return w.status }
+func (w *responseBuffer) Size() int              { return w.body.Len() }
+func (w *responseBuffer) Written() bool          { return w.body.Len() > 0 }
+func (w *responseBuffer) Write(b []byte) (int, error) {
+	if w.body.Len()+len(b) > 32<<20 {
+		w.overflow = true
+		return len(b), nil
+	}
+	return w.body.Write(b)
+}
+func (w *responseBuffer) WriteString(s string) (int, error) { return w.Write([]byte(s)) }
+func (w *responseBuffer) Flush()                            {}
+
+func sensitive(k string) bool {
+	key := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(k, "_", ""), "-", ""))
+	for _, part := range []string{"password", "passwd", "secret", "credential", "cookie", "authorization", "apikey", "accesstoken", "devicetoken", "refreshtoken", "recoverycode"} {
+		if strings.Contains(key, part) {
+			return true
+		}
+	}
+	switch key {
+	case "token", "tokenhash", "digest", "rawjson", "rawpayload", "rawresponse", "requestheaders", "responseheaders":
+		return true
+	}
+	return false
+}
+func redact(v any) any {
+	switch value := v.(type) {
+	case map[string]any:
+		for k, item := range value {
+			if sensitive(k) {
+				delete(value, k)
+			} else {
+				value[k] = redact(item)
+			}
+		}
+	case []any:
+		for i, item := range value {
+			value[i] = redact(item)
+		}
+	}
+	return v
+}

server/app/goauto/clientapi/gateway_test.go

@@ -0,0 +1,165 @@
+package clientapi
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/common/clientprincipal"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func fixture(t *testing.T) (*gorm.DB, clientkey.Service) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sql, _ := db.DB()
+	sql.SetMaxOpenConns(1)
+	t.Cleanup(func() { sql.Close() })
+	if err = db.AutoMigrate(&clientkey.Key{}, &clientkey.Audit{}); err != nil {
+		t.Fatal(err)
+	}
+	return db, clientkey.Service{DB: db, Modules: Catalog(Inventory())}
+}
+func TestEveryRouteIsExplicitlyScoped(t *testing.T) {
+	db, s := fixture(t)
+	routes := Inventory()
+	if len(s.Modules) != 12 {
+		t.Fatal("menu groups lost")
+	}
+	router := gin.New()
+	seen := map[string]bool{}
+	for _, e := range routes {
+		key := e.Method + e.Path
+		if seen[key] {
+			t.Fatal("duplicate route")
+		}
+		seen[key] = true
+		if strings.Contains(e.Path, "payment") || strings.Contains(e.Path, "token") || strings.Contains(e.Path, "client-keys") || e.Handle == nil {
+			t.Fatal("forbidden route")
+		}
+		router.Handle(e.Method, "/api/client/v1"+e.Path, Gate(db, e), func(c *gin.Context) { c.JSON(200, gin.H{"data": "ok"}) })
+		if e.Method != "GET" && e.Capability == "read" {
+			t.Fatal("mutating read permission")
+		}
+	}
+	for _, e := range routes {
+		for _, scheme := range []string{"http", "https"} {
+			grant := clientkey.Grant{Module: e.Module}
+			v, token, err := s.Create(context.Background(), "test", []clientkey.Grant{grant}, 1)
+			if err != nil {
+				t.Fatal(err)
+			}
+			path := e.Path
+			for _, param := range []string{":productId", ":runId", ":recordId", ":jobId", ":batchId", ":shopId", ":ruleId", ":taskId"} {
+				path = strings.ReplaceAll(path, param, "1")
+			}
+			req := httptest.NewRequest(e.Method, scheme+"://example.test/api/client/v1"+path, nil)
+			req.Header.Set("Authorization", "Bearer "+token)
+			rr := httptest.NewRecorder()
+			router.ServeHTTP(rr, req)
+			want := 200
+			if e.Capability != "read" {
+				want = 403
+			}
+			if rr.Code != want {
+				t.Fatalf("%s got %d want %d", keyFor(e), rr.Code, want)
+			}
+			if e.Capability == "write" {
+				grant.Write = true
+			} else if e.Capability != "read" {
+				grant.Actions = []string{e.Capability}
+			}
+			if _, err = s.Update(context.Background(), v.ID, 1, 1, []clientkey.Grant{grant}, false); err != nil {
+				t.Fatal(err)
+			}
+			rr = httptest.NewRecorder()
+			router.ServeHTTP(rr, req.Clone(context.Background()))
+			if rr.Code != 200 {
+				t.Fatalf("authorized %s failed: %d", keyFor(e), rr.Code)
+			}
+		}
+	}
+}
+func keyFor(e Endpoint) string { return e.Method + " " + e.Path }
+func TestRevocationTransportRedactionAndAudit(t *testing.T) {
+	db, s := fixture(t)
+	v, token, err := s.Create(context.Background(), "test", []clientkey.Grant{{Module: "pdd_products"}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e := Endpoint{Method: "GET", Path: "/pdd-products", Module: "pdd_products", Capability: "read"}
+	router := gin.New()
+	calls := 0
+	router.GET("/api/client/v1/pdd-products", Gate(db, e), func(c *gin.Context) {
+		calls++
+		id, ok := clientprincipal.Get(c)
+		if !ok || id.KeyID != v.ID {
+			t.Error("client attribution missing")
+		}
+		c.JSON(200, gin.H{"code": 200, "data": gin.H{"apiKey": "sentinel-secret", "rawJson": "sentinel-raw", "title": "product", "nested": []any{gin.H{"device_token": "sentinel-token"}}}})
+	})
+	send := func(tlsOn bool, credential, path string) *httptest.ResponseRecorder {
+		req := httptest.NewRequest("GET", "http://example.test"+path, nil)
+		if tlsOn {
+			req.TLS = &tls.ConnectionState{}
+		}
+		req.Header.Set("Authorization", "Bearer "+credential)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, req)
+		return rr
+	}
+	path := "/api/client/v1/pdd-products"
+	for _, tlsOn := range []bool{false, true} {
+		if send(tlsOn, "jwt", path).Code != 401 || send(tlsOn, "", path).Code != 401 || send(tlsOn, token, path+"?token=invalid").Code != 400 {
+			t.Fatal("credential fallback accepted")
+		}
+		rr := send(tlsOn, token, path)
+		if rr.Code != 200 || strings.Contains(rr.Body.String(), "sentinel") || !strings.Contains(rr.Body.String(), "product") {
+			t.Fatal("redaction failed")
+		}
+		if rr.Header().Get("Cache-Control") != "no-store" || rr.Header().Get("X-Client-Request-Id") == "" {
+			t.Fatal("cache or audit headers missing")
+		}
+	}
+	if _, err = s.Update(context.Background(), v.ID, 1, 1, nil, true); err != nil {
+		t.Fatal(err)
+	}
+	if send(true, token, path).Code != 401 || send(false, token, path).Code != 401 || calls != 2 {
+		t.Fatal("revocation not immediate")
+	}
+	var logs []clientkey.Audit
+	db.Find(&logs)
+	raw, _ := json.Marshal(logs)
+	if strings.Contains(string(raw), token) || strings.Contains(string(raw), "sentinel") {
+		t.Fatal("audit leaked payload")
+	}
+}
+func TestAuditUnavailableDoesNotExecute(t *testing.T) {
+	db, s := fixture(t)
+	_, token, err := s.Create(context.Background(), "test", []clientkey.Grant{{Module: "pdd_products", Write: true}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	db.Migrator().DropTable(&clientkey.Audit{})
+	router := gin.New()
+	called := false
+	e := Endpoint{Method: "POST", Path: "/pdd-products", Module: "pdd_products", Capability: "write"}
+	router.POST(e.Path, Gate(db, e), func(c *gin.Context) { called = true; c.JSON(200, gin.H{}) })
+	req := httptest.NewRequest("POST", "https://example.test"+e.Path, nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	if rr.Code != 503 || called {
+		t.Fatal("executed without audit")
+	}
+}

server/app/goauto/clientapi/integration_test.go

@@ -0,0 +1,81 @@
+package clientapi
+
+import (
+	"context"
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/product"
+	"go-admin/common/middleware"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestClientCanCreateProductWithoutLoginAndReplay(t *testing.T) {
+	db, s := fixture(t)
+	if err := db.AutoMigrate(&models.PDDProduct{}); err != nil {
+		t.Fatal(err)
+	}
+	_, token, err := s.Create(context.Background(), "test", []clientkey.Grant{{Module: "pdd_products", Write: true}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e := Endpoint{Method: "POST", Path: "/pdd-products", Module: "pdd_products", Capability: "write"}
+	router := gin.New()
+	router.Use(func(c *gin.Context) { c.Set("db", db); c.Next() })
+	router.POST("/api/client/v1/pdd-products", Gate(db, e), product.Handler{}.Create)
+	for n := 0; n < 2; n++ {
+		req := httptest.NewRequest("POST", "https://example.test/api/client/v1/pdd-products", strings.NewReader(`{"requestId":"00000000-0000-4000-8000-000000000237","url":"https://mobile.yangkeduo.com/goods.html?goods_id=100000000001"}`))
+		req.Header.Set("Authorization", "Bearer "+token)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, req)
+		if rr.Code != 200 {
+			t.Fatalf("product create failed status %d", rr.Code)
+		}
+		var body struct {
+			Data struct {
+				Replayed bool `json:"replayed"`
+			}
+		}
+		json.Unmarshal(rr.Body.Bytes(), &body)
+		if (n == 1) != body.Data.Replayed {
+			t.Fatal("business idempotency changed")
+		}
+	}
+	var count int64
+	db.Model(&models.PDDProduct{}).Count(&count)
+	if count != 1 {
+		t.Fatal("duplicate business write")
+	}
+}
+
+func TestManagementRequiresAdminNotClientIdentity(t *testing.T) {
+	db, s := fixture(t)
+	h := clientkey.Handler{DB: db, Modules: s.Modules}
+	for _, role := range []string{"admin", "purchaser", "client", ""} {
+		for _, scheme := range []string{"http", "https"} {
+			router := gin.New()
+			router.Use(func(c *gin.Context) {
+				c.Set(jwt.JwtPayloadKey, jwt.MapClaims{"rolekey": role, "identity": float64(7)})
+				c.Next()
+			})
+			router.POST("/keys", middleware.RequireRoleKey("admin"), NoStore, h.Create)
+			req := httptest.NewRequest("POST", scheme+"://example.test/keys", strings.NewReader(`{"name":"test","grants":[{"module":"pdd_products","write":false,"actions":[]}]}`))
+			rr := httptest.NewRecorder()
+			router.ServeHTTP(rr, req)
+			want := 403
+			if role == "admin" {
+				want = 200
+			}
+			if rr.Code != want {
+				t.Fatalf("role %q status %d", role, rr.Code)
+			}
+			if role == "admin" && rr.Header().Get("Cache-Control") != "no-store" {
+				t.Fatal("one-time secret cacheable")
+			}
+		}
+	}
+}

server/app/goauto/clientapi/matching.go

@@ -0,0 +1,45 @@
+package clientapi
+
+import (
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	"go-admin/app/goauto/aimatching"
+	"io"
+	"net/http"
+)
+
+// resolveSpecs accepts only specification text, never a provider URL/key,
+// prompt, raw order, address or account. It returns a suggestion, not an order.
+func resolveSpecs(c *gin.Context) {
+	var req struct {
+		TargetColor string   `json:"targetColor"`
+		TargetSize  string   `json:"targetSize"`
+		Colors      []string `json:"colors"`
+		Sizes       []string `json:"sizes"`
+	}
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 64<<10)
+	d := json.NewDecoder(c.Request.Body)
+	d.DisallowUnknownFields()
+	if d.Decode(&req) != nil || d.Decode(&struct{}{}) != io.EOF || len(req.Colors) > 200 || len(req.Sizes) > 200 {
+		c.JSON(422, gin.H{"code": 422, "message": "规格请求无效"})
+		return
+	}
+	for _, s := range append(append([]string{req.TargetColor, req.TargetSize}, req.Colors...), req.Sizes...) {
+		if len([]rune(s)) > 255 {
+			c.JSON(422, gin.H{"code": 422, "message": "规格值过长"})
+			return
+		}
+	}
+	db, err := pkg.GetOrm(c)
+	if err != nil {
+		c.JSON(503, gin.H{"code": 503})
+		return
+	}
+	v, err := aimatching.NewService(db).Resolve(c.Request.Context(), aimatching.MatchRequest{TargetColor: req.TargetColor, TargetSize: req.TargetSize, Colors: req.Colors, Sizes: req.Sizes})
+	if err != nil {
+		c.JSON(422, gin.H{"code": 422, "message": "未获得可靠匹配，请检查候选规格或联系管理员"})
+		return
+	}
+	c.JSON(200, gin.H{"code": 200, "data": gin.H{"mappedColor": v.MappedColor, "mappedSize": v.MappedSize, "source": v.Source}})
+}

server/app/goauto/clientapi/routes.go

@@ -0,0 +1,170 @@
+// Package clientapi exposes only the reviewed client route inventory. It never
+// forwards arbitrary URLs or synthesizes a logged-in administrator identity.
+package clientapi
+
+import (
+	"go-admin/app/goauto/access"
+	"go-admin/app/goauto/aimatching"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/app/goauto/device"
+	"go-admin/app/goauto/product"
+	"go-admin/app/goauto/purchase"
+	"go-admin/app/goauto/purchaserule"
+	"go-admin/app/goauto/rule"
+	"go-admin/app/goauto/shopeeproduct"
+	"go-admin/app/goauto/sybimport"
+	"go-admin/app/goauto/sybinnercode"
+	"go-admin/app/goauto/sybshop"
+	"go-admin/app/goauto/task"
+	"go-admin/common/middleware"
+	"sort"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
+)
+
+type Endpoint struct {
+	Method, Path, Module, Capability string
+	Handle                           gin.HandlerFunc
+}
+
+func Inventory() []Endpoint {
+	p := product.Handler{}
+	s := shopeeproduct.Handler{}
+	y := sybimport.Handler{}
+	i := sybinnercode.Handler{}
+	shop := sybshop.Handler{}
+	r := rule.Handler{}
+	pr := purchaserule.Handler{}
+	t := task.Handler{}
+	buy := purchase.Handler{}
+	return []Endpoint{
+		{"POST", "/ai-matching-settings/resolve", access.ModuleAIMatching, "match", resolveSpecs},
+		{"GET", "/devices", access.ModuleDevices, "read", device.Handler{}.List},
+		{"GET", "/pdd-products", access.ModulePDDProducts, "read", p.List},
+		{"GET", "/pdd-products/:productId", access.ModulePDDProducts, "read", p.Detail},
+		{"POST", "/pdd-products", access.ModulePDDProducts, "write", p.Create},
+		{"PATCH", "/pdd-products/:productId", access.ModulePDDProducts, "write", p.Update},
+		{"GET", "/shopee-products", access.ModuleShopeeProducts, "read", s.List},
+		{"GET", "/shopee-products/:productId", access.ModuleShopeeProducts, "read", s.Detail},
+		{"POST", "/shopee-products", access.ModuleShopeeProducts, "write", s.Create},
+		{"PATCH", "/shopee-products/:productId", access.ModuleShopeeProducts, "write", s.Update},
+		{"POST", "/shopee-products/:productId/link-pdd", access.ModuleShopeeProducts, "write", s.LinkPDD},
+		{"POST", "/shopee-products/:productId/specs/values", access.ModuleShopeeProducts, "write", s.AddSpecValue},
+		{"PUT", "/shopee-products/:productId/specs/mapping", access.ModuleShopeeProducts, "write", s.SetMapping},
+		{"DELETE", "/shopee-products/:productId/specs/values", access.ModuleShopeeProducts, "delete", s.RemoveSpecValue},
+		{"DELETE", "/shopee-products/:productId/specs/mapping", access.ModuleShopeeProducts, "delete", s.ClearMapping},
+		{"POST", "/shopee-products/batch-delete", access.ModuleShopeeProducts, "delete", s.BatchDelete},
+		{"POST", "/shopee-products/:productId/specs/mapping/auto-match", access.ModuleShopeeProducts, "match", s.AutoMatchMappings},
+		{"POST", "/shopee-products/:productId/specs/mapping/confirm", access.ModuleShopeeProducts, "match", s.ConfirmMapping},
+		{"GET", "/syb-products", access.ModuleSYBProducts, "read", y.List},
+		{"GET", "/syb-products/:productId", access.ModuleSYBProducts, "read", y.Detail},
+		{"PATCH", "/syb-products/:productId/correction", access.ModuleSYBProducts, "write", y.ManualCorrect},
+		{"POST", "/syb-products/:productId/reparse", access.ModuleSYBProducts, "reparse", y.Reparse},
+		{"POST", "/syb-products/reparse-batch", access.ModuleSYBProducts, "reparse", y.ReparseBatch},
+		{"GET", "/syb-products/sync-runs", access.ModuleSYBSyncRuns, "read", y.ListSyncRuns},
+		{"GET", "/syb-products/sync-runs/:runId", access.ModuleSYBSyncRuns, "read", y.SyncRunDetail},
+		{"POST", "/syb-products/import", access.ModuleSYBSyncRuns, "sync", y.Import},
+		{"GET", "/syb-inner-codes", access.ModuleSYBInnerCodes, "read", i.List},
+		{"GET", "/syb-inner-codes/:recordId", access.ModuleSYBInnerCodes, "read", i.Detail},
+		{"GET", "/syb-inner-codes/match-jobs/:jobId", access.ModuleSYBInnerCodes, "read", i.MatchJob},
+		{"GET", "/syb-inner-codes/apply-batches/:batchId", access.ModuleSYBInnerCodes, "read", i.ApplyBatch},
+		{"POST", "/syb-inner-codes/rematch", access.ModuleSYBInnerCodes, "match", i.Rematch},
+		{"POST", "/syb-inner-codes/import", access.ModuleSYBInnerCodes, "import", i.Import},
+		{"POST", "/syb-inner-codes/batch-delete", access.ModuleSYBInnerCodes, "delete", i.Delete},
+		{"POST", "/syb-inner-codes/apply-preview", access.ModuleSYBInnerCodes, "writeback", i.ApplyPreview},
+		{"POST", "/syb-inner-codes/apply", access.ModuleSYBInnerCodes, "writeback", i.Apply},
+		{"POST", "/syb-inner-codes/:recordId/recheck", access.ModuleSYBInnerCodes, "match", i.Recheck},
+		{"GET", "/syb-shops", access.ModuleSYBShops, "read", shop.List},
+		{"POST", "/syb-shops", access.ModuleSYBShops, "write", shop.Create},
+		{"PATCH", "/syb-shops/:shopId/name", access.ModuleSYBShops, "write", shop.Rename},
+		{"PATCH", "/syb-shops/:shopId/enabled", access.ModuleSYBShops, "write", shop.SetEnabled},
+		{"DELETE", "/syb-shops/:shopId", access.ModuleSYBShops, "delete", shop.Delete},
+		{"GET", "/collection-rules", access.ModuleCollectionRules, "read", r.List},
+		{"POST", "/collection-rules", access.ModuleCollectionRules, "write", r.Create},
+		{"PATCH", "/collection-rules/:ruleId", access.ModuleCollectionRules, "write", r.Update},
+		{"DELETE", "/collection-rules/:ruleId", access.ModuleCollectionRules, "delete", r.Delete},
+		{"GET", "/purchase-rules", access.ModulePurchaseRules, "read", pr.List},
+		{"GET", "/purchase-rules/current", access.ModulePurchaseRules, "read", pr.Current},
+		{"POST", "/purchase-rules", access.ModulePurchaseRules, "write", pr.Create},
+		{"PATCH", "/purchase-rules/:ruleId", access.ModulePurchaseRules, "write", pr.Update},
+		{"DELETE", "/purchase-rules/:ruleId", access.ModulePurchaseRules, "delete", pr.Delete},
+		{"PUT", "/purchase-rules/current", access.ModulePurchaseRules, "activate", pr.SetCurrent},
+		{"GET", "/collection-tasks", access.ModuleCollectionTasks, "read", t.AdminList},
+		{"GET", "/collection-tasks/:taskId", access.ModuleCollectionTasks, "read", t.AdminDetail},
+		{"POST", "/collection-tasks", access.ModuleCollectionTasks, "collect", t.AdminCreate},
+		{"POST", "/collection-tasks/batch", access.ModuleCollectionTasks, "collect", t.AdminBatchCreate},
+		{"POST", "/collection-tasks/:taskId/reset", access.ModuleCollectionTasks, "collect", t.AdminReset},
+		{"DELETE", "/collection-tasks/:taskId", access.ModuleCollectionTasks, "delete", t.AdminDelete},
+		{"GET", "/purchase-tasks", access.ModulePurchaseTasks, "read", buy.AdminList},
+		{"GET", "/purchase-tasks/:taskId", access.ModulePurchaseTasks, "read", buy.AdminDetail},
+		{"POST", "/purchase-tasks/batch-preview", access.ModulePurchaseTasks, "purchase", buy.AdminBatchPreview},
+		{"POST", "/purchase-tasks", access.ModulePurchaseTasks, "purchase", buy.AdminCreate},
+		{"POST", "/purchase-tasks/batch", access.ModulePurchaseTasks, "purchase", buy.AdminBatchCreate},
+		{"POST", "/purchase-tasks/batch-retry", access.ModulePurchaseTasks, "purchase", buy.AdminBatchRetry},
+		{"POST", "/purchase-tasks/stock", access.ModulePurchaseTasks, "purchase", buy.AdminCreateStock},
+		{"GET", "/ai-matching-settings", access.ModuleAIMatching, "read", func(c *gin.Context) {
+			db, err := pkg.GetOrm(c)
+			if err != nil {
+				c.JSON(500, gin.H{"code": 500})
+				return
+			}
+			v, err := aimatching.NewService(db).Settings(c.Request.Context())
+			if err != nil {
+				c.JSON(500, gin.H{"code": 500})
+				return
+			}
+			c.JSON(200, gin.H{"code": 200, "data": gin.H{"enabled": v.Enabled}})
+		}},
+	}
+}
+
+func Catalog(routes []Endpoint) []clientkey.Module {
+	mods := map[string]clientkey.Module{}
+	for _, m := range access.GoAutoModules() {
+		mods[m.Key] = clientkey.Module{Key: m.Key, Title: m.Title, Actions: []string{}}
+	}
+	for _, e := range routes {
+		m := mods[e.Module]
+		if e.Capability == "write" {
+			m.Writable = true
+		} else if e.Capability != "read" {
+			found := false
+			for _, a := range m.Actions {
+				if a == e.Capability {
+					found = true
+				}
+			}
+			if !found {
+				m.Actions = append(m.Actions, e.Capability)
+			}
+		}
+		mods[e.Module] = m
+	}
+	out := []clientkey.Module{}
+	for _, g := range access.GoAutoMenuGroups() {
+		for _, key := range g.ModuleKeys {
+			m := mods[key]
+			m.Group = g.Title
+			sort.Strings(m.Actions)
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+func InitRouter(engine *gin.Engine, auth *jwt.GinJWTMiddleware) {
+	routes := Inventory()
+	catalog := Catalog(routes)
+	h := clientkey.Handler{Modules: catalog}
+	management := engine.Group("/api/admin/v1/client-keys", auth.MiddlewareFunc(), middleware.RequireRoleKey("admin"), NoStore)
+	management.GET("", h.List)
+	management.GET("/modules", h.Catalog)
+	management.POST("", h.Create)
+	management.PATCH("/:keyId/grants", h.Edit)
+	management.POST("/:keyId/disable", h.Disable)
+	for _, e := range routes {
+		engine.Handle(e.Method, "/api/client/v1"+e.Path, Gate(nil, e), e.Handle)
+	}
+}

server/app/goauto/clientkey/handler.go

@@ -0,0 +1,127 @@
+package clientkey
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth/user"
+	"gorm.io/gorm"
+)
+
+type Handler struct {
+	DB      *gorm.DB
+	Modules []Module
+}
+
+func (h Handler) service(c *gin.Context) (Service, bool) {
+	db := h.DB
+	var err error
+	if db == nil {
+		db, err = pkg.GetOrm(c)
+	}
+	if err != nil || db == nil {
+		failure(c, errors.New("database unavailable"))
+		return Service{}, false
+	}
+	c.Header("Cache-Control", "no-store")
+	return Service{db, h.Modules}, true
+}
+func failure(c *gin.Context, err error) {
+	status, message := 500, "服务端处理失败"
+	switch {
+	case errors.Is(err, ErrInvalid):
+		status, message = 422, ErrInvalid.Error()
+	case errors.Is(err, ErrConflict):
+		status, message = 409, ErrConflict.Error()
+	case errors.Is(err, gorm.ErrRecordNotFound):
+		status, message = 404, "密钥不存在"
+	}
+	c.AbortWithStatusJSON(status, gin.H{"code": status, "message": message})
+}
+func (h Handler) Catalog(c *gin.Context) { c.JSON(200, gin.H{"code": 200, "data": h.Modules}) }
+func (h Handler) List(c *gin.Context) {
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	if page < 1 {
+		page = 1
+	}
+	size := 20
+	var total int64
+	var keys []Key
+	if err := s.DB.WithContext(c.Request.Context()).Model(&Key{}).Count(&total).Error; err != nil {
+		failure(c, err)
+		return
+	}
+	if err := s.DB.WithContext(c.Request.Context()).Order("id DESC").Offset((page - 1) * size).Limit(size).Find(&keys).Error; err != nil {
+		failure(c, err)
+		return
+	}
+	items := make([]View, 0, len(keys))
+	for _, k := range keys {
+		items = append(items, view(k))
+	}
+	c.JSON(200, gin.H{"code": 200, "data": gin.H{"items": items, "total": total, "page": page, "pageSize": size}})
+}
+func decode(c *gin.Context, v any) bool {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 64<<10)
+	d := json.NewDecoder(c.Request.Body)
+	d.DisallowUnknownFields()
+	if d.Decode(v) != nil || d.Decode(&struct{}{}) != io.EOF {
+		failure(c, ErrInvalid)
+		return false
+	}
+	return true
+}
+func (h Handler) Create(c *gin.Context) {
+	var req struct {
+		Name   string  `json:"name"`
+		Grants []Grant `json:"grants"`
+	}
+	if !decode(c, &req) {
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	result, secret, err := s.Create(c.Request.Context(), req.Name, req.Grants, uint64(user.GetUserId(c)))
+	if err != nil {
+		failure(c, err)
+		return
+	}
+	c.JSON(200, gin.H{"code": 200, "data": gin.H{"key": result, "secret": secret}})
+}
+func (h Handler) Edit(c *gin.Context)    { h.update(c, false) }
+func (h Handler) Disable(c *gin.Context) { h.update(c, true) }
+func (h Handler) update(c *gin.Context, disable bool) {
+	id, err := strconv.ParseUint(c.Param("keyId"), 10, 64)
+	if err != nil {
+		failure(c, ErrInvalid)
+		return
+	}
+	var req struct {
+		Version uint64  `json:"version"`
+		Grants  []Grant `json:"grants"`
+	}
+	if !decode(c, &req) {
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	result, err := s.Update(c.Request.Context(), id, req.Version, uint64(user.GetUserId(c)), req.Grants, disable)
+	if err != nil {
+		failure(c, err)
+		return
+	}
+	c.JSON(200, gin.H{"code": 200, "data": result})
+}

server/app/goauto/clientkey/service.go

@@ -0,0 +1,222 @@
+// Package clientkey implements independent, revocable client credentials (#237).
+package clientkey
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"sort"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+var ErrInvalid = errors.New("名称或授权无效")
+var ErrConflict = errors.New("密钥已停用或授权已被修改，请刷新后重试")
+var ErrCredential = errors.New("客户端密钥无效或已停用")
+
+type Grant struct {
+	Module  string   `json:"module"`
+	Write   bool     `json:"write"`
+	Actions []string `json:"actions"`
+}
+type Module struct {
+	Key      string   `json:"key"`
+	Title    string   `json:"title"`
+	Group    string   `json:"group"`
+	Writable bool     `json:"writable"`
+	Actions  []string `json:"actions"`
+}
+type Key struct {
+	ID         uint64     `gorm:"primaryKey" json:"id"`
+	Name       string     `gorm:"size:80;not null" json:"name"`
+	Prefix     string     `gorm:"size:24;not null" json:"prefix"`
+	Digest     string     `gorm:"size:64;uniqueIndex;not null" json:"-"`
+	GrantsJSON string     `gorm:"type:text;not null" json:"-"`
+	Enabled    bool       `gorm:"not null" json:"enabled"`
+	Version    uint64     `gorm:"not null" json:"version"`
+	CreatedBy  uint64     `json:"createdBy"`
+	UpdatedBy  uint64     `json:"updatedBy"`
+	CreatedAt  time.Time  `json:"createdAt"`
+	UpdatedAt  time.Time  `json:"updatedAt"`
+	LastUsedAt *time.Time `json:"lastUsedAt"`
+}
+
+func (Key) TableName() string { return "client_api_key" }
+
+type Audit struct {
+	ID        uint64 `gorm:"primaryKey"`
+	KeyID     uint64 `gorm:"index;not null"`
+	ActorID   uint64
+	Event     string `gorm:"size:32;not null"`
+	RequestID string `gorm:"size:32;index"`
+	Method    string `gorm:"size:10"`
+	Route     string `gorm:"size:180"`
+	Status    int
+	Changes   string `gorm:"type:text"`
+	CreatedAt time.Time
+}
+
+func (Audit) TableName() string { return "client_api_key_audit" }
+
+type View struct {
+	Key
+	Grants []Grant `json:"grants"`
+}
+
+func view(k Key) View {
+	var g []Grant
+	_ = json.Unmarshal([]byte(k.GrantsJSON), &g)
+	return View{Key: k, Grants: g}
+}
+
+type Service struct {
+	DB      *gorm.DB
+	Modules []Module
+}
+
+func (s Service) Normalize(in []Grant) ([]Grant, error) {
+	if len(in) == 0 || len(in) > len(s.Modules) {
+		return nil, ErrInvalid
+	}
+	catalog := map[string]Module{}
+	for _, m := range s.Modules {
+		catalog[m.Key] = m
+	}
+	seen := map[string]bool{}
+	out := make([]Grant, 0, len(in))
+	for _, g := range in {
+		m, ok := catalog[g.Module]
+		if !ok || seen[g.Module] || (g.Write && !m.Writable) {
+			return nil, ErrInvalid
+		}
+		seen[g.Module] = true
+		allowed := map[string]bool{}
+		for _, a := range m.Actions {
+			allowed[a] = true
+		}
+		used := map[string]bool{}
+		actions := []string{}
+		for _, a := range g.Actions {
+			if !allowed[a] || used[a] {
+				return nil, ErrInvalid
+			}
+			used[a] = true
+			actions = append(actions, a)
+		}
+		sort.Strings(actions)
+		out = append(out, Grant{g.Module, g.Write, actions})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Module < out[j].Module })
+	return out, nil
+}
+func (s Service) Create(ctx context.Context, name string, grants []Grant, actor uint64) (View, string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" || len([]rune(name)) > 80 || actor == 0 {
+		return View{}, "", ErrInvalid
+	}
+	g, err := s.Normalize(grants)
+	if err != nil {
+		return View{}, "", err
+	}
+	raw, _ := json.Marshal(g)
+	secret := make([]byte, 32)
+	if _, err = rand.Read(secret); err != nil {
+		return View{}, "", err
+	}
+	token := "gak_" + hex.EncodeToString(secret)
+	digest := sha256.Sum256([]byte(token))
+	k := Key{Name: name, Prefix: token[:16], Digest: hex.EncodeToString(digest[:]), GrantsJSON: string(raw), Enabled: true, Version: 1, CreatedBy: actor, UpdatedBy: actor}
+	err = s.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Create(&k).Error; err != nil {
+			return err
+		}
+		return tx.Create(&Audit{KeyID: k.ID, ActorID: actor, Event: "create", Changes: string(raw)}).Error
+	})
+	if err != nil {
+		return View{}, "", err
+	}
+	return view(k), token, nil
+}
+func (s Service) Update(ctx context.Context, id, version, actor uint64, grants []Grant, disable bool) (View, error) {
+	if id == 0 || version == 0 || actor == 0 {
+		return View{}, ErrInvalid
+	}
+	var raw []byte
+	if !disable {
+		g, err := s.Normalize(grants)
+		if err != nil {
+			return View{}, err
+		}
+		raw, _ = json.Marshal(g)
+	}
+	var k Key
+	err := s.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.First(&k, id).Error; err != nil {
+			return err
+		}
+		changes := map[string]any{"version": version + 1, "updated_by": actor, "updated_at": time.Now().UTC()}
+		event := "edit"
+		if disable {
+			changes["enabled"] = false
+			event = "disable"
+		} else {
+			changes["grants_json"] = string(raw)
+		}
+		result := tx.Model(&Key{}).Where("id = ? AND version = ? AND enabled = ?", id, version, true).Updates(changes)
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected != 1 {
+			return ErrConflict
+		}
+		diff, _ := json.Marshal(map[string]string{"before": k.GrantsJSON, "after": string(raw)})
+		if err := tx.Create(&Audit{KeyID: id, ActorID: actor, Event: event, Changes: string(diff)}).Error; err != nil {
+			return err
+		}
+		return tx.First(&k, id).Error
+	})
+	return view(k), err
+}
+func (s Service) Authenticate(ctx context.Context, token string) (Key, error) {
+	if len(token) != 68 || !strings.HasPrefix(token, "gak_") {
+		return Key{}, ErrCredential
+	}
+	if _, err := hex.DecodeString(token[4:]); err != nil {
+		return Key{}, ErrCredential
+	}
+	digest := sha256.Sum256([]byte(token))
+	var k Key
+	err := s.DB.WithContext(ctx).Where("digest = ? AND enabled = ?", hex.EncodeToString(digest[:]), true).First(&k).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return Key{}, ErrCredential
+	}
+	return k, err
+}
+func (k Key) Allows(module, capability string) bool {
+	var grants []Grant
+	if json.Unmarshal([]byte(k.GrantsJSON), &grants) != nil {
+		return false
+	}
+	for _, g := range grants {
+		if g.Module != module {
+			continue
+		}
+		if capability == "read" {
+			return true
+		}
+		if capability == "write" {
+			return g.Write
+		}
+		for _, a := range g.Actions {
+			if a == capability {
+				return true
+			}
+		}
+	}
+	return false
+}

server/app/goauto/clientkey/service_test.go

@@ -0,0 +1,115 @@
+package clientkey
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+	"strings"
+	"testing"
+)
+
+func testService(t *testing.T) Service {
+	t.Helper()
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sql, _ := db.DB()
+	sql.SetMaxOpenConns(1)
+	t.Cleanup(func() { sql.Close() })
+	if err = db.AutoMigrate(&Key{}, &Audit{}); err != nil {
+		t.Fatal(err)
+	}
+	return Service{db, []Module{{Key: "products", Writable: true, Actions: []string{"delete"}}, {Key: "devices", Actions: []string{}}}}
+}
+func TestCredentialLifecycle(t *testing.T) {
+	s := testService(t)
+	ctx := context.Background()
+	v, token, err := s.Create(ctx, "Tool", []Grant{{Module: "products"}}, 7)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(token) != 68 || v.Digest == token {
+		t.Fatal("invalid credential generation")
+	}
+	wire, _ := json.Marshal(v)
+	if strings.Contains(string(wire), token) || strings.Contains(string(wire), v.Digest) {
+		t.Fatal("secret serialized")
+	}
+	k, err := s.Authenticate(ctx, token)
+	if err != nil || !k.Allows("products", "read") || k.Allows("products", "write") || k.Allows("devices", "read") {
+		t.Fatal("default grants")
+	}
+	updated, err := s.Update(ctx, k.ID, 1, 8, []Grant{{Module: "products", Write: true, Actions: []string{"delete"}}}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	k, err = s.Authenticate(ctx, token)
+	if err != nil || !k.Allows("products", "write") || !k.Allows("products", "delete") || updated.Version != 2 || k.Digest != v.Digest {
+		t.Fatal("edit changed credential or failed to apply grants")
+	}
+	if _, err = s.Update(ctx, k.ID, 1, 8, []Grant{{Module: "devices"}}, false); !errors.Is(err, ErrConflict) {
+		t.Fatal("stale edit accepted")
+	}
+	if _, err = s.Update(ctx, k.ID, 2, 8, nil, true); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Authenticate(ctx, token); !errors.Is(err, ErrCredential) {
+		t.Fatal("disabled credential accepted")
+	}
+	if _, err = s.Update(ctx, k.ID, 3, 8, []Grant{{Module: "products"}}, false); !errors.Is(err, ErrConflict) {
+		t.Fatal("disabled key edited")
+	}
+	var logs []Audit
+	s.DB.Find(&logs)
+	if len(logs) != 3 {
+		t.Fatalf("audit count %d", len(logs))
+	}
+	data, _ := json.Marshal(logs)
+	if strings.Contains(string(data), token) {
+		t.Fatal("secret in audit")
+	}
+}
+func TestInvalidGrantsAndCredentials(t *testing.T) {
+	s := testService(t)
+	for _, g := range [][]Grant{nil, {{Module: "admin"}}, {{Module: "devices", Write: true}}, {{Module: "products", Actions: []string{"payment"}}}, {{Module: "products"}, {Module: "products"}}} {
+		if _, err := s.Normalize(g); err == nil {
+			t.Fatal("invalid grant accepted")
+		}
+	}
+	for _, token := range []string{"", "jwt", "gak_" + strings.Repeat("z", 64), strings.Repeat("a", 68)} {
+		if _, err := s.Authenticate(context.Background(), token); !errors.Is(err, ErrCredential) {
+			t.Fatal("invalid credential accepted")
+		}
+	}
+}
+func TestAuditFailureRollsBack(t *testing.T) {
+	s := testService(t)
+	ctx := context.Background()
+	v, _, err := s.Create(ctx, "Tool", []Grant{{Module: "products"}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = s.DB.Migrator().DropTable(&Audit{}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Update(ctx, v.ID, 1, 1, nil, true); err == nil {
+		t.Fatal("audit failure ignored")
+	}
+	var k Key
+	s.DB.First(&k, v.ID)
+	if !k.Enabled || k.Version != 1 {
+		t.Fatal("mutation not rolled back")
+	}
+	if _, secret, err := s.Create(ctx, "Failed", []Grant{{Module: "products"}}, 1); err == nil || secret != "" {
+		t.Fatal("creation audit failure ignored")
+	}
+	var count int64
+	s.DB.Model(&Key{}).Count(&count)
+	if count != 1 {
+		t.Fatal("key persisted without audit")
+	}
+}

server/app/goauto/device/handler.go

@@ -48,7 +48,7 @@ func (handler Handler) Register(context *gin.Context) {
 		writeError(context, internalError(err))
 		return
 	}
-	response, err := NewService(db).Register(context.Request.Context(), request, bearerToken(context.GetHeader("Authorization")))
+	response, err := NewService(db).Register(context.Request.Context(), request, bearerToken(context.GetHeader("Authorization")), strings.TrimSpace(context.GetHeader("X-GoAuto-Device-Recovery-Code")))
 	if err != nil {
 		writeError(context, err)
 		return
@@ -84,6 +84,26 @@ func (handler Handler) RevokeToken(context *gin.Context) {
 	handler.adminAction(context, (*Service).RevokeToken)
 }
 
+func (handler Handler) ResetIdentity(context *gin.Context) {
+	deviceID, err := strconv.ParseUint(context.Param("deviceId"), 10, 64)
+	if err != nil || deviceID == 0 {
+		writeError(context, invalidRequest("deviceId 无效"))
+		return
+	}
+	db, err := handler.database(context)
+	if err != nil {
+		writeError(context, internalError(err))
+		return
+	}
+	response, err := NewService(db).ResetIdentity(context.Request.Context(), deviceID)
+	if err != nil {
+		writeError(context, err)
+		return
+	}
+	context.Header("Cache-Control", "no-store")
+	context.JSON(http.StatusOK, gin.H{"code": http.StatusOK, "data": response})
+}
+
 func (handler Handler) adminAction(context *gin.Context, action func(*Service, stdcontext.Context, uint64) error) {
 	deviceID, err := strconv.ParseUint(context.Param("deviceId"), 10, 64)
 	if err != nil || deviceID == 0 {

server/app/goauto/device/router.go

@@ -22,5 +22,6 @@ func InitRouter(engine *gin.Engine, authMiddleware *jwt.GinJWTMiddleware) {
 	admin := engine.Group("/api/admin/v1/devices").Use(authMiddleware.MiddlewareFunc()).Use(middleware.AuthCheckRole())
 	admin.GET("", handler.List)
 	admin.POST("/:deviceId/disable", middleware.RequireRoleKey("admin"), handler.Disable)
+	admin.POST("/:deviceId/identity-reset", middleware.RequireRoleKey("admin"), handler.ResetIdentity)
 	admin.POST("/:deviceId/token/revoke", middleware.RequireRoleKey("admin"), handler.RevokeToken)
 }

server/app/goauto/device/service.go

@@ -28,8 +28,12 @@ const (
 	CodeDeviceTaskMismatch = "DEVICE_TASK_MISMATCH"
 	CodeDeviceNotFound     = "DEVICE_NOT_FOUND"
 	CodeInternal           = "INTERNAL_ERROR"
+	CodeRecoveryInvalid    = "DEVICE_RECOVERY_INVALID"
+	CodeRecoveryExpired    = "DEVICE_RECOVERY_EXPIRED"
 )
 
+const deviceRecoveryLifetime = 10 * time.Minute
+
 type ServiceError struct {
 	Code      string
 	Message   string
@@ -67,6 +71,11 @@ type RegisterResponse struct {
 	Replayed                 bool   `json:"replayed,omitempty"`
 }
 
+type ResetIdentityResponse struct {
+	DeviceID  uint64    `json:"deviceId"`
+	ExpiresAt time.Time `json:"expiresAt"`
+}
+
 type Service struct {
 	DB                *gorm.DB
 	Now               func() time.Time
@@ -108,6 +117,10 @@ func tokenMatches(token, digest string) bool {
 	return subtle.ConstantTimeCompare(got[:], want) == 1
 }
 
+func digestMatches(value string, digest *string) bool {
+	return digest != nil && tokenMatches(value, *digest)
+}
+
 // Authenticate returns the active device represented by a bearer token.
 // Agent feature packages use this method so token verification stays in one
 // place and raw tokens never leave request memory.
@@ -131,7 +144,11 @@ func (service *Service) Authenticate(ctx context.Context, token string) (models.
 	return result, nil
 }
 
-func (service *Service) Register(ctx context.Context, request RegisterRequest, presentedToken string) (RegisterResponse, error) {
+func (service *Service) Register(ctx context.Context, request RegisterRequest, presentedToken string, recoveryCodes ...string) (RegisterResponse, error) {
+	recoveryCode := ""
+	if len(recoveryCodes) > 0 {
+		recoveryCode = recoveryCodes[0]
+	}
 	request = normalizeRegisterRequest(request)
 	if err := validateRegisterRequest(request); err != nil {
 		return RegisterResponse{}, err
@@ -162,9 +179,15 @@ func (service *Service) Register(ctx context.Context, request RegisterRequest, p
 		if existing.Status == models.DeviceStatusDisabled {
 			return RegisterResponse{}, &ServiceError{Code: CodeDeviceDisabled, Message: "设备已停用", Retryable: false}
 		}
-		if !tokenMatches(presentedToken, existing.TokenDigest) {
-			return RegisterResponse{}, &ServiceError{
-				Code: CodeInstallIDConflict, Message: "installId 已注册，需要该设备的有效 Token", Retryable: false,
+		usingRecovery := !tokenMatches(presentedToken, existing.TokenDigest)
+		if usingRecovery {
+			validCode := recoveryCode != "" && digestMatches(recoveryCode, existing.RecoveryCodeDigest)
+			autoRecovery := recoveryCode == "" && existing.RecoveryCodeDigest == nil && existing.RecoveryExpiresAt != nil && existing.RecoveryUsedAt == nil
+			if !validCode && !autoRecovery {
+				return RegisterResponse{}, &ServiceError{Code: CodeInstallIDConflict, Message: "installId 已注册，需要该设备的有效 Token", Retryable: false}
+			}
+			if existing.RecoveryExpiresAt == nil || !service.Now().Before(*existing.RecoveryExpiresAt) {
+				return RegisterResponse{}, &ServiceError{Code: CodeRecoveryExpired, Message: "设备身份重置窗口已过期，请在后台重新操作", Retryable: false}
 			}
 		}
 		updates := map[string]any{
@@ -175,6 +198,20 @@ func (service *Service) Register(ctx context.Context, request RegisterRequest, p
 		if request.Capabilities != nil {
 			updates["capabilities_json"] = encodeCapabilities(request.Capabilities)
 		}
+		if usingRecovery {
+			newToken, generateErr := service.GenerateToken()
+			if generateErr != nil {
+				return RegisterResponse{}, internalError(generateErr)
+			}
+			now := service.Now()
+			updates["token_digest"] = tokenDigest(newToken)
+			updates["token_issued_at"] = now
+			updates["recovery_code_digest"] = nil
+			updates["recovery_expires_at"] = nil
+			updates["recovery_used_at"] = now
+			updates["status"] = models.DeviceStatusOnline
+			response.DeviceToken = newToken
+		}
 		result := db.Model(&models.AgentDevice{}).
 			Where("id = ? AND token_digest = ? AND token_revoked_at IS NULL", existing.ID, existing.TokenDigest).
 			Updates(updates)
@@ -222,6 +259,42 @@ func (service *Service) Register(ctx context.Context, request RegisterRequest, p
 	return response, nil
 }
 
+// ResetIdentity invalidates the current token and opens a short-lived automatic
+// re-registration window for the same installId. It retains the device row and
+// task bindings, so no recovery code needs to leave the Admin workflow.
+func (service *Service) ResetIdentity(ctx context.Context, deviceID uint64) (ResetIdentityResponse, error) {
+	if service.DB == nil {
+		return ResetIdentityResponse{}, internalError(errors.New("database is nil"))
+	}
+	now := service.Now()
+	expiresAt := now.Add(deviceRecoveryLifetime)
+	response := ResetIdentityResponse{DeviceID: deviceID, ExpiresAt: expiresAt}
+	err := service.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var device models.AgentDevice
+		if err := tx.First(&device, deviceID).Error; errors.Is(err, gorm.ErrRecordNotFound) {
+			return &ServiceError{Code: CodeDeviceNotFound, Message: "设备不存在", Retryable: false}
+		} else if err != nil {
+			return internalError(err)
+		}
+		if device.Status == models.DeviceStatusDisabled {
+			return &ServiceError{Code: CodeDeviceDisabled, Message: "设备已停用", Retryable: false}
+		}
+		invalidatedToken, generateErr := service.GenerateToken()
+		if generateErr != nil {
+			return internalError(generateErr)
+		}
+		return tx.Model(&models.AgentDevice{}).Where("id = ?", deviceID).Updates(map[string]any{
+			"token_digest": tokenDigest(invalidatedToken), "token_issued_at": now,
+			"recovery_code_digest": nil, "recovery_expires_at": expiresAt,
+			"recovery_used_at": nil, "status": models.DeviceStatusOffline,
+		}).Error
+	})
+	if err != nil {
+		return ResetIdentityResponse{}, err
+	}
+	return response, nil
+}
+
 func (service *Service) Disable(ctx context.Context, deviceID uint64) error {
 	return service.deactivate(ctx, deviceID, false)
 }

server/app/goauto/device/service_test.go

@@ -185,6 +185,72 @@ func TestDisableAndRevokePreventFurtherAuthentication(t *testing.T) {
 	}
 }
 
+func TestResetIdentityRecoversSameDeviceAndRotatesToken(t *testing.T) {
+	db := openTestDatabase(t)
+	service := newTestService(t, db)
+	tokens := []string{"original-token", "invalidated-token", "replacement-token"}
+	service.GenerateToken = func() (string, error) {
+		if len(tokens) == 0 {
+			t.Fatal("unexpected token generation")
+		}
+		value := tokens[0]
+		tokens = tokens[1:]
+		return value, nil
+	}
+	request := validRegisterRequest()
+	registered, err := service.Register(context.Background(), request, "")
+	if err != nil {
+		t.Fatalf("first registration: %v", err)
+	}
+	recovery, err := service.ResetIdentity(context.Background(), registered.DeviceID)
+	if err != nil {
+		t.Fatalf("reset identity: %v", err)
+	}
+	if !recovery.ExpiresAt.After(service.Now()) {
+		t.Fatalf("unexpected recovery response: %+v", recovery)
+	}
+	request.RequestID = uuid.NewString()
+	recovered, err := service.Register(context.Background(), request, "original-token")
+	if err != nil {
+		t.Fatalf("recover registration: %v", err)
+	}
+	if recovered.DeviceID != registered.DeviceID || recovered.DeviceToken != "replacement-token" {
+		t.Fatalf("unexpected recovery result: %+v", recovered)
+	}
+	var stored models.AgentDevice
+	if err := db.First(&stored, registered.DeviceID).Error; err != nil {
+		t.Fatalf("load recovered device: %v", err)
+	}
+	if stored.InstallID != strings.ToLower(request.InstallID) || stored.Status != models.DeviceStatusOnline || stored.RecoveryCodeDigest != nil || stored.RecoveryUsedAt == nil {
+		t.Fatalf("recovery did not retain device safely: %+v", stored)
+	}
+	request.RequestID = uuid.NewString()
+	if _, err := service.Register(context.Background(), request, "original-token"); serviceErrorCode(t, err) != CodeInstallIDConflict {
+		t.Fatal("automatic recovery window was reusable")
+	}
+}
+
+func TestResetIdentityRejectsExpiredRecoveryCode(t *testing.T) {
+	db := openTestDatabase(t)
+	service := newTestService(t, db)
+	tokens := []string{"original-token", "invalidated-token"}
+	service.GenerateToken = func() (string, error) { value := tokens[0]; tokens = tokens[1:]; return value, nil }
+	request := validRegisterRequest()
+	registered, err := service.Register(context.Background(), request, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	recovery, err := service.ResetIdentity(context.Background(), registered.DeviceID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	service.Now = func() time.Time { return recovery.ExpiresAt.Add(time.Second) }
+	request.RequestID = uuid.NewString()
+	if _, err := service.Register(context.Background(), request, ""); serviceErrorCode(t, err) != CodeRecoveryExpired {
+		t.Fatalf("expected expired recovery code, got %v", err)
+	}
+}
+
 func TestRegistrationValidationRejectsInvalidUUIDs(t *testing.T) {
 	service := newTestService(t, openTestDatabase(t))
 	request := validRegisterRequest()

server/app/goauto/models/schema.go

@@ -39,6 +39,9 @@ type AgentDevice struct {
 	TokenDigest            string     `json:"-" gorm:"size:64;not null;uniqueIndex:ux_agent_device_token_digest"`
 	TokenIssuedAt          time.Time  `json:"tokenIssuedAt" gorm:"not null"`
 	TokenRevokedAt         *time.Time `json:"tokenRevokedAt" gorm:"index"`
+	RecoveryCodeDigest     *string    `json:"-" gorm:"size:64;index"`
+	RecoveryExpiresAt      *time.Time `json:"-" gorm:"index"`
+	RecoveryUsedAt         *time.Time `json:"-"`
 	LastRegisterRequestID  *string    `json:"-" gorm:"size:36;uniqueIndex:ux_agent_device_last_register_request_id"`
 	LastHeartbeatRequestID *string    `json:"-" gorm:"size:36;uniqueIndex:ux_agent_device_last_heartbeat_request_id"`
 	LastHeartbeatAt        *time.Time `json:"lastHeartbeatAt" gorm:"index"`

server/app/goauto/purchase/agent_retry_test.go

@@ -2,7 +2,6 @@ package purchase
 
 import (
 	"context"
-	"strings"
 	"testing"
 	"time"
 
@@ -72,6 +71,11 @@ func TestAgentRetryCreatesOneFixedDeviceTaskAndReplays(t *testing.T) {
 	setCollectedPDDPrice(t, db, f.pdd.ID)
 	service := testService(db)
 	failed := failedLiveTask(t, db, service, f)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Updates(map[string]any{
+		"target_color": "当前黑色", "target_size": "均碼",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
 
 	history, err := service.AgentHistoryDetail(context.Background(), failed.ID, f.token)
 	if err != nil || !history.Task.Retryable || history.Task.RetryDisabledReason != "" {
@@ -93,6 +97,9 @@ func TestAgentRetryCreatesOneFixedDeviceTaskAndReplays(t *testing.T) {
 	if oldTask.Status != models.PurchaseTaskStatusFailed || newTask.Status != models.PurchaseTaskStatusPending || newTask.DeviceID == nil || *newTask.DeviceID != f.device.ID || newTask.AddressSuffix == oldTask.AddressSuffix {
 		t.Fatalf("retry did not preserve old task or fix new task to device: old=%+v new=%+v", oldTask, newTask)
 	}
+	if newTask.TargetColorSnapshot != "当前黑色" || newTask.TargetSizeSnapshot != "均碼" || newTask.SpecSource != "unresolved" || purchaseAttemptPhase(newTask) != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("retry did not use current SYB targets and a fresh probe: %+v", newTask)
+	}
 
 	replay, err := service.AgentRetry(context.Background(), failed.ID, request, f.token)
 	if err != nil || !replay.Replayed || replay.TaskID != first.TaskID {
@@ -158,7 +165,7 @@ func TestMatchedReplacementExposesContinueAndReusesAgentRetry(t *testing.T) {
 	}
 }
 
-func TestMatchedReplacementRejectsClearedMappingWithoutCallingAI(t *testing.T) {
+func TestMatchedReplacementAllowsRetryWithoutPersistedMappingAndDoesNotCallAI(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), true)
 	setCollectedPDDPrice(t, db, f.pdd.ID)
@@ -172,11 +179,11 @@ func TestMatchedReplacementRejectsClearedMappingWithoutCallingAI(t *testing.T) {
 	service.Matcher = matcher
 
 	detail, err := service.AgentHistoryDetail(context.Background(), failed.ID, f.token)
-	if err != nil || detail.ContinuePurchaseEligible || !strings.Contains(detail.ContinuePurchaseDisabledReason, "规格匹配已失效") || matcher.calls != 0 {
+	if err != nil || !detail.ContinuePurchaseEligible || detail.ContinuePurchaseDisabledReason != "" || matcher.calls != 0 {
 		t.Fatalf("cleared mapping qualification mismatch: detail=%+v calls=%d error=%v", detail, matcher.calls, err)
 	}
-	_, err = service.AgentRetry(context.Background(), failed.ID, AgentRetryRequest{RequestID: uuid.NewString()}, f.token)
-	if code(err) != CodeMappingRequired || matcher.calls != 0 {
-		t.Fatalf("cleared mapping reached AI or retry: code=%s calls=%d error=%v", code(err), matcher.calls, err)
+	created, err := service.AgentRetry(context.Background(), failed.ID, AgentRetryRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || created.TaskID == 0 || matcher.calls != 0 {
+		t.Fatalf("cleared mapping retry did not create probe task: result=%+v calls=%d error=%v", created, matcher.calls, err)
 	}
 }

server/app/goauto/purchase/ai_match_eligibility.go

@@ -32,7 +32,10 @@ type skuCombinationRow struct {
 }
 
 func sybSpecsTrusted(syb models.SYBProduct) bool {
-	return syb.ParseStatus == models.SYBParseStatusSuccess || syb.ManuallyConfirmed || syb.AIConfirmed
+	if strings.TrimSpace(syb.TargetColor) == "" && strings.TrimSpace(syb.TargetSize) == "" {
+		return false
+	}
+	return syb.ParseStatus != models.SYBParseStatusFailed || syb.ManuallyConfirmed || syb.AIConfirmed
 }
 
 func aiConfirmedSpecsCurrent(syb models.SYBProduct, shopee models.ShopeeProduct) bool {
@@ -174,7 +177,10 @@ func aiMatchQualificationForDataset(id uint64, dataset batchPreviewDataset) aiMa
 		if request.TargetSize != "" {
 			size = matched.MappedSize
 		}
-		if validSKUCombination(dataset.skuCombinationsByPDD[pdd.ID], syb.TargetColor, syb.TargetSize, color, size) {
+		// 人工录入或外部导入的 PDD 档案可以没有采集任务 SKU 证据。没有
+		// 证据时只确认候选值；一旦有证据，仍必须命中同一个可售组合。
+		combinations := dataset.skuCombinationsByPDD[pdd.ID]
+		if len(combinations) == 0 || validSKUCombination(combinations, syb.TargetColor, syb.TargetSize, color, size) {
 			return aiMatchQualification{Eligible: true, Request: request, MappedColor: mappedColor, MappedSize: mappedSize, Deterministic: &matched}
 		}
 	}

server/app/goauto/purchase/batch.go

@@ -105,8 +105,7 @@ func (s *Service) BatchPreview(ctx context.Context, req BatchPreviewRequest) (Ba
 	items := make([]BatchPreviewItem, 0, len(ids))
 	eligible := 0
 	for _, id := range ids {
-		item := s.previewFromDataset(ctx, id, dataset, false, guard)
-		item.enforcePersistedMatch(id, dataset)
+		item := s.previewFromDataset(id, dataset, guard)
 		item.applyCollectionEligibility(id, dataset)
 		qualification := aiMatchQualificationForDataset(id, dataset)
 		item.AIMatchEligible = qualification.Eligible
@@ -331,22 +330,6 @@ func (s *Service) validateBatchDevice(ctx context.Context, deviceID *uint64, rul
 	return ensureCapabilities(record, purchasecontract.RequiredCapabilities(rule))
 }
 
-func (s *Service) previewOne(ctx context.Context, id uint64) BatchPreviewItem {
-	_, _, currentRule, ruleErr := purchaserule.CurrentRule(ctx, s.DB, models.PurchaseExecutionModeLive)
-	if ruleErr != nil {
-		item := BatchPreviewItem{SYBProductID: id}
-		item.ReasonCode, item.Reason, item.NextAction = serviceErrorFields(ruleErr)
-		return item
-	}
-	dataset, err := s.loadBatchPreviewDataset(ctx, []uint64{id})
-	if err != nil {
-		item := BatchPreviewItem{SYBProductID: id}
-		item.ReasonCode, item.Reason, item.NextAction = CodeInternal, "服务端处理失败", "retry"
-		return item
-	}
-	return s.previewFromDataset(ctx, id, dataset, true, purchasecontract.EffectivePriceGuard(currentRule))
-}
-
 func (s *Service) previewOneDeterministic(ctx context.Context, id uint64, guard purchasecontract.PriceLimits) BatchPreviewItem {
 	dataset, err := s.loadBatchPreviewDataset(ctx, []uint64{id})
 	if err != nil {
@@ -354,8 +337,7 @@ func (s *Service) previewOneDeterministic(ctx context.Context, id uint64, guard
 		item.ReasonCode, item.Reason, item.NextAction = CodeInternal, "服务端处理失败", "retry"
 		return item
 	}
-	item := s.previewFromDataset(ctx, id, dataset, false, guard)
-	item.enforcePersistedMatch(id, dataset)
+	item := s.previewFromDataset(id, dataset, guard)
 	return item
 }
 
@@ -379,7 +361,7 @@ func taskPointerValue(value *uint64) uint64 {
 	return *value
 }
 
-func (s *Service) previewFromDataset(ctx context.Context, id uint64, dataset batchPreviewDataset, allowAI bool, guard purchasecontract.PriceLimits) BatchPreviewItem {
+func (s *Service) previewFromDataset(id uint64, dataset batchPreviewDataset, guard purchasecontract.PriceLimits) BatchPreviewItem {
 	item := BatchPreviewItem{SYBProductID: id}
 	syb, found := dataset.sybByID[id]
 	if !found {
@@ -427,26 +409,15 @@ func (s *Service) previewFromDataset(ctx context.Context, id uint64, dataset bat
 	}
 	mappedColor, mappedSize, source := confirmedMappings(shopee.SpecsJSON, syb.TargetColor, syb.TargetSize)
 	item.MappedColor, item.MappedSize = mappedColor, mappedSize
-	candidates, archiveUsable := archiveCandidates(pdd.SpecsJSON, syb.TargetColor, syb.TargetSize)
+	candidates, _ := archiveCandidates(pdd.SpecsJSON, syb.TargetColor, syb.TargetSize)
 	// #190：失效的已保存映射不再拦截，降级为 unresolved，与创建路径保持一致。
 	if source != "unresolved" && !mappingTargetsValid(candidates, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) {
 		mappedColor, mappedSize, source = "", "", "unresolved"
 		item.MappedColor, item.MappedSize = "", ""
 	}
 	if source == "unresolved" {
-		if !archiveUsable {
-			item.ReasonCode, item.Reason, item.NextAction = CodeMappingRequired, "关联的 PDD 商品没有完整可选规格", "open_pdd"
-			return item
-		}
 		request := aimatching.MatchRequest{TargetColor: syb.TargetColor, TargetSize: syb.TargetSize, Colors: candidates.Colors, Sizes: candidates.Sizes}
-		if allowAI {
-			matched, matchErr := s.matcher().Resolve(ctx, request)
-			if matchErr != nil {
-				item.ReasonCode, item.Reason, item.NextAction = serviceErrorFields(purchaseMatchError(matchErr))
-				return item
-			}
-			item.MappedColor, item.MappedSize = matched.MappedColor, matched.MappedSize
-		} else if matched, ok := aimatching.DeterministicMatch(request); ok {
+		if matched, ok := aimatching.DeterministicMatch(request); ok {
 			item.MappedColor, item.MappedSize = matched.MappedColor, matched.MappedSize
 		}
 		// #190：映射不完整不再拦截，任务以 unresolved 建立并交由规格探测解析。
@@ -480,46 +451,6 @@ func (s *Service) previewFromDataset(ctx context.Context, id uint64, dataset bat
 	return item
 }
 
-// enforcePersistedMatch is the #188 gate for the SYB list and batch-create
-// workflow. A transient deterministic result is not purchase readiness: the
-// color/size mapping must already be confirmed on the Shopee product and must
-// still identify one complete, available SKU combination from the latest
-// successful collection.
-func (item *BatchPreviewItem) enforcePersistedMatch(id uint64, dataset batchPreviewDataset) {
-	if item.ReasonCode != "" && item.ReasonCode != CodeMappingRequired {
-		return
-	}
-	syb, ok := dataset.sybByID[id]
-	if !ok || syb.ShopeeProductID == nil {
-		return
-	}
-	shopee, ok := dataset.shopeeByID[*syb.ShopeeProductID]
-	if !ok || shopee.PDDProductID == nil {
-		return
-	}
-	pdd, ok := dataset.pddByID[*shopee.PDDProductID]
-	if !ok || pdd.Status != "active" {
-		return
-	}
-	mappedColor, mappedSize, source := confirmedMappings(shopee.SpecsJSON, syb.TargetColor, syb.TargetSize)
-	item.MappedColor, item.MappedSize = mappedColor, mappedSize
-	if source == "unresolved" {
-		item.Eligible = false
-		item.ReasonCode, item.Reason, item.NextAction = CodeMappingRequired, "规格尚未匹配并保存，请先完成 AI 匹配或人工确认", "open_mapping"
-		return
-	}
-	combinations := dataset.skuCombinationsByPDD[pdd.ID]
-	if len(combinations) == 0 {
-		item.Eligible = false
-		item.ReasonCode, item.Reason, item.NextAction = CodeMappingRequired, "缺少当前 PDD 商品的完整可售 SKU 组合，请先重新采集", "open_pdd"
-		return
-	}
-	if !validSKUCombination(combinations, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) {
-		item.Eligible = false
-		item.ReasonCode, item.Reason, item.NextAction = CodeMappingRequired, "已保存规格映射不属于当前可售的 PDD 规格组合，请重新匹配", "open_mapping"
-	}
-}
-
 func purchasePriceRange(raw, mappedColor string, guard purchasecontract.PriceLimits) (reference, minPrice, maxPrice int64, err error) {
 	var dimensions []productspec.Dimension
 	if json.Unmarshal([]byte(raw), &dimensions) != nil {

server/app/goauto/purchase/batch_spec_match.go

@@ -50,11 +50,6 @@ func (s *Service) BatchSpecMatch(ctx context.Context, req BatchSpecMatchRequest)
 	if err != nil {
 		return BatchSpecMatchResponse{}, internal(err)
 	}
-	settings, err := aimatching.NewService(s.DB).Settings(ctx)
-	if err != nil {
-		return BatchSpecMatchResponse{}, internal(err)
-	}
-
 	response := BatchSpecMatchResponse{Items: make([]BatchSpecMatchItem, 0, len(ids))}
 	for _, id := range ids {
 		item := BatchSpecMatchItem{SYBProductID: id, Status: BatchSpecMatchFailed}
@@ -87,9 +82,11 @@ func (s *Service) BatchSpecMatch(ctx context.Context, req BatchSpecMatchRequest)
 			}
 		}
 		item.Source, item.Confidence = matched.Source, matched.Decision.Confidence
-		autoConfirm := qualification.Deterministic != nil || (matched.Source == aimatching.SourceAI && matched.Decision.Confidence != nil && *matched.Decision.Confidence >= settings.AutoConfirmMinConfidence && strings.TrimSpace(matched.Decision.Reason) != "")
+		// #200：在 SYB 批量入口，AI 只要返回了可保存的规格结果，就由后续的
+		// 候选与可售 SKU 组合校验决定是否放行；置信度仅保留为审计信息。
+		autoConfirm := qualification.Deterministic != nil || (matched.Source == aimatching.SourceAI && strings.TrimSpace(matched.Decision.Reason) != "")
 		if !autoConfirm {
-			item.Status, item.Reason = BatchSpecMatchPending, "匹配结果未达到自动确认阈值，请人工确认"
+			item.Status, item.Reason = BatchSpecMatchPending, "AI 未返回可用规格结果，请人工确认"
 			if strings.TrimSpace(matched.Decision.Reason) != "" {
 				item.Reason += "：" + strings.TrimSpace(matched.Decision.Reason)
 			}
@@ -104,7 +101,8 @@ func (s *Service) BatchSpecMatch(ctx context.Context, req BatchSpecMatchRequest)
 		if request.TargetSize != "" {
 			mappedSize = matched.MappedSize
 		}
-		if !mappingTargetsValid(specCandidates{Colors: request.Colors, Sizes: request.Sizes}, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) || !validSKUCombination(dataset.skuCombinationsByPDD[pdd.ID], syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) {
+		combinations := dataset.skuCombinationsByPDD[pdd.ID]
+		if !mappingTargetsValid(specCandidates{Colors: request.Colors, Sizes: request.Sizes}, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) || (len(combinations) > 0 && !validSKUCombination(combinations, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize)) {
 			item.Status, item.Reason = BatchSpecMatchPending, "AI 结果不是当前可售的 PDD 规格组合，请人工确认"
 			response.PendingCount++
 			response.Items = append(response.Items, item)
@@ -117,7 +115,7 @@ func (s *Service) BatchSpecMatch(ctx context.Context, req BatchSpecMatchRequest)
 			response.Items = append(response.Items, item)
 			continue
 		}
-		if _, err := shopeeproduct.NewService(s.DB).ApplyResolvedMappings(ctx, shopee.ID, uuid.NewString(), settings.AutoConfirmMinConfidence, writes); err != nil {
+		if _, err := shopeeproduct.NewService(s.DB).ApplyResolvedMappings(ctx, shopee.ID, uuid.NewString(), writes); err != nil {
 			item.Reason = "规格映射保存失败，请刷新后重试"
 			response.FailedCount++
 			response.Items = append(response.Items, item)

server/app/goauto/purchase/batch_spec_match_test.go

@@ -9,7 +9,6 @@ import (
 	"go-admin/app/goauto/models"
 	"go-admin/app/goauto/shopeeproduct"
 
-	"github.com/google/uuid"
 	"gorm.io/gorm"
 )
 
@@ -137,18 +136,14 @@ func exactBatchSpecFixture(t *testing.T) (*Service, fixture) {
 	return testService(db), f
 }
 
-func TestBatchSpecMatchPersistsExactMatchBeforePurchaseCreation(t *testing.T) {
+func TestBatchSpecMatchPersistsExactMatchButPurchaseDoesNotWaitForIt(t *testing.T) {
 	service, f := exactBatchSpecFixture(t)
 	matcher := &batchSpecMatcher{}
 	service.Matcher = matcher
 
 	before, err := service.BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{f.syb.ID}})
-	if err != nil || len(before.Items) != 1 || before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStageColorMapping {
-		t.Fatalf("unpersisted exact match was not gated: %+v err=%v", before, err)
-	}
-	blocked, err := service.BatchCreate(context.Background(), BatchCreateRequest{RequestID: uuid.NewString(), SYBProductIDs: []uint64{f.syb.ID}, DeviceID: &f.device.ID})
-	if err != nil || blocked.CreatedCount != 0 || blocked.FailedCount != 1 || blocked.Items[0].ReasonCode != CodeMappingRequired {
-		t.Fatalf("batch create bypassed persisted mapping gate: %+v err=%v", blocked, err)
+	if err != nil || len(before.Items) != 1 || !before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("live-probe purchase was incorrectly gated by persisted mapping: %+v err=%v", before, err)
 	}
 
 	matched, err := service.BatchSpecMatch(context.Background(), BatchSpecMatchRequest{SYBProductIDs: []uint64{f.syb.ID}})
@@ -175,10 +170,10 @@ func TestBatchSpecMatchPersistsExactMatchBeforePurchaseCreation(t *testing.T) {
 	}
 }
 
-func TestManuallyConfirmedUncertainSpecsCanBeMatchedBeforePurchase(t *testing.T) {
+func TestExtractedUncertainSpecsCanBeMatchedBeforePurchase(t *testing.T) {
 	service, f := exactBatchSpecFixture(t)
 	if err := service.DB.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Updates(map[string]any{
-		"parse_status": models.SYBParseStatusUncertain, "manually_confirmed": true,
+		"parse_status": models.SYBParseStatusUncertain, "manually_confirmed": false,
 	}).Error; err != nil {
 		t.Fatal(err)
 	}
@@ -186,16 +181,16 @@ func TestManuallyConfirmedUncertainSpecsCanBeMatchedBeforePurchase(t *testing.T)
 	service.Matcher = matcher
 
 	before, err := service.BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{f.syb.ID}})
-	if err != nil || len(before.Items) != 1 || before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStageColorMapping {
-		t.Fatalf("manually confirmed specs did not enter matching: %+v err=%v", before, err)
+	if err != nil || len(before.Items) != 1 || !before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("extracted uncertain specs were not purchase-ready for live probing: %+v err=%v", before, err)
 	}
 	matched, err := service.BatchSpecMatch(context.Background(), BatchSpecMatchRequest{SYBProductIDs: []uint64{f.syb.ID}})
 	if err != nil || matched.AutoConfirmedCount != 1 || matcher.calls != 0 {
-		t.Fatalf("manual correction did not allow exact match: %+v calls=%d err=%v", matched, matcher.calls, err)
+		t.Fatalf("extracted uncertain specs did not allow exact match: %+v calls=%d err=%v", matched, matcher.calls, err)
 	}
 	after, err := service.BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{f.syb.ID}})
 	if err != nil || !after.Items[0].Eligible || after.Items[0].ProcessStage != ProcessStagePurchaseReady {
-		t.Fatalf("saved mapping did not unlock manual correction: %+v err=%v", after, err)
+		t.Fatalf("saved mapping did not unlock extracted uncertain specs: %+v err=%v", after, err)
 	}
 }
 
@@ -236,7 +231,7 @@ func TestBatchPreviewExposesExplicitAIMatchEligibility(t *testing.T) {
 		t.Fatalf("preview failed: %+v err=%v", preview, err)
 	}
 	item := preview.Items[0]
-	if !item.AIMatchEligible || item.AIMatchDisabledReason != "" || item.Eligible || item.ProcessStage != ProcessStageColorMapping {
+	if !item.AIMatchEligible || item.AIMatchDisabledReason != "" || !item.Eligible || item.ProcessStage != ProcessStagePurchaseReady {
 		t.Fatalf("explicit AI eligibility mismatch: %+v", item)
 	}
 }
@@ -265,21 +260,38 @@ func TestBatchPreviewAllowsUncertainParseAndMissingSKUCombination(t *testing.T)
 	}
 }
 
-func TestBatchSpecMatchLeavesLowConfidenceForManualHandling(t *testing.T) {
+func TestBatchSpecMatchAndPreviewAllowMissingSKUCombinationEvidence(t *testing.T) {
+	service, f := unresolvedBatchSpecFixture(t)
+	if err := service.DB.Where("pdd_product_id = ?", f.pdd.ID).Delete(&models.CollectionTask{}).Error; err != nil {
+		t.Fatal(err)
+	}
+	service.Matcher = &batchSpecMatcher{results: []aimatching.MatchResult{aiBatchResult(0.6)}}
+
+	matched, err := service.BatchSpecMatch(context.Background(), BatchSpecMatchRequest{SYBProductIDs: []uint64{f.syb.ID}})
+	if err != nil || matched.AutoConfirmedCount != 1 || matched.PendingCount != 0 {
+		t.Fatalf("AI result without SKU evidence was not confirmed: %+v err=%v", matched, err)
+	}
+	preview, err := service.BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{f.syb.ID}})
+	if err != nil || len(preview.Items) != 1 || !preview.Items[0].Eligible || preview.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("missing SKU evidence unexpectedly blocked purchase: %+v err=%v", preview, err)
+	}
+}
+
+func TestBatchSpecMatchAutoConfirmsReturnedAIMatchRegardlessOfConfidence(t *testing.T) {
 	service, f := unresolvedBatchSpecFixture(t)
 	service.Matcher = &batchSpecMatcher{results: []aimatching.MatchResult{aiBatchResult(0.6)}}
 
 	response, err := service.BatchSpecMatch(context.Background(), BatchSpecMatchRequest{SYBProductIDs: []uint64{f.syb.ID}})
-	if err != nil || response.PendingCount != 1 || response.AutoConfirmedCount != 0 {
-		t.Fatalf("unexpected low-confidence result: %+v err=%v", response, err)
+	if err != nil || response.PendingCount != 0 || response.AutoConfirmedCount != 1 {
+		t.Fatalf("low-confidence AI result was not auto-confirmed: %+v err=%v", response, err)
 	}
 	mapping := savedColorMapping(t, service, f.shopee.ID)
-	if mapping == nil || mapping.PDDValue != "旧白色" || mapping.Status != shopeeproduct.MappingStatusConfirmed {
-		t.Fatalf("low-confidence result changed the saved mapping: %+v", mapping)
+	if mapping == nil || mapping.PDDValue != "米白色" || mapping.Status != shopeeproduct.MappingStatusConfirmed || mapping.Confidence == nil || *mapping.Confidence != 0.6 {
+		t.Fatalf("AI result was not saved as confirmed: %+v", mapping)
 	}
 	preview, err := service.BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{f.syb.ID}})
-	if err != nil || preview.Items[0].Eligible || preview.Items[0].ProcessStage != ProcessStageColorMapping {
-		t.Fatalf("pending mapping unexpectedly became purchase-ready: %+v err=%v", preview, err)
+	if err != nil || !preview.Items[0].Eligible || preview.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("saved AI result did not become purchase-ready: %+v err=%v", preview, err)
 	}
 }
 

server/app/goauto/purchase/batch_test.go

@@ -44,8 +44,32 @@ func TestBatchPreviewUsesPDDPriceAndExplainsIneligibleRows(t *testing.T) {
 	}
 }
 
+func TestSybSpecsTrustedOnlyBlocksFailedOrEmptyExtraction(t *testing.T) {
+	tests := []struct {
+		name  string
+		syb   models.SYBProduct
+		trust bool
+	}{
+		{"success", models.SYBProduct{ParseStatus: models.SYBParseStatusSuccess, TargetColor: "黑色", TargetSize: "XL"}, true},
+		{"uncertain with color", models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain, TargetColor: "套装"}, true},
+		{"uncertain with size", models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain, TargetSize: "均码"}, true},
+		{"failed with values", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, TargetColor: "黑色"}, false},
+		{"failed AI confirmed", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, TargetColor: "黑色", AIConfirmed: true}, true},
+		{"failed manually confirmed", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, TargetColor: "黑色", ManuallyConfirmed: true}, true},
+		{"AI confirmed without values", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, AIConfirmed: true}, false},
+		{"uncertain without values", models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sybSpecsTrusted(tt.syb); got != tt.trust {
+				t.Fatalf("sybSpecsTrusted=%v, want %v", got, tt.trust)
+			}
+		})
+	}
+}
+
 func TestSYBSpecsTrustedAcceptsAIWithoutCallingItManual(t *testing.T) {
-	row := models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain, AIConfirmed: true}
+	row := models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain, TargetColor: "黑色", AIConfirmed: true}
 	if !sybSpecsTrusted(row) {
 		t.Fatal("a valid AI-confirmed parse must pass the purchase parse gate")
 	}
@@ -289,8 +313,24 @@ func TestBatchPreviewBulkLoadsAndNeverCallsAIMatcher(t *testing.T) {
 	if queries != 7 {
 		t.Fatalf("batch preview used %d queries, want 7 bounded queries including collection eligibility and current purchase rule", queries)
 	}
-	if len(response.Items) != 2 || response.Items[0].Eligible || response.Items[1].Eligible || response.Items[0].ReasonCode != CodeMappingRequired {
-		t.Fatalf("unresolved rows must not be reported as purchase-ready: %+v", response)
+	if len(response.Items) != 2 || !response.Items[0].Eligible || !response.Items[1].Eligible || response.EligibleCount != 2 {
+		t.Fatalf("unresolved rows must be ready for mandatory live probing: %+v", response)
+	}
+}
+
+func TestBatchPreviewAllowsIncompleteArchivedCandidatesForMandatoryLiveProbe(t *testing.T) {
+	db := testDB(t)
+	fixture := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.PDDProduct{}).Where("id = ?", fixture.pdd.ID).Update(
+		"specs_json",
+		`[{"name":"颜色","role":"color","values":[{"name":"黑色","selectable":true,"priceCent":2000}]}]`,
+	).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	response, err := testService(db).BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{fixture.syb.ID}})
+	if err != nil || len(response.Items) != 1 || !response.Items[0].Eligible || response.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("incomplete archive blocked live probe task creation: %+v err=%v", response, err)
 	}
 }
 

server/app/goauto/purchase/handler.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"go-admin/common/clientprincipal"
 	"io"
 	"net/http"
 	"strconv"
@@ -470,6 +471,9 @@ func writeAdminReplay(c *gin.Context, data any, replayed bool) {
 }
 
 func allowedOperator(c *gin.Context) bool {
+	if _, ok := clientprincipal.Get(c); ok {
+		return true
+	}
 	role, _ := jwt.ExtractClaims(c)["rolekey"].(string)
 	if role == "admin" || role == "purchaser" {
 		return true
@@ -544,6 +548,9 @@ func writeError(c *gin.Context, err error) {
 	c.JSON(status, gin.H{"code": code, "message": msg, "retryable": retryable})
 }
 func operatorID(c *gin.Context) uint64 {
+	if id, ok := clientprincipal.Get(c); ok {
+		return id.AuthorizedBy
+	}
 	claims := jwt.ExtractClaims(c)
 	switch v := claims["identity"].(type) {
 	case float64:

server/app/goauto/purchase/lifecycle.go

@@ -33,6 +33,19 @@ func (s *Service) Next(ctx context.Context, token string) (*TaskPayload, error)
 	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
 		return nil, internal(err)
 	}
+	// A completed probe reserves the device's purchase flow while the server
+	// resolves the exact specs. Returning that task as a waiting payload keeps
+	// the Agent from claiming another purchase or collection task and preserves
+	// the PDD page that the probe just inspected.
+	var waiting models.PurchaseTask
+	if err = s.DB.WithContext(ctx).
+		Where("device_id = ? AND status = ?", d.ID, models.PurchaseTaskStatusSpecProbePending).
+		Order("created_at, id").
+		First(&waiting).Error; err == nil {
+		return s.payload(waiting, nil, false)
+	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, internal(err)
+	}
 	now := s.Now()
 	var candidates []models.PurchaseTask
 	if err = s.DB.WithContext(ctx).Where("status IN ? AND (lease_expires_at IS NULL OR lease_expires_at <= ?) AND (device_id IS NULL OR device_id = ?)", []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusSpecProbePending}, now, d.ID).Order("CASE WHEN device_id IS NULL THEN 1 ELSE 0 END, created_at, id").Limit(100).Find(&candidates).Error; err != nil {
@@ -186,17 +199,14 @@ func (s *Service) Start(ctx context.Context, taskID uint64, req ActionRequest, t
 		if e = ensureAccountFree(tx, t.PDDAccountID, t.ID, s.Now()); e != nil {
 			return e
 		}
-		phase := models.PurchaseAttemptPhasePurchase
-		if t.SpecSource == "unresolved" {
-			phase = models.PurchaseAttemptPhaseSpecProbe
-		}
+		phase := purchaseAttemptPhase(t)
 		ruleSnapshotHash := purchaseRuleSnapshotHash(t.RuleSnapshot)
 		now := s.Now()
 		var a models.PurchaseTaskAttempt
 		if e = tx.Where("task_id = ? AND status = ?", t.ID, models.PurchaseAttemptStatusPending).Order("attempt_number DESC, id DESC").First(&a).Error; e == nil {
-			if a.DeviceID == nil || *a.DeviceID != d.ID || a.RuleSnapshotHash != ruleSnapshotHash {
+			if a.DeviceID == nil || *a.DeviceID != d.ID || a.RuleSnapshotHash != ruleSnapshotHash || a.Phase != phase {
 				failureCode := CodeStateConflict
-				message := "采购规则快照校验失败，请重新重试任务"
+				message := "采购任务执行快照校验失败，请重新创建任务"
 				a.Status = models.PurchaseAttemptStatusFailed
 				a.ErrorCode = &failureCode
 				a.ErrorMessage = &message
@@ -266,6 +276,9 @@ func (s *Service) MarkOrderSubmitStarted(ctx context.Context, taskID uint64, req
 		if t.ExecutionMode != models.PurchaseExecutionModeLive {
 			return TaskPayload{}, fail(CodeStateConflict, "演练任务不能创建订单")
 		}
+		if a.Phase != models.PurchaseAttemptPhasePurchase {
+			return TaskPayload{}, fail(CodeStateConflict, "规格探测阶段不能进入创建订单边界")
+		}
 		if _, e := uuid.Parse(req.RequestID); e != nil {
 			return TaskPayload{}, fail(CodeInvalidRequest, "requestId 无效")
 		}
@@ -536,19 +549,29 @@ func (s *Service) resolveProbedSpecs(ctx context.Context, taskID uint64, attempt
 		}
 		decision.NoMatch, decision.Decision = true, snapshot
 		decision.FailureCode, decision.FailureMessage = "PURCHASE_SPEC_NOT_MATCHED", "没有找到可采购的 PDD 颜色或尺码"
-	} else if matched, matchErr := s.matcher().Resolve(ctx, request); matchErr == nil {
-		snapshot, marshalErr := json.Marshal(matched.Decision)
-		if marshalErr != nil {
-			return TaskPayload{}, internal(marshalErr)
-		}
-		decision.MappedColor, decision.MappedSize, decision.Source, decision.Decision = matched.MappedColor, matched.MappedSize, matched.Source, snapshot
 	} else {
-		snapshot, marshalErr := json.Marshal(aimatching.NoMatchDecision(request, aimatching.SourceAI, purchaseMatchReason(matchErr)))
-		if marshalErr != nil {
-			return TaskPayload{}, internal(marshalErr)
+		matched, matchErr := s.resolveProbedMatch(ctx, task, request)
+		valid := matchErr == nil && (matched.Source == "manual_mapping" || matched.Source == aimatching.SourceExact || matched.Source == aimatching.SourceAI) &&
+			matchCandidateValid(request.TargetColor, matched.MappedColor, request.Colors) &&
+			matchCandidateValid(request.TargetSize, matched.MappedSize, request.Sizes)
+		if valid {
+			snapshot, marshalErr := json.Marshal(matched.Decision)
+			if marshalErr != nil {
+				return TaskPayload{}, internal(marshalErr)
+			}
+			decision.MappedColor, decision.MappedSize, decision.Source, decision.Decision = matched.MappedColor, matched.MappedSize, matched.Source, snapshot
+		} else {
+			reason := purchaseMatchReason(matchErr)
+			if matchErr == nil {
+				reason = "AI 规格匹配结果不属于当次 PDD 候选"
+			}
+			snapshot, marshalErr := json.Marshal(aimatching.NoMatchDecision(request, aimatching.SourceAI, reason))
+			if marshalErr != nil {
+				return TaskPayload{}, internal(marshalErr)
+			}
+			decision.NoMatch, decision.Decision = true, snapshot
+			decision.FailureCode, decision.FailureMessage = "PURCHASE_SPEC_NOT_MATCHED", reason
 		}
-		decision.NoMatch, decision.Decision = true, snapshot
-		decision.FailureCode, decision.FailureMessage = "PURCHASE_SPEC_NOT_MATCHED", purchaseMatchReason(matchErr)
 	}
 	updated, _, err := s.applySpecDecision(ctx, taskID, decision, nil)
 	if err != nil {
@@ -567,7 +590,7 @@ func purchaseMatchReason(err error) string {
 			return "AI 规格匹配暂时不可用，请稍后重新创建采购任务"
 		}
 	}
-	return "没有找到可采购的 PDD 颜色或尺码"
+	return "已采集到当前规格，但未能确定颜色或尺码映射"
 }
 
 type probedSpecCandidates struct {
@@ -649,7 +672,7 @@ func (s *Service) withRunning(ctx context.Context, taskID uint64, token string,
 
 func ensureDeviceFree(tx *gorm.DB, deviceID, taskID uint64, now time.Time) error {
 	var count int64
-	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND device_id = ? AND (status IN ? OR (status IN ? AND lease_expires_at > ?))", taskID, deviceID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted}, []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusSpecProbePending}, now).Count(&count).Error; e != nil {
+	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND device_id = ? AND (status IN ? OR (status = ? AND lease_expires_at > ?))", taskID, deviceID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusSpecProbePending}, models.PurchaseTaskStatusPending, now).Count(&count).Error; e != nil {
 		return internal(e)
 	}
 	if count > 0 {
@@ -668,7 +691,7 @@ func ensureAccountFree(tx *gorm.DB, accountID *uint64, taskID uint64, now time.T
 		return nil
 	}
 	var count int64
-	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND pdd_account_id = ? AND (status IN ? OR (status IN ? AND lease_expires_at > ?))", taskID, *accountID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted}, []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusSpecProbePending}, now).Count(&count).Error; e != nil {
+	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND pdd_account_id = ? AND (status IN ? OR (status = ? AND lease_expires_at > ?))", taskID, *accountID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusSpecProbePending}, models.PurchaseTaskStatusPending, now).Count(&count).Error; e != nil {
 		return internal(e)
 	}
 	if count > 0 {

server/app/goauto/purchase/match_worker_test.go

@@ -40,6 +40,19 @@ func queuedMatchTask(t *testing.T) (*gorm.DB, fixture, models.PurchaseTask) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	fingerprint, snapshot, err := currentPurchaseMatchInput(db, task)
+	if err != nil {
+		t.Fatal(err)
+	}
+	work := models.PurchaseSpecMatchWorkItem{
+		PurchaseTaskID:    task.ID,
+		Status:            models.PurchaseMatchPending,
+		InputFingerprint:  fingerprint,
+		InputSnapshotJSON: snapshot,
+	}
+	if err := db.Create(&work).Error; err != nil {
+		t.Fatal(err)
+	}
 	return db, f, task
 }
 

server/app/goauto/purchase/probe_resolution.go

@@ -0,0 +1,207 @@
+package purchase
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+
+	"go-admin/app/goauto/aimatching"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/shopeeproduct"
+)
+
+// resolveProbedMatch keeps the live probe as the source of executable labels.
+// Confirmed product mappings may guide the decision only when they still map
+// uniquely to a label observed by this attempt.
+func (s *Service) resolveProbedMatch(ctx context.Context, task models.PurchaseTask, request aimatching.MatchRequest) (aimatching.MatchResult, error) {
+	resolvedColor, resolvedSize := "", ""
+	roleSources := map[string]string{}
+
+	mappings := probeGuidanceFromSnapshot(task.SpecDecisionSnapshot)
+	if candidate, ok := currentMappedCandidate(mappings.color.value, request.Colors); ok {
+		resolvedColor, roleSources[shopeeproduct.RoleColor] = candidate, mappings.color.source
+	}
+	if candidate, ok := currentMappedCandidate(mappings.size.value, request.Sizes); ok {
+		resolvedSize, roleSources[shopeeproduct.RoleSize] = candidate, mappings.size.source
+	}
+
+	if task.TargetColorSnapshot != "" && resolvedColor == "" {
+		if exact, ok := aimatching.DeterministicMatch(aimatching.MatchRequest{TargetColor: task.TargetColorSnapshot, Colors: request.Colors}); ok {
+			resolvedColor, roleSources[shopeeproduct.RoleColor] = exact.MappedColor, aimatching.SourceExact
+		}
+	}
+	if task.TargetSizeSnapshot != "" && resolvedSize == "" {
+		if exact, ok := aimatching.DeterministicMatch(aimatching.MatchRequest{TargetSize: task.TargetSizeSnapshot, Sizes: request.Sizes}); ok {
+			resolvedSize, roleSources[shopeeproduct.RoleSize] = exact.MappedSize, aimatching.SourceExact
+		}
+	}
+
+	missingColor := task.TargetColorSnapshot != "" && resolvedColor == ""
+	missingSize := task.TargetSizeSnapshot != "" && resolvedSize == ""
+	var providerDecision aimatching.DecisionSnapshot
+	if missingColor || missingSize {
+		remaining := aimatching.MatchRequest{}
+		if missingColor {
+			remaining.TargetColor, remaining.Colors = task.TargetColorSnapshot, request.Colors
+		}
+		if missingSize {
+			remaining.TargetSize, remaining.Sizes = task.TargetSizeSnapshot, request.Sizes
+		}
+		matched, err := s.matcher().Resolve(ctx, remaining)
+		if err != nil {
+			return aimatching.MatchResult{}, err
+		}
+		if matched.Source != aimatching.SourceExact && matched.Source != aimatching.SourceAI {
+			return aimatching.MatchResult{}, &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "规格匹配来源无效"}
+		}
+		providerDecision = matched.Decision
+		if missingColor {
+			if !matchCandidateValid(remaining.TargetColor, matched.MappedColor, remaining.Colors) {
+				return aimatching.MatchResult{}, &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "AI 返回的颜色不属于当次候选"}
+			}
+			resolvedColor, roleSources[shopeeproduct.RoleColor] = matched.MappedColor, matched.Source
+		}
+		if missingSize {
+			if !matchCandidateValid(remaining.TargetSize, matched.MappedSize, remaining.Sizes) {
+				return aimatching.MatchResult{}, &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "AI 返回的尺码不属于当次候选"}
+			}
+			resolvedSize, roleSources[shopeeproduct.RoleSize] = matched.MappedSize, matched.Source
+		}
+	}
+
+	source := probeSourceSummary(roleSources)
+	reason := "当次候选完成确定性匹配"
+	if containsRoleSource(roleSources, "manual_mapping") || containsRoleSource(roleSources, aimatching.SourceAI) {
+		reason = "已确认映射经当次候选验证，未解决规格按确定性或 AI 匹配"
+	}
+	result := aimatching.RecordedMatch(request, source, resolvedColor, resolvedSize, reason)
+	result.Decision.RoleSources = roleSources
+	result.Decision.Provider = providerDecision.Provider
+	result.Decision.Model = providerDecision.Model
+	result.Decision.Confidence = providerDecision.Confidence
+	return result, nil
+}
+
+type confirmedProbeMapping struct {
+	value   string
+	source  string
+	invalid bool
+}
+
+type confirmedProbeMappingSet struct {
+	color confirmedProbeMapping
+	size  confirmedProbeMapping
+}
+
+type probeGuidanceSnapshot struct {
+	ConfirmedMappings map[string]probeGuidanceMapping `json:"confirmedMappings,omitempty"`
+}
+
+type probeGuidanceMapping struct {
+	Value  string `json:"value"`
+	Source string `json:"source"`
+}
+
+func newProbeGuidanceSnapshot(raw, targetColor, targetSize string) (string, error) {
+	mappings := confirmedProbeMappings(raw, targetColor, targetSize)
+	snapshot := probeGuidanceSnapshot{ConfirmedMappings: map[string]probeGuidanceMapping{}}
+	if mappings.color.value != "" {
+		snapshot.ConfirmedMappings[shopeeproduct.RoleColor] = probeGuidanceMapping{Value: mappings.color.value, Source: mappings.color.source}
+	}
+	if mappings.size.value != "" {
+		snapshot.ConfirmedMappings[shopeeproduct.RoleSize] = probeGuidanceMapping{Value: mappings.size.value, Source: mappings.size.source}
+	}
+	encoded, err := json.Marshal(snapshot)
+	return string(encoded), err
+}
+
+func probeGuidanceFromSnapshot(raw string) confirmedProbeMappingSet {
+	var snapshot probeGuidanceSnapshot
+	if json.Unmarshal([]byte(raw), &snapshot) != nil {
+		return confirmedProbeMappingSet{}
+	}
+	result := confirmedProbeMappingSet{}
+	if mapping, ok := snapshot.ConfirmedMappings[shopeeproduct.RoleColor]; ok {
+		result.color = confirmedProbeMapping{value: strings.TrimSpace(mapping.Value), source: mapping.Source}
+	}
+	if mapping, ok := snapshot.ConfirmedMappings[shopeeproduct.RoleSize]; ok {
+		result.size = confirmedProbeMapping{value: strings.TrimSpace(mapping.Value), source: mapping.Source}
+	}
+	return result
+}
+
+func confirmedProbeMappings(raw, targetColor, targetSize string) confirmedProbeMappingSet {
+	var specs []shopeeproduct.SpecDimension
+	if json.Unmarshal([]byte(raw), &specs) != nil {
+		return confirmedProbeMappingSet{}
+	}
+	result := confirmedProbeMappingSet{}
+	for _, dimension := range specs {
+		for _, value := range dimension.Values {
+			if value.Mapping == nil || value.Mapping.Status != shopeeproduct.MappingStatusConfirmed {
+				continue
+			}
+			mapping := confirmedProbeMapping{value: strings.TrimSpace(value.Mapping.PDDValue), source: mapSource(value.Mapping.Source)}
+			switch {
+			case dimension.Role == shopeeproduct.RoleColor && value.Name == targetColor:
+				result.color = mergeConfirmedProbeMapping(result.color, mapping)
+			case dimension.Role == shopeeproduct.RoleSize && value.Name == targetSize:
+				result.size = mergeConfirmedProbeMapping(result.size, mapping)
+			}
+		}
+	}
+	return result
+}
+
+func mergeConfirmedProbeMapping(current, incoming confirmedProbeMapping) confirmedProbeMapping {
+	if current.invalid {
+		return current
+	}
+	if current.value == "" {
+		return incoming
+	}
+	if current.value != incoming.value {
+		return confirmedProbeMapping{invalid: true}
+	}
+	return current
+}
+
+func currentMappedCandidate(mapped string, candidates []string) (string, bool) {
+	mapped = strings.TrimSpace(mapped)
+	if mapped == "" {
+		return "", false
+	}
+	matches := make([]string, 0, 1)
+	seen := map[string]bool{}
+	for _, candidate := range candidates {
+		candidate = strings.TrimSpace(candidate)
+		if candidate == "" || seen[candidate] || aimatching.Normalize(candidate) != aimatching.Normalize(mapped) {
+			continue
+		}
+		seen[candidate] = true
+		matches = append(matches, candidate)
+	}
+	if len(matches) != 1 {
+		return "", false
+	}
+	return matches[0], true
+}
+
+func probeSourceSummary(roleSources map[string]string) string {
+	if containsRoleSource(roleSources, "manual_mapping") {
+		return "manual_mapping"
+	}
+	if containsRoleSource(roleSources, aimatching.SourceAI) {
+		return aimatching.SourceAI
+	}
+	return aimatching.SourceExact
+}
+
+func containsRoleSource(roleSources map[string]string, target string) bool {
+	for _, source := range roleSources {
+		if source == target {
+			return true
+		}
+	}
+	return false
+}

server/app/goauto/purchase/process_stage.go

@@ -69,8 +69,7 @@ func (s *Service) ProcessStages(ctx context.Context, ids []uint64) (map[uint64]P
 		return nil, err
 	}
 	for _, id := range ids {
-		preview := s.previewFromDataset(ctx, id, dataset, false, guard)
-		preview.enforcePersistedMatch(id, dataset)
+		preview := s.previewFromDataset(id, dataset, guard)
 		qualification := aiMatchQualificationForDataset(id, dataset)
 		preview.AIMatchEligible = qualification.Eligible
 		preview.AIMatchDisabledReason = qualification.DisabledReason

server/app/goauto/purchase/reset.go

@@ -87,6 +87,9 @@ func (s *Service) reset(ctx context.Context, taskID uint64, req PurchaseResetReq
 		if err := validatePurchaseResetState(tx, task); err != nil {
 			return err
 		}
+		if task.SpecSource != "unresolved" && !hasCompletePurchaseSpec(task) {
+			return fail(CodeMappingRequired, "任务没有完整的精确商品规格，请创建新采购任务")
+		}
 		deviceRecord, err := lockPurchaseResetDevice(tx, task, authenticated)
 		if err != nil {
 			return err
@@ -130,10 +133,7 @@ func (s *Service) reset(ctx context.Context, taskID uint64, req PurchaseResetReq
 			return conflictOrInternal(err)
 		}
 
-		phase := models.PurchaseAttemptPhasePurchase
-		if task.SpecSource == "unresolved" {
-			phase = models.PurchaseAttemptPhaseSpecProbe
-		}
+		phase := purchaseAttemptPhase(task)
 		// MySQL normalizes values written to a JSON column. Reload the task before
 		// hashing so the pending attempt uses the exact representation Start will
 		// read later, rather than the pre-persistence DefaultLiveRule bytes.
@@ -155,6 +155,18 @@ func (s *Service) reset(ctx context.Context, taskID uint64, req PurchaseResetReq
 	return response, err
 }
 
+func purchaseAttemptPhase(task models.PurchaseTask) string {
+	if task.SpecSource == "unresolved" || !hasCompletePurchaseSpec(task) {
+		return models.PurchaseAttemptPhaseSpecProbe
+	}
+	return models.PurchaseAttemptPhasePurchase
+}
+
+func hasCompletePurchaseSpec(task models.PurchaseTask) bool {
+	return (strings.TrimSpace(task.TargetColorSnapshot) == "" || strings.TrimSpace(task.MappedColorSnapshot) != "") &&
+		(strings.TrimSpace(task.TargetSizeSnapshot) == "" || strings.TrimSpace(task.MappedSizeSnapshot) != "")
+}
+
 func validatePurchaseResetState(tx *gorm.DB, task models.PurchaseTask) error {
 	switch task.Status {
 	case models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusOrderCreated, models.PurchaseTaskStatusOrderResultUnknown:

server/app/goauto/purchase/reset_test.go

@@ -108,6 +108,36 @@ func TestPurchaseResetReusesTaskRefreshesRuleAndIsIdempotent(t *testing.T) {
 	}
 }
 
+func TestPurchaseResetRejectsResolvedDecisionWithoutExactSpec(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	service := testService(db)
+	failed := failedLiveTask(t, db, service, f)
+	decisionID := uuid.NewString()
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Model(&models.PurchaseTask{}).Where("id = ?", failed.ID).Updates(map[string]any{
+		"spec_source": "ai_match", "spec_decision_request_id": decisionID,
+		"mapped_color_snapshot": "", "mapped_size_snapshot": "",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := service.ResetForDevice(context.Background(), failed.ID, PurchaseResetRequest{RequestID: uuid.NewString()}, f.token)
+	if code(err) != CodeMappingRequired {
+		t.Fatalf("resolved decision without exact spec was reset: %v", err)
+	}
+	var task models.PurchaseTask
+	if queryErr := db.First(&task, failed.ID).Error; queryErr != nil {
+		t.Fatal(queryErr)
+	}
+	if task.Status != models.PurchaseTaskStatusFailed {
+		t.Fatalf("rejected reset changed task status: %+v", task)
+	}
+	var attemptCount int64
+	if queryErr := db.Model(&models.PurchaseTaskAttempt{}).Where("task_id = ?", failed.ID).Count(&attemptCount).Error; queryErr != nil || attemptCount != 0 {
+		t.Fatalf("rejected reset created attempt: count=%d err=%v", attemptCount, queryErr)
+	}
+}
+
 func TestPurchaseStartPersistsPendingAttemptSnapshotMismatchAsFailure(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), true)

server/app/goauto/purchase/retry.go

@@ -218,7 +218,12 @@ func (s *Service) retryEligibility(ctx context.Context, task models.PurchaseTask
 		return decision
 	}
 
-	preview := s.previewOne(ctx, *task.SYBProductID)
+	_, _, currentRule, ruleErr := purchaserule.CurrentRule(ctx, s.DB, models.PurchaseExecutionModeLive)
+	if ruleErr != nil {
+		code, message, _ := serviceErrorFields(ruleErr)
+		return retryDecision{ReasonCode: code, Reason: message}
+	}
+	preview := s.previewOneDeterministic(ctx, *task.SYBProductID, purchasecontract.EffectivePriceGuard(currentRule))
 	if !preview.Eligible {
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
@@ -230,10 +235,9 @@ func (s *Service) retryEligibility(ctx context.Context, task models.PurchaseTask
 }
 
 // retryQueryEligibility is deliberately limited to local task and device
-// safety checks. Admin list/detail queries must never call previewOne because
-// previewOne can fall back to the external AI provider for unresolved specs.
-// The batch-retry command runs retryEligibility and performs that complete,
-// current-archive validation only after the operator submits the retry.
+// safety checks. The batch-retry command performs deterministic archive and
+// price validation, but specification resolution belongs to the new task's
+// mandatory live probe and never calls AI before task creation.
 func (s *Service) retryQueryEligibility(ctx context.Context, task models.PurchaseTask, checkDeviceBusy bool) retryDecision {
 	decision := s.retryStateEligibility(ctx, task)
 	if !decision.Allowed {
@@ -263,25 +267,20 @@ func (s *Service) continuePurchaseEligibility(ctx context.Context, task models.P
 	guard := purchasecontract.EffectivePriceGuard(currentRule)
 	syb, found := dataset.sybByID[*task.SYBProductID]
 	if !found || syb.ShopeeProductID == nil {
-		preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+		preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
 	shopee, found := dataset.shopeeByID[*syb.ShopeeProductID]
 	if !found || shopee.PDDProductID == nil {
-		preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+		preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
-	pdd, found := dataset.pddByID[*shopee.PDDProductID]
+	_, found = dataset.pddByID[*shopee.PDDProductID]
 	if !found {
-		preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+		preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
-	mappedColor, mappedSize, source := confirmedMappings(shopee.SpecsJSON, syb.TargetColor, syb.TargetSize)
-	candidates, _ := archiveCandidates(pdd.SpecsJSON, syb.TargetColor, syb.TargetSize)
-	if source == "unresolved" || !mappingTargetsValid(candidates, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) {
-		return retryDecision{ReasonCode: CodeMappingRequired, Reason: "规格匹配已失效，请在 Admin 重新确认"}
-	}
-	preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+	preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 	if !preview.Eligible {
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}

server/app/goauto/purchase/retry_test.go

@@ -223,7 +223,7 @@ func TestAdminListRetryEligibilityRejectsBusyOriginalDevice(t *testing.T) {
 	}
 }
 
-func TestAdminQueriesDoNotResolveSpecsButBatchRetryStillDoes(t *testing.T) {
+func TestAdminQueriesAndBatchRetryDoNotResolveArchivedSpecs(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	service := testService(db)
@@ -253,8 +253,8 @@ func TestAdminQueriesDoNotResolveSpecsButBatchRetryStillDoes(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if matcher.calls != 1 || retry.CreatedCount != 0 || retry.FailedCount != 1 || retry.Items[0].ReasonCode != CodeMappingRequired {
-		t.Fatalf("batch retry skipped full matching: result=%+v matcherCalls=%d", retry, matcher.calls)
+	if matcher.calls != 0 || retry.CreatedCount != 1 || retry.FailedCount != 0 {
+		t.Fatalf("batch retry did not create a mandatory probe task: result=%+v matcherCalls=%d", retry, matcher.calls)
 	}
 }
 

server/app/goauto/purchase/service.go

@@ -54,11 +54,6 @@ type SpecMatcher interface {
 	Resolve(context.Context, aimatching.MatchRequest) (aimatching.MatchResult, error)
 }
 
-type externalMatchPlan struct {
-	fingerprint string
-	snapshot    string
-}
-
 type matchFingerprint struct {
 	SYBProductID    uint64          `json:"sybProductId"`
 	TargetColor     string          `json:"targetColor"`
@@ -96,51 +91,6 @@ func (s *Service) Create(ctx context.Context, req CreateRequest) (models.Purchas
 	return call.task, call.replayed, call.err
 }
 
-func (s *Service) prepareExternalMatch(ctx context.Context, req CreateRequest) (*externalMatchPlan, error) {
-	if req.ExecutionMode != models.PurchaseExecutionModeLive || req.SYBProductID == nil {
-		return nil, nil
-	}
-	var syb models.SYBProduct
-	if err := s.DB.WithContext(ctx).First(&syb, *req.SYBProductID).Error; err != nil {
-		return nil, notFound(err, "顺云宝商品不存在")
-	}
-	if syb.ShopeeProductID == nil {
-		return nil, fail(CodeInvalidRequest, "该商品尚未关联蝦皮商品")
-	}
-	var shopee models.ShopeeProduct
-	if err := s.DB.WithContext(ctx).First(&shopee, *syb.ShopeeProductID).Error; err != nil {
-		return nil, notFound(err, "蝦皮商品不存在")
-	}
-	if shopee.PDDProductID == nil {
-		return nil, fail(CodeInvalidRequest, "该蝦皮商品尚未关联拼多多商品")
-	}
-	var pdd models.PDDProduct
-	if err := s.DB.WithContext(ctx).First(&pdd, *shopee.PDDProductID).Error; err != nil {
-		return nil, notFound(err, "拼多多商品不存在")
-	}
-	targetColor, targetSize := strings.TrimSpace(req.TargetColor), strings.TrimSpace(req.TargetSize)
-	if targetColor == "" {
-		targetColor = syb.TargetColor
-	}
-	if targetSize == "" {
-		targetSize = syb.TargetSize
-	}
-	_, _, source := confirmedMappings(shopee.SpecsJSON, targetColor, targetSize)
-	candidates, usable := archiveCandidates(pdd.SpecsJSON, targetColor, targetSize)
-	if pdd.Status != "active" || source != "unresolved" || !usable {
-		return nil, nil
-	}
-	request := aimatching.MatchRequest{TargetColor: targetColor, TargetSize: targetSize, Colors: candidates.Colors, Sizes: candidates.Sizes}
-	if _, deterministic := aimatching.DeterministicMatch(request); deterministic {
-		return nil, nil
-	}
-	fingerprint, snapshot, err := creationMatchInput(syb, shopee, pdd, request)
-	if err != nil {
-		return nil, internal(err)
-	}
-	return &externalMatchPlan{fingerprint: fingerprint, snapshot: snapshot}, nil
-}
-
 func creationMatchInput(syb models.SYBProduct, shopee models.ShopeeProduct, pdd models.PDDProduct, request aimatching.MatchRequest) (string, string, error) {
 	canonical := func(raw string) (json.RawMessage, error) {
 		var value any
@@ -194,10 +144,6 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
 		return models.PurchaseTask{}, false, internal(err)
 	}
-	externalPlan, err := s.prepareExternalMatch(ctx, req)
-	if err != nil {
-		return models.PurchaseTask{}, false, err
-	}
 	replayed := false
 	err = s.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("create_request_id = ?", req.RequestID).First(&out).Error; err == nil {
@@ -334,22 +280,25 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 			if currency == "" {
 				currency = shopee.Currency
 			}
-			mappedColor, mappedSize, specSource = confirmedMappings(shopee.SpecsJSON, targetColor, targetSize)
+			// Every new SYB purchase must use the candidates observed on the
+			// current PDD page. Freeze confirmed mappings only as guidance for
+			// validation against that future probe; they never skip the probe.
+			mappedColor, mappedSize, specSource = "", "", "unresolved"
+			guidance, marshalErr := newProbeGuidanceSnapshot(shopee.SpecsJSON, targetColor, targetSize)
+			if marshalErr != nil {
+				return internal(marshalErr)
+			}
+			decisionSnapshot = guidance
 		}
 		candidates, archiveUsable := archiveCandidates(pdd.SpecsJSON, targetColor, targetSize)
 		matchRequest := aimatching.MatchRequest{TargetColor: targetColor, TargetSize: targetSize, Colors: candidates.Colors, Sizes: candidates.Sizes}
-		if externalPlan != nil {
-			fingerprint, fingerprintErr := creationMatchFingerprint(syb, shopee, pdd, matchRequest)
-			if fingerprintErr != nil {
-				return internal(fingerprintErr)
-			}
-			if fingerprint != externalPlan.fingerprint {
-				return fail(CodeMappingRequired, "规格匹配输入已变化，请重新创建采购任务")
-			}
-		}
 		if taskType == models.PurchaseTaskTypeStock {
 			// Direct stock selection was already validated above. It never enters
 			// mapping, deterministic matching, or the external AI fallback.
+		} else if req.ExecutionMode == models.PurchaseExecutionModeLive {
+			// The first attempt is always spec_probe for an SYB purchase. The
+			// exact task-level decision is frozen only from that probe result.
+			mappedColor, mappedSize, specSource = "", "", "unresolved"
 		} else if pdd.Status != "active" {
 			mappedColor, mappedSize, specSource = "", "", "unresolved"
 		} else if specSource == "manual_mapping" || specSource == "exact_match" || specSource == "ai_match" {
@@ -365,8 +314,6 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 			}
 		} else if !archiveUsable {
 			mappedColor, mappedSize, specSource = "", "", "unresolved"
-		} else if externalPlan != nil {
-			mappedColor, mappedSize, specSource = "", "", "unresolved"
 		} else if match, matched := aimatching.DeterministicMatch(matchRequest); !matched {
 			// #190：确定性匹配失败不再拒绝，降级为 unresolved 交给规格探测。
 			mappedColor, mappedSize, specSource = "", "", "unresolved"
@@ -404,17 +351,8 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 		if err := tx.Model(&out).Update("address_suffix", out.AddressSuffix).Error; err != nil {
 			return internal(err)
 		}
-		if externalPlan != nil {
-			work := models.PurchaseSpecMatchWorkItem{PurchaseTaskID: out.ID, Status: models.PurchaseMatchPending, InputFingerprint: externalPlan.fingerprint, InputSnapshotJSON: externalPlan.snapshot}
-			if err := tx.Create(&work).Error; err != nil {
-				return internal(err)
-			}
-		}
 		return nil
 	})
-	if err == nil && !replayed && externalPlan != nil && s.StartMatching != nil {
-		s.StartMatching(s.DB)
-	}
 	return out, replayed, err
 }
 

server/app/goauto/purchase/service_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"go-admin/app/goauto/aimatching"
 	"go-admin/app/goauto/device"
 	"go-admin/app/goauto/migrations"
 	"go-admin/app/goauto/models"
@@ -29,6 +30,19 @@ type fixture struct {
 	token  string
 }
 
+type liveProbeMatcher struct {
+	result  aimatching.MatchResult
+	err     error
+	calls   int
+	request aimatching.MatchRequest
+}
+
+func (matcher *liveProbeMatcher) Resolve(_ context.Context, request aimatching.MatchRequest) (aimatching.MatchResult, error) {
+	matcher.calls++
+	matcher.request = request
+	return matcher.result, matcher.err
+}
+
 func testDB(t *testing.T) *gorm.DB {
 	t.Helper()
 	dsn := fmt.Sprintf("file:%s?mode=memory&cache=shared&_foreign_keys=on", strings.ReplaceAll(t.Name(), "/", "_"))
@@ -107,6 +121,30 @@ func createLive(t *testing.T, s *Service, f fixture) (models.PurchaseTask, error
 	r, _, err := s.Create(context.Background(), CreateRequest{RequestID: uuid.NewString(), ExecutionMode: models.PurchaseExecutionModeLive, SYBProductID: &f.syb.ID, DeviceID: &f.device.ID, MinUnitPriceCent: 400, MaxUnitPriceCent: 3000, RuleSnapshot: liveRule(true)})
 	return r, err
 }
+
+func startLivePurchaseAfterProbe(t *testing.T, s *Service, f fixture, task models.PurchaseTask) TaskPayload {
+	t.Helper()
+	if _, err := s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	probeAttempt, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || probeAttempt.Phase != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("probe start: %+v %v", probeAttempt, err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: probeAttempt.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黑色"]},{"key":"size","values":["XL"]}]}`)}
+	if _, err = s.SubmitResult(context.Background(), task.ID, probe, f.token); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	purchaseAttempt, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || purchaseAttempt.Phase != models.PurchaseAttemptPhasePurchase {
+		t.Fatalf("purchase start: %+v %v", purchaseAttempt, err)
+	}
+	return purchaseAttempt
+}
+
 func code(err error) string {
 	var e *ServiceError
 	if errors.As(err, &e) {
@@ -224,9 +262,23 @@ func TestCreateAndLifecycleValidateCapabilitiesAndIdempotentResult(t *testing.T)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if start.Phase != models.PurchaseAttemptPhasePurchase {
+	if start.Phase != models.PurchaseAttemptPhaseSpecProbe {
 		t.Fatalf("unexpected phase %s", start.Phase)
 	}
+	if _, err = s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); code(err) != CodeStateConflict {
+		t.Fatalf("probe entered order boundary: %v", err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: start.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黑色"]},{"key":"size","values":["XL"]}]}`)}
+	if _, err = s.SubmitResult(context.Background(), task.ID, probe, f.token); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	start, err = s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || start.Phase != models.PurchaseAttemptPhasePurchase {
+		t.Fatalf("purchase start: %+v %v", start, err)
+	}
 	if _, err = s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
 		t.Fatal(err)
 	}
@@ -243,7 +295,7 @@ func TestCreateAndLifecycleValidateCapabilitiesAndIdempotentResult(t *testing.T)
 	}
 	var count int64
 	db.Model(&models.PurchaseTaskAttempt{}).Where("task_id = ?", task.ID).Count(&count)
-	if count != 1 || first.Status != models.PurchaseTaskStatusOrderCreated {
+	if count != 2 || first.Status != models.PurchaseTaskStatusOrderCreated {
 		t.Fatalf("duplicate attempt or wrong status: %d %+v", count, first)
 	}
 	var stored models.PurchaseTask
@@ -344,6 +396,198 @@ func TestSlowPathUsesTwoAttemptsAndFreezesDecision(t *testing.T) {
 	}
 }
 
+func TestLiveProbeCallsAIOnlyAfterCandidatesAreReturned(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "象牙白").Error; err != nil {
+		t.Fatal(err)
+	}
+	request := aimatching.MatchRequest{TargetColor: "象牙白", TargetSize: "XL", Colors: []string{"米白色", "白色"}, Sizes: []string{"XL"}}
+	matcher := &liveProbeMatcher{result: aimatching.RecordedMatch(request, aimatching.SourceAI, "米白色", "XL", "在当次候选中唯一匹配")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil || matcher.calls != 0 || task.SpecSource != "unresolved" {
+		t.Fatalf("task creation called matcher or skipped probe: task=%+v calls=%d err=%v", task, matcher.calls, err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || first.Phase != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("probe start: %+v %v", first, err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["米白色","白色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || matcher.calls != 1 || resolved.Status != models.PurchaseTaskStatusPending || resolved.MappedColor != "米白色" || resolved.MappedSize != "XL" {
+		t.Fatalf("probe AI result: %+v calls=%d err=%v", resolved, matcher.calls, err)
+	}
+}
+
+func TestLiveProbeReusesConfirmedColorAndResolvesCurrentSizeWithoutAI(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Updates(map[string]any{
+		"target_color": "薑黃色",
+		"target_size":  "5XL",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	specs := []shopeeproduct.SpecDimension{
+		{Name: "颜色", Role: shopeeproduct.RoleColor, Values: []shopeeproduct.SpecValue{{Name: "薑黃色", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "黄色", Source: shopeeproduct.MappingSourceManual, Status: shopeeproduct.MappingStatusConfirmed}}}},
+		{Name: "尺码", Role: shopeeproduct.RoleSize, Values: []shopeeproduct.SpecValue{{Name: "5XL", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "XXXXXL", Source: shopeeproduct.MappingSourceAIMatch, Status: shopeeproduct.MappingStatusConfirmed, Reason: "历史档案原文"}}}},
+	}
+	raw, _ := json.Marshal(specs)
+	if err := db.Model(&models.ShopeeProduct{}).Where("id = ?", f.shopee.ID).Update("specs_json", string(raw)).Error; err != nil {
+		t.Fatal(err)
+	}
+	matcher := &liveProbeMatcher{err: errors.New("AI should not be called")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil || task.MappedColorSnapshot != "" || task.MappedSizeSnapshot != "" {
+		t.Fatalf("live task skipped mandatory probe: %+v err=%v", task, err)
+	}
+	if err = db.Model(&models.ShopeeProduct{}).Where("id = ?", f.shopee.ID).Update("specs_json", `[]`).Error; err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["白色","黄色","黑色"]},{"key":"size","values":["4XL","5XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || matcher.calls != 0 || resolved.Status != models.PurchaseTaskStatusPending {
+		t.Fatalf("confirmed mapping resolution failed: %+v calls=%d err=%v", resolved, matcher.calls, err)
+	}
+	if resolved.MappedColor != "黄色" || resolved.MappedSize != "5XL" {
+		t.Fatalf("task did not freeze current probe labels: %+v", resolved)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	var decision struct {
+		RoleSources map[string]string `json:"roleSources"`
+	}
+	if err = json.Unmarshal([]byte(saved.SpecDecisionSnapshot), &decision); err != nil {
+		t.Fatal(err)
+	}
+	if saved.SpecSource != "manual_mapping" || decision.RoleSources[shopeeproduct.RoleColor] != "manual_mapping" || decision.RoleSources[shopeeproduct.RoleSize] != aimatching.SourceExact {
+		t.Fatalf("mixed role sources were not audited: task=%+v decision=%+v", saved, decision)
+	}
+}
+
+func TestLiveProbeCallsAIOnlyForRoleWithoutCurrentConfirmedMapping(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "薑黃色").Error; err != nil {
+		t.Fatal(err)
+	}
+	specs := []shopeeproduct.SpecDimension{
+		{Name: "颜色", Role: shopeeproduct.RoleColor, Values: []shopeeproduct.SpecValue{{Name: "薑黃色", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "旧黄色", Source: shopeeproduct.MappingSourceManual, Status: shopeeproduct.MappingStatusConfirmed}}}},
+		{Name: "尺码", Role: shopeeproduct.RoleSize, Values: []shopeeproduct.SpecValue{{Name: "XL", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "XL", Source: shopeeproduct.MappingSourceManual, Status: shopeeproduct.MappingStatusConfirmed}}}},
+	}
+	raw, _ := json.Marshal(specs)
+	if err := db.Model(&models.ShopeeProduct{}).Where("id = ?", f.shopee.ID).Update("specs_json", string(raw)).Error; err != nil {
+		t.Fatal(err)
+	}
+	aiRequest := aimatching.MatchRequest{TargetColor: "薑黃色", Colors: []string{"黄色"}}
+	matcher := &liveProbeMatcher{result: aimatching.RecordedMatch(aiRequest, aimatching.SourceAI, "黄色", "", "当前颜色候选匹配")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黄色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || matcher.calls != 1 || resolved.MappedColor != "黄色" || resolved.MappedSize != "XL" {
+		t.Fatalf("partial AI resolution failed: %+v request=%+v err=%v", resolved, matcher.request, err)
+	}
+	if matcher.request.TargetColor != "薑黃色" || matcher.request.TargetSize != "" || len(matcher.request.Colors) != 1 || len(matcher.request.Sizes) != 0 {
+		t.Fatalf("resolved size was unnecessarily sent to AI: %+v", matcher.request)
+	}
+}
+
+func TestLiveProbeRejectsMatcherValueOutsideCurrentCandidates(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "象牙黑").Error; err != nil {
+		t.Fatal(err)
+	}
+	request := aimatching.MatchRequest{TargetColor: "象牙黑", Colors: []string{"黑色"}}
+	matcher := &liveProbeMatcher{result: aimatching.RecordedMatch(request, aimatching.SourceAI, "候选外颜色", "XL", "无效返回")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黑色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || resolved.Status != models.PurchaseTaskStatusFailed || resolved.MappedColor != "" || resolved.MappedSize != "" {
+		t.Fatalf("out-of-candidate result was accepted: %+v err=%v", resolved, err)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil || saved.ErrorCode == nil || *saved.ErrorCode != "PURCHASE_SPEC_NOT_MATCHED" {
+		t.Fatalf("outside-candidate failure was not persisted: %+v err=%v", saved, err)
+	}
+	if saved.ErrorMessage == nil || *saved.ErrorMessage != "已采集到当前规格，但未能确定颜色或尺码映射" {
+		t.Fatalf("outside-candidate failure reason was not preserved: %+v", saved)
+	}
+}
+
+func TestLiveProbeUsesAccurateMessageWhenCompleteCandidatesCannotBeMatched(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "薑黃色").Error; err != nil {
+		t.Fatal(err)
+	}
+	s := testService(db)
+	s.Matcher = &liveProbeMatcher{err: &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "no match"}}
+	task, err := createLive(t, s, f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黄色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || resolved.Status != models.PurchaseTaskStatusFailed {
+		t.Fatalf("no-match probe did not converge: %+v err=%v", resolved, err)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if saved.ErrorMessage == nil || *saved.ErrorMessage != "已采集到当前规格，但未能确定颜色或尺码映射" {
+		t.Fatalf("complete candidates used misleading failure reason: %+v", saved)
+	}
+}
+
 func TestSecondSpecProbeFailsClosedWithoutClearingDecision(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
@@ -428,7 +672,7 @@ func TestSpecResolutionAllowedMatrix(t *testing.T) {
 	}
 }
 
-func TestCreateUsesDeterministicTraditionalAndWeightMatching(t *testing.T) {
+func TestLiveProbeUsesDeterministicTraditionalAndWeightMatching(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"浅蓝色","selectable":true,"priceCent":2000}]},{"name":"尺码","role":"size","values":[{"name":"4XL 160-170斤","selectable":true}]}]`).Error; err != nil {
@@ -437,12 +681,26 @@ func TestCreateUsesDeterministicTraditionalAndWeightMatching(t *testing.T) {
 	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Updates(map[string]any{"target_color": "淺藍色", "target_size": "４XL 80-85公斤"}).Error; err != nil {
 		t.Fatal(err)
 	}
-	task, err := createLive(t, testService(db), f)
-	if err != nil || task.SpecSource != "exact_match" || task.MappedColorSnapshot != "浅蓝色" || task.MappedSizeSnapshot != "4XL 160-170斤" {
-		t.Fatalf("deterministic match failed: %+v %v", task, err)
+	s := testService(db)
+	task, err := createLive(t, s, f)
+	if err != nil || task.SpecSource != "unresolved" || task.MappedColorSnapshot != "" || task.MappedSizeSnapshot != "" {
+		t.Fatalf("live task skipped probe: %+v %v", task, err)
 	}
-	if strings.Contains(task.SpecDecisionSnapshot, "apiKey") || !strings.Contains(task.SpecDecisionSnapshot, "exact_match") {
-		t.Fatalf("task decision snapshot is unsafe or incomplete: %s", task.SpecDecisionSnapshot)
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || first.Phase != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("probe start: %+v %v", first, err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["浅蓝色"]},{"key":"size","values":["4XL 160-170斤"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || resolved.MappedColor != "浅蓝色" || resolved.MappedSize != "4XL 160-170斤" {
+		t.Fatalf("deterministic probe match failed: %+v %v", resolved, err)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil || strings.Contains(saved.SpecDecisionSnapshot, "apiKey") || !strings.Contains(saved.SpecDecisionSnapshot, "exact_match") {
+		t.Fatalf("task decision snapshot is unsafe or incomplete: %s err=%v", saved.SpecDecisionSnapshot, err)
 	}
 }
 
@@ -457,12 +715,12 @@ func TestCreateDoesNotTrustMappedLabelsFromRequest(t *testing.T) {
 		SYBProductID: &f.syb.ID, DeviceID: &f.device.ID, MappedColor: "白色", MappedSize: "XL",
 		MinUnitPriceCent: 400, MaxUnitPriceCent: 3000, RuleSnapshot: liveRule(true),
 	})
-	if err != nil || task.SpecSource != "exact_match" || task.MappedColorSnapshot != "黑色" || task.MappedSizeSnapshot != "XL" {
-		t.Fatalf("request-provided mapping must not override server match: %+v %v", task, err)
+	if err != nil || task.SpecSource != "unresolved" || task.MappedColorSnapshot != "" || task.MappedSizeSnapshot != "" {
+		t.Fatalf("request-provided mapping must not skip live probe: %+v %v", task, err)
 	}
 }
 
-func TestCreateQueuesUsableArchiveWhenDeterministicMatchFails(t *testing.T) {
+func TestCreateDoesNotQueueArchiveMatchingBeforeLiveProbe(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"白色","selectable":true,"priceCent":2000}]},{"name":"尺码","role":"size","values":[{"name":"L","selectable":true}]}]`).Error; err != nil {
@@ -475,12 +733,12 @@ func TestCreateQueuesUsableArchiveWhenDeterministicMatchFails(t *testing.T) {
 		t.Fatalf("task=%+v err=%v", task, err)
 	}
 	var count int64
-	if err := db.Model(&models.PurchaseSpecMatchWorkItem{}).Where("purchase_task_id = ?", task.ID).Count(&count).Error; err != nil || count != 1 {
+	if err := db.Model(&models.PurchaseSpecMatchWorkItem{}).Where("purchase_task_id = ?", task.ID).Count(&count).Error; err != nil || count != 0 {
 		t.Fatalf("work count=%d err=%v", count, err)
 	}
 }
 
-func TestCreateQueuesExternalMatchingWithoutCallingProvider(t *testing.T) {
+func TestCreateDispatchesProbeInsteadOfExternalArchiveMatching(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"白色","selectable":true,"priceCent":2000},{"name":"米白色","selectable":true,"priceCent":2000}]},{"name":"尺码","role":"size","values":[{"name":"XL","selectable":true}]}]`).Error; err != nil {
@@ -495,12 +753,48 @@ func TestCreateQueuesExternalMatchingWithoutCallingProvider(t *testing.T) {
 	if err != nil || task.ID == 0 || task.SpecSource != "unresolved" {
 		t.Fatalf("queued task=%+v err=%v", task, err)
 	}
-	var work models.PurchaseSpecMatchWorkItem
-	if err := db.Where("purchase_task_id = ?", task.ID).First(&work).Error; err != nil || work.Status != models.PurchaseMatchPending || work.InputFingerprint == "" {
-		t.Fatalf("work=%+v err=%v", work, err)
+	var count int64
+	if err := db.Model(&models.PurchaseSpecMatchWorkItem{}).Where("purchase_task_id = ?", task.ID).Count(&count).Error; err != nil || count != 0 {
+		t.Fatalf("unexpected archive match work count=%d err=%v", count, err)
 	}
-	if next, err := service.Next(context.Background(), f.token); err != nil || next != nil {
-		t.Fatalf("matching task dispatched: %+v %v", next, err)
+	if next, err := service.Next(context.Background(), f.token); err != nil || next == nil || next.MappedColor != "" || next.MappedSize != "" || !next.SpecResolutionAllowed {
+		t.Fatalf("probe task was not dispatchable: %+v %v", next, err)
+	}
+}
+
+func TestNextReturnsAssignedProbeWaitingTaskBeforeOtherWork(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"黑色","selectable":true,"priceCent":1200}]},{"name":"尺码","role":"size","values":[{"name":"XL","selectable":true}]}]`).Error; err != nil {
+		t.Fatal(err)
+	}
+	service := testService(db)
+	request := StockCreateRequest{
+		RequestID: uuid.NewString(), ExecutionMode: models.PurchaseExecutionModeLive,
+		PDDProductID: f.pdd.ID, DeviceID: &f.device.ID, Color: "黑色", Size: "XL",
+		Quantity: 1, MinUnitPriceCent: 900, MaxUnitPriceCent: 1500,
+	}
+	waiting, _, err := service.CreateStock(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.RequestID = uuid.NewString()
+	other, _, err := service.CreateStock(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Session(&gorm.Session{SkipHooks: true}).Model(&models.PurchaseTask{}).Where("id = ?", waiting.ID).Updates(map[string]any{
+		"status": models.PurchaseTaskStatusSpecProbePending, "mapped_color_snapshot": "", "mapped_size_snapshot": "",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	next, err := service.Next(context.Background(), f.token)
+	if err != nil || next == nil || next.TaskID != waiting.ID || next.Status != models.PurchaseTaskStatusSpecProbePending {
+		t.Fatalf("waiting probe task not reserved: next=%+v other=%d err=%v", next, other.ID, err)
+	}
+	if _, err = service.Claim(context.Background(), other.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); code(err) != CodeDeviceBusy {
+		t.Fatalf("other purchase claimed while probe waits: %v", err)
 	}
 }
 
@@ -509,9 +803,10 @@ func TestOrderUnknownIsNotAutomaticallyRedispatched(t *testing.T) {
 	f := seed(t, db, liveCaps(), true)
 	s := testService(db)
 	task, _ := createLive(t, s, f)
-	s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	started, _ := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	started := startLivePurchaseAfterProbe(t, s, f, task)
+	if _, err := s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
 	actual := int64(1999)
 	if _, err := s.SubmitResult(context.Background(), task.ID, ResultRequest{
 		RequestID: uuid.NewString(), TaskAttemptID: started.TaskAttemptID, ResultType: "order_result_unknown",
@@ -527,7 +822,7 @@ func TestOrderUnknownIsNotAutomaticallyRedispatched(t *testing.T) {
 		t.Fatalf("unknown task evidence not preserved: %+v", saved)
 	}
 	var attempt models.PurchaseTaskAttempt
-	if err := db.Where("task_id = ?", task.ID).First(&attempt).Error; err != nil {
+	if err := db.Where("task_id = ?", task.ID).Order("attempt_number DESC").First(&attempt).Error; err != nil {
 		t.Fatal(err)
 	}
 	if attempt.ErrorCode == nil || *attempt.ErrorCode != CodeOrderTimeMissing || attempt.ErrorMessage == nil {
@@ -544,9 +839,10 @@ func TestOrderUnknownRejectsOrderFieldsAndUnapprovedFailureCode(t *testing.T) {
 	f := seed(t, db, liveCaps(), true)
 	s := testService(db)
 	task, _ := createLive(t, s, f)
-	s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	started, _ := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	started := startLivePurchaseAfterProbe(t, s, f, task)
+	if _, err := s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
 
 	if _, err := s.SubmitResult(context.Background(), task.ID, ResultRequest{
 		RequestID: uuid.NewString(), TaskAttemptID: started.TaskAttemptID, ResultType: "order_result_unknown",

server/app/goauto/shopeeproduct/batch_resolved_mapping.go

@@ -7,7 +7,8 @@ import (
 
 // ResolvedMappingItem is one mapping produced by the narrowly scoped SYB
 // batch-match entry point. Confirmed writes are restricted to auditable exact
-// matches and high-confidence AI decisions; SetMapping remains pending-first.
+// matches and AI decisions with a returned match reason; SetMapping remains
+// pending-first.
 type ResolvedMappingItem struct {
 	Dimension  string
 	ValueName  string
@@ -20,14 +21,11 @@ type ResolvedMappingItem struct {
 
 // ApplyResolvedMappings atomically applies the color/size mappings needed by
 // one SYB detail row. It is independent from SetMapping so #188's explicit
-// high-confidence exception cannot change existing callers' pending semantics.
-func (service *Service) ApplyResolvedMappings(ctx context.Context, id uint64, requestID string, minimumConfidence float64, items []ResolvedMappingItem) (SaveResponse, error) {
+// confirmed-match exception cannot change existing callers' pending semantics.
+func (service *Service) ApplyResolvedMappings(ctx context.Context, id uint64, requestID string, items []ResolvedMappingItem) (SaveResponse, error) {
 	if len(items) == 0 || len(items) > 2 {
 		return SaveResponse{}, invalidRequest("必须包含 1 至 2 个待写入规格映射")
 	}
-	if minimumConfidence < 0 || minimumConfidence > 1 {
-		return SaveResponse{}, invalidRequest("自动确认阈值无效")
-	}
 	seen := make(map[string]bool, len(items))
 	for _, item := range items {
 		key := strings.TrimSpace(item.Dimension) + "\x00" + strings.TrimSpace(item.ValueName)
@@ -41,9 +39,6 @@ func (service *Service) ApplyResolvedMappings(ctx context.Context, id uint64, re
 		if item.Status != MappingStatusConfirmed || strings.TrimSpace(item.Reason) == "" {
 			return SaveResponse{}, invalidRequest("自动确认映射必须包含确认状态和匹配理由")
 		}
-		if item.Source == MappingSourceAIMatch && (item.Confidence == nil || *item.Confidence < minimumConfidence) {
-			return SaveResponse{}, invalidRequest("AI 自动确认必须达到置信度阈值")
-		}
 		if err := service.validatePDDMappingTarget(ctx, id, item.Dimension, item.ValueName, strings.TrimSpace(item.PDDValue)); err != nil {
 			return SaveResponse{}, err
 		}

server/app/goauto/sybimport/import_handler.go

@@ -3,6 +3,8 @@ package sybimport
 import (
 	"context"
 	"errors"
+	"fmt"
+	"go-admin/common/clientprincipal"
 	"net/http"
 	"strconv"
 	"strings"
@@ -85,7 +87,8 @@ func StartImport(ctx context.Context, db *gorm.DB, request ImportRequest, actor
 	}
 	run, err := NewSyncRunService(db).Create(ctx, CreateSyncRunInput{
 		DateFrom: request.DateFrom, DateTo: request.DateTo, ShopFilterHash: enabledShopHash(enabled),
-		OperatorID: actor.ID, OperatorName: strings.TrimSpace(actor.Name),
+		ShopFilterSnapshot: cloneShopSnapshot(enabled),
+		OperatorID:         actor.ID, OperatorName: strings.TrimSpace(actor.Name),
 	})
 	if err != nil {
 		importGate.Unlock()
@@ -97,7 +100,7 @@ func StartImport(ctx context.Context, db *gorm.DB, request ImportRequest, actor
 	importGate.running = true
 	importGate.Unlock()
 
-	go runImport(db, run.ID, request, settings)
+	go runImport(db, run.ID, request, settings, cloneShopSnapshot(enabled))
 	return StartImportResult{RunID: run.ID, Status: run.Status}, nil
 }
 
@@ -112,8 +115,10 @@ func isImportAlreadyRunning(err error) bool {
 // `[必须]` This remains the authenticated manual entry point. Both it and the
 // scheduler delegate to StartImport, and every downstream SYB call is read-only.
 func (handler Handler) Import(c *gin.Context) {
-	if claimString(jwt.ExtractClaims(c)["rolekey"]) != "admin" {
-		c.JSON(http.StatusForbidden, gin.H{"code": "FORBIDDEN", "message": "只有管理员可以开始导入"})
+	role := claimString(jwt.ExtractClaims(c)["rolekey"])
+	client, clientOK := clientprincipal.Get(c)
+	if role != "admin" && role != "purchaser" && !clientOK {
+		c.JSON(http.StatusForbidden, gin.H{"code": "FORBIDDEN", "message": "只有管理员或采购员可以开始同步"})
 		return
 	}
 	var request ImportRequest
@@ -126,9 +131,13 @@ func (handler Handler) Import(c *gin.Context) {
 		return
 	}
 	claims := jwt.ExtractClaims(c)
-	result, err := StartImport(c.Request.Context(), service.DB, request, ImportActor{
+	actor := ImportActor{
 		ID: claimUint64(claims["identity"]), Name: claimString(claims["nice"]),
-	}, false)
+	}
+	if clientOK {
+		actor = ImportActor{ID: client.AuthorizedBy, Name: fmt.Sprintf("client-key:%d", client.KeyID)}
+	}
+	result, err := StartImport(c.Request.Context(), service.DB, request, actor, false)
 	if err != nil {
 		var serviceErr *ServiceError
 		if errors.As(err, &serviceErr) {
@@ -145,7 +154,7 @@ func (handler Handler) Import(c *gin.Context) {
 	c.JSON(http.StatusAccepted, gin.H{"code": 200, "data": gin.H{"runId": result.RunID, "status": result.Status}})
 }
 
-func runImport(db *gorm.DB, runID uint64, request ImportRequest, settings config.SYB) {
+func runImport(db *gorm.DB, runID uint64, request ImportRequest, settings config.SYB, allowed map[string]string) {
 	defer func() { importGate.Lock(); importGate.running = false; importGate.Unlock() }()
 	ctx, cancel := context.WithTimeout(context.Background(), importTimeout)
 	defer cancel()
@@ -156,7 +165,7 @@ func runImport(db *gorm.DB, runID uint64, request ImportRequest, settings config
 		OcrURL: settings.OcrURL, OcrMaxAttempts: settings.OcrMaxAttempts,
 	})
 	if err == nil {
-		report, err = SyncWithProgress(ctx, db, client, SyncConfig{PageSize: settings.PageSize, MaxMatches: settings.MaxMatches}, request.DateFrom, request.DateTo,
+		report, err = SyncWithShopSnapshot(ctx, db, client, SyncConfig{PageSize: settings.PageSize, MaxMatches: settings.MaxMatches}, request.DateFrom, request.DateTo, allowed,
 			func(progress SyncProgress) error { return runs.UpdateProgress(ctx, runID, progress) })
 	}
 	status := SyncRunSucceeded
@@ -168,6 +177,14 @@ func runImport(db *gorm.DB, runID uint64, request ImportRequest, settings config
 	_ = runs.Finish(finishCtx, runID, status, report, err)
 }
 
+func cloneShopSnapshot(source map[string]string) map[string]string {
+	cloned := make(map[string]string, len(source))
+	for normalized, display := range source {
+		cloned[normalized] = display
+	}
+	return cloned
+}
+
 func claimUint64(value any) uint64 {
 	switch typed := value.(type) {
 	case float64:

server/app/goauto/sybimport/import_handler_test.go

@@ -53,17 +53,26 @@ func TestImportRejectsNoEnabledShopBeforeConnect(t *testing.T) {
 	}
 }
 
-func TestImportRequiresAdminRole(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	engine := gin.New()
-	engine.Use(func(c *gin.Context) { c.Set(jwt.JwtPayloadKey, jwt.MapClaims{"rolekey": "purchaser"}); c.Next() })
-	engine.POST("/api/admin/v1/syb-products/import", Handler{}.Import)
-	request := httptest.NewRequest(http.MethodPost, "/api/admin/v1/syb-products/import", bytes.NewBufferString(`{"dateFrom":"2026-08-19","dateTo":"2026-08-19"}`))
-	request.Header.Set("Content-Type", "application/json")
-	recorder := httptest.NewRecorder()
-	engine.ServeHTTP(recorder, request)
-	if recorder.Code != http.StatusForbidden || !strings.Contains(recorder.Body.String(), "只有管理员") {
-		t.Fatalf("采购员应被拒绝: status=%d body=%s", recorder.Code, recorder.Body.String())
+func TestImportRoleBoundary(t *testing.T) {
+	for _, role := range []string{"admin", "purchaser", "viewer", "", "custom-role"} {
+		t.Run(role, func(t *testing.T) {
+			gin.SetMode(gin.TestMode)
+			engine := gin.New()
+			engine.Use(func(c *gin.Context) { c.Set(jwt.JwtPayloadKey, jwt.MapClaims{"rolekey": role}); c.Next() })
+			engine.POST("/api/admin/v1/syb-products/import", Handler{}.Import)
+			// Authorized roles reach JSON validation; no DB or external SYB call is made.
+			request := httptest.NewRequest(http.MethodPost, "/api/admin/v1/syb-products/import", bytes.NewBufferString(`{`))
+			request.Header.Set("Content-Type", "application/json")
+			recorder := httptest.NewRecorder()
+			engine.ServeHTTP(recorder, request)
+			want := http.StatusForbidden
+			if role == "admin" || role == "purchaser" {
+				want = http.StatusUnprocessableEntity
+			}
+			if recorder.Code != want {
+				t.Fatalf("role=%q status=%d want=%d body=%s", role, recorder.Code, want, recorder.Body.String())
+			}
+		})
 	}
 }
 

server/app/goauto/sybimport/pagination_overlap_test.go

@@ -0,0 +1,101 @@
+package sybimport
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+func freezePaginationToday(t *testing.T) {
+	t.Helper()
+	previous := syncNow
+	syncNow = func() time.Time { return time.Date(2026, 8, 29, 12, 0, 0, 0, time.FixedZone("Asia/Shanghai", 8*60*60)) }
+	t.Cleanup(func() { syncNow = previous })
+}
+
+func TestTodayCrossPageOverlapRestartsWithIndependentIDs(t *testing.T) {
+	freezePaginationToday(t)
+	f := &fakeSYB{perDay: map[string]int{"2026-08-29": 4}}
+	f.pageIDs = func(_ string, start, call int) []int64 {
+		if call == 2 {
+			return []int64{1001, 1002}
+		}
+		if call > 2 {
+			return []int64{int64(2000 + start), int64(2001 + start)}
+		}
+		return nil
+	}
+	rows, err := loadDailyListWithRecovery(context.Background(), newSyncClient(t, f), "2026-08-29", 2, 4, 100)
+	if err != nil || len(rows) != 4 || f.listTotalCalls != 2 {
+		t.Fatalf("rows=%d totals=%d err=%v", len(rows), f.listTotalCalls, err)
+	}
+	if got := strings.Join(f.listCalls, ","); got != "2026-08-29:0,2026-08-29:2,2026-08-29:0,2026-08-29:2" {
+		t.Fatalf("did not restart at first page: %s", got)
+	}
+	for index, row := range rows {
+		if row.ID != int64(2000+index) {
+			t.Fatal("rows leaked from abandoned attempt")
+		}
+	}
+}
+
+func TestTodayPersistentOverlapPreservesYesterdayButDoesNotImportToday(t *testing.T) {
+	freezePaginationToday(t)
+	f := &fakeSYB{perDay: map[string]int{"2026-08-28": 2, "2026-08-29": 4}}
+	f.pageIDs = func(date string, start, _ int) []int64 {
+		if date == "2026-08-29" && start == 2 {
+			return []int64{1001, 1002}
+		}
+		return nil
+	}
+	db := newSyncTestDB(t)
+	report, err := Sync(context.Background(), db, newSyncClient(t, f), SyncConfig{PageSize: 2, MaxMatches: 100}, "2026-08-28", "2026-08-29")
+	if err == nil {
+		t.Fatal("overlap was treated as successful sync")
+	}
+	for _, token := range []string{"连续 3 次", "跨页重复", "firstPage=1", "firstRow=2", "page=2", "row=1", "start=2", "pageSize=2", "expectedTotal=4", "unique=2"} {
+		if !strings.Contains(err.Error(), token) {
+			t.Fatalf("missing %s in %v", token, err)
+		}
+	}
+	if strings.Contains(err.Error(), "1001") || strings.Contains(err.Error(), "已保存") {
+		t.Fatalf("unsafe diagnosis/degraded save: %v", err)
+	}
+	if len(f.listCalls) != 7 || f.detailCalls != 1 || report.OrderCount != 2 {
+		t.Fatalf("unexpected retry/import boundary: pages=%d details=%d orders=%d", len(f.listCalls), f.detailCalls, report.OrderCount)
+	}
+	var count int64
+	if e := db.Table("syb_product").Count(&count).Error; e != nil || count != 2 {
+		t.Fatalf("yesterday not preserved: count=%d err=%v", count, e)
+	}
+}
+
+func TestPaginationHardErrorsDoNotUseOverlapRecovery(t *testing.T) {
+	freezePaginationToday(t)
+	for _, tc := range []struct {
+		name, date, message string
+		page                int
+		ids                 []int64
+		calls               int
+	}{
+		{"same page", "2026-08-29", "同页重复", 0, []int64{1000, 1000}, 1},
+		{"mixed overlap and same page", "2026-08-29", "同页重复", 2, []int64{1001, 1001}, 2},
+		{"overlap and invalid ID", "2026-08-29", "非法 id", 2, []int64{1001, 0}, 2},
+		{"historical overlap", "2026-08-28", "跨页重复", 2, []int64{1001, 1002}, 2},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			f := &fakeSYB{perDay: map[string]int{tc.date: 4}}
+			f.pageIDs = func(_ string, start, _ int) []int64 {
+				if start == tc.page {
+					return tc.ids
+				}
+				return nil
+			}
+			rows, err := loadDailyListWithRecovery(context.Background(), newSyncClient(t, f), tc.date, 2, 4, 100)
+			if rows != nil || err == nil || !strings.Contains(err.Error(), tc.message) || len(f.listCalls) != tc.calls || f.listTotalCalls != 0 {
+				t.Fatalf("unexpected recovery: rows=%d pages=%d totals=%d err=%v", len(rows), len(f.listCalls), f.listTotalCalls, err)
+			}
+		})
+	}
+}

server/app/goauto/sybimport/parse.go

@@ -13,6 +13,13 @@ import (
 
 var bracketPattern = regexp.MustCompile(`【[^】]*】`)
 
+// explicitSizePattern recognizes only values whose spelling carries a strong
+// size signal. SYB has now been observed returning both "color,size" and
+// "size,color". A color dictionary would inevitably guess at product-specific
+// labels, so role reversal is allowed only when exactly one side matches this
+// deliberately narrow pattern.
+var explicitSizePattern = regexp.MustCompile(`(?i)^(?:均(?:码|碼|号|號)|one\s*size|free\s*size|x{0,4}[sml]|[2-9]xl|(?:加大|大|中|小)(?:码|碼|号|號)|\d+(?:\.\d+)?(?:cm|mm|m|码|碼|号|號|公分)|\d+(?:\.\d+)?(?:[-~～至到]\d+(?:\.\d+)?)?(?:斤|公斤|千克|kg))$`)
+
 // ambiguousPattern flags leftover separators or multi-token noise after
 // bracket stripping — the signal that a "clean" split still isn't reliable.
 // Observed in the real SYB sample: "黑色+白色【純棉兩件裝】 簡約親膚" strips
@@ -29,8 +36,8 @@ type ParseResult struct {
 	Note   string
 }
 
-// Parse implements the #41 rule: split on the last comma into color/size,
-// strip 【...】 annotations, and classify the result. It never guesses a
+// Parse implements the #41/#216 rule: split on the last comma, strip 【...】
+// annotations, and classify the result. It never guesses a
 // missing value and never invents a color or size that is not literally
 // present in the input.
 //
@@ -41,9 +48,13 @@ type ParseResult struct {
 //     brackets stripped, becomes the size candidate; color stays empty. A
 //     single token with no separator cannot be split into two dimensions
 //     without guessing which one it is.
-//   - comma present, last segment (size) and first segment(s) (color) both
-//     non-empty after stripping brackets, and the color candidate has no
-//     leftover separator/whitespace -> success.
+//   - comma present and exactly one side has an explicit size signal -> that
+//     side is size and the other side is color. This supports both observed
+//     SYB orders without allowing AI or a fuzzy color dictionary to swap roles.
+//   - comma present and neither side has an explicit size signal -> retain the
+//     established SYB color,size contract for backward compatibility.
+//   - comma present and both sides have explicit size signals -> uncertain;
+//     there is no safe color decision.
 //   - comma present but either side is empty after stripping, or the color
 //     candidate still carries a leftover '+' or internal whitespace -> the
 //     split happened but is not trustworthy -> uncertain.
@@ -65,12 +76,20 @@ func Parse(raw string) ParseResult {
 		return ParseResult{Size: size, Status: models.SYBParseStatusUncertain, Note: "无分隔符，仅识别出单一规格值"}
 	}
 
-	colorPart := stripBrackets(trimmed[:lastComma])
-	sizePart := stripBrackets(trimmed[lastComma+1:])
+	firstPart := stripBrackets(trimmed[:lastComma])
+	secondPart := stripBrackets(trimmed[lastComma+1:])
+	colorPart, sizePart := firstPart, secondPart
 
 	if colorPart == "" || sizePart == "" {
 		return ParseResult{Color: colorPart, Size: sizePart, Status: models.SYBParseStatusUncertain, Note: "按逗号拆分后有一侧为空"}
 	}
+	firstIsSize, secondIsSize := explicitSizePattern.MatchString(firstPart), explicitSizePattern.MatchString(secondPart)
+	if firstIsSize && secondIsSize {
+		return ParseResult{Color: firstPart, Size: secondPart, Status: models.SYBParseStatusUncertain, Note: "逗号两侧均具有尺码特征，无法安全识别颜色"}
+	}
+	if firstIsSize {
+		colorPart, sizePart = secondPart, firstPart
+	}
 	if ambiguousPattern.MatchString(colorPart) {
 		return ParseResult{Color: colorPart, Size: sizePart, Status: models.SYBParseStatusUncertain, Note: "颜色部分含备注文本或多个分隔符，拆分结果可能不准确"}
 	}

server/app/goauto/sybimport/parse_test.go

@@ -19,6 +19,27 @@ func TestParseRealSample_CleanColorAndSize(t *testing.T) {
 	}
 }
 
+func TestParseReversedSizeAndColorWhenOnlyFirstHasExplicitSizeEvidence(t *testing.T) {
+	result := sybimport.Parse("均碼,黑色")
+	if result.Color != "黑色" || result.Size != "均碼" || result.Status != models.SYBParseStatusSuccess {
+		t.Fatalf("expected reversed role parse 黑色/均碼 success, got %+v", result)
+	}
+}
+
+func TestParseKeepsTraditionalColorAndSizeOrderWhenSecondHasSizeEvidence(t *testing.T) {
+	result := sybimport.Parse("黑色,均码")
+	if result.Color != "黑色" || result.Size != "均码" || result.Status != models.SYBParseStatusSuccess {
+		t.Fatalf("expected normal role parse 黑色/均码 success, got %+v", result)
+	}
+}
+
+func TestParseTwoExplicitSizesIsUncertainInsteadOfSwapping(t *testing.T) {
+	result := sybimport.Parse("M,L")
+	if result.Status != models.SYBParseStatusUncertain || result.Color != "M" || result.Size != "L" {
+		t.Fatalf("expected conflicting size evidence to stay uncertain, got %+v", result)
+	}
+}
+
 func TestParseRealSample_AmbiguousColorWithAnnotationAndSeparator(t *testing.T) {
 	result := sybimport.Parse("黑色+白色【純棉兩件裝】 簡約親膚,L【建議52.5-60公斤】")
 	if result.Status != models.SYBParseStatusUncertain {

server/app/goauto/sybimport/role_repair.go

@@ -0,0 +1,164 @@
+package sybimport
+
+import (
+	"context"
+	"encoding/json"
+	"sort"
+
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/shopeeproduct"
+
+	"gorm.io/gorm"
+)
+
+// SpecRoleRepairReport contains only aggregate migration evidence. It does not
+// expose order numbers, raw source payloads, or specification text.
+type SpecRoleRepairReport struct {
+	SYBRows        int
+	ShopeeProducts int
+}
+
+type specRoleChange struct {
+	OldColor string
+	OldSize  string
+}
+
+// RepairReversedSpecRoles corrects only the historical shape that #216 can
+// prove was role-reversed: the newly parsed color/size are exactly the old
+// size/color. Human-confirmed rows are never overwritten. RawJSON is read for
+// reparsing and deliberately excluded from every update.
+func RepairReversedSpecRoles(ctx context.Context, db *gorm.DB) (SpecRoleRepairReport, error) {
+	report := SpecRoleRepairReport{}
+	err := db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var records []models.SYBProduct
+		if err := tx.Where("manually_confirmed = ?", false).Find(&records).Error; err != nil {
+			return err
+		}
+
+		changesByProduct := map[uint64][]specRoleChange{}
+		for _, record := range records {
+			var raw rawDetailSpec
+			if json.Unmarshal([]byte(record.RawJSON), &raw) != nil {
+				continue
+			}
+			parsed := Parse(raw.ProductSpec)
+			if parsed.Status == models.SYBParseStatusFailed || parsed.Color == record.TargetColor ||
+				parsed.Color != record.TargetSize || parsed.Size != record.TargetColor {
+				continue
+			}
+			if err := tx.Model(&models.SYBProduct{}).Where("id = ?", record.ID).Updates(map[string]any{
+				"target_color": parsed.Color,
+				"target_size":  parsed.Size,
+				"parse_status": parsed.Status,
+				"parse_note":   parsed.Note,
+			}).Error; err != nil {
+				return err
+			}
+			report.SYBRows++
+			if record.ShopeeProductID != nil {
+				productID := *record.ShopeeProductID
+				changesByProduct[productID] = append(changesByProduct[productID], specRoleChange{
+					OldColor: record.TargetColor,
+					OldSize:  record.TargetSize,
+				})
+			}
+		}
+
+		for productID, changes := range changesByProduct {
+			changed, err := reconcileRepairedShopeeSpecs(tx, productID, changes)
+			if err != nil {
+				return err
+			}
+			if changed {
+				report.ShopeeProducts++
+			}
+		}
+		return nil
+	})
+	return report, err
+}
+
+func reconcileRepairedShopeeSpecs(tx *gorm.DB, productID uint64, changes []specRoleChange) (bool, error) {
+	var product models.ShopeeProduct
+	if err := tx.First(&product, productID).Error; err != nil {
+		return false, err
+	}
+	existing, err := shopeeproduct.Unmarshal(product.SpecsJSON)
+	if err != nil {
+		return false, err
+	}
+
+	var rows []models.SYBProduct
+	if err := tx.Where("shopee_product_id = ? AND (parse_status = ? OR manually_confirmed = ?)",
+		productID, models.SYBParseStatusSuccess, true).Find(&rows).Error; err != nil {
+		return false, err
+	}
+	usedColors, usedSizes := map[string]bool{}, map[string]bool{}
+	for _, row := range rows {
+		if row.TargetColor != "" {
+			usedColors[row.TargetColor] = true
+		}
+		if row.TargetSize != "" {
+			usedSizes[row.TargetSize] = true
+		}
+	}
+	oldColors, oldSizes := map[string]bool{}, map[string]bool{}
+	for _, change := range changes {
+		oldColors[change.OldColor] = true
+		oldSizes[change.OldSize] = true
+	}
+
+	cleaned := make([]shopeeproduct.SpecDimension, 0, len(existing))
+	for _, dimension := range existing {
+		values := make([]shopeeproduct.SpecValue, 0, len(dimension.Values))
+		for _, value := range dimension.Values {
+			remove := value.Source == shopeeproduct.ValueSourceImport && value.Mapping == nil
+			switch dimension.Role {
+			case shopeeproduct.RoleColor:
+				remove = remove && oldColors[value.Name] && !usedColors[value.Name]
+			case shopeeproduct.RoleSize:
+				remove = remove && oldSizes[value.Name] && !usedSizes[value.Name]
+			default:
+				remove = false
+			}
+			if !remove {
+				values = append(values, value)
+			}
+		}
+		dimension.Values = values
+		cleaned = append(cleaned, dimension)
+	}
+
+	incoming := make([]shopeeproduct.SpecDimension, 0, 2)
+	if values := sortedImportValues(usedColors); len(values) > 0 {
+		incoming = append(incoming, shopeeproduct.SpecDimension{Name: "颜色", Role: shopeeproduct.RoleColor, Values: values})
+	}
+	if values := sortedImportValues(usedSizes); len(values) > 0 {
+		incoming = append(incoming, shopeeproduct.SpecDimension{Name: "尺码", Role: shopeeproduct.RoleSize, Values: values})
+	}
+	reconciled := shopeeproduct.Merge(cleaned, incoming)
+	if err := shopeeproduct.Validate(reconciled); err != nil {
+		return false, err
+	}
+	encoded, err := shopeeproduct.Marshal(reconciled)
+	if err != nil {
+		return false, err
+	}
+	if encoded == product.SpecsJSON {
+		return false, nil
+	}
+	return true, tx.Model(&models.ShopeeProduct{}).Where("id = ?", productID).Update("specs_json", encoded).Error
+}
+
+func sortedImportValues(set map[string]bool) []shopeeproduct.SpecValue {
+	names := make([]string, 0, len(set))
+	for name := range set {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	values := make([]shopeeproduct.SpecValue, 0, len(names))
+	for _, name := range names {
+		values = append(values, shopeeproduct.SpecValue{Name: name, Source: shopeeproduct.ValueSourceImport})
+	}
+	return values
+}

server/app/goauto/sybimport/role_repair_test.go

@@ -0,0 +1,126 @@
+package sybimport
+
+import (
+	"context"
+	"testing"
+
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/shopeeproduct"
+)
+
+func TestRepairReversedSpecRolesIsSafeAndIdempotent(t *testing.T) {
+	db := newSyncTestDB(t)
+	manualMapping := &shopeeproduct.Mapping{PDDValue: "藏青", Source: shopeeproduct.MappingSourceManual, Status: shopeeproduct.MappingStatusConfirmed}
+	specs, err := shopeeproduct.Marshal([]shopeeproduct.SpecDimension{
+		{Name: "颜色", Role: shopeeproduct.RoleColor, Values: []shopeeproduct.SpecValue{
+			{Name: "均碼", Source: shopeeproduct.ValueSourceImport},
+			{Name: "手工蓝", Source: shopeeproduct.ValueSourceManual, Mapping: manualMapping},
+		}},
+		{Name: "尺码", Role: shopeeproduct.RoleSize, Values: []shopeeproduct.SpecValue{{Name: "黑色", Source: shopeeproduct.ValueSourceImport}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	product := models.ShopeeProduct{ShopeeItemID: "ROLE-REPAIR", Title: "测试", ShopName: "测试店铺", Currency: "TWD", SpecsJSON: specs}
+	if err := db.Create(&product).Error; err != nil {
+		t.Fatal(err)
+	}
+	raw := `{"productSpec":"均碼,黑色"}`
+	row := models.SYBProduct{OrderCode: "ROLE-ORDER", DetailID: 1, StockID: 1, ShopeeItemID: product.ShopeeItemID,
+		ShopeeProductID: &product.ID, ProductTitle: "测试", TargetColor: "均碼", TargetSize: "黑色", Quantity: 1,
+		ParseStatus: models.SYBParseStatusSuccess, RawJSON: raw}
+	if err := db.Create(&row).Error; err != nil {
+		t.Fatal(err)
+	}
+	manual := models.SYBProduct{OrderCode: "MANUAL-ORDER", DetailID: 2, StockID: 2, ShopeeItemID: product.ShopeeItemID,
+		ShopeeProductID: &product.ID, ProductTitle: "测试", TargetColor: "人工颜色", TargetSize: "人工尺码", Quantity: 1,
+		ParseStatus: models.SYBParseStatusSuccess, ManuallyConfirmed: true, RawJSON: raw}
+	if err := db.Create(&manual).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	report, err := RepairReversedSpecRoles(context.Background(), db)
+	if err != nil || report.SYBRows != 1 || report.ShopeeProducts != 1 {
+		t.Fatalf("unexpected repair report=%+v err=%v", report, err)
+	}
+	var repaired, untouched models.SYBProduct
+	db.First(&repaired, row.ID)
+	db.First(&untouched, manual.ID)
+	if repaired.TargetColor != "黑色" || repaired.TargetSize != "均碼" || repaired.RawJSON != raw {
+		t.Fatalf("repaired row is invalid: %+v", repaired)
+	}
+	if untouched.TargetColor != "人工颜色" || untouched.TargetSize != "人工尺码" {
+		t.Fatalf("manual row was overwritten: %+v", untouched)
+	}
+
+	db.First(&product, product.ID)
+	reconciled, err := shopeeproduct.Unmarshal(product.SpecsJSON)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertSpecValue(t, reconciled, shopeeproduct.RoleColor, "均碼", false)
+	assertSpecValue(t, reconciled, shopeeproduct.RoleSize, "黑色", false)
+	assertSpecValue(t, reconciled, shopeeproduct.RoleColor, "黑色", true)
+	assertSpecValue(t, reconciled, shopeeproduct.RoleSize, "均碼", true)
+	assertSpecValue(t, reconciled, shopeeproduct.RoleColor, "手工蓝", true)
+
+	replay, err := RepairReversedSpecRoles(context.Background(), db)
+	if err != nil || replay.SYBRows != 0 || replay.ShopeeProducts != 0 {
+		t.Fatalf("repair was not idempotent: report=%+v err=%v", replay, err)
+	}
+}
+
+func TestRepairReversedSpecRolesKeepsAmbiguousColorUncertain(t *testing.T) {
+	db := newSyncTestDB(t)
+	specs, err := shopeeproduct.Marshal([]shopeeproduct.SpecDimension{
+		{Name: "颜色", Role: shopeeproduct.RoleColor, Values: []shopeeproduct.SpecValue{{Name: "均碼", Source: shopeeproduct.ValueSourceImport}}},
+		{Name: "尺码", Role: shopeeproduct.RoleSize, Values: []shopeeproduct.SpecValue{{Name: "黑色+白色", Source: shopeeproduct.ValueSourceImport}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	product := models.ShopeeProduct{ShopeeItemID: "ROLE-UNCERTAIN", Title: "测试", ShopName: "测试店铺", Currency: "TWD", SpecsJSON: specs}
+	if err := db.Create(&product).Error; err != nil {
+		t.Fatal(err)
+	}
+	row := models.SYBProduct{OrderCode: "UNCERTAIN-ORDER", DetailID: 1, StockID: 1, ShopeeItemID: product.ShopeeItemID,
+		ShopeeProductID: &product.ID, ProductTitle: "测试", TargetColor: "均碼", TargetSize: "黑色+白色", Quantity: 1,
+		ParseStatus: models.SYBParseStatusSuccess, RawJSON: `{"productSpec":"均碼,黑色+白色"}`}
+	if err := db.Create(&row).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	report, err := RepairReversedSpecRoles(context.Background(), db)
+	if err != nil || report.SYBRows != 1 || report.ShopeeProducts != 1 {
+		t.Fatalf("unexpected repair report=%+v err=%v", report, err)
+	}
+	db.First(&row, row.ID)
+	if row.TargetColor != "黑色+白色" || row.TargetSize != "均碼" || row.ParseStatus != models.SYBParseStatusUncertain {
+		t.Fatalf("ambiguous color role/status was not preserved safely: %+v", row)
+	}
+	db.First(&product, product.ID)
+	reconciled, err := shopeeproduct.Unmarshal(product.SpecsJSON)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assertSpecValue(t, reconciled, shopeeproduct.RoleColor, "均碼", false)
+	assertSpecValue(t, reconciled, shopeeproduct.RoleSize, "黑色+白色", false)
+}
+
+func assertSpecValue(t *testing.T, specs []shopeeproduct.SpecDimension, role, name string, want bool) {
+	t.Helper()
+	found := false
+	for _, dimension := range specs {
+		if dimension.Role != role {
+			continue
+		}
+		for _, value := range dimension.Values {
+			if value.Name == name {
+				found = true
+			}
+		}
+	}
+	if found != want {
+		t.Fatalf("role=%s value=%q found=%v want=%v specs=%+v", role, name, found, want, specs)
+	}
+}

server/app/goauto/sybimport/router.go

@@ -19,7 +19,7 @@ func InitRouter(engine *gin.Engine, auth *jwt.GinJWTMiddleware) {
 	admin.POST("/reparse-batch", handler.ReparseBatch)
 	admin.POST("/import", handler.Import)
 	// Run history is intentionally authenticated but not Casbin-gated: #50
-	// makes it read-only for every role, while Import enforces admin itself.
+	// makes it readable for every role; Import also requires admin/purchaser.
 	readonly := engine.Group("/api/admin/v1/syb-products").Use(auth.MiddlewareFunc())
 	readonly.GET("/sync-runs", handler.ListSyncRuns)
 	readonly.GET("/sync-runs/:runId", handler.SyncRunDetail)

server/app/goauto/sybimport/sync.go

@@ -59,12 +59,16 @@ type SyncReport struct {
 	// it a renamed or newly opened shop is never noticed (#50).
 	ShopBreakdown  map[string]ShopBreakdown `json:"shopBreakdown"`
 	ShopFilterHash string                   `json:"shopFilterHash"`
-	OrderCount     int                      `json:"orderCount"`
-	DetailCount    int                      `json:"detailCount"`
-	Created        int                      `json:"created"`
-	Updated        int                      `json:"updated"`
-	StartedAt      time.Time                `json:"startedAt"`
-	FinishedAt     time.Time                `json:"finishedAt"`
+	// ShopFilterSnapshot is the immutable enabled-shop snapshot supplied when
+	// the run was created. It is intentionally a display-name list for audit;
+	// matching continues to use the normalized map passed to the sync.
+	ShopFilterSnapshot []string  `json:"shopFilterSnapshot"`
+	OrderCount         int       `json:"orderCount"`
+	DetailCount        int       `json:"detailCount"`
+	Created            int       `json:"created"`
+	Updated            int       `json:"updated"`
+	StartedAt          time.Time `json:"startedAt"`
+	FinishedAt         time.Time `json:"finishedAt"`
 }
 
 type ShopBreakdown struct {
@@ -120,19 +124,24 @@ func Sync(ctx context.Context, db *gorm.DB, client *sybclient.Client, cfg SyncCo
 }
 
 func SyncWithProgress(ctx context.Context, db *gorm.DB, client *sybclient.Client, cfg SyncConfig, dateFrom, dateTo string, progress ProgressFunc) (SyncReport, error) {
+	allowed, err := sybshop.EnabledNames(ctx, db)
+	if err != nil {
+		return SyncReport{From: dateFrom, To: dateTo, StartedAt: time.Now().UTC(), ShopBreakdown: map[string]ShopBreakdown{}}, err
+	}
+	return SyncWithShopSnapshot(ctx, db, client, cfg, dateFrom, dateTo, allowed, progress)
+}
+
+// SyncWithShopSnapshot runs against the immutable enabled-shop snapshot taken
+// by StartImport. It must not query syb_shop again: doing so would make the
+// run's effective allow-list differ from the snapshot recorded on its row.
+func SyncWithShopSnapshot(ctx context.Context, db *gorm.DB, client *sybclient.Client, cfg SyncConfig, dateFrom, dateTo string, allowed map[string]string, progress ProgressFunc) (SyncReport, error) {
 	report := SyncReport{From: dateFrom, To: dateTo, StartedAt: time.Now().UTC(),
-		ShopBreakdown: map[string]ShopBreakdown{}}
+		ShopBreakdown: map[string]ShopBreakdown{}, ShopFilterSnapshot: shopSnapshotNames(allowed)}
 
 	dates, err := splitDateRange(dateFrom, dateTo)
 	if err != nil {
 		return report, err
 	}
-	// `[必须]` The allow-list is read once and used for the whole run, so a shop
-	// enabled midway cannot make one day behave differently from the next.
-	allowed, err := sybshop.EnabledNames(ctx, db)
-	if err != nil {
-		return report, err
-	}
 	if len(allowed) == 0 {
 		return report, ErrNoEnabledShop
 	}
@@ -283,6 +292,15 @@ func SyncWithProgress(ctx context.Context, db *gorm.DB, client *sybclient.Client
 	return report, nil
 }
 
+func shopSnapshotNames(allowed map[string]string) []string {
+	names := make([]string, 0, len(allowed))
+	for _, display := range allowed {
+		names = append(names, display)
+	}
+	sort.Strings(names)
+	return names
+}
+
 func enabledShopHash(allowed map[string]string) string {
 	names := make([]string, 0, len(allowed))
 	for normalized := range allowed {
@@ -340,7 +358,7 @@ func loadDailyListWithRecovery(ctx context.Context, client *sybclient.Client, da
 		}
 		var drift *snapshotDriftError
 		if !errors.As(err, &drift) {
-			return nil, err
+			return nil, fmt.Errorf("今天第 %d/%d 次拉取失败: %w", attempt, maxTodaySnapshotAttempts, err)
 		}
 		last = drift
 	}
@@ -352,7 +370,8 @@ func loadDailyListWithRecovery(ctx context.Context, client *sybclient.Client, da
 
 func loadDailyList(ctx context.Context, client *sybclient.Client, date string, pageSize, expectedTotal int) ([]sybclient.StockRow, error) {
 	rows := make([]sybclient.StockRow, 0, expectedTotal)
-	seen := make(map[int64]struct{}, expectedTotal)
+	type position struct{ page, row int }
+	seen := make(map[int64]position, expectedTotal)
 
 	for start := 0; start < expectedTotal; start += pageSize {
 		pageIndex := start/pageSize + 1
@@ -368,14 +387,27 @@ func loadDailyList(ctx context.Context, client *sybclient.Client, date string, p
 		if pageCount != len(page) {
 			return nil, fmt.Errorf("%s 货运单列表第 %d 页响应条数不自洽：total=%d，list=%d", date, pageIndex, pageCount, len(page))
 		}
-		for _, row := range page {
+		// Validate the whole page first: a same-page duplicate must not be
+		// hidden behind an earlier, recoverable cross-page overlap.
+		pageSeen := make(map[int64]int, len(page))
+		for index, row := range page {
 			if row.ID <= 0 {
 				return nil, fmt.Errorf("%s 货运单列表包含非法 id=%d", date, row.ID)
 			}
-			if _, duplicate := seen[row.ID]; duplicate {
-				return nil, fmt.Errorf("%s 货运单列表重复返回 id=%d", date, row.ID)
+			if firstRow, duplicate := pageSeen[row.ID]; duplicate {
+				return nil, fmt.Errorf("%s 货运单列表同页重复 [firstPage=%d,firstRow=%d,page=%d,row=%d,start=%d,pageSize=%d,expectedTotal=%d,unique=%d]",
+					date, pageIndex, firstRow, pageIndex, index+1, start, pageSize, expectedTotal, len(rows))
 			}
-			seen[row.ID] = struct{}{}
+			pageSeen[row.ID] = index + 1
+		}
+		for index, row := range page {
+			if first, duplicate := seen[row.ID]; duplicate {
+				// No rows/valid flag: overlapping pages are never eligible for
+				// the existing final-attempt degraded save, even after deduping.
+				return nil, &snapshotDriftError{message: fmt.Sprintf("%s 货运单列表跨页重复 [firstPage=%d,firstRow=%d,page=%d,row=%d,start=%d,pageSize=%d,expectedTotal=%d,unique=%d]",
+					date, first.page, first.row, pageIndex, index+1, start, pageSize, expectedTotal, len(rows))}
+			}
+			seen[row.ID] = position{page: pageIndex, row: index + 1}
 			rows = append(rows, row)
 		}
 		if len(page) != expectedPageCount {