Merge remote-tracking branch 'origin/feat/338-return-match' into feat/339-syb-page-size

A match whose return has passed its destroy deadline keeps blocking
purchase (user decision: remind, don't auto-cancel). Show 「退货已过销毁截止」
in the SYB products match column and compare dialog, and 「已过销毁截止」
under the occupying SYB product on the yeeke returns page. Uses the live
package deadline, so a resync that moves the deadline updates the flag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTDbDcwbDw1TSAcE6wfh2F

.gitignore

@@ -31,3 +31,7 @@
 /android/**/build/
 __pycache__/
 *.py[cod]
+
+# Third-party capture and device dumps: contain credentials, tokens and personal data.
+*.har
+/xml_data/

AGENTS.md

@@ -30,7 +30,7 @@
 - 不保存原始控件树和整屏设备截图；允许保存按规格值节点边界裁剪的商品图片区域，且裁剪结果不得包含账号、地址、订单、支付及其他个人数据。除此之外只保存结构化任务日志、错误码、任务规则快照和采集结果。
 - 一台设备同一时刻只执行一个任务；手机离线时当前采集任务失败，默认不重试、不自动换机。
 - Android Agent 端：找不到控件、验证码、风控、人机验证或登录失效时明确失败，不使用 OCR/VLM。
-- 服务端顺云宝（SYB）登录：允许调用配置的线上 OCR 服务识别登录验证码（见 #48）。验证码图片会离开本项目发送到该服务，更换服务地址前必须重新评估。此例外只适用于 SYB 登录，不扩大到 Agent 端或任何 PDD 相关流程。
+- 服务端顺云宝（SYB）登录与 yeeke（mmt.yeeke.com 对裹）登录：允许调用配置的线上自建 OCR 服务识别登录验证码（SYB 见 #48；yeeke 于 2026-09-23 经用户在 #336 明确批准）。验证码图片会离开本项目发送到该服务，更换服务地址前必须重新评估；OCR 请求和日志不得记录账号、密码、验证码原文或 token。此例外只适用于上述两个服务端登录流程，不扩大到 Agent 端或任何 PDD 相关流程。
 - 规格匹配：Agent 本地不得自行猜测规格或点击相近候选，只执行服务端下发的精确规格；人工映射缺失、商品无规格数据或目标规格定位不到时，由服务端 AI 匹配接口决策（见 #46），AI 无结果时明确失败。
 - SKU 数据不完整仍须提交并允许在任务详情查看，状态记为 `completed_partial`。
 - 规则创建即生效；删除后不能创建新任务，但已有任务继续使用自身规则快照。

android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "cn.ilapage.goauto.agent"
         minSdk = 23
         targetSdk = 34
-        versionCode = 51
-        versionName = "0.9.38"
+        versionCode = 76
+        versionName = "0.9.63"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

android/app/src/main/AndroidManifest.xml

@@ -7,6 +7,8 @@
     <uses-permission android:name="android.permission.WAKE_LOCK" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+    <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="32" />
 
     <queries>
         <package android:name="com.xunmeng.pinduoduo" />

android/app/src/main/java/cn/ilapage/goauto/agent/MainActivity.kt

@@ -38,6 +38,7 @@ class MainActivity : AppCompatActivity() {
         )
         setContentView(buildContent())
         requestNotificationPermission()
+        requestMediaPermission()
         if (AgentSettingsStore(this).serverUrl().isNotBlank()) AgentForegroundService.start(this)
         AgentAppUpdateManager.checkOnceAtStartup(this)
     }
@@ -49,6 +50,7 @@ class MainActivity : AppCompatActivity() {
 
     override fun onResume() {
         super.onResume()
+        cn.ilapage.goauto.agent.automation.GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         screenPolicyHandler.removeCallbacks(screenPolicyRefresh)
         screenPolicyHandler.post(screenPolicyRefresh)
     }
@@ -126,6 +128,16 @@ class MainActivity : AppCompatActivity() {
         }
     }
 
+    // 首次启动时仍然弹一次系统授权框（体验最佳位置），但这不是唯一入口：拒绝后
+    // （包括"不再询问"）用户可以在"状态"页的相册权限卡片里重新发起授权或跳转应用详情页，
+    // 见 cn.ilapage.goauto.agent.ui.MediaPermissionPolicy / AgentStatusFragment。
+    private fun requestMediaPermission() {
+        val permission = cn.ilapage.goauto.agent.ui.MediaPermissionPolicy.requiredPermission()
+        if (checkSelfPermission(permission) != PackageManager.PERMISSION_GRANTED) {
+            requestPermissions(arrayOf(permission), MEDIA_PERMISSION_REQUEST)
+        }
+    }
+
     private fun applyScreenPolicy() {
         val keepScreenOn = cn.ilapage.goauto.agent.service.AgentStateStore(this).read().keepScreenOn
         if (keepScreenOn) {
@@ -144,5 +156,6 @@ class MainActivity : AppCompatActivity() {
         private const val TAB_PREFERENCES = "goauto_agent_ui"
         private const val LAST_SELECTED_TAB = "last_selected_tab"
         private const val STATE_SELECTED_TAB = "selected_tab"
+        private const val MEDIA_PERMISSION_REQUEST = 101
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/GoAutoAccessibilityService.kt

@@ -18,6 +18,8 @@ import android.util.Log
 import android.view.Display
 import android.view.accessibility.AccessibilityEvent
 import android.view.accessibility.AccessibilityNodeInfo
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubbleController
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePresentation
 import java.util.concurrent.CountDownLatch
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicBoolean
@@ -32,6 +34,9 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         ActivityEvidenceTracker { packageName, className -> isDeclaredActivity(packageName, className) }
     }
     private var accessibilityButtonCallback: AccessibilityButtonController.AccessibilityButtonCallback? = null
+    private val purchaseResultBubble by lazy {
+        PurchaseResultBubbleController(this) { currentPackage() == PDD_PACKAGE }
+    }
 
     override fun onServiceConnected() {
         serviceInfo = serviceInfo.apply {
@@ -48,18 +53,19 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
 
     override fun onAccessibilityEvent(event: AccessibilityEvent?) {
         if (event?.eventType == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {
-            val packageName = event.packageName?.toString()
-            if (packageName != null && packageName != lastForegroundPackage) {
-                lastForegroundPackage = packageName
+            val foregroundPackage = event.packageName?.toString()
+            if (foregroundPackage != null && foregroundPackage != lastForegroundPackage) {
+                lastForegroundPackage = foregroundPackage
                 foregroundRevision.incrementAndGet()
             }
-            if (packageName == PDD_PACKAGE) lastPddForegroundAt.set(SystemClock.elapsedRealtime())
-            activityTracker.observe(packageName, event.className?.toString())
+            if (foregroundPackage == PDD_PACKAGE) lastPddForegroundAt.set(SystemClock.elapsedRealtime())
+            activityTracker.observe(foregroundPackage, event.className?.toString())
         }
     }
     override fun onInterrupt() = Unit
 
     override fun onDestroy() {
+        dismissPurchaseResultBubble()
         unregisterAccessibilityButton()
         if (instance === this) instance = null
         super.onDestroy()
@@ -71,6 +77,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         runCatching {
             val callback = object : AccessibilityButtonController.AccessibilityButtonCallback() {
                 override fun onClicked(controller: AccessibilityButtonController) {
+                    dismissPurchaseResultBubble()
                     AccessibilityButtonPolicy.handleClick(::openAgentPreservingTab)
                 }
             }
@@ -115,6 +122,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
     ).restore(packageName, timeoutMillis)
 
     fun openAgentPreservingTab(): Boolean = runCatching {
+        dismissPurchaseResultBubble()
         startActivity(
             android.content.Intent(this, cn.ilapage.goauto.agent.MainActivity::class.java).apply {
                 addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK or android.content.Intent.FLAG_ACTIVITY_CLEAR_TOP or android.content.Intent.FLAG_ACTIVITY_SINGLE_TOP)
@@ -123,6 +131,14 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         true
     }.getOrDefault(false)
 
+    fun showPurchaseResultBubble(presentation: PurchaseResultBubblePresentation) {
+        purchaseResultBubble.show(presentation)
+    }
+
+    fun dismissPurchaseResultBubble() {
+        purchaseResultBubble.dismiss()
+    }
+
     override fun visibleTexts(): List<String> {
         val root = rootInActiveWindow ?: return emptyList()
         val texts = mutableListOf<String>()
@@ -178,6 +194,39 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         return swipeNode(node, direction)
     }
 
+    /** Backfill never uses ancestor clicks or coordinate/gesture fallbacks. */
+    fun clickBackfill(target: SnapshotNode): Boolean {
+        val page = capture()
+        BackfillPagePolicy.validate(page)
+        val fresh = page.nodes.singleOrNull { it.path == target.path && it.label == target.label &&
+            it.bounds == target.bounds && it.className == target.className } ?: return false
+        val allowed = BackfillPagePolicy.cards(page).any { it.path == fresh.path } ||
+            BackfillPagePolicy.expansion(page)?.path == fresh.path ||
+            (fresh.label == "全部" && page.nodes.any { it.label in setOf("我的订单", "全部订单") })
+        if (!allowed || !BackfillPagePolicy.safe(page, fresh)) return false
+        val root = rootInActiveWindow ?: return false
+        if (root.packageName?.toString() != BackfillPagePolicy.PDD) return false
+        var node = root
+        for (index in fresh.path.split('/').drop(1)) node = node.getChild(index.toInt()) ?: return false
+        val bounds = Rect().also(node::getBoundsInScreen)
+        if (!node.isClickable || !node.isEnabled || !node.isVisibleToUser ||
+            NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom) != fresh.bounds ||
+            (node.text?.toString()?.trim().takeUnless { it.isNullOrEmpty() } ?: node.contentDescription?.toString()?.trim().orEmpty()) != fresh.label) return false
+        return node.performAction(AccessibilityNodeInfo.ACTION_CLICK)
+    }
+
+    fun scrollBackfill(): Boolean {
+        BackfillPagePolicy.validate(capture())
+        val root = rootInActiveWindow ?: return false
+        val candidates = mutableListOf<AccessibilityNodeInfo>()
+        walk(root) { if (it.isScrollable && it.isVisibleToUser && it.isEnabled) candidates += it }
+        // Prefer the unique largest vertical viewport. Ambiguous panes fail closed.
+        val areas = candidates.map { it to Rect().also(it::getBoundsInScreen) }
+        val maxArea = areas.maxOfOrNull { it.second.width().toLong() * it.second.height() } ?: return false
+        val target = areas.filter { it.second.width().toLong() * it.second.height() == maxArea }.singleOrNull() ?: return false
+        return target.first.performAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD)
+    }
+
     override fun capture(): UiSnapshot {
         val root = rootInActiveWindow ?: return UiSnapshot(null, null, emptyList())
         val rootPackage = root.packageName?.toString()
@@ -314,6 +363,42 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }
     }
 
+    override fun clickAddressEntryFresh(target: SnapshotNode): FreshClickOutcome {
+        val root = rootInActiveWindow ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.ROOT_UNAVAILABLE)
+        val indexes = target.path.split('/').mapNotNull(String::toIntOrNull)
+        if (indexes.isEmpty() || indexes.first() != 0 || indexes.size != target.path.split('/').size) {
+            return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        var node = root
+        for (index in indexes.drop(1)) {
+            node = node.getChild(index)
+                ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        val bounds = Rect().also(node::getBoundsInScreen)
+        if (!node.isVisibleToUser || !node.isEnabled ||
+            node.preferredOrDescendantLabel() != target.label ||
+            node.className?.toString() != target.className ||
+            kotlin.math.abs(bounds.centerX() - target.bounds.centerX) > 32 ||
+            kotlin.math.abs(bounds.centerY() - target.bounds.centerY) > 32
+        ) {
+            return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        var ancestorDepth = 0
+        while (!node.isClickable) {
+            node = node.parent ?: return FreshClickOutcome(
+                FreshActionResult.FAILED,
+                FreshClickReason.NO_CLICKABLE_ANCESTOR,
+                clickableAncestorDepth = ancestorDepth,
+            )
+            ancestorDepth++
+        }
+        return if (node.performAction(AccessibilityNodeInfo.ACTION_CLICK)) {
+            FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS, 1, ancestorDepth)
+        } else {
+            FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.ACTION_CLICK_FALSE, 1, ancestorDepth)
+        }
+    }
+
     override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult {
         val root = rootInActiveWindow ?: return FreshActionResult.NOT_FOUND
         val candidates = mutableListOf<AccessibilityNodeInfo>()
@@ -333,31 +418,32 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (bounds.width() < 2 || bounds.height() < 2 || Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
             return FreshActionResult.FAILED
         }
-        val path = Path().apply {
-            moveTo(bounds.centerX().toFloat(), bounds.centerY().toFloat())
-        }
-        val completed = AtomicBoolean(false)
-        val latch = CountDownLatch(1)
-        val queued = dispatchGesture(
-            GestureDescription.Builder().addStroke(GestureDescription.StrokeDescription(path, 0, 80)).build(),
-            object : GestureResultCallback() {
-                override fun onCompleted(gestureDescription: GestureDescription?) {
-                    completed.set(true)
-                    latch.countDown()
-                }
+        return if (dispatchCenterTap(bounds)) FreshActionResult.SUCCESS else FreshActionResult.FAILED
+    }
 
-                override fun onCancelled(gestureDescription: GestureDescription?) {
-                    latch.countDown()
-                }
-            },
-            null,
-        )
-        if (!queued) return FreshActionResult.FAILED
-        return if (latch.await(1_500, TimeUnit.MILLISECONDS) && completed.get()) {
-            FreshActionResult.SUCCESS
-        } else {
-            FreshActionResult.FAILED
+    override fun tapSpecFresh(target: SnapshotNode): FreshActionResult {
+        val width = resources.displayMetrics.widthPixels
+        val height = resources.displayMetrics.heightPixels
+        if (!PurchaseSpecGesturePolicy.isAllowed(target, width, height)) return FreshActionResult.FAILED
+        val root = rootInActiveWindow ?: return FreshActionResult.NOT_FOUND
+        val candidates = mutableListOf<AccessibilityNodeInfo>()
+        walk(root) { node ->
+            val bounds = Rect().also(node::getBoundsInScreen)
+            if (node.isVisibleToUser && node.isEnabled &&
+                node.preferredOrDescendantLabel() == target.label &&
+                node.className?.toString() == target.className &&
+                kotlin.math.abs(bounds.centerX() - target.bounds.centerX) <= 32 &&
+                kotlin.math.abs(bounds.centerY() - target.bounds.centerY) <= 32
+            ) candidates += node
         }
+        if (candidates.isEmpty()) return FreshActionResult.NOT_FOUND
+        if (candidates.size != 1) return FreshActionResult.AMBIGUOUS
+        val bounds = Rect().also(candidates.single()::getBoundsInScreen)
+        val freshTarget = target.copy(bounds = NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom))
+        if (!PurchaseSpecGesturePolicy.isAllowed(freshTarget, width, height)) {
+            return FreshActionResult.FAILED
+        }
+        return if (dispatchCenterTap(bounds)) FreshActionResult.SUCCESS else FreshActionResult.FAILED
     }
 
     override fun inputFresh(target: SnapshotNode, value: String): FreshActionResult {
@@ -397,17 +483,27 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
 
     override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
         val root = rootInActiveWindow ?: return false
-        val matches = mutableListOf<AccessibilityNodeInfo>()
-        walk(root) { node ->
-            val bounds = Rect().also(node::getBoundsInScreen)
-            if (node.isVisibleToUser && node.isEnabled && node.isScrollable &&
-                node.className?.toString() == target.className &&
-                kotlin.math.abs(bounds.centerX() - target.bounds.centerX) <= 32 &&
-                kotlin.math.abs(bounds.centerY() - target.bounds.centerY) <= 32
-            ) matches += node
+        val candidates = mutableListOf<PurchaseScrollCandidate>()
+        val liveNodes = mutableMapOf<String, AccessibilityNodeInfo>()
+        fun visit(node: AccessibilityNodeInfo, path: String) {
+            if (node.isVisibleToUser && node.isEnabled && node.isScrollable) {
+                val bounds = Rect().also(node::getBoundsInScreen)
+                candidates += PurchaseScrollCandidate(
+                    path, node.className?.toString(),
+                    NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom),
+                )
+                liveNodes[path] = node
+            }
+            for (index in 0 until node.childCount) {
+                node.getChild(index)?.let { visit(it, "$path/$index") }
+            }
         }
-        if (matches.size != 1) return false
-        return swipeNode(matches.single(), direction, durationMs, preferScrollAction = false)
+        visit(root, "0")
+        val resolved = PurchaseScrollLocator.locate(
+            PurchaseScrollCandidate(target.path, target.className, target.bounds), candidates,
+        ) ?: return false
+        val current = liveNodes[resolved.path] ?: return false
+        return swipeNode(current, direction, durationMs, preferScrollAction = true)
     }
 
     override fun backPurchase(): Boolean = performGlobalAction(GLOBAL_ACTION_BACK)
@@ -421,9 +517,17 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }.getOrDefault(false)
     }
 
+    private var lastSpecRowSwipeFailure = "none"
+
+    override fun specRowSwipeFailureReason(): String = lastSpecRowSwipeFailure
+
     override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean {
+        lastSpecRowSwipeFailure = "none"
         if (anchor == null) return swipe(SemanticTarget.SPEC_PANEL, direction)
-        val root = rootInActiveWindow ?: return false
+        val root = rootInActiveWindow ?: run {
+            lastSpecRowSwipeFailure = "windowMissing"
+            return false
+        }
         val matches = mutableListOf<AccessibilityNodeInfo>()
         walk(root) { node ->
             val bounds = Rect().also(node::getBoundsInScreen)
@@ -441,6 +545,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         val horizontal = direction == SwipeDirection.LEFT || direction == SwipeDirection.RIGHT
         if (matches.size != 1) {
             if (!SpecSwipeSafety.allowGlobalFallback(direction)) {
+                lastSpecRowSwipeFailure = if (matches.isEmpty()) "anchorMissing" else "anchorAmbiguous"
                 Log.i("GoAutoCollector", "swipe direction=$direction result=blocked reason=anchor-not-unique matches=${matches.size}")
                 return false
             }
@@ -464,19 +569,27 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (anchoredTarget != null) {
             val bounds = Rect().also(anchoredTarget::getBoundsInScreen)
             Log.i("GoAutoCollector", "swipe direction=$direction anchored=true bounds=$bounds class=${anchoredTarget.className}")
-            return swipeNode(
+            val success = swipeNode(
                 anchoredTarget,
                 direction,
                 preferScrollAction = SpecSwipeSafety.preferAccessibilityScrollAction(direction),
             )
+            if (!success) lastSpecRowSwipeFailure = "gestureFailed"
+            return success
         }
         if (!SpecSwipeSafety.allowGlobalFallback(direction)) {
+            lastSpecRowSwipeFailure = "horizontalContainerMissing"
             Log.i("GoAutoCollector", "swipe direction=$direction result=blocked reason=no-anchored-horizontal-container")
             return false
         }
         return swipe(SemanticTarget.SPEC_PANEL, direction)
     }
 
+    override fun swipeSpecRow(target: SnapshotNode, direction: SwipeDirection): Boolean {
+        if (direction != SwipeDirection.LEFT && direction != SwipeDirection.RIGHT) return false
+        return swipeSpec(direction, target)
+    }
+
     override fun pullDownSpecPanel(anchor: SnapshotNode): Boolean {
         if (!anchor.scrollable) return false
         val root = rootInActiveWindow ?: return false
@@ -617,6 +730,28 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         return latch.await(1500, TimeUnit.MILLISECONDS) && completed.get()
     }
 
+    private fun dispatchCenterTap(bounds: Rect): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N || bounds.width() < 2 || bounds.height() < 2) return false
+        val path = Path().apply { moveTo(bounds.centerX().toFloat(), bounds.centerY().toFloat()) }
+        val completed = AtomicBoolean(false)
+        val latch = CountDownLatch(1)
+        val queued = dispatchGesture(
+            GestureDescription.Builder().addStroke(GestureDescription.StrokeDescription(path, 0, 80)).build(),
+            object : GestureResultCallback() {
+                override fun onCompleted(gestureDescription: GestureDescription?) {
+                    completed.set(true)
+                    latch.countDown()
+                }
+
+                override fun onCancelled(gestureDescription: GestureDescription?) {
+                    latch.countDown()
+                }
+            },
+            null,
+        )
+        return queued && latch.await(1_500, TimeUnit.MILLISECONDS) && completed.get()
+    }
+
     private fun walk(node: AccessibilityNodeInfo, visit: (AccessibilityNodeInfo) -> Unit) {
         visit(node)
         for (index in 0 until node.childCount) node.getChild(index)?.let { walk(it, visit) }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/OrderBackfillPolicy.kt

@@ -0,0 +1,119 @@
+package cn.ilapage.goauto.agent.automation
+
+import java.math.BigInteger
+import java.math.BigDecimal
+import java.text.SimpleDateFormat
+import java.util.Locale
+import java.util.TimeZone
+
+/** Runtime evidence only: a sorted prefix cannot prove the unvisited tail is sorted. */
+class OrderBackfillWindow(days: String, val confirmedAt: Long) {
+    val cutoff: Long
+    var checked = 0
+        private set
+    var nonDescending = false
+        private set
+    private var previous: Long? = null
+    private var missingTime = false
+    private var timed = 0
+
+    init {
+        require(days.matches(Regex("[0-9]+")) && BigInteger(days) > BigInteger.ZERO)
+        cutoff = BigInteger.valueOf(confirmedAt).subtract(BigInteger(days).multiply(BigInteger.valueOf(86_400_000)))
+            .max(BigInteger.valueOf(Long.MIN_VALUE)).toLong()
+    }
+
+    fun observe(time: Long?): Boolean {
+        checked++
+        if (time == null) missingTime = true else {
+            if (previous != null && time > previous!!) nonDescending = true
+            previous = time
+            timed++
+        }
+        // Check at least five details before using a sampled ordering assumption.
+        return !nonDescending && !missingTime && timed >= ORDERING_SAMPLE && time != null && time < cutoff
+    }
+
+    fun includes(time: Long?): Boolean = time == null || time in cutoff..confirmedAt
+
+    companion object {
+        const val ORDERING_SAMPLE = 5
+        const val MAX_ORDERS = 200
+        const val MAX_DURATION_MS = 10 * 60_000L
+        const val UNORDERED = "列表非严格倒序，已改为有界扫描，可能未覆盖全部"
+    }
+}
+
+data class BackfillItem(
+    val addressSuffix: String,
+    val pddOrderNo: String,
+    val orderSubmittedAt: String?,
+    val pddOrderAmountCent: Long? = null,
+)
+data class BackfillDetail(val item: BackfillItem?, val timeMillis: Long?)
+
+/** Per-detail accumulator. Never retains raw text, addresses, names or phone numbers. */
+class BackfillDetailReader(private val zone: TimeZone = TimeZone.getDefault()) {
+    private val suffixes = mutableSetOf<String>()
+    private val orders = mutableSetOf<String>()
+    private val times = mutableSetOf<Long>()
+    private val amounts = mutableSetOf<Long>()
+    private var invalidAmount = false
+
+    fun accept(text: String) {
+        SUFFIX.findAll(text).forEach { suffixes += it.value }
+        ORDER_NO.findAll(text).forEach { orders += it.groupValues[1] }
+        ORDER_TIME.findAll(text).forEach { match -> parseTime(match.groupValues[1])?.let(times::add) }
+        // Treat each accessibility node label independently: a label and an
+        // unrelated price in the next node must never be joined into evidence.
+        text.lineSequence().forEach(::acceptAmountLabel)
+    }
+
+    fun finish(): BackfillDetail {
+        val time = times.singleOrNull()
+        val item = if (suffixes.size == 1 && orders.size == 1 && times.size <= 1) {
+            BackfillItem(suffixes.single(), orders.single(), time?.let {
+                SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssXXX", Locale.ROOT).apply { timeZone = zone }.format(it)
+            }, amounts.singleOrNull()?.takeUnless { invalidAmount })
+        } else null
+        suffixes.clear()
+        orders.clear()
+        times.clear()
+        amounts.clear()
+        invalidAmount = false
+        return BackfillDetail(item, time)
+    }
+
+    private fun acceptAmountLabel(label: String) {
+        var start = label.indexOf("实付")
+        while (start >= 0) {
+            val ignored = label.substring(0, start).trimEnd().let { it.endsWith("未") || it.endsWith("预计") }
+            if (!ignored) {
+                val candidate = label.substring(start)
+                val match = PAID_AMOUNT.find(candidate)
+                if (match == null || match.range.first != 0) invalidAmount = true
+                else try {
+                    amounts += BigDecimal(match.groupValues[1]).movePointRight(2).toBigIntegerExact().longValueExact()
+                } catch (_: ArithmeticException) {
+                    invalidAmount = true
+                }
+            }
+            start = label.indexOf("实付", start + 2)
+        }
+    }
+
+    private fun parseTime(raw: String): Long? {
+        val normalized = raw.replace('年', '-').replace('月', '-').replace("日", "").replace('/', '-').replace('.', '-')
+        val pattern = if (normalized.count { it == ':' } == 2) "yyyy-M-d H:mm:ss" else "yyyy-M-d H:mm"
+        val position = java.text.ParsePosition(0)
+        val date = SimpleDateFormat(pattern, Locale.ROOT).apply { isLenient = false; timeZone = zone }.parse(normalized, position)
+        return date?.time?.takeIf { position.index == normalized.length }
+    }
+
+    companion object {
+        val ORDER_NO = Regex("(?:订单编号|订单号)\\s*[:：]?\\s*([A-Za-z0-9-]{6,64})")
+        val ORDER_TIME = Regex("(?:下单时间|创建时间)\\s*[:：]?\\s*(20\\d{2}[-/.年]\\d{1,2}[-/.月]\\d{1,2}日?\\s+\\d{1,2}:\\d{2}(?::\\d{2})?)")
+        private val PAID_AMOUNT = Regex("实付[ \\t:：,，]*(\\d+(?:\\.\\d{1,2})?)[ \\t]*元(?![0-9.])")
+        private val SUFFIX = Regex("_cg[1-9][0-9]*(?![0-9A-Za-z_０-９])")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/OrderBackfillScanner.kt

@@ -0,0 +1,140 @@
+package cn.ilapage.goauto.agent.automation
+
+import java.security.MessageDigest
+
+object BackfillPagePolicy {
+    const val PDD = "com.xunmeng.pinduoduo"
+    val forbidden = listOf("确认收货", "申请退款", "催发货", "去支付", "立即支付", "提交订单", "付款", "退款", "取消订单", "再次购买", "删除订单")
+    private val risk = listOf("验证码", "安全验证", "人机验证", "登录", "账号异常", "风险验证", "拖动滑块")
+    fun validate(page: UiSnapshot) {
+        require(page.packageName == PDD && page.activityName?.startsWith(PDD) == true) { "PDD 页面身份不符" }
+        require(page.nodes.none { it.visible && risk.any { word -> it.label.contains(word) } }) { "遇到登录或安全验证，已停止" }
+    }
+    private fun subtree(page: UiSnapshot, node: SnapshotNode) = page.nodes.filter { it.path == node.path || it.path.startsWith(node.path + "/") }
+    fun safe(page: UiSnapshot, node: SnapshotNode): Boolean = node.visible && node.enabled && node.clickable &&
+        node.bounds.width > 0 && node.bounds.height > 0 &&
+        subtree(page, node).none { child -> forbidden.any { child.label.contains(it) } } &&
+        page.nodes.none { other -> other.visible && forbidden.any { other.label.contains(it) } &&
+            other.bounds.left < node.bounds.right && other.bounds.right > node.bounds.left &&
+            other.bounds.top < node.bounds.bottom && other.bounds.bottom > node.bounds.top }
+
+    fun list(page: UiSnapshot): Boolean = page.nodes.any { it.visible && it.label == "全部" && it.selected } &&
+        page.nodes.any { it.visible && it.label in setOf("我的订单", "全部订单") }
+    fun detail(page: UiSnapshot): Boolean = page.nodes.any { it.visible && (it.label == "订单详情" || it.label.contains("订单编号")) }
+    fun expansion(page: UiSnapshot): SnapshotNode? {
+        if (!detail(page) || page.nodes.none { it.visible && it.label.contains("订单编号") }) return null
+        val order = page.nodes.first { it.visible && it.label.contains("订单编号") }
+        val snapshot = page.nodes.filter { it.visible && it.label == "商品快照" }.singleOrNull() ?: return null
+        return page.nodes.filter { it.label == "展开" && safe(page, it) && it.bounds.top >= order.bounds.top &&
+            it.bounds.top < snapshot.bounds.bottom && it.bounds.bottom > snapshot.bounds.top }.singleOrNull()
+    }
+    fun cards(page: UiSnapshot): List<SnapshotNode> {
+        if (!list(page)) return emptyList()
+        return page.nodes.filter { node ->
+            if (!safe(page, node)) return@filter false
+            if (node.label in setOf("订单详情", "查看详情")) return@filter true
+            val children = subtree(page, node)
+            val product = children.any { it.className?.endsWith("ImageView") == true } && children.any { it.label.length >= 4 }
+            val parent = page.nodes.firstOrNull { it.path == node.parentPath } ?: return@filter false
+            val context = subtree(page, parent)
+            product && context.any { it.label in setOf("查看物流", "确认收货", "去支付", "待发货", "待收货", "交易成功", "再次购买") }
+        }.sortedBy { it.bounds.top }.let { candidates ->
+            candidates.filter { node -> candidates.none { it !== node && it.path.startsWith(node.path + "/") } }
+        }
+    }
+    fun fingerprint(page: UiSnapshot, card: SnapshotNode): String {
+        val labels = subtree(page, card).joinToString("|") { it.label }
+        return MessageDigest.getInstance("SHA-256").digest(labels.toByteArray()).joinToString("") { "%02x".format(it) }
+    }
+}
+
+interface BackfillDriver {
+    fun openOrders()
+    fun capture(): UiSnapshot
+    fun click(node: SnapshotNode): Boolean
+    fun scroll(): Boolean
+    fun back(): Boolean
+    fun pause()
+}
+
+class OrderBackfillScanner(
+    private val driver: BackfillDriver,
+    private val window: OrderBackfillWindow,
+    private val checkActive: () -> Unit,
+    private val submit: (BackfillItem) -> Unit,
+    private val progress: (Int) -> Unit,
+) {
+    fun scan(): String {
+        checkActive()
+        driver.openOrders()
+        driver.pause()
+        var page = read()
+        if (!BackfillPagePolicy.list(page)) {
+            val tab = page.nodes.filter { it.label == "全部" && BackfillPagePolicy.safe(page, it) }.singleOrNull()
+            check(page.nodes.any { it.label in setOf("我的订单", "全部订单") } && tab != null) { "未识别我的订单-全部" }
+            act { driver.click(tab) }
+            page = read()
+            check(BackfillPagePolicy.list(page)) { "无法确认全部订单标签" }
+        }
+        if (page.nodes.any { it.visible && it.label == "暂无订单" }) return "扫描完成，未发现订单"
+        val seenCards = mutableSetOf<String>()
+        val seenOrders = mutableSetOf<String>()
+        var noProgress = 0
+        while (window.checked < OrderBackfillWindow.MAX_ORDERS) {
+            checkActive()
+            check(BackfillPagePolicy.list(page)) { "返回后未识别全部订单列表" }
+            val card = BackfillPagePolicy.cards(page).firstOrNull { BackfillPagePolicy.fingerprint(page, it) !in seenCards }
+            if (card == null) {
+                if (++noProgress >= 3) return finish("列表无进展或卡片无法安全识别，未完整扫描")
+                checkActive()
+                if (!driver.scroll()) return finish("列表滚动结束或不可滚动，未完整扫描")
+                driver.pause()
+                page = read()
+                continue
+            }
+            noProgress = 0
+            seenCards += BackfillPagePolicy.fingerprint(page, card)
+            act { driver.click(card) }
+            var detail = read()
+            check(BackfillPagePolicy.detail(detail)) { "点击后未识别订单详情" }
+            val reader = BackfillDetailReader()
+            var expanded = false
+            // Limited detail scrolling; only this accumulator associates fields across these frames.
+            for (step in 0 until 6) {
+                reader.accept(detail.nodes.filter { it.visible }.joinToString("\n") { it.label })
+                val expand = if (expanded) null else BackfillPagePolicy.expansion(detail)
+                if (expand != null) {
+                    act { driver.click(expand) }
+                    expanded = true
+                } else {
+                    checkActive()
+                    if (!driver.scroll()) break
+                    driver.pause()
+                }
+                detail = read()
+                check(BackfillPagePolicy.detail(detail)) { "滚动后无法确认订单详情，未完整扫描" }
+            }
+            reader.accept(detail.nodes.filter { it.visible }.joinToString("\n") { it.label })
+            val found = reader.finish()
+            val stopForTime = window.observe(found.timeMillis)
+            progress(window.checked)
+            found.item?.takeIf { window.includes(found.timeMillis) && seenOrders.add(it.pddOrderNo) }?.let(submit)
+            if (stopForTime) return "已达指定天数（已读序列倒序）；未完整扫描，后续列表时序未经验证"
+            act { driver.back() }
+            page = read()
+        }
+        return finish("达到 200 单内部上限，未完整扫描")
+    }
+
+    private fun finish(reason: String): String = reason + if (window.nonDescending) "\n${OrderBackfillWindow.UNORDERED}" else ""
+
+    private fun read(): UiSnapshot {
+        checkActive()
+        return driver.capture().also(BackfillPagePolicy::validate)
+    }
+    private fun act(action: () -> Boolean) {
+        checkActive()
+        check(action()) { "安全页面操作失败，未完整扫描" }
+        driver.pause()
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddLaunchFallback.kt

@@ -0,0 +1,8 @@
+package cn.ilapage.goauto.agent.automation
+
+internal object PddLaunchFallback {
+    fun open(preferDirect: Boolean, direct: () -> Boolean, browser: () -> Boolean): Boolean {
+        if (preferDirect && runCatching(direct).getOrDefault(false)) return true
+        return runCatching(browser).getOrDefault(false)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddNavigation.kt

@@ -31,11 +31,21 @@ object PddPageClassifier {
 }
 
 class PddLinkLauncher(private val context: Context) {
-    fun open(url: String): Boolean {
+    fun open(url: String, preferDirect: Boolean = false): Boolean {
         val uri = runCatching { Uri.parse(url) }.getOrNull() ?: return false
         if (uri.scheme !in setOf("http", "https") || !isPddHost(uri.host) || uri.getQueryParameter("goods_id").isNullOrBlank()) {
             return false
         }
+        return PddLaunchFallback.open(preferDirect, direct = {
+            val direct = Intent(Intent.ACTION_VIEW, uri)
+                .setPackage("com.xunmeng.pinduoduo")
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK)
+            context.startActivity(direct)
+            true
+        }, browser = { openBrowser(uri) })
+    }
+
+    private fun openBrowser(uri: Uri): Boolean {
         val base = Intent(Intent.ACTION_VIEW, uri).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
         val browser = BROWSER_PACKAGES.firstOrNull { packageName ->
             runCatching { context.packageManager.getPackageInfo(packageName, 0) }.isSuccess

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddProductDetailCollector.kt

@@ -90,7 +90,28 @@ data class VisibleSpecValue(
     val rawText: String = text,
 )
 data class VisibleDimension(val key: String, val name: String, val values: List<VisibleSpecValue>)
-enum class SpecPanelType { UNKNOWN, NORMAL_SCROLLABLE, NON_SCROLLABLE_CONFIRMATION, QUICK_CONFIRMATION, ORDER_CONFIRMATION }
+enum class SpecPanelType {
+    UNKNOWN,
+    NORMAL_SCROLLABLE,
+    NON_SCROLLABLE_CONFIRMATION,
+    QUICK_CONFIRMATION,
+    ORDER_CONFIRMATION,
+    /**
+     * #331 fallback: only reached when no stronger panel type matched. It
+     * requires an address entry, a payment-method entry and one quantity input
+     * box, plus at least one auxiliary signal. It is recognition only and never
+     * relaxes any click target (the final order-submit click stays strict).
+     */
+    REQUIRED_EVIDENCE,
+}
+
+/** #331 bounded wait for a spec panel that is still loading after an entry click or an address save. */
+object SpecPanelStabilityPolicy {
+    /** Upper bound for waiting until the required evidence is present and the structure is stable. */
+    const val WAIT_BOUND_MS = 5_000L
+    /** Sampling interval used after an address save returns to the purchase panel. */
+    const val ADDRESS_SAVE_POLL_MS = 200L
+}
 
 object PddSoldOutRecoveryDefaults {
     const val EXACT_TEXT = "商品已售罄"
@@ -99,6 +120,8 @@ object PddSoldOutRecoveryDefaults {
     const val SETTLE_MILLIS = 2_000L
 }
 
+data class PurchasePanelContext(val container: SnapshotNode, val exactColor: String)
+
 data class ParsedPddScreen(
     val summary: ProductSummary,
     val dimensions: List<VisibleDimension>,
@@ -123,9 +146,63 @@ data class ParsedPddScreen(
     val hasSelectionSummary: Boolean,
     val hasQuantityControls: Boolean,
     val hasOrderSubmitAction: Boolean,
+    val explicitSpecEntryCount: Int,
+    val nestedSpecEntryCount: Int,
+    val bottomPurchaseEntryCount: Int,
     val problem: PageProblem?,
     val sourceNodes: List<SnapshotNode>,
+    val isPddPackage: Boolean,
+    val hasCloseControl: Boolean = false,
+    val hasPaymentArea: Boolean = false,
+    val purchaseContextMatched: Boolean = false,
+    // #331 evidence flags. Presence only: address text is never kept here.
+    val hasAddressEntry: Boolean = false,
+    val hasPaymentEntry: Boolean = false,
+    val hasQuantityInput: Boolean = false,
+    val hasQuantityAdjustControls: Boolean = false,
+    val quantityInputCount: Int = 0,
+    /** #331: address entry, payment entry and quantity input share one bounded panel container. */
+    val requiredEvidenceSameContainer: Boolean = false,
 ) {
+    /** The three #331 required spec-panel items are all visible. */
+    val hasRequiredPanelEvidence: Boolean get() = hasAddressEntry && hasPaymentEntry && hasQuantityInput
+
+    /** Boolean/count-only evidence string for diagnostics; contains no page text. */
+    fun requiredEvidenceSummary(): String =
+        "addr=${hasAddressEntry.flag()};pay=${hasPaymentEntry.flag()};qin=$quantityInputCount;" +
+            "adj=${hasQuantityAdjustControls.flag()};summary=${hasSelectionSummary.flag()};" +
+            "close=${hasCloseControl.flag()};submit=${hasOrderSubmitAction.flag()};same=${requiredEvidenceSameContainer.flag()}"
+
+    /**
+     * #331 purchaser-readable hints for missing required items. Only emitted
+     * when the page shows at least one required item or parsed options, so an
+     * unrelated page does not produce misleading environment hints. No page
+     * text or personal data is included.
+     */
+    fun requiredEvidenceHints(): List<String> {
+        val partial = hasAddressEntry || hasPaymentEntry || hasQuantityInput || panelOptionCount > 0
+        if (!partial) return emptyList()
+        return buildList {
+            if (!hasPaymentEntry) add(MISSING_PAYMENT_ENTRY_HINT)
+            if (!hasAddressEntry) add(MISSING_ADDRESS_ENTRY_HINT)
+            if (!hasQuantityInput) add(MISSING_QUANTITY_INPUT_HINT)
+            if (hasRequiredPanelEvidence && !requiredEvidenceSameContainer) add(NOT_SAME_CONTAINER_HINT)
+        }
+    }
+
+    /** Hints joined for a failure message with a leading separator; empty when there is nothing to hint. */
+    fun requiredEvidenceHintSuffix(): String =
+        requiredEvidenceHints().takeIf { it.isNotEmpty() }?.joinToString("；", prefix = "；") ?: ""
+
+    private fun Boolean.flag(): Int = if (this) 1 else 0
+
+    companion object {
+        const val MISSING_PAYMENT_ENTRY_HINT = "未找到支付入口：请确认 PDD 默认支付方式为微信支付"
+        const val MISSING_ADDRESS_ENTRY_HINT = "未找到收货地址入口：请确认 PDD 已设置默认收货地址"
+        const val MISSING_QUANTITY_INPUT_HINT = "未找到购买数量输入框"
+        const val NOT_SAME_CONTAINER_HINT = "收货地址入口、支付入口和购买数量输入框不在同一规格面板内"
+    }
+
     fun isTransientSoldOut(
         exactText: String,
         fallbackTopText: String = "相似商品",
@@ -159,6 +236,7 @@ data class ParsedPddScreen(
 }
 
 object PddScreenParser {
+    private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
     private data class SafeSpecEntry(val anchor: SnapshotNode, val clickTarget: SnapshotNode)
     private val pricePattern = Regex("[¥￥]\\s*([0-9]+(?:\\.[0-9]{1,2})?)")
     private val salesPattern = Regex("已拼\\s*[0-9]+(?:\\.[0-9]+)?\\s*(?:万|亿)?\\s*\\+?\\s*(?:件|人)?")
@@ -176,7 +254,14 @@ object PddScreenParser {
     // purchase/order/payment controls must never become collection click targets.
     private val nonConfigurableClickDenylist = listOf("提交订单", "确认订单", "支付", "付款")
 
-    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?): ParsedPddScreen {
+    /** Masked CN mobile number shown in the purchase address row, e.g. 138****5678. Presence only. */
+    val MASKED_PHONE_PATTERN = Regex("(?<![0-9])[0-9]{3}\\*{4}[0-9]{4}(?![0-9])")
+    /** An address/payment entry must be clickable itself or through a nearby row container. */
+    private const val ENTRY_CLICKABLE_ANCESTOR_MAX_DEPTH = 6
+    /** Whole-sheet containers are clickable too; a real entry row stays well below this share of the screen height. */
+    private const val ENTRY_ROW_MAX_HEIGHT_PERCENT = 30
+
+    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?, purchaseContext: PurchasePanelContext? = null): ParsedPddScreen {
         val visibleNodes = snapshot.nodes.filter { it.visible }
         val visible = visibleNodes.mapNotNull { node ->
             val descendants = descendants(node, visibleNodes)
@@ -193,6 +278,8 @@ object PddScreenParser {
             }
         }
         val labels = visible.map(SnapshotNode::label)
+        val visibleByPath = visible.associateBy(SnapshotNode::path)
+        val sourceByPath = visibleNodes.associateBy(SnapshotNode::path)
         val textAliases = config.textAliases
         val problem = PddPageClassifier.classify(snapshot.packageName, snapshot.activityName, labels)
         val compactLabels = labels.map { it.replace(" ", "") }
@@ -230,7 +317,23 @@ object PddScreenParser {
         val decreaseControls = visible.filter { it.clickable && it.label.replace(" ", "") in textAliases.specPanel.quantityDecreaseAliases }
         val increaseControls = visible.filter { it.clickable && it.label.replace(" ", "") in textAliases.specPanel.quantityIncreaseAliases }
         val hasQuantityControls = quantityInputs.size == 1 && decreaseControls.size == 1 && increaseControls.size == 1
+        // #331: the unique input box is required; the +/- buttons are only auxiliary.
+        val hasQuantityInput = quantityInputs.size == 1 && quantityInputs.single().enabled
+        val hasQuantityAdjustControls = decreaseControls.size == 1 && increaseControls.size == 1
         val hasPaymentArea = compactLabels.any { label -> textAliases.specPanel.paymentAreaAliases.any(label::contains) }
+        val addressEntryRows = addressEntryRows(visibleNodes, screenHeight)
+        val paymentEntryRows = paymentEntryRows(visibleNodes, screenHeight, textAliases.specPanel.paymentAreaAliases)
+        val hasAddressEntry = addressEntryRows.isNotEmpty()
+        val hasPaymentEntry = paymentEntryRows.isNotEmpty()
+        // #331: the three required items must sit in one panel container, not
+        // merely somewhere on screen (e.g. an address dialog, a payment dialog
+        // and an unrelated input box). Same area bound idea as boundedScrollables.
+        val requiredEvidenceSameContainer = hasAddressEntry && hasPaymentEntry && hasQuantityInput &&
+            addressEntryRows.any { address ->
+                paymentEntryRows.any { payment ->
+                    sharesBoundedPanelContainer(listOf(address, payment, quantityInputs.single()), sourceByPath, screenArea)
+                }
+            }
         val hasQuickBuy = visible.any { node ->
             node.label.replace(" ", "").let { compact -> textAliases.specPanel.quickBuyAliases.any(compact::contains) } &&
                 node.bounds.centerY.toDouble() >= screenHeight * 0.75
@@ -266,27 +369,50 @@ object PddScreenParser {
             headings.forEachIndexed { index, heading ->
                 val lower = headings.getOrNull(index + 1)?.bounds?.top ?: Int.MAX_VALUE
                 val dimensionKey = dimensionKey(heading.label, config, any { it.key == "color" })
-                val values = panelVisible.asSequence()
-                    .filter { it.clickable && it.bounds.top >= heading.bounds.bottom && it.bounds.bottom <= lower }
-                    .filter { it.bounds.width > 0 && it.bounds.height > 0 && it.label.length <= 80 }
+                fun inValueRegion(node: SnapshotNode) =
+                    node.bounds.top >= heading.bounds.bottom && node.bounds.bottom <= lower &&
+                        node.bounds.width > 0 && node.bounds.height > 0 && node.label.length <= 80
+                val candidates = panelVisible.asSequence()
+                    .filter { it.clickable && inValueRegion(it) }
                     .filterNot { isExactHeadingLabel(it.label, config) }
                     .filterNot { node ->
                         isExcludedOptionLabel(node.label) ||
                             descendants(node, visibleNodes).any { descendant -> isExcludedOptionLabel(descendant.label) }
                     }
-                    .map {
-                        val rawText = it.label
+                    .toList()
+                // #332/task 535: one option block may expose several clickable
+                // nodes (outer block, image, inner text with a badge such as
+                // "零差评"). Nodes nested in the same labelled option block are
+                // collapsed into one value named by the outer block. The click
+                // node is still chosen by safeOptionRank among the members.
+                val values = candidates
+                    .groupBy { candidate ->
+                        optionBlock(candidate, candidates, visibleByPath, sourceByPath, ::inValueRegion)?.path ?: candidate.path
+                    }
+                    .map { (blockPath, members) ->
+                        val block = visibleByPath[blockPath]
+                        val chosen = members.minBy { option -> safeOptionRank(option, visibleNodes) }
+                        val selected = members.any(SnapshotNode::selected) || block?.selected == true
+                        val checked = members.any(SnapshotNode::checked) || block?.checked == true
+                        Triple(chosen.copy(selected = selected, checked = checked), block?.label ?: chosen.label, members)
+                    }
+                    .asSequence()
+                    .map { (option, blockLabel, members) ->
+                        val rawText = blockLabel
                         val normalizedText = when (dimensionKey) {
                             "color" -> SpecValueNormalizer.normalizeColor(rawText)
                             "size" -> SpecValueNormalizer.normalizeSize(rawText)
                             else -> rawText
                         }
-                        val stateText = (listOf(it.label) + descendants(it, visibleNodes).map(SnapshotNode::label)).joinToString(" ")
+                        val stateText = (listOf(option.label) + descendants(option, visibleNodes).map(SnapshotNode::label)).joinToString(" ")
                         VisibleSpecValue(
                             normalizedText,
-                            it.enabled && !stateText.containsUnavailableWord(),
-                            it,
-                            if (dimensionKey == "color") colorImageBoundsForOption(it, visibleNodes) else null,
+                            option.enabled && !stateText.containsUnavailableWord(),
+                            option,
+                            if (dimensionKey == "color") {
+                                (listOf(option) + members.filter { it.path != option.path })
+                                    .firstNotNullOfOrNull { colorImageBoundsForOption(it, visibleNodes) }
+                            } else null,
                             rawText,
                         )
                     }
@@ -301,32 +427,96 @@ object PddScreenParser {
         // Opening evidence is intentionally independent from whether the current
         // viewport still exposes a clickable spec value. PDD may hide the only
         // selected value or restore a previously scrolled confirmation panel.
+        val continuedPurchasePanel = snapshot.packageName == PDD_PACKAGE && problem == null &&
+            purchaseContext != null && headedPanelScrollable != null &&
+            headedPanelScrollable.path == purchaseContext.container.path &&
+            headedPanelScrollable.className == purchaseContext.container.className &&
+            kotlin.math.abs(headedPanelScrollable.bounds.left - purchaseContext.container.bounds.left) <= 32 &&
+            kotlin.math.abs(headedPanelScrollable.bounds.right - purchaseContext.container.bounds.right) <= 32 &&
+            minOf(headedPanelScrollable.bounds.bottom, purchaseContext.container.bounds.bottom) >
+                maxOf(headedPanelScrollable.bounds.top, purchaseContext.container.bounds.top)
+        val structuredSelectionPanel = headedPanelScrollable != null &&
+            (headings.size >= 2 || (continuedPurchasePanel && headings.isNotEmpty())) &&
+            dimensions.any { it.values.isNotEmpty() } && hasClose &&
+            hasQuantityControls && hasPaymentArea && hasOrderSubmitAction
+        // Some selected-spec panels omit both the "已选" prefix and a confirm
+        // button. Keep the same structural evidence required for checkout.
         val specPanelType = when {
             quickConfirmationEvidence -> SpecPanelType.QUICK_CONFIRMATION
             orderConfirmationEvidence -> SpecPanelType.ORDER_CONFIRMATION
+            structuredSelectionPanel -> SpecPanelType.NORMAL_SCROLLABLE
             panelScrollable != null && (hasSelectionSummary || hasSubmitHint || (hasPanelTitle && hasPanelAction)) -> SpecPanelType.NORMAL_SCROLLABLE
             hasSelectionSummary && hasPanelTitle && hasPanelAction -> SpecPanelType.NON_SCROLLABLE_CONFIRMATION
+            // Some PDD builds expose the complete selector as non-scrollable
+            // before a value is selected, so an "已选" summary is absent. Two
+            // parsed dimensions with selectable values plus the unique quantity
+            // controls and lower-page order action remain required; generic
+            // product/review pages cannot satisfy this combined evidence.
+            panelScrollable == null && headings.size >= 2 && dimensions.size >= 2 &&
+                dimensions.sumOf { it.values.size } >= 2 &&
+                hasQuantityControls && hasOrderSubmitAction -> SpecPanelType.NON_SCROLLABLE_CONFIRMATION
+            // #331 fallback, evaluated only after every stronger branch failed.
+            // Required: address entry + payment entry + one enabled quantity
+            // input. Auxiliary (at least one): grouped options, selection
+            // summary, close control, +/- controls or the lower submit action.
+            requiredEvidenceSameContainer && (
+                dimensions.any { it.values.isNotEmpty() } || hasSelectionSummary || hasClose ||
+                    hasQuantityAdjustControls || hasOrderSubmitAction
+                ) -> SpecPanelType.REQUIRED_EVIDENCE
             else -> SpecPanelType.UNKNOWN
         }
         val panelOpen = specPanelType != SpecPanelType.UNKNOWN
+        val unprefixedSummary = if (structuredSelectionPanel) {
+            val quantity = quantityInputs.single()
+            val knownColors = (dimensions.filter { it.key == "color" }.flatMap { it.values }.map { it.text } +
+                listOfNotNull(purchaseContext?.exactColor?.takeIf { continuedPurchasePanel && it.isNotBlank() })).distinct()
+            val byPath = visibleNodes.associateBy { it.path }
+            var region = quantity.parentPath?.let(byPath::get)
+            var summary: String? = null
+            while (region != null && region.bounds.bottom <= headedPanelScrollable!!.bounds.top) {
+                val candidates = visible.filter { node ->
+                    node.path.startsWith("${region!!.path}/") && !node.clickable &&
+                        node.className?.endsWith("TextView") == true &&
+                        node.bounds.bottom <= quantity.bounds.top && node.label.length <= 160 &&
+                        knownColors.any { SpecValueNormalizer.summaryHasExactToken(node.label, it) }
+                }.map { it.label }.distinct()
+                if (candidates.isNotEmpty()) {
+                    summary = candidates.singleOrNull()
+                    break
+                }
+                region = region.parentPath?.let(byPath::get)
+            }
+            summary
+        } else null
         val firstHeadingTop = headings.firstOrNull()?.bounds?.top ?: Int.MAX_VALUE
         val price = visible.asSequence()
             .filter { it.bounds.top < firstHeadingTop }
             .mapNotNull { node -> pricePattern.find(node.label)?.groupValues?.get(1)?.let(::priceCent) }
             .firstOrNull()
-        val explicitSpecEntry = if (panelOpen) null else visible
+        val explicitSpecEntries = if (panelOpen) emptyList() else visible
             .filter { it.clickable && isSpecEntry(it.label, config) && !hasReviewContext(it, visibleNodes, config) }
-            .maxByOrNull { it.bounds.top }
-        val bottomSpecEntry = if (panelOpen || explicitSpecEntry != null) null else safeBottomSpecEntry(visibleNodes, visible, config)
-        val candidateSpecEntry = explicitSpecEntry ?: bottomSpecEntry?.anchor
-        val candidateClickTarget = explicitSpecEntry ?: bottomSpecEntry?.clickTarget
+        val explicitSpecEntry = explicitSpecEntries.maxByOrNull { it.bounds.top }
+        val nestedSpecEntries = if (panelOpen || explicitSpecEntry != null) emptyList() else
+            safeNestedSpecEntries(visibleNodes, visible, config)
+        // A nested selection row is accepted only when it is the single safe
+        // candidate. This covers PDD layouts that split “请选择” and the
+        // dimension name across child nodes of one clickable parent, without
+        // turning arbitrary page text into a click target.
+        val nestedSpecEntry = nestedSpecEntries.singleOrNull()
+        val bottomSpecEntries = if (panelOpen || explicitSpecEntry != null || nestedSpecEntry != null) emptyList() else
+            safeBottomSpecEntries(visibleNodes, visible, config)
+        val bottomSpecEntry = bottomSpecEntries.firstOrNull()
+        val candidateSpecEntry = explicitSpecEntry ?: nestedSpecEntry?.anchor ?: bottomSpecEntry?.anchor
+        val candidateClickTarget = explicitSpecEntry ?: nestedSpecEntry?.clickTarget ?: bottomSpecEntry?.clickTarget
         val reviewPageOpen = isReviewPage(visibleNodes, visible, screenHeight, candidateSpecEntry, config)
         val specEntry = candidateSpecEntry.takeUnless { reviewPageOpen }
         val specEntryClickTarget = candidateClickTarget.takeUnless { reviewPageOpen }
         val specEntrySource = when {
             reviewPageOpen -> null
             explicitSpecEntry != null -> "explicit_selection"
-            bottomSpecEntry != null -> "bottom_purchase"
+            nestedSpecEntry != null -> "nested_selection"
+            bottomSpecEntries.size == 1 -> "bottom_purchase"
+            bottomSpecEntry != null -> "bottom_purchase_rightmost"
             else -> null
         }
         val quickConfirmationEntry = if (quickConfirmationEvidence) quickConfirmationSpecEntry(visibleNodes, visible, config) else null
@@ -349,7 +539,7 @@ object PddScreenParser {
             selectedSummary = labels.firstOrNull {
                 val compact = it.replace(" ", "")
                 textAliases.selection.selectedPrefixes.any(compact::startsWith)
-            },
+            } ?: unprefixedSummary,
             priceCent = price,
             specPanelOpen = panelOpen,
             specPanelType = specPanelType,
@@ -368,10 +558,23 @@ object PddScreenParser {
             panelHeadingCount = headings.size,
             panelOptionCount = dimensions.sumOf { it.values.size },
             hasSelectionSummary = hasSelectionSummary,
+            hasCloseControl = hasClose,
+            hasPaymentArea = hasPaymentArea,
+            purchaseContextMatched = continuedPurchasePanel,
             hasQuantityControls = hasQuantityControls,
             hasOrderSubmitAction = hasOrderSubmitAction,
+            hasAddressEntry = hasAddressEntry,
+            hasPaymentEntry = hasPaymentEntry,
+            hasQuantityInput = hasQuantityInput,
+            hasQuantityAdjustControls = hasQuantityAdjustControls,
+            quantityInputCount = quantityInputs.size,
+            requiredEvidenceSameContainer = requiredEvidenceSameContainer,
+            explicitSpecEntryCount = explicitSpecEntries.size,
+            nestedSpecEntryCount = nestedSpecEntries.size,
+            bottomPurchaseEntryCount = bottomSpecEntries.size,
             problem = problem,
             sourceNodes = visibleNodes,
+            isPddPackage = snapshot.packageName == PDD_PACKAGE,
         )
     }
 
@@ -380,6 +583,93 @@ object PddScreenParser {
         return compact in excludedExactOptionLabels || excludedOptionWords.any { compact.contains(it) }
     }
 
+    /**
+     * Outermost labelled clickable ancestor inside the value region whose label
+     * prefixes every candidate nested in it. Rows that contain several distinct
+     * options never qualify because their members do not share its label.
+     */
+    private fun optionBlock(
+        candidate: SnapshotNode,
+        candidates: List<SnapshotNode>,
+        visibleByPath: Map<String, SnapshotNode>,
+        sourceByPath: Map<String, SnapshotNode>,
+        inValueRegion: (SnapshotNode) -> Boolean,
+    ): SnapshotNode? {
+        fun compact(value: String) = value.replace(Regex("\\s+"), "")
+        var block: SnapshotNode? = null
+        var parentPath = candidate.parentPath
+        while (parentPath != null) {
+            val raw = sourceByPath[parentPath] ?: break
+            val resolved = visibleByPath[parentPath]
+            // Only a block with its own label names the option; a blank row
+            // container resolved from its first child never merges options.
+            if (raw.clickable && raw.label.isNotBlank() && resolved != null && inValueRegion(resolved)) {
+                val outer = compact(resolved.label)
+                val members = candidates.filter { it.path == resolved.path || it.path.startsWith("${resolved.path}/") }
+                if (outer.isEmpty() || members.any { !compact(it.label).startsWith(outer) }) break
+                block = resolved
+            }
+            parentPath = raw.parentPath
+        }
+        return block
+    }
+
+    /** The nearby clickable row holding [node], or null when there is none or it is not a plausible entry row. */
+    private fun clickableEntryRow(node: SnapshotNode, sourceByPath: Map<String, SnapshotNode>, screenHeight: Int): SnapshotNode? {
+        var current: SnapshotNode? = node
+        var depth = 0
+        while (current != null && depth <= ENTRY_CLICKABLE_ANCESTOR_MAX_DEPTH) {
+            if (current.clickable) {
+                val plausible = current.visible && current.enabled && current.bounds.width > 0 && current.bounds.height > 0 &&
+                    (screenHeight <= 0 || current.bounds.height * 100 <= screenHeight * ENTRY_ROW_MAX_HEIGHT_PERCENT)
+                return current.takeIf { plausible }
+            }
+            current = current.parentPath?.let(sourceByPath::get)
+            depth++
+        }
+        return null
+    }
+
+    /** Address rows: a masked phone inside a nearby clickable row. The address text is never read out. */
+    private fun addressEntryRows(source: List<SnapshotNode>, screenHeight: Int): List<SnapshotNode> {
+        val byPath = source.associateBy(SnapshotNode::path)
+        return source.filter { node ->
+            node.visible && node.bounds.width > 0 && node.bounds.height > 0 && MASKED_PHONE_PATTERN.containsMatchIn(node.label)
+        }.mapNotNull { clickableEntryRow(it, byPath, screenHeight) }.distinctBy(SnapshotNode::path)
+    }
+
+    /** Payment-method rows via the configurable payment aliases inside a nearby clickable row. */
+    private fun paymentEntryRows(source: List<SnapshotNode>, screenHeight: Int, aliases: List<String>): List<SnapshotNode> {
+        val byPath = source.associateBy(SnapshotNode::path)
+        return source.filter { node ->
+            node.visible && node.bounds.width > 0 && node.bounds.height > 0 &&
+                node.label.replace(Regex("\\s+"), "").let { compact -> aliases.any(compact::contains) }
+        }.mapNotNull { clickableEntryRow(it, byPath, screenHeight) }.distinctBy(SnapshotNode::path)
+    }
+
+    /**
+     * #331: true when the lowest common ancestor of [nodes] is a real panel
+     * container: it is not a window root (a node without parent) and, like
+     * boundedScrollables, it does not cover the whole screen. Items taken from
+     * separate dialogs/pages only meet at the root or a full-screen wrapper.
+     */
+    private fun sharesBoundedPanelContainer(nodes: List<SnapshotNode>, sourceByPath: Map<String, SnapshotNode>, screenArea: Long): Boolean {
+        fun chain(node: SnapshotNode): List<SnapshotNode> {
+            val result = mutableListOf(node)
+            var current = node.parentPath?.let(sourceByPath::get)
+            while (current != null) {
+                result += current
+                current = current.parentPath?.let(sourceByPath::get)
+            }
+            return result
+        }
+        val others = nodes.drop(1).map { node -> chain(node).map(SnapshotNode::path).toSet() }
+        val common = chain(nodes.first()).firstOrNull { candidate -> others.all { candidate.path in it } } ?: return false
+        val parent = common.parentPath?.let(sourceByPath::get) ?: return false
+        if (parent.path == common.path || common.bounds.width <= 0 || common.bounds.height <= 0) return false
+        return screenArea == 0L || common.bounds.width.toLong() * common.bounds.height < screenArea
+    }
+
     private fun orderSubmitCandidatesAncestorFree(candidate: SnapshotNode, source: List<SnapshotNode>, aliases: List<String>): Boolean {
         val candidatePrefix = "${candidate.path}/"
         return source.none { node ->
@@ -458,10 +748,40 @@ object PddScreenParser {
         return hasSpecWord && config.textAliases.selection.specEntryPrefixes.any(compact::startsWith)
     }
 
-    private fun safeBottomSpecEntry(source: List<SnapshotNode>, visible: List<SnapshotNode>, config: PddCollectorConfig): SafeSpecEntry? {
-        val screenWidth = source.maxOfOrNull { it.bounds.right } ?: return null
-        val screenHeight = source.maxOfOrNull { it.bounds.bottom } ?: return null
-        if (screenWidth <= 0 || screenHeight <= 0) return null
+    private fun safeNestedSpecEntries(source: List<SnapshotNode>, visible: List<SnapshotNode>, config: PddCollectorConfig): List<SafeSpecEntry> {
+        val screenHeight = source.maxOfOrNull { it.bounds.bottom } ?: return emptyList()
+        if (screenHeight <= 0) return emptyList()
+        return source.asSequence()
+            .filter { it.visible && it.enabled && it.clickable && it.bounds.width > 0 && it.bounds.height > 0 }
+            // The fixed purchase bar begins at the lower fifth of the screen.
+            // A specs row has no reason to be inside that action-only zone.
+            .filter { it.bounds.centerY.toDouble() < screenHeight * 0.8 }
+            .mapNotNull { candidate ->
+                val context = (listOf(candidate.label) + descendants(candidate, source).map(SnapshotNode::label))
+                    .joinToString("") { it.replace(Regex("\\s+"), "") }
+                if (!isSpecEntryContext(context, config) ||
+                    nonConfigurableClickDenylist.any(context::contains) ||
+                    hasReviewContext(candidate, source, config)
+                ) return@mapNotNull null
+                val anchor = visible.firstOrNull { it.path == candidate.path } ?: candidate
+                SafeSpecEntry(anchor, candidate)
+            }
+            .distinctBy { it.clickTarget.path }
+            .toList()
+    }
+
+    private fun isSpecEntryContext(compact: String, config: PddCollectorConfig): Boolean {
+        if (config.textAliases.review.entryAliases.any(compact::contains)) return false
+        val hasSpecWord = (config.colorAliases + config.sizeAliases +
+            config.textAliases.dimension.exactNames + config.textAliases.dimension.adaptiveAliases)
+            .any(compact::contains)
+        return hasSpecWord && config.textAliases.selection.specEntryPrefixes.any(compact::contains)
+    }
+
+    private fun safeBottomSpecEntries(source: List<SnapshotNode>, visible: List<SnapshotNode>, config: PddCollectorConfig): List<SafeSpecEntry> {
+        val screenWidth = source.maxOfOrNull { it.bounds.right } ?: return emptyList()
+        val screenHeight = source.maxOfOrNull { it.bounds.bottom } ?: return emptyList()
+        if (screenWidth <= 0 || screenHeight <= 0) return emptyList()
         val byPath = source.associateBy(SnapshotNode::path)
         val normalizedByPath = visible.associateBy(SnapshotNode::path)
         val buyWords = config.textAliases.purchase.buyWords
@@ -485,8 +805,10 @@ object PddScreenParser {
                 val normalizedTarget = normalizedByPath[clickTarget.path] ?: return@mapNotNull null
                 SafeSpecEntry(normalizedAnchor, normalizedTarget) to clickTarget.bounds.width.toLong() * clickTarget.bounds.height
             }
-            .minWithOrNull(compareBy<Pair<SafeSpecEntry, Long>> { it.second }.thenByDescending { it.first.clickTarget.bounds.centerX })
-            ?.first
+            .sortedWith(compareByDescending<Pair<SafeSpecEntry, Long>> { it.first.clickTarget.bounds.centerX }.thenBy { it.second })
+            .map { it.first }
+            .distinctBy { it.clickTarget.path }
+            .toList()
     }
 
     private fun hasReviewContext(node: SnapshotNode, source: List<SnapshotNode>, config: PddCollectorConfig): Boolean {
@@ -1280,6 +1602,41 @@ class PddProductDetailCollector(
             .count()
     }
 
+    /**
+     * #334: the panel already shows its topmost color heading (the first
+     * parsed dimension is "color") with values visible, so no restore swipe
+     * is required. Swiping an already-top panel drags the bottom sheet
+     * further and can make the color/size headings vanish.
+     */
+    private fun isSpecPanelAtTop(screen: ParsedPddScreen): Boolean {
+        val first = screen.dimensions.firstOrNull() ?: return false
+        return first.key == "color" && first.values.isNotEmpty()
+    }
+
+    private fun recordSpecPanelTopSwipe(
+        reason: AgentDiagnosticReason,
+        screen: ParsedPddScreen,
+        swipeCount: Int,
+        headingCountBefore: Int?,
+        headingCountAfter: Int?,
+    ) {
+        if (taskId <= 0) return
+        diagnostic(
+            AgentDiagnosticEvent(
+                taskId = taskId,
+                // A dedicated PAGE_STABILITY event on purpose: SPEC_PANEL_ENTRY
+                // already carries the panel-open/restore diagnostics elsewhere,
+                // and several tests assert a single SPEC_PANEL_ENTRY event per run.
+                stage = AgentDiagnosticStage.PAGE_STABILITY,
+                reason = reason,
+                attempt = swipeCount,
+                targetClassName = "type=${screen.specPanelType.name};headBefore=${headingCountBefore ?: -1};" +
+                    "headAfter=${headingCountAfter ?: -1};dim=${screen.dimensions.sumOf { it.values.size }}",
+                clickableAncestorDepth = screen.panelHeadingCount,
+            ),
+        )
+    }
+
     private fun moveSpecPanelToTop(
         goodsId: String,
         config: PddCollectorConfig,
@@ -1289,17 +1646,40 @@ class PddProductDetailCollector(
     ): PddCollectorResult? {
         var previous: List<String>? = null
         var stable = 0
-        repeat(config.limits.getValue("specVerticalSwipes")) {
+        var priorHeadingCount = -1
+        var priorDimensionCount = -1
+        var swipes = 0
+        repeat(config.limits.getValue("specVerticalSwipes")) { pass ->
             if (now() > deadline) return failure("RULE_NOT_MATCHED", "采集超过规则总超时")
             val screen = parse(goodsId, config, evidence)
             screen.problem?.let { return failure(it.code, it.message) }
             if (!screen.pageEvidenceMatched) return failure("RULE_NOT_MATCHED", "采集期间离开 PDD 商品详情页")
+            if (pass == 0 && isSpecPanelAtTop(screen)) {
+                recordSpecPanelTopSwipe(AgentDiagnosticReason.SPEC_PANEL_TOP_ALREADY, screen, swipes, null, screen.panelHeadingCount)
+                return null
+            }
+            val headingCount = screen.panelHeadingCount
+            val dimensionCount = screen.dimensions.sumOf { it.values.size }
+            // A normal scroll-to-top can legitimately drop the panel's
+            // heading count (lower dimensions scroll out of view) without
+            // losing any values, so heading count alone must never trigger
+            // this. Only a full loss of every collected spec value, or the
+            // panel no longer being recognized as open, indicates the sheet
+            // was dragged too far.
+            val panelNoLongerRecognized = !screen.specPanelOpen || screen.specPanelType == SpecPanelType.UNKNOWN
+            if (pass > 0 && priorDimensionCount > 0 && (dimensionCount == 0 || panelNoLongerRecognized)) {
+                recordSpecPanelTopSwipe(AgentDiagnosticReason.SPEC_PANEL_TOP_COLLAPSED, screen, swipes, priorHeadingCount, headingCount)
+                return failure("SPEC_PANEL_TOP_COLLAPSED", "回顶滑动导致规格标题消失，已停止滑动")
+            }
+            priorHeadingCount = headingCount
+            priorDimensionCount = dimensionCount
             val signature = viewportSignature(screen)
             stable = if (previous != null && signature == previous) stable + 1 else 0
             previous = signature
             if (stable >= config.limits.getValue("stableEdgeReads")) return null
             val anchor = screen.dimensions.flatMap { it.values }.firstOrNull()?.node ?: specPanelContainer ?: return null
             if (!driver.swipeSpec(SwipeDirection.DOWN, anchor)) return null
+            swipes++
             pause(350)
         }
         return null
@@ -1467,6 +1847,8 @@ class PddProductDetailCollector(
             "type=${it.specPanelType.name};scroll=${it.panelScrollableCount};head=${it.panelHeadingCount};" +
                 "option=${it.panelOptionCount};summary=${it.hasSelectionSummary.toInt()};" +
                 "quantity=${it.hasQuantityControls.toInt()};submit=${it.hasOrderSubmitAction.toInt()};" +
+                "addr=${it.hasAddressEntry.toInt()};pay=${it.hasPaymentEntry.toInt()};qin=${it.quantityInputCount};" +
+                "adj=${it.hasQuantityAdjustControls.toInt()};close=${it.hasCloseControl.toInt()};" +
                 "changed=${screenChanged.toInt()};" +
                 "recovery=${when {
                     recoverySucceeded -> "success"

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PinduoduoImageSearchAsset.kt

@@ -0,0 +1,188 @@
+package cn.ilapage.goauto.agent.automation
+
+import android.content.ContentUris
+import android.content.ContentValues
+import android.content.Context
+import android.graphics.Bitmap
+import android.graphics.BitmapFactory
+import android.net.Uri
+import android.os.Build
+import android.os.Bundle
+import android.provider.MediaStore
+import cn.ilapage.goauto.agent.network.ImageSearchImage
+import java.io.ByteArrayOutputStream
+import java.security.MessageDigest
+import java.util.UUID
+
+data class PreparedImageSearchAsset(val uri: Uri)
+
+/**
+ * 图搜参考图的纯校验与缩放决策逻辑（#277），与 Android 框架解耦以便 JVM 单测覆盖。
+ * MediaStore 读写、真机相册顺序等只能真机验证，见 [PinduoduoImageSearchAssetStore]。
+ */
+object ImageSearchAssetPolicy {
+    const val MAX_BYTES = 20 * 1024 * 1024
+    const val MIN_SEARCH_IMAGE_EDGE = 960
+    const val MAX_SEARCH_IMAGE_EDGE = 4_096
+    const val SEARCH_JPEG_QUALITY = 95
+
+    fun valid(bytes: ByteArray, reference: ImageSearchImage): Boolean {
+        if (bytes.isEmpty() || bytes.size.toLong() != reference.sizeBytes || bytes.size > MAX_BYTES) return false
+        if (reference.mediaType != "image/jpeg" && reference.mediaType != "image/png") return false
+        if (reference.mediaType == "image/jpeg" && !hasJpegMarkers(bytes)) return false
+        return sha256(bytes) == reference.sha256.lowercase()
+    }
+
+    fun hasJpegMarkers(bytes: ByteArray): Boolean =
+        bytes.size >= 4 &&
+            bytes[0] == 0xff.toByte() &&
+            bytes[1] == 0xd8.toByte() &&
+            bytes[bytes.size - 2] == 0xff.toByte() &&
+            bytes[bytes.size - 1] == 0xd9.toByte()
+
+    fun sha256(bytes: ByteArray): String =
+        MessageDigest.getInstance("SHA-256").digest(bytes).joinToString("") { "%02x".format(it) }
+
+    /**
+     * 目标缩放尺寸，纯整数运算，便于单测覆盖临界值。
+     * 已经不小于 [MIN_SEARCH_IMAGE_EDGE] 时返回 null（原图直接使用）。
+     * 放大后超过 [MAX_SEARCH_IMAGE_EDGE] 时也返回 null（放弃放大，交由调用方决定是否使用原图或失败）。
+     */
+    fun targetScaledSize(width: Int, height: Int): Pair<Int, Int>? {
+        if (width <= 0 || height <= 0) return null
+        if (width >= MIN_SEARCH_IMAGE_EDGE && height >= MIN_SEARCH_IMAGE_EDGE) return null
+        val scale = maxOf(
+            MIN_SEARCH_IMAGE_EDGE.toDouble() / width,
+            MIN_SEARCH_IMAGE_EDGE.toDouble() / height,
+        )
+        val targetWidth = (width * scale).toInt()
+        val targetHeight = (height * scale).toInt()
+        if (targetWidth > MAX_SEARCH_IMAGE_EDGE || targetHeight > MAX_SEARCH_IMAGE_EDGE) return null
+        return targetWidth to targetHeight
+    }
+}
+
+class PinduoduoImageSearchAssetStore(context: Context) {
+    private val resolver = context.applicationContext.contentResolver
+
+    fun prepare(bytes: ByteArray, reference: ImageSearchImage): PreparedImageSearchAsset? {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q || !ImageSearchAssetPolicy.valid(bytes, reference)) return null
+        deleteStalePreparedImages()
+        val searchBytes = prepareSearchCopy(bytes) ?: return null
+        val values = ContentValues().apply {
+            put(MediaStore.Images.Media.DISPLAY_NAME, "$DISPLAY_NAME_PREFIX${UUID.randomUUID()}.jpg")
+            put(MediaStore.Images.Media.MIME_TYPE, "image/jpeg")
+            put(MediaStore.Images.Media.RELATIVE_PATH, MEDIA_DIRECTORY)
+            put(MediaStore.Images.Media.IS_PENDING, 1)
+        }
+        val uri = resolver.insert(MediaStore.Images.Media.EXTERNAL_CONTENT_URI, values) ?: return null
+        return try {
+            val wrote = resolver.openOutputStream(uri)?.use { it.write(searchBytes) } != null
+            if (!wrote) {
+                resolver.delete(uri, null, null)
+                return null
+            }
+            resolver.update(uri, ContentValues().apply { put(MediaStore.Images.Media.IS_PENDING, 0) }, null, null)
+            resolver.notifyChange(uri, null)
+            Thread.sleep(MEDIA_INDEX_SETTLE_MILLIS)
+            PreparedImageSearchAsset(uri)
+        } catch (_: Exception) {
+            resolver.delete(uri, null, null)
+            null
+        }
+    }
+
+    /**
+     * 本方案不做图像识别，只保证自己写入的图片是相册中最新的一项，从而在 PDD 图搜页"最近项目"
+     * 网格里稳定命中第一格。
+     *
+     * `[坑②修复]` 真机实测该网格同时包含图片和视频（观察到带时长文案的视频格子）。早前实现只在
+     * `MediaStore.Images` 里比较 jpeg，若相册里有更新的视频，网格第一格就不是我们写入的图，会导致
+     * 点错图。这里改为查询 `MediaStore.Files`（图片 + 视频），把结果交给纯函数
+     * [ImageSearchMediaRecencyPolicy] 判定；只要存在按 (DATE_ADDED, _ID) 排序更靠前的记录，
+     * 就返回 false（调用方据此明确失败，不猜测、不往后找）。真机验证未执行。
+     */
+    /**
+     * 确认我们写入的图是相册中最新的一项（图片与视频一起比较）。
+     *
+     * `[必须]` 用经典的 sortOrder 字符串，不要用 Bundle 的 QUERY_ARG_SORT_COLUMNS /
+     * QUERY_ARG_LIMIT。2026-09-15 真机对比：OnePlus PLY110（Android 16 / SDK 36）
+     * 认 Bundle 参数，三星 SM-G9700（Android 12 / SDK 31）不认——排序被忽略后
+     * LIMIT 取回的是任意 5 行，我们刚写入的图根本不在其中，于是判定"不是最新"
+     * 并以 IMAGE_SEARCH_ASSET_NOT_LATEST 失败，实际相册里最新的照片还是两天前的。
+     *
+     * LIMIT 不能写进 sortOrder：Android 11 起 MediaProvider 会以
+     * "Invalid token LIMIT" 拒绝。改为按排序游标读前 [RECENCY_QUERY_LIMIT] 行。
+     */
+    fun isMostRecent(asset: PreparedImageSearchAsset): Boolean {
+        val ownId = runCatching { ContentUris.parseId(asset.uri) }.getOrNull() ?: return false
+        val filesUri = MediaStore.Files.getContentUri("external")
+        val selection = "${MediaStore.Files.FileColumns.MEDIA_TYPE} IN (?, ?)"
+        val selectionArgs = arrayOf(
+            MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE.toString(),
+            MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO.toString(),
+        )
+        val sortOrder =
+            "${MediaStore.Files.FileColumns.DATE_ADDED} DESC, ${MediaStore.Files.FileColumns._ID} DESC"
+        val entries = runCatching {
+            resolver.query(
+                filesUri,
+                arrayOf(MediaStore.Files.FileColumns._ID, MediaStore.Files.FileColumns.DATE_ADDED),
+                selection,
+                selectionArgs,
+                sortOrder,
+            )?.use { cursor ->
+                val idIndex = cursor.getColumnIndexOrThrow(MediaStore.Files.FileColumns._ID)
+                val dateIndex = cursor.getColumnIndexOrThrow(MediaStore.Files.FileColumns.DATE_ADDED)
+                val result = mutableListOf<ImageSearchMediaEntry>()
+                while (result.size < RECENCY_QUERY_LIMIT && cursor.moveToNext()) {
+                    result += ImageSearchMediaEntry(cursor.getLong(idIndex), cursor.getLong(dateIndex))
+                }
+                result
+            }
+        }.getOrNull() ?: return false
+        return ImageSearchMediaRecencyPolicy.isMostRecent(entries, ownId)
+    }
+
+    fun delete(asset: PreparedImageSearchAsset?) {
+        asset ?: return
+        runCatching { resolver.delete(asset.uri, null, null) }
+    }
+
+    private fun deleteStalePreparedImages() {
+        runCatching {
+            resolver.delete(
+                MediaStore.Images.Media.EXTERNAL_CONTENT_URI,
+                "${MediaStore.Images.Media.RELATIVE_PATH} = ? AND ${MediaStore.Images.Media.DISPLAY_NAME} LIKE ?",
+                arrayOf("$MEDIA_DIRECTORY/", "$DISPLAY_NAME_PREFIX%.jpg"),
+            )
+        }
+    }
+
+    private fun prepareSearchCopy(source: ByteArray): ByteArray? {
+        val bitmap = BitmapFactory.decodeByteArray(source, 0, source.size) ?: return null
+        val target = ImageSearchAssetPolicy.targetScaledSize(bitmap.width, bitmap.height)
+        if (target == null) {
+            bitmap.recycle()
+            return source
+        }
+        val (targetWidth, targetHeight) = target
+        val scaled = Bitmap.createScaledBitmap(bitmap, targetWidth, targetHeight, true)
+        if (scaled !== bitmap) bitmap.recycle()
+        return try {
+            ByteArrayOutputStream().use { output ->
+                if (!scaled.compress(Bitmap.CompressFormat.JPEG, ImageSearchAssetPolicy.SEARCH_JPEG_QUALITY, output)) return null
+                output.toByteArray()
+            }
+        } finally {
+            scaled.recycle()
+        }
+    }
+
+    private companion object {
+        const val MEDIA_DIRECTORY = "Pictures/GoAutoSearch"
+        const val DISPLAY_NAME_PREFIX = "goauto-search-"
+        const val MEDIA_INDEX_SETTLE_MILLIS = 750L
+        const val RECENCY_QUERY_LIMIT = 5
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PinduoduoImageSearchAutomation.kt

@@ -0,0 +1,491 @@
+package cn.ilapage.goauto.agent.automation
+
+/**
+ * PDD 图搜状态机（#277）。
+ *
+ * 拆成两层：
+ *  - 本文件顶部的纯判定对象（[ImageSearchRecoveryPolicy]、[ImageSearchCandidatePolicy]、
+ *    [ImageSearchMediaRecencyPolicy]）不依赖 AccessibilityNodeInfo/MediaStore，可在 JVM
+ *    单测中直接覆盖。
+ *  - [PinduoduoImageSearchAutomation] 是实际驱动 [PddCollectorDriver] 的执行器，只能真机验证。
+ *
+ * 归位状态机思路参考本机 D:\chengma\cmroubao_old 的
+ * PinduoduoImageSearchAutomation.kt（未整包复制，只借鉴"归位到入口，上限次数内不断重试"的结构）。
+ * OCR/VLM 相关文件（PinduoduoGoodsIdOcr / PinduoduoCheckoutOcr / PinduoduoSpecificationVlm）
+ * 未参考、未移植。
+ */
+enum class ImageSearchPageKind {
+    HOME,
+    IMAGE_SEARCH_ENTRY,
+    IMAGE_SEARCH_RESULTS,
+    RETRY_DIALOG,
+    ORDER_CONFIRM,
+    OTHER_PDD,
+    NON_PDD,
+}
+
+enum class ImageSearchRecoveryAction {
+    /** 已经在图搜入口页，无需再动作。 */
+    NONE,
+    /** 在首页，点击"拍照搜索"入口（唯一可点节点）。 */
+    CLICK_CAMERA,
+    /**
+     * 关闭"再试一次"弹窗。
+     *
+     * `[必须]` 这个弹窗按返回键**无效**——2026-09-15 真机实测，按 BACK 前后两次
+     * uiautomator dump 逐字节相同。唯一出口是点"取消"，而点"取消"会退出图搜、
+     * 回到拼多多首页，所以关闭之后仍要重新走一遍入口。
+     */
+    DISMISS_RETRY_DIALOG,
+
+    /** 在结果页/订单确认页/其它拼多多页面，按返回逐步归位。订单确认页只允许返回，
+     * 绝不点击任何支付/下单控件。 */
+    BACK,
+    /** 完全不在拼多多前台，需要先拉起应用。 */
+    LAUNCH_PDD,
+}
+
+/**
+ * 归位状态机的纯判定逻辑：给定当前页面的包名、可见文案、排序控件数量，判断处于哪种页面形态，
+ * 以及归位到图搜入口还需要做什么动作。
+ */
+object ImageSearchRecoveryPolicy {
+    /** 归位动作上限，参考 cmroubao_old 的经验值，防止死循环。 */
+    const val MAX_RECOVERY_ACTIONS = 50
+
+    /**
+     * 允许关闭"再试一次"弹窗并重新进入的次数上限。
+     *
+     * `[必须]` 进入图搜页后拼多多的摄像头会实时识别，识别不到东西约 4 秒后自己弹出
+     * 该弹窗（2026-09-15 真机实测：+3s 无弹窗、+5s 有）。关闭后会回到首页，重新进入
+     * 又会撞上同一个窗口，因此必须单独设上限，否则会在通用的 50 次预算里空转数分钟。
+     */
+    const val MAX_RETRY_DIALOG_RECOVERIES = 3
+
+    /**
+     * 首页搜索栏的 content-desc，真机实测 `[381,166][765,223]` TextView 携带。
+     * 只用于证明"当前确实在带搜索栏的首页"，不作为点击目标。
+     */
+    const val SEARCH_BAR_CONTENT_DESCRIPTION = "搜索"
+
+    fun classify(
+        packageName: String?,
+        visibleTexts: Collection<String>,
+        sortControlCount: Int,
+        hasClickableCameraEntry: Boolean,
+    ): ImageSearchPageKind {
+        if (packageName != PDD_PACKAGE) return ImageSearchPageKind.NON_PDD
+        if (PinduoduoImageSearchCriteria.isRetryDialog(visibleTexts)) return ImageSearchPageKind.RETRY_DIALOG
+        if (PinduoduoImageSearchCriteria.isImageSearchResultsPage(visibleTexts, sortControlCount)) {
+            return ImageSearchPageKind.IMAGE_SEARCH_RESULTS
+        }
+        if (PinduoduoImageSearchCriteria.isImageSearchEntryPage(visibleTexts)) return ImageSearchPageKind.IMAGE_SEARCH_ENTRY
+        if (visibleTexts.any { text -> ORDER_CONFIRM_MARKERS.any(text::contains) }) return ImageSearchPageKind.ORDER_CONFIRM
+        // `[必须]` HOME 只能由**可点**的相机入口证明，不能只看文案。真机核对
+        // （2026-09-15）发现个人中心 tab 的根节点同样带 content-desc='拍照搜索'，
+        // 覆盖全屏且 clickable=false，而 visibleTexts() 会把 contentDescription
+        // 当文本收集。只看文案会把个人中心判成首页，随后几何兜底就会点到该页
+        // 顶部最靠右的可点节点——实测那是「设置」按钮。
+        if (hasClickableCameraEntry) return ImageSearchPageKind.HOME
+        return ImageSearchPageKind.OTHER_PDD
+    }
+
+    fun nextAction(kind: ImageSearchPageKind): ImageSearchRecoveryAction = when (kind) {
+        ImageSearchPageKind.IMAGE_SEARCH_ENTRY -> ImageSearchRecoveryAction.NONE
+        ImageSearchPageKind.HOME -> ImageSearchRecoveryAction.CLICK_CAMERA
+        ImageSearchPageKind.NON_PDD -> ImageSearchRecoveryAction.LAUNCH_PDD
+        ImageSearchPageKind.RETRY_DIALOG -> ImageSearchRecoveryAction.DISMISS_RETRY_DIALOG
+        ImageSearchPageKind.IMAGE_SEARCH_RESULTS,
+        ImageSearchPageKind.ORDER_CONFIRM,
+        ImageSearchPageKind.OTHER_PDD,
+        -> ImageSearchRecoveryAction.BACK
+    }
+
+    fun exceedsRecoveryBudget(actionCount: Int): Boolean = actionCount >= MAX_RECOVERY_ACTIONS
+
+    private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
+
+    // 只读识别信号：用于判断当前是否停在订单确认形态的页面，从而选择"按返回"这一条归位路径。
+    // 这里的任何文案都不会被配置成点击目标。
+    private val ORDER_CONFIRM_MARKERS = listOf(
+        "提交订单", "确认购买", "现在买，仅",
+        "待付款", "待支付", "去支付", "立即支付", "确认支付",
+    )
+}
+
+/** 图搜结果页里的一张候选卡片，供纯函数挑选。 */
+data class ImageSearchResultCard(
+    val top: Int,
+    val left: Int,
+    val width: Int,
+    val height: Int,
+    val texts: List<String>,
+    /** 卡片内图片是否已加载完成；不作为过滤条件，仅用于诊断/测试，容忍未加载完成的卡片。 */
+    val imageLoaded: Boolean = true,
+)
+
+/**
+ * 结果页候选卡片挑选：取第一个（先按 top 再按 left），跳过带"广告"文案的卡片。
+ * 不检查 [ImageSearchResultCard.imageLoaded]——参考项目 T-271 曾因为"图片未加载完时卡片读不出来"
+ * 在真机失败过，这里刻意不把加载状态当作过滤条件。
+ */
+object ImageSearchCandidatePolicy {
+    private const val AD_MARKER = "广告"
+
+    /** 节点是否完全落在卡片矩形内。 */
+    fun inside(card: ImageSearchResultCard, bounds: NodeBounds): Boolean =
+        bounds.left >= card.left && bounds.top >= card.top &&
+            bounds.right <= card.left + card.width && bounds.bottom <= card.top + card.height
+
+    /**
+     * 卡片内最靠上的有文案节点，作为点击目标。
+     *
+     * `[必须]` 点击目标不能是卡片容器本身。快照里 SnapshotNode.label 只取节点**自身**的
+     * text/contentDescription，而 clickFreshDetailed 重新定位时用 preferredOrDescendantLabel()
+     * ——会往子孙里挖。候选卡片是自身无文案的 FrameLayout，两者算出的 label 一个是空串、
+     * 一个是标题文字，永远对不上，重找直接返回 TARGET_NOT_FOUND。改为瞄准有文案的子节点，
+     * 由 clickFreshDetailed 既有的"向上走到可点祖先"逻辑落到卡片容器上。
+     */
+    fun clickTargetInside(card: ImageSearchResultCard, nodes: List<SnapshotNode>): SnapshotNode? =
+        nodes.filter { it.label.isNotEmpty() && inside(card, it.bounds) }.minByOrNull { it.bounds.top }
+
+    fun firstOpenableCandidate(cards: List<ImageSearchResultCard>): ImageSearchResultCard? =
+        cards
+            .filter { card -> card.texts.none { it.contains(AD_MARKER) } }
+            .sortedWith(compareBy({ it.top }, { it.left }))
+            .firstOrNull()
+}
+
+/** 相册里的一条媒体记录（图片或视频），仅取判定所需字段。 */
+data class ImageSearchMediaEntry(val id: Long, val dateAdded: Long)
+
+/**
+ * 坑②：现有 [PinduoduoImageSearchAssetStore.isMostRecent] 只比较 jpeg，若相册里有更新的视频，
+ * 网格第一格就不是我们写入的图。这里把"最新一项"的判定扩大到全部媒体（图片 + 视频），
+ * 并入 [PinduoduoImageSearchAssetStore] 时以 MediaStore.Files 同时查询两种类型。
+ * 找不到自己、或者存在按 (dateAdded, id) 排序更靠前的记录时，一律返回 false（明确失败，不往后找）。
+ */
+object ImageSearchMediaRecencyPolicy {
+    fun isMostRecent(entries: List<ImageSearchMediaEntry>, ownId: Long): Boolean {
+        if (entries.isEmpty()) return false
+        val latest = entries.maxWithOrNull(compareBy({ it.dateAdded }, { it.id })) ?: return false
+        return latest.id == ownId
+    }
+}
+
+data class ImageSearchAutomationResult(val successful: Boolean, val code: String, val message: String)
+
+/**
+ * 图搜状态机执行器：驱动 [PddCollectorDriver] 完成"归位到图搜入口 -> 选相册第一张 -> 等结果页 ->
+ * 打开第一个候选"。goods_id 识别与商品采集接回现有的 [CurrentPageIdentityRunner] +
+ * [PddProductDetailCollector] 链路（在 AgentForegroundService 里完成），本类只负责把
+ * 拼多多带到"候选商品详情页已打开"这一步。
+ *
+ * `[未验证]` 全部真机点击序列均未在真机执行，只能保证纯判定逻辑（上面三个 object）经过单测覆盖。
+ */
+class PinduoduoImageSearchAutomation(
+    private val driver: PddCollectorDriver,
+    private val currentPackage: () -> String?,
+    private val pause: (Long) -> Unit = Thread::sleep,
+) {
+    /**
+     * 归位到图搜入口页并在同一次迭代内选中相册第一张。
+     *
+     * `[必须]` 归位与选图必须合成一个循环，不能拆成 restoreToEntry() + selectFirstRecentImage()
+     * 两次调用。2026-09-15 真机实测：进入图搜页后拼多多的摄像头开始实时识别，识别不到东西
+     * 约 4 秒后自己弹出"再试一次"弹窗，把相册网格整个遮住；而该弹窗是独立 window，
+     * rootInActiveWindow 只能看到弹窗的 13 个节点，底下的图搜页完全不可见。
+     *
+     * 拆成两次调用时，中间要多一次完整的无障碍树抓取（图搜页节点很多，开销不小），
+     * 等第二次抓取回来时弹窗往往已经弹出，于是找不到"最近项目"锚点并报
+     * IMAGE_SEARCH_ENTRY_NOT_FOUND——线上任务 262 连续四次都是这样，每次约 3 秒。
+     * 手动实测在 1.8 秒内点中第一格可以干净进入结果页，所以余量存在，只是不能浪费。
+     *
+     * 结构参考同作者的 cmroubao_old（android-buyer PinduoduoImageSearchAutomation）：
+     * 检测到图搜页的那一刻就在当前快照上选图，并且每个动作之后等待预期页面出现，
+     * 而不是盲目重判——页面加载中时判据一个都不命中，会被误判成其它页面而按下返回键。
+     */
+    fun enterAndSelectImage(
+        launchPdd: () -> PddLaunchResult,
+        resetPddToHome: () -> PddLaunchResult = launchPdd,
+    ): ImageSearchAutomationResult {
+        var actions = 0
+        var dialogRecoveries = 0
+        var stalledBacks = 0
+        while (true) {
+            val snapshot = driver.capture()
+            val visible = snapshot.nodes.filter { it.visible }
+            val texts = visible.map { it.label }
+            PddPageClassifier.classify(snapshot.packageName, snapshot.activityName, texts)?.let {
+                return ImageSearchAutomationResult(false, it.code, it.message)
+            }
+            val sortControlCount = visible.count { it.label in SORT_CONTROL_LABELS }
+            val cameraEntry = uniqueCameraEntry(visible)
+            val kind = ImageSearchRecoveryPolicy.classify(
+                currentPackage(), texts, sortControlCount, hasClickableCameraEntry = cameraEntry != null,
+            )
+            when (ImageSearchRecoveryPolicy.nextAction(kind)) {
+                ImageSearchRecoveryAction.NONE -> {
+                    // 已在图搜入口页：就用刚抓到的这份快照选图，不再返回调用方、不再重新抓树。
+                    if (selectFirstRecentImageFrom(visible)) {
+                        return ImageSearchAutomationResult(true, "OK", "已选中相册第一张")
+                    }
+                    // 选不中通常是网格还没渲染出来，等一轮重来；弹窗弹出时会在下一轮被识别并关闭。
+                }
+                ImageSearchRecoveryAction.CLICK_CAMERA -> {
+                    val target = cameraEntry
+                        ?: return ImageSearchAutomationResult(false, "IMAGE_SEARCH_ENTRY_NOT_FOUND", "找不到唯一可点的拍照搜索入口")
+                    driver.clickFreshDetailed(target)
+                    // `[必须]` 点完入口后等页面稳定再决策。图搜页加载中时判据一个都不命中，
+                    // 会被判成 OTHER_PDD 并按下返回键，等于自己把刚打开的图搜页退掉。
+                    val settled = awaitPage(ENTRY_SETTLE_TIMEOUT_MILLIS) {
+                        it == ImageSearchPageKind.IMAGE_SEARCH_ENTRY || it == ImageSearchPageKind.RETRY_DIALOG
+                    }
+                    if (settled != null && selectFirstRecentImageFrom(settled)) {
+                        return ImageSearchAutomationResult(true, "OK", "已选中相册第一张")
+                    }
+                }
+                ImageSearchRecoveryAction.DISMISS_RETRY_DIALOG -> {
+                    dialogRecoveries++
+                    if (dialogRecoveries > ImageSearchRecoveryPolicy.MAX_RETRY_DIALOG_RECOVERIES) {
+                        return ImageSearchAutomationResult(
+                            false, "IMAGE_SEARCH_CAMERA_BLOCKED",
+                            "拼多多摄像头识别反复失败，图搜页始终被重试弹窗占据",
+                        )
+                    }
+                    if (!dismissRetryDialog(visible)) {
+                        return ImageSearchAutomationResult(
+                            false, "IMAGE_SEARCH_CAMERA_BLOCKED",
+                            "无法关闭重试弹窗，请人工处理后重试",
+                        )
+                    }
+                }
+                ImageSearchRecoveryAction.BACK -> {
+                    driver.back()
+                    // `[必须]` 按完返回要等页面真的换掉再判下一步。固定 300ms 盲等不够
+                    // PDD 完成一次切换，抓到的是动画中间态：判据一个都不命中，被归为
+                    // OTHER_PDD，于是再按一次——50 次预算 15 秒空转耗尽，App 可能一次
+                    // 完整返回都没做完（#292 真机任务 156）。CLICK_CAMERA 分支早就这么
+                    // 等了，这里是同一个坑漏掉的另一半。
+                    val moved = awaitPage(BACK_SETTLE_TIMEOUT_MILLIS) { it != kind } != null
+                    stalledBacks = if (moved) 0 else stalledBacks + 1
+                    if (stalledBacks >= MAX_STALLED_BACKS) {
+                        // 返回键推不动就别再按了：把 PDD 的返回栈清到根活动，直接回首页。
+                        stalledBacks = 0
+                        when (resetPddToHome()) {
+                            PddLaunchResult.INTENT_MISSING -> return ImageSearchAutomationResult(false, "PDD_APP_UNAVAILABLE", "没有找到拼多多应用，请确认已安装")
+                            PddLaunchResult.FAILED -> return ImageSearchAutomationResult(false, "PDD_FOREGROUND_LAUNCH_FAILED", "无法打开拼多多，请手动打开商品页后重试")
+                            PddLaunchResult.STARTED -> awaitPage(HOME_SETTLE_TIMEOUT_MILLIS) { it == ImageSearchPageKind.HOME }
+                        }
+                    }
+                }
+                ImageSearchRecoveryAction.LAUNCH_PDD -> {
+                    when (launchPdd()) {
+                        PddLaunchResult.INTENT_MISSING -> return ImageSearchAutomationResult(false, "PDD_APP_UNAVAILABLE", "没有找到拼多多应用，请确认已安装")
+                        PddLaunchResult.FAILED -> return ImageSearchAutomationResult(false, "PDD_FOREGROUND_LAUNCH_FAILED", "无法打开拼多多，请手动打开商品页后重试")
+                        PddLaunchResult.STARTED -> Unit
+                    }
+                }
+            }
+            actions++
+            if (ImageSearchRecoveryPolicy.exceedsRecoveryBudget(actions)) {
+                return ImageSearchAutomationResult(false, "IMAGE_SEARCH_ENTRY_NOT_FOUND", "归位到图搜入口并选中参考图失败，请人工检查")
+            }
+            pause(RECOVERY_STEP_MILLIS)
+        }
+    }
+
+    /**
+     * 轮询直到页面稳定为 [accept] 接受的形态，命中时返回**那一次抓取**的可见节点，
+     * 供调用方直接使用，避免为了拿到同一个页面再抓一次树。超时返回 null。
+     */
+    private fun awaitPage(
+        timeoutMillis: Long,
+        accept: (ImageSearchPageKind) -> Boolean,
+    ): List<SnapshotNode>? {
+        val deadline = System.currentTimeMillis() + timeoutMillis
+        while (System.currentTimeMillis() <= deadline) {
+            val snapshot = driver.capture()
+            val visible = snapshot.nodes.filter { it.visible }
+            val texts = visible.map { it.label }
+            val sortControlCount = visible.count { it.label in SORT_CONTROL_LABELS }
+            val kind = ImageSearchRecoveryPolicy.classify(
+                currentPackage(), texts, sortControlCount,
+                hasClickableCameraEntry = uniqueCameraEntry(visible) != null,
+            )
+            if (accept(kind)) return visible
+            pause(POLL_INTERVAL_MILLIS)
+        }
+        return null
+    }
+
+    /**
+     * 点"取消"关闭"再试一次"弹窗。
+     *
+     * `[必须]` 不用 BACK：真机实测 BACK 对该弹窗完全无效。也不点"再试一次"——那会
+     * 重新启动摄像头识别，几秒后再弹一次，形成死循环。
+     */
+    private fun dismissRetryDialog(visible: List<SnapshotNode>): Boolean {
+        val cancel = visible.firstOrNull {
+            it.enabled && it.clickable && it.label == PinduoduoImageSearchCriteria.RETRY_DIALOG_CANCEL_TEXT
+        } ?: return false
+        return driver.clickFreshDetailed(cancel).result == FreshActionResult.SUCCESS
+    }
+
+    /** 只保留唯一同时满足 content-desc 和 clickable 的节点；否则按几何兜底（顶部区域最靠右的可点节点）。 */
+    private fun uniqueCameraEntry(visible: List<SnapshotNode>): SnapshotNode? {
+        val byText = visible.filter {
+            it.enabled && it.clickable && it.contentDescription == PinduoduoImageSearchCriteria.CAMERA_ENTRY_CONTENT_DESCRIPTION
+        }
+        byText.singleOrNull()?.let { return it }
+        if (byText.isNotEmpty()) return null
+        // `[必须]` 几何兜底只在确实看得到顶部搜索栏时才允许。否则任何 PDD 页面都会
+        // 交出"顶部最靠右的可点节点"，在个人中心那是「设置」。实测首页搜索栏含
+        // content-desc='搜索' 的节点，个人中心没有。
+        val hasSearchBar = visible.any {
+            it.visible && it.bounds.top <= PinduoduoImageSearchCriteria.CAMERA_ENTRY_FALLBACK_MAX_TOP_PX &&
+                it.contentDescription?.trim() == ImageSearchRecoveryPolicy.SEARCH_BAR_CONTENT_DESCRIPTION
+        }
+        if (!hasSearchBar) return null
+        val fallback = visible.filter {
+            it.enabled && it.clickable && it.bounds.top <= PinduoduoImageSearchCriteria.CAMERA_ENTRY_FALLBACK_MAX_TOP_PX
+        }
+        return fallback.maxByOrNull { it.bounds.right }
+    }
+
+    /**
+     * 在**已经抓好**的快照上定位"最近项目"锚点下方的网格并点击第一格。
+     *
+     * `[必须]` 接收 visible 而不是自己 capture：见 [enterAndSelectImage] 的说明，
+     * 多一次抓取就可能错过 4 秒窗口。
+     */
+    fun selectFirstRecentImageFrom(visible: List<SnapshotNode>): Boolean {
+        val anchor = visible.firstOrNull { it.label.contains(PinduoduoImageSearchCriteria.RECENT_ITEMS_LABEL) } ?: return false
+        val screenWidth = visible.maxOfOrNull { it.bounds.right } ?: return false
+        val cells = visible
+            .filter { it.clickable && it.bounds.top >= anchor.bounds.bottom }
+            .map { PinduoduoImageSearchCriteria.GridCandidate(it.bounds.top, it.bounds.left, it.bounds.width, it.bounds.height) }
+        val target = PinduoduoImageSearchCriteria.firstRecentImageGridCell(cells, screenWidth) ?: return false
+        val node = visible.firstOrNull {
+            it.clickable && it.bounds.top == target.top && it.bounds.left == target.left &&
+                it.bounds.width == target.width && it.bounds.height == target.height
+        } ?: return false
+        return driver.clickFreshDetailed(node).result == FreshActionResult.SUCCESS
+    }
+
+    /**
+     * 轮询直到进入结果页。
+     *
+     * `[必须]` 出现"再试一次"弹窗时**不点"再试一次"**：那会重启摄像头识别、几秒后再弹一次。
+     * 这里直接判失败交回调用方，由 restoreToEntry 走关闭并重新进入的路径（有独立次数上限）。
+     */
+    fun waitForResultsPage(timeoutMillis: Long = DEFAULT_RESULTS_TIMEOUT_MILLIS): Boolean {
+        // 失败由调用方映射为 IMAGE_SEARCH_RESULTS_NOT_READY，与"结果页出来了但候选点不动"
+        // 区分开——两者此前共用 IMAGE_SEARCH_NO_CANDIDATES，定位问题时完全分不清。
+        val deadline = System.currentTimeMillis() + timeoutMillis
+        while (System.currentTimeMillis() <= deadline) {
+            val snapshot = driver.capture()
+            val visible = snapshot.nodes.filter { it.visible }
+            val texts = visible.map { it.label }
+            val sortControlCount = visible.count { it.label in SORT_CONTROL_LABELS }
+            if (PinduoduoImageSearchCriteria.isImageSearchResultsPage(texts, sortControlCount)) return true
+            if (PinduoduoImageSearchCriteria.isRetryDialog(texts)) return false
+            pause(RECOVERY_STEP_MILLIS)
+        }
+        return false
+    }
+
+    /** 打开结果页第一个非广告候选卡片；容忍卡片内图片尚未加载完成。 */
+    fun openFirstCandidate(): ImageSearchAutomationResult {
+        val snapshot = driver.capture()
+        val visible = snapshot.nodes.filter { it.visible }
+        val cardContainers = visible.filter { node ->
+            node.clickable &&
+                node.bounds.width in CARD_WIDTH_RANGE &&
+                node.bounds.height in CARD_HEIGHT_RANGE
+        }
+        if (cardContainers.isEmpty()) {
+            return ImageSearchAutomationResult(
+                false, "IMAGE_SEARCH_NO_CANDIDATES", "结果页没有可识别的商品卡片",
+            )
+        }
+        // `[必须]` 卡片内文案按**几何包含**判定，不用 path 前缀。path 的父子语义从未核对过，
+        // 而 bounds 包含在 2026-09-15 的真机 dump 上直接验证过：四张 535x764 卡片各自的
+        // 标题、价格、店铺文案都能正确归位。
+        val cards = cardContainers.map { container ->
+            ImageSearchResultCard(
+                top = container.bounds.top,
+                left = container.bounds.left,
+                width = container.bounds.width,
+                height = container.bounds.height,
+                texts = visible.filter {
+                    it.label.isNotEmpty() && ImageSearchCandidatePolicy.inside(
+                        ImageSearchResultCard(container.bounds.top, container.bounds.left, container.bounds.width, container.bounds.height, emptyList()),
+                        it.bounds,
+                    )
+                }.map { it.label },
+            )
+        }
+        val chosen = ImageSearchCandidatePolicy.firstOpenableCandidate(cards)
+            ?: return ImageSearchAutomationResult(
+                false, "IMAGE_SEARCH_NO_CANDIDATES",
+                "结果页 ${cards.size} 张卡片全部是广告，没有可采集的候选",
+            )
+        val container = cardContainers.firstOrNull {
+            it.bounds.top == chosen.top && it.bounds.left == chosen.left &&
+                it.bounds.width == chosen.width && it.bounds.height == chosen.height
+        } ?: return ImageSearchAutomationResult(
+            false, "IMAGE_SEARCH_CANDIDATE_CLICK_FAILED", "选中的候选卡片在点击前消失",
+        )
+
+        // `[必须]` 不能直接点卡片容器。快照里 SnapshotNode.label 只取节点**自身**的
+        // text/contentDescription，而 clickFreshDetailed 重新定位时用的是
+        // preferredOrDescendantLabel()——会往子孙里挖。候选卡片是自身无文案的
+        // FrameLayout，两者算出的 label 一个是空串、一个是标题文字，永远对不上，
+        // 重找直接返回 TARGET_NOT_FOUND（2026-09-15 真机：任务 262 卡在这里）。
+        // 改为瞄准卡片内有文案的子节点，由 clickFreshDetailed 既有的"向上走到可点祖先"
+        // 逻辑落到卡片容器上。
+        val labelled = ImageSearchCandidatePolicy.clickTargetInside(chosen, visible)
+            ?: return ImageSearchAutomationResult(
+                false, "IMAGE_SEARCH_CANDIDATE_CLICK_FAILED", "候选卡片内没有可定位的文案节点",
+            )
+        val outcome = driver.clickFreshDetailed(labelled)
+        if (outcome.result != FreshActionResult.SUCCESS) {
+            return ImageSearchAutomationResult(
+                false, "IMAGE_SEARCH_CANDIDATE_CLICK_FAILED",
+                "候选卡片点击失败[result=${outcome.result};reason=${outcome.reason}]",
+            )
+        }
+        return ImageSearchAutomationResult(true, "OK", "已打开第一个候选")
+    }
+
+
+    private fun SnapshotNode.width6xHeight(): Boolean = bounds.width > 0 && bounds.height > 0
+
+    private companion object {
+        const val RECOVERY_STEP_MILLIS = 300L
+
+        /** 动作之间的轮询间隔，取自 cmroubao_old 的实测值。 */
+        const val POLL_INTERVAL_MILLIS = 200L
+
+        /**
+         * 点击图搜入口后等待页面稳定的上限。
+         *
+         * `[必须]` 必须明显短于摄像头自动弹出重试弹窗的约 4 秒，否则等到的就是弹窗而不是图搜页。
+         */
+        const val ENTRY_SETTLE_TIMEOUT_MILLIS = 2_500L
+
+        /** 按下返回后等待页面形态变化的上限。 */
+        const val BACK_SETTLE_TIMEOUT_MILLIS = 1_500L
+
+        /** 连续多少次返回推不动页面后，改用清栈重启回首页。 */
+        const val MAX_STALLED_BACKS = 3
+
+        /** 清栈回首页后等待首页出现的上限。 */
+        const val HOME_SETTLE_TIMEOUT_MILLIS = 5_000L
+        const val DEFAULT_RESULTS_TIMEOUT_MILLIS = 15_000L
+        val SORT_CONTROL_LABELS = setOf("综合", "销量", "价格", "品牌")
+        val CARD_WIDTH_RANGE = 400..700
+        val CARD_HEIGHT_RANGE = 600..950
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PinduoduoImageSearchCriteria.kt

@@ -0,0 +1,102 @@
+package cn.ilapage.goauto.agent.automation
+
+/**
+ * PDD 图搜相关页面判据的纯函数实现（#277）。
+ *
+ * 常量来源：移植自同作者另一个项目（本机 D:\chengma\cmroubao_old），并已于
+ * 2026-09-15 在真机（1080x2354，PDD HomeActivity / NewPageActivity）dump 无障碍
+ * 树逐条核对，三处判据全部命中：
+ *
+ *  1. 首页搜索框右侧 `[941,161][1080,228] ImageView clickable=true`
+ *     content-desc 正是 [CAMERA_ENTRY_CONTENT_DESCRIPTION]。
+ *     `[必须]` 必须同时要求 clickable：个人中心 tab 的**根节点**也带着同一个
+ *     content-desc 且覆盖全屏、clickable=false，只按文案匹配会点到整屏。
+ *     实测首页该文案共 2 个节点、仅 1 个可点，"唯一可点"过滤是必需的。
+ *  2. 图搜页 [isImageSearchEntryPage] 的四段文案齐备；`最近项目` 锚点
+ *     `[0,1892][210,1898]`，其下网格每格 267px，267*4=1068，屏宽 1080，
+ *     落在 ±[GRID_WIDTH_TOLERANCE_PX] 容差内。
+ *  3. 结果页 `搜图片同款` 出现，排序控件为 综合/销量/价格/品牌 共 4 个（>=3）。
+ *
+ * 已知与移植来源的差异，以及尚未验证的部分，见下方各常量注释。
+ */
+object PinduoduoImageSearchCriteria {
+
+    /** 首页/搜索结果页上，图搜入口按钮的 contentDescription。要求唯一匹配后才可点击。 */
+    const val CAMERA_ENTRY_CONTENT_DESCRIPTION = "拍照搜索"
+
+    /**
+     * 几何兜底（用户 2026-09-15 提供）：若按 content-desc 找不到入口，首页顶部
+     * 区域最靠右的可点节点即是相机图标。实测 `[941,161][1080,228]` 紧贴右边缘。
+     * 仅在文案匹配失败时使用，且必须限制在顶部搜索栏所在的纵向范围内。
+     */
+    const val CAMERA_ENTRY_FALLBACK_MAX_TOP_PX = 320
+
+    /**
+     * "再试一次"弹窗文案。
+     *
+     * `[已验证]` 2026-09-15 真机复现，三个常量全部命中。进入图搜页后摄像头会
+     * 实时识别，识别不到东西约 4 秒后拼多多**自己**弹出该弹窗（+3s 无、+5s 有），
+     * 不需要我们点任何东西。它会遮住相册网格。
+     *
+     * `[必须]` 按 BACK 对该弹窗**完全无效**（前后两次 dump 逐字节相同）；点「取消」
+     * 可以关闭，但会退出图搜、回到拼多多首页。实测在 1.8 秒内点中相册第一格
+     * 可以赶在弹窗之前干净进入结果页。
+     */
+    const val RETRY_DIALOG_CANCEL_TEXT = "取消"
+    const val RETRY_DIALOG_CONFIRM_TEXT = "再试一次"
+    const val RETRY_DIALOG_HINT_TEXT = "请对准商品或码，保持手机稳定"
+
+    /**
+     * 相册网格锚点。
+     *
+     * `[注意]` 真机实测该网格同时包含**视频**（观察到带时长文案 03:02 的格子）。
+     * 资产准备侧的"自己是否为相册最新一张"只比较 jpeg，若有更新的视频排在前面，
+     * 第一格就不是我们写入的图。接线时必须复核这一点，必要时改为按 uri 定位。
+     */
+    const val RECENT_ITEMS_LABEL = "最近项目"
+
+    private const val GRID_COLUMNS = 4
+    private const val GRID_WIDTH_TOLERANCE_PX = 24
+
+    /** 图搜首页（选择"最近项目"/拍照）判据：需同时出现相册、最近搜索、历史浏览等文案，且有拍照引导。 */
+    fun isImageSearchEntryPage(texts: Collection<String>): Boolean {
+        val hasAlbum = texts.any { it.contains("我的相册") }
+        val hasRecentSearch = texts.any { it.contains("最近搜索") }
+        val hasHistory = texts.any { it.contains("历史浏览") }
+        val hasCameraHint = texts.any {
+            // 真机实测取景提示是「对准商品/条形码/二维码，自动识别」，移植来源的
+            // 「即可进行自动识别」不命中；靠「点击拍照」兜住。三者保留为或关系，
+            // 以覆盖未授予相机权限等其它形态。
+            it.contains("点击拍照") || it.contains("开启相机权限") || it.contains("即可进行自动识别")
+        }
+        return hasAlbum && hasRecentSearch && hasHistory && hasCameraHint
+    }
+
+    /** 图搜结果页判据：出现"搜图片同款"标题，且排序/筛选控件数量达到阈值。 */
+    fun isImageSearchResultsPage(texts: Collection<String>, sortControlCount: Int): Boolean =
+        texts.any { it.contains("搜图片同款") } && sortControlCount >= 3
+
+    /** "再试一次"弹窗判据。 */
+    fun isRetryDialog(texts: Collection<String>): Boolean {
+        val hasHint = texts.any { it.contains(RETRY_DIALOG_HINT_TEXT) }
+        val hasCancel = texts.any { it == RETRY_DIALOG_CANCEL_TEXT }
+        val hasRetry = texts.any { it == RETRY_DIALOG_CONFIRM_TEXT }
+        return hasHint && hasCancel && hasRetry
+    }
+
+    data class GridCandidate(val top: Int, val left: Int, val width: Int, val height: Int)
+
+    /**
+     * 在"最近项目"标签下方的候选矩形里，挑出 4 列等宽网格（宽度 * 4 约等于屏宽，容差
+     * [GRID_WIDTH_TOLERANCE_PX]px；高度 >= 宽度/2）里最靠左上的一个（先按 top 再按 left 排序）。
+     * 找不到符合条件的候选时返回 null。
+     */
+    fun firstRecentImageGridCell(candidates: List<GridCandidate>, screenWidth: Int): GridCandidate? {
+        val fourColumns = candidates.filter { cell ->
+            cell.width > 0 &&
+                cell.height >= cell.width / 2 &&
+                kotlin.math.abs(cell.width * GRID_COLUMNS - screenWidth) <= GRID_WIDTH_TOLERANCE_PX
+        }
+        return fourColumns.sortedWith(compareBy({ it.top }, { it.left })).firstOrNull()
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseLiveAutomation.kt

@@ -19,8 +19,16 @@ data class FinalConfirmationEvidence(
     val activityName: String,
 )
 
-data class PurchaseOrderEvidence(val orderNo: String, val submittedAt: String)
-data class PurchaseOrderReadFailure(val code: String, val message: String)
+data class PurchaseOrderEvidence(val orderNo: String, val submittedAt: String, val pddOrderAmountCent: Long? = null)
+data class PurchaseOrderReadFailure(
+    val code: String,
+    val message: String,
+    // `[必须]` 与是否读到订单号无关：只要采样期间出现过待付款/支付相关文案，
+    // 就说明大概率已经点通了下单、PDD 侧可能已经建了订单，只是没能读全证据
+    // （比如返回窗口太短、错过了订单详情页）。给 order_result_unknown 分优先级用，
+    // 不改变判定结果本身（#302）。
+    val paymentPageObserved: Boolean = false,
+)
 
 class PurchaseLiveException(val code: String, message: String, val actualUnitPriceCent: Long? = null) : IllegalStateException(message)
 
@@ -32,10 +40,64 @@ class PurchaseLiveException(val code: String, message: String, val actualUnitPri
 class PurchaseLiveAutomation(
     private val driver: PurchaseUiDriver,
     private val pause: (Long) -> Unit = Thread::sleep,
+    /** Boolean/count-only diagnostics; never receives address text. */
+    private val panelDiagnostic: (String) -> Unit = {},
 ) {
     private var submitAttempted = false
     var lastOrderReadFailure: PurchaseOrderReadFailure? = null
         private set
+
+    /**
+     * Advances an already verified spec selector to the order confirmation
+     * page. Only the selector's unique exact confirm button is clickable; an
+     * order-submit or payment control can never satisfy this transition.
+     */
+    fun advanceToOrderConfirmation(allowUnclassifiedPanelWithSelectionProof: Boolean = false) {
+        var snapshot = driver.capture()
+        pageProblem(snapshot)
+        if (orderConfirmationReady(snapshot)) return
+        if (snapshot.packageName != PDD_PACKAGE) {
+            fail("PURCHASE_SPEC_CONFIRMATION_NOT_READY", "当前不是拼多多规格页面，未创建订单")
+        }
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        val unclassifiedSelectionPanelWithProof = allowUnclassifiedPanelWithSelectionProof &&
+            screen.specPanelType == SpecPanelType.UNKNOWN &&
+            screen.priceCent != null &&
+            snapshot.nodes.count {
+                it.visible && it.enabled && it.className?.endsWith("EditText") == true && it.label.toLongOrNull() != null
+            } == 1
+        if (
+            screen.specPanelType !in setOf(SpecPanelType.NORMAL_SCROLLABLE, SpecPanelType.NON_SCROLLABLE_CONFIRMATION) &&
+            !unclassifiedSelectionPanelWithProof
+        ) {
+            fail("PURCHASE_SPEC_CONFIRMATION_NOT_READY", "当前规格面板不能安全确认，未创建订单")
+        }
+        val aliases = PurchaseRehearsalExecutor.DEFAULT_COLLECTOR.textAliases.specPanel.confirmAliases
+            .map { it.replace(" ", "") }
+            .toSet()
+        val targets = snapshot.nodes.filter { node ->
+            node.visible && node.enabled && node.clickable && node.label.replace(" ", "") in aliases
+        }.distinctBy { it.path }
+        if (targets.isEmpty()) {
+            fail("PURCHASE_SPEC_CONFIRM_TARGET_MISSING", "没有找到唯一的规格确认按钮，未创建订单")
+        }
+        if (targets.size > 1) {
+            fail("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", "规格确认按钮不唯一，未创建订单")
+        }
+        when (driver.clickFresh(targets.single())) {
+            FreshActionResult.SUCCESS -> Unit
+            FreshActionResult.AMBIGUOUS -> fail("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", "规格确认按钮不唯一，未创建订单")
+            else -> fail("PURCHASE_SPEC_CONFIRM_CLICK_FAILED", "规格确认按钮点击失败，未创建订单")
+        }
+        repeat(SPEC_CONFIRMATION_MAX_SAMPLES) {
+            pause(SPEC_CONFIRMATION_SAMPLE_INTERVAL_MS)
+            snapshot = driver.capture()
+            pageProblem(snapshot)
+            if (orderConfirmationReady(snapshot)) return
+        }
+        fail("PURCHASE_SPEC_CONFIRMATION_UNCONFIRMED", "规格确认后没有进入订单确认页，未创建订单")
+    }
+
     fun updateShippingAddress(addressSuffix: String): ShippingAddressProof {
         if (!addressSuffix.matches(Regex("^_cg[1-9][0-9]*$"))) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "采购任务的地址标记无效")
         var snapshot = driver.capture()
@@ -43,12 +105,31 @@ class PurchaseLiveAutomation(
         var unchangedCount = 0
         for (attempt in 0 until 5) {
             pageProblem(snapshot)
-            val entries = mergedDirect(snapshot.nodes.filter { it.visible && it.enabled && MASKED_PHONE.containsMatchIn(it.label) })
-            if (entries.size == 1) {
-                when (driver.tapPurchaseFresh(entries.single())) {
+            val resolution = resolveAddressEntries(snapshot)
+            if (resolution.addressCardCount > 1 || resolution.tapTargetCount > 1) {
+                fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${resolution.diagnostic()}]")
+            }
+            if (resolution.target != null) {
+                pause(ADDRESS_ENTRY_STABLE_INTERVAL_MS)
+                val stableSnapshot = driver.capture()
+                pageProblem(stableSnapshot)
+                val stableResolution = resolveAddressEntries(stableSnapshot)
+                if (stableResolution.addressCardCount > 1 || stableResolution.tapTargetCount > 1) {
+                    fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${stableResolution.diagnostic()}]")
+                }
+                if (stableResolution.target == null || stableResolution.fingerprint() != resolution.fingerprint()) {
+                    snapshot = stableSnapshot
+                    continue
+                }
+                val target = stableResolution.target
+                val result = when (target.activation) {
+                    AddressEntryActivation.CLICK -> driver.clickAddressEntryFresh(target.node).result
+                    AddressEntryActivation.TAP -> driver.tapPurchaseFresh(target.node)
+                }
+                when (result) {
                     FreshActionResult.SUCCESS -> Unit
-                    FreshActionResult.AMBIGUOUS -> fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单")
-                    else -> fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口点击失败，未创建订单")
+                    FreshActionResult.AMBIGUOUS -> fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${stableResolution.diagnostic()}]")
+                    else -> fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口点击失败，未创建订单 [${stableResolution.diagnostic()}]")
                 }
                 pause(1_000)
                 snapshot = waitFor("PURCHASE_ADDRESS_PANEL_TIMEOUT", "收货地址页面打开超时，未创建订单") {
@@ -56,7 +137,9 @@ class PurchaseLiveAutomation(
                 }
                 return editAndVerifyAddress(snapshot, addressSuffix)
             }
-            if (entries.size > 1) fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单")
+            if (resolution.phoneNodeCount > 0) {
+                fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口无法安全定位，未创建订单 [${resolution.diagnostic()}]")
+            }
             val panel = purchasePanelScrollTargets(snapshot)
             if (panel.size != 1) fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "没有找到唯一的规格面板滚动区域，未创建订单")
             val signature = viewportSignature(snapshot, panel.single())
@@ -72,6 +155,161 @@ class PurchaseLiveAutomation(
         fail("PURCHASE_ADDRESS_PANEL_TIMEOUT", "规格面板下拉后仍未找到收货地址，未创建订单")
     }
 
+    private enum class AddressEntryActivation { CLICK, TAP }
+
+    private data class AddressEntryTarget(
+        val node: SnapshotNode,
+        val activation: AddressEntryActivation,
+        val cardKey: String,
+    )
+
+    private data class AddressCardCandidate(
+        val phone: SnapshotNode,
+        val clickableCard: SnapshotNode?,
+        val semanticKey: String?,
+    )
+
+    private data class AddressEntryResolution(
+        val phoneNodeCount: Int,
+        val addressCardCount: Int,
+        val tapTargetCount: Int,
+        val target: AddressEntryTarget?,
+    ) {
+        fun diagnostic(): String =
+            "phoneNodes=$phoneNodeCount;addressCards=$addressCardCount;tapTargets=$tapTargetCount"
+
+        fun fingerprint(): String? = target?.let {
+            listOf(
+                it.activation.name,
+                it.cardKey,
+                it.node.label,
+                it.node.className.orEmpty(),
+                it.node.bounds.left,
+                it.node.bounds.top,
+                it.node.bounds.right,
+                it.node.bounds.bottom,
+            ).joinToString(":")
+        }
+    }
+
+    private fun resolveAddressEntries(snapshot: UiSnapshot): AddressEntryResolution {
+        val phones = snapshot.nodes.filter {
+            it.visible && it.enabled && maskedPhone(it.label) != null
+        }.distinctBy { it.path }
+        if (phones.isEmpty()) return AddressEntryResolution(0, 0, 0, null)
+
+        val byPath = snapshot.nodes.associateBy(SnapshotNode::path)
+        val candidates = phones.map { phone ->
+            val card = nearestClickableAncestor(phone, byPath)
+            AddressCardCandidate(phone, card, card?.let { addressCardSemanticKey(it, snapshot) })
+        }
+        val groups = mutableListOf<MutableList<AddressCardCandidate>>()
+        candidates.forEach { candidate ->
+            val matching = groups.filter { group -> group.any { sameLogicalAddress(it, candidate) } }
+            if (matching.isEmpty()) {
+                groups += mutableListOf(candidate)
+            } else {
+                val primary = matching.first()
+                primary += candidate
+                matching.drop(1).forEach { duplicate ->
+                    primary += duplicate
+                    groups.remove(duplicate)
+                }
+            }
+        }
+
+        val targets = groups.mapIndexed { index, group ->
+            val clickable = group.filter { it.clickableCard != null }
+                .minWithOrNull(compareBy<AddressCardCandidate>({ nodeArea(requireNotNull(it.clickableCard)) }, { it.phone.path }))
+            if (clickable != null) {
+                AddressEntryTarget(clickable.phone, AddressEntryActivation.CLICK, logicalAddressKey(group, index))
+            } else {
+                AddressEntryTarget(group.minBy { nodeArea(it.phone) }.phone, AddressEntryActivation.TAP, logicalAddressKey(group, index))
+            }
+        }
+
+        val actionable = targets.filter { it.node.bounds.width >= 2 && it.node.bounds.height >= 2 }
+        return AddressEntryResolution(
+            phoneNodeCount = phones.size,
+            addressCardCount = targets.size,
+            tapTargetCount = actionable.size,
+            target = actionable.singleOrNull(),
+        )
+    }
+
+    private fun nearestClickableAncestor(
+        source: SnapshotNode,
+        byPath: Map<String, SnapshotNode>,
+    ): SnapshotNode? {
+        var current: SnapshotNode? = source
+        while (current != null) {
+            if (current.clickable && current.visible && current.enabled) return current
+            current = current.parentPath?.let(byPath::get)
+        }
+        return null
+    }
+
+    private fun addressCardSemanticKey(card: SnapshotNode, snapshot: UiSnapshot): String? {
+        val labels = snapshot.nodes.asSequence()
+            .filter { it.visible && (it.path == card.path || it.path.startsWith("${card.path}/")) }
+            .map { normalizeAddressSemantic(it.label) }
+            .filter { it.isNotBlank() && maskedPhone(it) == null && it !in ADDRESS_CARD_GENERIC_LABELS }
+            .distinct()
+            .sorted()
+            .toList()
+        if (labels.none { it.length >= ADDRESS_SEMANTIC_MIN_LENGTH }) return null
+        return labels.joinToString("|")
+    }
+
+    private fun normalizeAddressSemantic(value: String): String = value
+        .replace(Regex("\\s+"), "")
+        .replace("，", ",")
+        .replace("：", ":")
+        .lowercase()
+
+    private fun sameLogicalAddress(first: AddressCardCandidate, second: AddressCardCandidate): Boolean {
+        if (maskedPhone(first.phone.label) != maskedPhone(second.phone.label)) return false
+        if (first.clickableCard?.path != null && first.clickableCard.path == second.clickableCard?.path) return true
+        if (sameAddressRegion(first.phone, second.phone)) return true
+        val firstCard = first.clickableCard
+        val secondCard = second.clickableCard
+        if (firstCard != null && secondCard != null && boundsRepresentSameRegion(firstCard.bounds, secondCard.bounds)) return true
+        return first.semanticKey != null && first.semanticKey == second.semanticKey
+    }
+
+    private fun boundsRepresentSameRegion(first: NodeBounds, second: NodeBounds): Boolean {
+        val overlapWidth = (minOf(first.right, second.right) - maxOf(first.left, second.left)).coerceAtLeast(0)
+        val overlapHeight = (minOf(first.bottom, second.bottom) - maxOf(first.top, second.top)).coerceAtLeast(0)
+        val overlap = overlapWidth.toLong() * overlapHeight
+        val smaller = minOf(first.width.toLong() * first.height, second.width.toLong() * second.height)
+        return smaller > 0 && overlap * 100 >= smaller * ADDRESS_CARD_OVERLAP_PERCENT
+    }
+
+    private fun logicalAddressKey(group: List<AddressCardCandidate>, index: Int): String {
+        val semantic = group.mapNotNull(AddressCardCandidate::semanticKey).distinct().singleOrNull()
+        return semantic?.let { "semantic:$it" } ?: "geometry:$index:${group.minOf { it.phone.bounds.top }}"
+    }
+
+    private fun sameAddressRegion(first: SnapshotNode, second: SnapshotNode): Boolean {
+        if (maskedPhone(first.label) != maskedPhone(second.label)) return false
+        val overlapWidth = (minOf(first.bounds.right, second.bounds.right) - maxOf(first.bounds.left, second.bounds.left)).coerceAtLeast(0)
+        val overlapHeight = (minOf(first.bounds.bottom, second.bounds.bottom) - maxOf(first.bounds.top, second.bounds.top)).coerceAtLeast(0)
+        val overlap = overlapWidth.toLong() * overlapHeight
+        val smaller = minOf(nodeArea(first), nodeArea(second))
+        val containsCenter = (
+            first.bounds.centerX in second.bounds.left..second.bounds.right &&
+                first.bounds.centerY in second.bounds.top..second.bounds.bottom
+            ) || (
+            second.bounds.centerX in first.bounds.left..first.bounds.right &&
+                second.bounds.centerY in first.bounds.top..first.bounds.bottom
+            )
+        return (smaller > 0 && overlap * 100 >= smaller * 50) || containsCenter
+    }
+
+    private fun maskedPhone(value: String): String? = MASKED_PHONE.find(value)?.value
+
+    private fun nodeArea(node: SnapshotNode): Long = node.bounds.width.toLong() * node.bounds.height
+
     fun finalConfirmation(input: PurchaseExecutionInput, address: ShippingAddressProof): FinalConfirmationEvidence {
         val snapshot = driver.capture()
         pageProblem(snapshot)
@@ -112,18 +350,31 @@ class PurchaseLiveAutomation(
     /** Reads the order flow with bounded chooser/payment Back actions and one verified PDD foreground request. */
     fun readOrderResult(): PurchaseOrderEvidence? {
         lastOrderReadFailure = null
+        var paymentPageObserved = false
         fun unknown(code: String, message: String): PurchaseOrderEvidence? {
-            lastOrderReadFailure = PurchaseOrderReadFailure(code, message)
+            lastOrderReadFailure = PurchaseOrderReadFailure(code, message, paymentPageObserved)
             return null
         }
         val labels = linkedSetOf<String>()
-        var backedOutOfPayment = false
+        var paymentBackAttempts = 0
+        var consecutivePaymentSamplesAfterBack = 0
         var backedOutOfChooser = false
         var restoredFromWechat = false
         var pddObservedAfterWechatRestore = false
+        var orderDetailEntryOpened = false
         var wechatRestorePendingSamples = 0
         var consecutiveEmptySnapshots = 0
-        repeat(ORDER_RESULT_MAX_SAMPLES) { index ->
+        var unpaidStartSample: Int? = null
+        var unpaidSwipes = 0
+        repeat(ORDER_RESULT_MAX_SAMPLES + ORDER_RESULT_UNPAID_MAX_SAMPLES) { index ->
+            // The first unpaid page receives its own bounded budget, even after a long handoff.
+            // Never reset it on repeated labels or navigation back to payment.
+            val unpaidStart = unpaidStartSample
+            if ((unpaidStart == null && index >= ORDER_RESULT_MAX_SAMPLES) ||
+                (unpaidStart != null && index - unpaidStart >= ORDER_RESULT_UNPAID_MAX_SAMPLES)) {
+                val failure = orderEvidenceFailure(labels)
+                return unknown(failure.code, failure.message)
+            }
             val snapshot = driver.capture()
             if (snapshot.packageName.isNullOrBlank()) {
                 consecutiveEmptySnapshots++
@@ -162,24 +413,74 @@ class PurchaseLiveAutomation(
                 return unknown("PURCHASE_ORDER_UNEXPECTED_APP", "核单期间出现未授权应用")
             }
             if (restoredFromWechat) pddObservedAfterWechatRestore = true
-            val paymentVisible = isKnownPddPaymentActivity(snapshot) ||
-                currentLabels.any { label -> PAYMENT_MARKERS.any(label::contains) }
             val orderContextVisible = currentLabels.any { label -> ORDER_CONTEXT_MARKERS.any(label::contains) }
-            if (!paymentVisible && !orderContextVisible) {
+            val unpaidContextVisible = currentLabels.any { label -> UNPAID_MARKERS.any(label::contains) }
+            // PDD can reuse its payment Activity for a read-only unpaid order page.
+            // Visible order-result evidence takes precedence over the Activity name:
+            // it permits only bounded reading gestures below, never a payment click.
+            val paymentVisible = isKnownPddPaymentActivity(snapshot) && !orderContextVisible && !unpaidContextVisible
+            if (paymentVisible) {
+                paymentPageObserved = true
+                if (paymentBackAttempts == 0) {
+                    paymentBackAttempts++
+                    if (!driver.backPurchase()) {
+                        return unknown("PURCHASE_ORDER_PAYMENT_BACK_FAILED", "支付页无法安全返回订单详情")
+                    }
+                    pause(500)
+                } else {
+                    consecutivePaymentSamplesAfterBack++
+                    if (consecutivePaymentSamplesAfterBack >= ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES) {
+                        return unknown(
+                            "PURCHASE_ORDER_PAYMENT_REPEATED",
+                            "支付页安全返回后持续无订单证据，已停止自动核单" +
+                                "[paymentBackAttempts=$paymentBackAttempts;" +
+                                "consecutivePaymentSamplesAfterBack=$consecutivePaymentSamplesAfterBack]",
+                        )
+                    }
+                    pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                }
+                return@repeat
+            }
+            consecutivePaymentSamplesAfterBack = 0
+            if (unpaidContextVisible) {
+                paymentPageObserved = true
+                if (unpaidStartSample == null) unpaidStartSample = index
+            }
+            if (!orderContextVisible && !unpaidContextVisible) {
+                if (unpaidStartSample != null) {
+                    // After reaching the unpaid page only observe; never click a newly exposed control.
+                    pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                    return@repeat
+                }
+                val entries = orderDetailEntryTargets(snapshot)
+                if (entries.size > 1) {
+                    return unknown("PURCHASE_ORDER_DETAIL_ENTRY_AMBIGUOUS", "订单详情入口不唯一，已停止只读核单")
+                }
+                if (entries.size == 1) {
+                    if (orderDetailEntryOpened) {
+                        return unknown("PURCHASE_ORDER_DETAIL_ENTRY_TIMEOUT", "进入订单详情后页面未出现可验证证据")
+                    }
+                    when (driver.clickFresh(entries.single())) {
+                        FreshActionResult.SUCCESS -> Unit
+                        FreshActionResult.AMBIGUOUS -> return unknown("PURCHASE_ORDER_DETAIL_ENTRY_AMBIGUOUS", "订单详情入口不唯一，已停止只读核单")
+                        else -> return unknown("PURCHASE_ORDER_DETAIL_ENTRY_FAILED", "订单详情入口点击失败，已停止只读核单")
+                    }
+                    orderDetailEntryOpened = true
+                    pause(500)
+                    return@repeat
+                }
                 pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
                 return@repeat
             }
             currentLabels.forEach(labels::add)
             parseOrderEvidence(labels)?.let { return it }
-            if (paymentVisible && !backedOutOfPayment) {
-                backedOutOfPayment = true
-                if (!driver.backPurchase()) {
-                    return unknown("PURCHASE_ORDER_PAYMENT_BACK_FAILED", "支付页无法安全返回订单详情")
-                }
-                pause(500)
-            } else if (paymentVisible) {
-                return unknown("PURCHASE_ORDER_PAYMENT_REPEATED", "支付页重复出现，已停止自动核单")
-            } else if (index > 0 && index % 15 == 0) {
+            if (unpaidStartSample != null && unpaidSwipes < ORDER_RESULT_UNPAID_MAX_SWIPES) {
+                unpaidSwipes++
+                driver.swipePurchase(SwipeDirection.UP, 400)
+                pause(ORDER_RESULT_UNPAID_SETTLE_MS)
+                return@repeat
+            }
+            if (unpaidStartSample == null && index > 0 && index % ORDER_RESULT_SCROLL_SAMPLE_INTERVAL == 0) {
                 driver.swipePurchase(SwipeDirection.UP, 400)
             }
             pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
@@ -188,6 +489,9 @@ class PurchaseLiveAutomation(
         return unknown(failure.code, failure.message)
     }
 
+    // orderEvidenceFailure 之外的路径（选择器卡住、微信恢复超时等）同样要带上
+    // 已经采集到的 paymentPageObserved，不能让 unknown() 之外的 return 漏标。
+
     private fun isKnownAndroidWechatChooser(snapshot: UiSnapshot, labels: Collection<String>): Boolean {
         val packageKnown = snapshot.packageName in ANDROID_CHOOSER_PACKAGES
         val activity = snapshot.activityName.orEmpty()
@@ -221,16 +525,60 @@ class PurchaseLiveAutomation(
         val save = uniqueClickable(stable, stable.nodes.filter { it.visible && it.enabled && it.label == "保存" })
         if (save.size != 1) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存按钮不唯一，未创建订单")
         click(save.single(), "保存地址")
-        val savedEvidence = waitForStableAddressEditorExit()
+        val savedEvidence = waitForStableAddressEditorExit(expected, suffix)
         if (!hasFinalSavedAddressEvidence(savedEvidence, expected, suffix)) {
-            if (!driver.backPurchase()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存后无法返回订单页面，未创建订单")
-            waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
-                hasFinalSavedAddressEvidence(it, expected, suffix)
+            if (isPurchaseConfirmationPanel(savedEvidence)) {
+                restoreFinalEvidenceInCurrentPanel(savedEvidence, expected, suffix)
+            } else {
+                if (!driver.backPurchase()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存后无法返回订单页面，未创建订单")
+                waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
+                    hasFinalSavedAddressEvidence(it, expected, suffix)
+                }
             }
         }
         return ShippingAddressProof(expected, suffix)
     }
 
+    private fun isPurchaseConfirmationPanel(snapshot: UiSnapshot): Boolean {
+        if (snapshot.packageName != PDD_PACKAGE || shippingAddressEditors(snapshot).isNotEmpty()) return false
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        return screen.specPanelType in PURCHASE_CONFIRMATION_PANEL_TYPES
+    }
+
+    private fun restoreFinalEvidenceInCurrentPanel(
+        initial: UiSnapshot,
+        expected: String,
+        suffix: String,
+    ) {
+        var snapshot = initial
+        var previousSignature: String? = null
+        repeat(ADDRESS_CONFIRMATION_SCROLL_LIMIT) { attempt ->
+            if (hasFinalSavedAddressEvidence(snapshot, expected, suffix)) return
+            if (!isPurchaseConfirmationPanel(snapshot)) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后采购面板发生变化，未创建订单")
+            }
+            val panels = purchasePanelScrollTargets(snapshot)
+            if (panels.size != 1) {
+                fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "地址保存后没有找到唯一的规格面板滚动区域，未创建订单")
+            }
+            val panel = panels.single()
+            val signature = viewportSignature(snapshot, panel)
+            if (signature == previousSignature) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板未找到完整订单确认信息，未创建订单")
+            }
+            previousSignature = signature
+            if (!driver.swipePurchaseIn(panel, SwipeDirection.DOWN, 350)) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板无法定位订单确认信息，未创建订单")
+            }
+            if (attempt < ADDRESS_CONFIRMATION_SCROLL_LIMIT - 1) pause(ADDRESS_CONFIRMATION_SCROLL_INTERVAL_MS)
+            snapshot = driver.capture()
+            pageProblem(snapshot)
+        }
+        if (!hasFinalSavedAddressEvidence(snapshot, expected, suffix)) {
+            fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板未找到完整订单确认信息，未创建订单")
+        }
+    }
+
     private fun hasSavedAddressEvidence(snapshot: UiSnapshot, expected: String, suffix: String): Boolean {
         if (snapshot.packageName != PDD_PACKAGE || shippingAddressEditors(snapshot).isNotEmpty()) return false
         val visible = snapshot.nodes.filter { it.visible }
@@ -248,14 +596,14 @@ class PurchaseLiveAutomation(
     private fun hasFinalSavedAddressEvidence(snapshot: UiSnapshot, expected: String, suffix: String): Boolean =
         hasSavedAddressEvidence(snapshot, expected, suffix) && finalSubmitTargets(snapshot).size == 1
 
-    private fun waitForStableAddressEditorExit(): UiSnapshot {
+    private fun waitForStableAddressEditorExit(expected: String, suffix: String): UiSnapshot {
         var consecutiveExits = 0
         repeat(50) {
             val snapshot = driver.capture()
             pageProblem(snapshot)
             if (snapshot.packageName == PDD_PACKAGE && shippingAddressEditors(snapshot).isEmpty()) {
                 consecutiveExits++
-                if (consecutiveExits >= 2) return snapshot
+                if (consecutiveExits >= 2) return waitForSettledPanelAfterAddressSave(snapshot, expected, suffix)
             } else {
                 consecutiveExits = 0
             }
@@ -264,6 +612,68 @@ class PurchaseLiveAutomation(
         fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存超时，未创建订单")
     }
 
+    /**
+     * #331: after the editor closes PDD may still be rebuilding the purchase
+     * sheet. Accept immediately when the final evidence or a stronger panel type
+     * is already present. A sheet recognized only through the required-evidence
+     * fallback must also be structurally stable for two consecutive samples. A
+     * stable page without any purchase-sheet marker (quantity input or payment
+     * entry), e.g. the address list, keeps the existing caller path. A partially
+     * loaded sheet is waited for up to [SpecPanelStabilityPolicy.WAIT_BOUND_MS]
+     * without pressing Back and then fails explicitly.
+     */
+    private fun waitForSettledPanelAfterAddressSave(initial: UiSnapshot, expected: String, suffix: String): UiSnapshot {
+        var snapshot = initial
+        var previousSignature: String? = null
+        var waitedMs = 0L
+        var samples = 0
+        while (true) {
+            samples++
+            val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+            val editorGone = snapshot.packageName == PDD_PACKAGE && shippingAddressEditors(snapshot).isEmpty()
+            val signature = structureSignature(snapshot)
+            val stable = editorGone && signature == previousSignature
+            val outcome = when {
+                editorGone && hasFinalSavedAddressEvidence(snapshot, expected, suffix) -> "final_evidence"
+                editorGone && screen.specPanelType in STRONG_PURCHASE_PANEL_TYPES -> "recognized"
+                stable && screen.specPanelType == SpecPanelType.REQUIRED_EVIDENCE -> "stable_required"
+                stable && !screen.hasQuantityInput && !screen.hasPaymentEntry -> "non_panel"
+                else -> null
+            }
+            if (outcome != null) {
+                addressSaveDiagnostic(outcome, waitedMs, samples, screen)
+                return snapshot
+            }
+            if (waitedMs >= SpecPanelStabilityPolicy.WAIT_BOUND_MS) {
+                addressSaveDiagnostic("timeout", waitedMs, samples, screen)
+                fail(
+                    "PURCHASE_ADDRESS_SAVE_TIMEOUT",
+                    "地址保存后规格面板未完整加载，未按返回键，未创建订单 [waitedMs=$waitedMs;samples=$samples;${screen.requiredEvidenceSummary()}]${screen.requiredEvidenceHintSuffix()}",
+                )
+            }
+            previousSignature = signature
+            pause(SpecPanelStabilityPolicy.ADDRESS_SAVE_POLL_MS)
+            waitedMs += SpecPanelStabilityPolicy.ADDRESS_SAVE_POLL_MS
+            snapshot = driver.capture()
+            pageProblem(snapshot)
+        }
+    }
+
+    private fun addressSaveDiagnostic(outcome: String, waitedMs: Long, samples: Int, screen: ParsedPddScreen) {
+        panelDiagnostic(
+            "addressSaveWait;outcome=$outcome;waitedMs=$waitedMs;samples=$samples;backPressed=false;" +
+                "type=${screen.specPanelType};${screen.requiredEvidenceSummary()}",
+        )
+    }
+
+    /** In-memory structure only (path, class, bounds, flags); no text is included. */
+    private fun structureSignature(snapshot: UiSnapshot): String = snapshot.nodes
+        .filter { it.visible }
+        .joinToString("|") { node ->
+            listOf(node.path, node.className.orEmpty(), node.bounds.left, node.bounds.top, node.bounds.right, node.bounds.bottom, node.clickable, node.scrollable, node.enabled)
+                .joinToString(":")
+        }
+
     private fun normalizeAddressText(value: String): String = value.filterNot(Char::isWhitespace)
 
     private fun hasExactTaskSuffix(value: String, suffix: String): Boolean =
@@ -293,7 +703,7 @@ class PurchaseLiveAutomation(
     private fun viewportSignature(snapshot: UiSnapshot, panel: SnapshotNode): String = snapshot.nodes
         .filter { node -> node.visible && inside(node.bounds, panel.bounds) }
         .joinToString("|") { node ->
-            listOf(node.className.orEmpty(), node.bounds.left, node.bounds.top, node.bounds.right, node.bounds.bottom, node.clickable, node.scrollable).joinToString(":")
+            listOf(node.path, node.className.orEmpty(), node.bounds.left, node.bounds.top, node.bounds.right, node.bounds.bottom, node.clickable, node.scrollable).joinToString(":")
         }
 
     private fun inside(child: NodeBounds, parent: NodeBounds): Boolean =
@@ -366,9 +776,173 @@ class PurchaseLiveAutomation(
         pause(500)
     }
 
-    private fun finalSubmitTargets(snapshot: UiSnapshot): List<SnapshotNode> = uniqueClickable(
+    /**
+     * #335 (3rd revision, reviewer cross-check on real dumps — Samsung sample): a
+     * two-step "row, then leaf" pick, not a single whole-panel leaf scan. A whole-panel
+     * scan can pick a labelled leaf that lives in a DIFFERENT clickable row than the real
+     * bottom bar — on the Samsung sample the bottom bar is a label-less 31px FrameLayout
+     * whose only text node is zero-size, so a naive scan falls through to the next
+     * lowest labelled leaf, which sits in the PAYMENT-METHOD row above it, and the climb
+     * from there lands the click on "change payment method" instead of the order button.
+     *
+     * Step 1 — row: among visible/enabled/non-zero-size CLICKABLE nodes inside the
+     * recognized panel's container (#331 judgment) with height ≤ [SUBMIT_ROW_MAX_HEIGHT_PERCENT]
+     * of screen height (same guard as 2bc624f, keeps a full-sheet/full-body wrapper from
+     * ever being "the row"), pick the one with the lowest bottom edge; ties go to the
+     * rightmost. This row — and only this row — may hold the order button. If its own
+     * subtree matches a payment-method alias (`textAliases.specPanel.paymentAreaAliases`,
+     * e.g. 微信支付/先用后付/支付方式) or [SUBMIT_TARGET_BLOCKED_MARKERS], fail explicitly;
+     * never fall back to a higher row — a higher row is never the order button either.
+     *
+     * Step 2 — leaf: within that row's own subtree (or the row itself), among
+     * visible/non-zero-size nodes with a NON-BLANK OWN LABEL whose nearest clickable
+     * ancestor is EXACTLY that row (not some nested sub-button, and not a higher row),
+     * pick the bottom-right-most one. [PurchaseUiDriver.clickFresh] re-finds its target
+     * live by `preferredOrDescendantLabel() == target.label && className && center±32`
+     * and only then climbs to the nearest clickable ancestor and clicks it (see
+     * `GoAutoAccessibilityService.clickFreshDetailed`); a label-less container's
+     * [SnapshotNode.label] is `""` but its live `preferredOrDescendantLabel()` digs into a
+     * child, so the re-find would always miss (task 594: TARGET_NOT_FOUND right after the
+     * irreversible boundary). Aiming at the labelled leaf — the same convention already
+     * used by `ImageSearchCandidatePolicy.clickTargetInside` — lets clickFresh's own
+     * climb-to-ancestor logic land the tap back on the row. If the row has no such leaf
+     * (Samsung: only a zero-size text node), fail explicitly (`bottom_row_unlabelled`) —
+     * never fall back to a higher row.
+     */
+    private fun finalSubmitTargets(snapshot: UiSnapshot): List<SnapshotNode> {
+        fun hasArea(node: SnapshotNode) = node.bounds.width > 0 && node.bounds.height > 0
+        val byPath = snapshot.nodes.associateBy { it.path }
+        fun clickableAncestor(node: SnapshotNode): SnapshotNode? {
+            var current: SnapshotNode? = node
+            while (current != null && !current.clickable) current = current.parentPath?.let(byPath::get)
+            return current
+        }
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        if (screen.specPanelType !in PURCHASE_CONFIRMATION_PANEL_TYPES) {
+            panelDiagnostic("bottomSubmit;outcome=not_panel;type=${screen.specPanelType}")
+            return emptyList()
+        }
+        val container = panelContainerBounds(snapshot)
+        if (container == null) {
+            panelDiagnostic("bottomSubmit;outcome=no_container;type=${screen.specPanelType}")
+            return emptyList()
+        }
+        val screenHeight = snapshot.nodes.filter { it.visible }.maxOfOrNull { it.bounds.bottom }?.coerceAtLeast(1) ?: 1
+
+        // Step 1: the bottom-most clickable row.
+        val rowCandidates = snapshot.nodes.filter { node ->
+            node.visible && node.enabled && node.clickable && hasArea(node) &&
+                node.bounds.height.toLong() * 100 <= screenHeight.toLong() * SUBMIT_ROW_MAX_HEIGHT_PERCENT &&
+                inside(node.bounds, container)
+        }.distinctBy { it.path }
+        if (rowCandidates.isEmpty()) {
+            panelDiagnostic("bottomSubmit;outcome=no_rows;type=${screen.specPanelType}")
+            return emptyList()
+        }
+        val rowMaxBottom = rowCandidates.maxOf { it.bounds.bottom }
+        val rowBottomTied = rowCandidates.filter { it.bounds.bottom == rowMaxBottom }
+        val rowTie = rowBottomTied.size > 1
+        val row = rowBottomTied.maxBy { it.bounds.right }
+
+        val rowSubtreeLabels = (listOf(row.label) + subtreeDescendants(row, snapshot).map(SnapshotNode::label)).joinToString("")
+        val paymentAreaAliases = PurchaseRehearsalExecutor.DEFAULT_COLLECTOR.textAliases.specPanel.paymentAreaAliases
+        if (paymentAreaAliases.any(rowSubtreeLabels::contains) || SUBMIT_TARGET_BLOCKED_MARKERS.any(rowSubtreeLabels::contains)) {
+            panelDiagnostic(
+                "bottomSubmit;outcome=row_blocked;tie=${rowTie.diagFlag()};class=${row.className};" +
+                    "w=${row.bounds.width};h=${row.bounds.height}",
+            )
+            return emptyList()
+        }
+
+        // Step 2: the bottom-right-most labelled leaf whose nearest clickable ancestor is exactly this row.
+        val leafCandidates = (listOf(row) + subtreeDescendants(row, snapshot)).filter { node ->
+            node.visible && node.enabled && hasArea(node) && node.label.isNotEmpty() &&
+                clickableAncestor(node)?.path == row.path
+        }.distinctBy { it.path }
+        if (leafCandidates.isEmpty()) {
+            panelDiagnostic(
+                "bottomSubmit;outcome=bottom_row_unlabelled;tie=${rowTie.diagFlag()};class=${row.className};" +
+                    "w=${row.bounds.width};h=${row.bounds.height}",
+            )
+            return emptyList()
+        }
+        val leafMaxBottom = leafCandidates.maxOf { it.bounds.bottom }
+        val leafBottomTied = leafCandidates.filter { it.bounds.bottom == leafMaxBottom }
+        val leafTie = leafBottomTied.size > 1
+        val chosen = leafBottomTied.maxBy { it.bounds.right }
+
+        val hasPrice = PRICE_PRESENCE.containsMatchIn(rowSubtreeLabels)
+        val legacyMarker = FINAL_SUBMIT_MARKERS.any { rowSubtreeLabels == it || rowSubtreeLabels.startsWith(it) }
+        panelDiagnostic(
+            "bottomSubmit;outcome=ok;rowTie=${rowTie.diagFlag()};leafTie=${leafTie.diagFlag()};" +
+                "leafClass=${chosen.className};rowClass=${row.className};w=${row.bounds.width};h=${row.bounds.height};" +
+                "price=${hasPrice.diagFlag()};legacyMarker=${legacyMarker.diagFlag()};type=${screen.specPanelType}",
+        )
+        return listOf(chosen)
+    }
+
+    private fun subtreeDescendants(node: SnapshotNode, snapshot: UiSnapshot): List<SnapshotNode> {
+        val prefix = "${node.path}/"
+        return snapshot.nodes.filter { it.path.startsWith(prefix) }
+    }
+
+    /**
+     * #335 follow-up: the submit click target must belong to the recognized spec panel,
+     * not just be somewhere on screen (e.g. an underlying goods-detail-page bottom bar
+     * that is still in the accessibility tree behind the panel). [ParsedPddScreen
+     * .specPanelContainer] (PddScreenParser's `panelScrollable`) is not usable for this:
+     * it is the inner *scrollable dimension list* used only for heading/option parsing,
+     * and in a real PDD sheet the address/payment/submit rows sit OUTSIDE it as
+     * structural siblings, not descendants. Instead this climbs from the panel's unique
+     * quantity input — present for every recognized #331 panel type used here — to the
+     * LARGEST ancestor that still does not cover the whole screen, i.e. the whole
+     * bottom-sheet container. That is the same "does not cover the whole screen" bounded
+     * notion #331 already uses for `sharesBoundedPanelContainer`/`boundedScrollables`,
+     * just walked from the quantity input instead of recomputed from private internals.
+     * A candidate then belongs to the panel when its center point falls inside that
+     * container's bounds (geometric containment, not path prefix, since PDD's own
+     * accessibility tree can place the submit bar as a structural sibling of the panel
+     * container that is still visually part of the sheet). Returns null (no target) when
+     * the quantity input is missing or not unique, so the caller fails explicitly instead
+     * of guessing a container.
+     */
+    private fun panelContainerBounds(snapshot: UiSnapshot): NodeBounds? {
+        val byPath = snapshot.nodes.associateBy { it.path }
+        val visible = snapshot.nodes.filter { it.visible }
+        val screenWidth = visible.maxOfOrNull { it.bounds.right } ?: return null
+        val screenHeight = visible.maxOfOrNull { it.bounds.bottom } ?: return null
+        val screenArea = screenWidth.toLong() * screenHeight
+        val quantity = snapshot.nodes.singleOrNull { node ->
+            node.visible && node.enabled && node.className == "android.widget.EditText" &&
+                node.label.toIntOrNull()?.let { it > 0 } == true
+        } ?: return null
+        var lastBounded: SnapshotNode? = null
+        var current: SnapshotNode = quantity
+        while (true) {
+            val parent = current.parentPath?.let(byPath::get) ?: break
+            val parentArea = parent.bounds.width.toLong() * parent.bounds.height
+            if (parentArea <= 0 || parentArea >= screenArea) break
+            lastBounded = parent
+            current = parent
+        }
+        return lastBounded?.bounds
+    }
+
+    private fun Boolean.diagFlag(): Int = if (this) 1 else 0
+
+    private fun orderConfirmationReady(snapshot: UiSnapshot): Boolean {
+        if (snapshot.packageName != PDD_PACKAGE) return false
+        if (snapshot.nodes.any { it.visible && it.enabled && MASKED_PHONE.containsMatchIn(it.label) }) return true
+        return PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null).specPanelType ==
+            SpecPanelType.ORDER_CONFIRMATION
+    }
+
+    /** A post-submit navigation target is allowed only when it is one exact, non-payment PDD order-detail entry. */
+    private fun orderDetailEntryTargets(snapshot: UiSnapshot): List<SnapshotNode> = uniqueClickable(
         snapshot,
-        snapshot.nodes.filter { node -> node.visible && node.enabled && FINAL_SUBMIT_MARKERS.any { node.label == it || node.label.startsWith(it) } },
+        snapshot.nodes.filter { node ->
+            node.visible && node.enabled && node.label in ORDER_DETAIL_ENTRY_MARKERS
+        },
     )
 
     private fun pageProblem(snapshot: UiSnapshot) {
@@ -387,7 +961,18 @@ class PurchaseLiveAutomation(
             runCatching { SimpleDateFormat(pattern, Locale.ROOT).apply { isLenient = false; timeZone = TimeZone.getTimeZone("Asia/Shanghai") }.parse(normalized) }.getOrNull()
         } ?: return null
         val output = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'", Locale.ROOT).apply { timeZone = TimeZone.getTimeZone("UTC") }.format(parsed)
-        return PurchaseOrderEvidence(orderNumbers.single(), output)
+        return PurchaseOrderEvidence(orderNumbers.single(), output, parsePayableAmount(labels))
+    }
+
+    private fun parsePayableAmount(labels: Collection<String>): Long? {
+        val amounts = labels.flatMap { label ->
+            PAYABLE_AMOUNT.findAll(label).map { match ->
+                runCatching { match.groupValues[1].toBigDecimal().movePointRight(2).longValueExact() }.getOrNull()
+            }.toList()
+        }
+        // Repeated parent/child labels are fine; conflicting/overflow amounts are omitted.
+        if (amounts.any { it == null }) return null
+        return amounts.distinct().singleOrNull()
     }
 
     private fun orderEvidenceFailure(labels: Collection<String>): PurchaseOrderReadFailure {
@@ -417,11 +1002,31 @@ class PurchaseLiveAutomation(
     private companion object {
         const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
         const val WECHAT_PACKAGE = "com.tencent.mm"
-        val MASKED_PHONE = Regex("(?<![0-9])[0-9]{3}\\*{4}[0-9]{4}(?![0-9])")
+        val MASKED_PHONE = PddScreenParser.MASKED_PHONE_PATTERN
+        val STRONG_PURCHASE_PANEL_TYPES = setOf(
+            SpecPanelType.NORMAL_SCROLLABLE,
+            SpecPanelType.NON_SCROLLABLE_CONFIRMATION,
+            SpecPanelType.ORDER_CONFIRMATION,
+        )
+        val PURCHASE_CONFIRMATION_PANEL_TYPES = STRONG_PURCHASE_PANEL_TYPES + SpecPanelType.REQUIRED_EVIDENCE
         val FINAL_SUBMIT_MARKERS = listOf("提交订单", "现在买，仅", "确认购买")
+        // #335: presence-only signal for diagnostics; never records the actual price digits.
+        val PRICE_PRESENCE = Regex("[¥￥][0-9]")
+        // #335: a bottom-edge candidate taller than this share of screen height is a
+        // whole-sheet/whole-body wrapper, never the order button itself.
+        const val SUBMIT_ROW_MAX_HEIGHT_PERCENT = 30
         val PAYMENT_MARKERS = listOf("立即支付", "确认支付", "输入支付密码")
+        // #335: broader than PAYMENT_MARKERS on purpose — this list is used ONLY by
+        // finalSubmitTargets' bottom-node subtree check, never by pageProblem/order-result
+        // parsing. "付款" alone must NOT join PAYMENT_MARKERS: UNPAID_MARKERS' "待付款"
+        // contains "付款" and PAYMENT_MARKERS gates the global pageProblem() payment guard,
+        // so adding it there would misclassify every ordinary unpaid-order page as a
+        // forbidden payment page.
+        val SUBMIT_TARGET_BLOCKED_MARKERS = listOf("立即支付", "确认支付", "去支付", "付款", "输入支付密码")
         val UNPAID_MARKERS = listOf("待付款", "待支付", "去支付")
+        val ORDER_DETAIL_ENTRY_MARKERS = setOf("查看订单", "订单详情")
         val ORDER_CONTEXT_MARKERS = listOf("订单编号", "订单号", "下单时间", "创建时间")
+        val PAYABLE_AMOUNT = Regex("(?<![\\p{L}])应付[ \\t:：,，]*[¥￥]?[ \\t]*(\\d+(?:\\.\\d{1,2})?)[ \\t]*元(?![0-9.])")
         val ORDER_NO = Regex("(?:订单编号|订单号)\\s*[:：]?\\s*([A-Za-z0-9-]{6,64})")
         val ORDER_TIME = Regex("(?:下单时间|创建时间)\\s*[:：]?\\s*(20[0-9]{2}[-/.年][0-9]{1,2}[-/.月][0-9]{1,2}日?\\s+[0-9]{1,2}:[0-9]{2}(?::[0-9]{2})?)")
         val ANDROID_CHOOSER_PACKAGES = setOf("android", "com.android.intentresolver")
@@ -435,6 +1040,19 @@ class PurchaseLiveAutomation(
         const val ORDER_RESULT_MAX_SAMPLES = 60
         const val ORDER_RESULT_MAX_EMPTY_SAMPLES = 15
         const val ORDER_RESULT_WECHAT_RESTORE_MAX_SAMPLES = 15
+        const val ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES = 25
+        const val ORDER_RESULT_UNPAID_MAX_SAMPLES = 30
+        const val ORDER_RESULT_UNPAID_MAX_SWIPES = 4
+        const val ORDER_RESULT_UNPAID_SETTLE_MS = 500L
+        const val ORDER_RESULT_SCROLL_SAMPLE_INTERVAL = 15
         const val ORDER_RESULT_SAMPLE_INTERVAL_MS = 200L
+        const val SPEC_CONFIRMATION_MAX_SAMPLES = 20
+        const val SPEC_CONFIRMATION_SAMPLE_INTERVAL_MS = 100L
+        const val ADDRESS_ENTRY_STABLE_INTERVAL_MS = 200L
+        const val ADDRESS_CARD_OVERLAP_PERCENT = 70
+        const val ADDRESS_SEMANTIC_MIN_LENGTH = 4
+        val ADDRESS_CARD_GENERIC_LABELS = setOf("收货地址", "修改", "默认地址", "默认")
+        const val ADDRESS_CONFIRMATION_SCROLL_LIMIT = 5
+        const val ADDRESS_CONFIRMATION_SCROLL_INTERVAL_MS = 500L
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseScrollLocator.kt

@@ -0,0 +1,24 @@
+package cn.ilapage.goauto.agent.automation
+
+internal data class PurchaseScrollCandidate(
+    val path: String,
+    val className: String?,
+    val bounds: NodeBounds,
+)
+
+internal object PurchaseScrollLocator {
+    fun locate(target: PurchaseScrollCandidate, candidates: List<PurchaseScrollCandidate>): PurchaseScrollCandidate? {
+        val compatible = candidates.filter {
+            it.className == target.className && boundsMatch(it.bounds, target.bounds)
+        }
+        val samePath = compatible.filter { it.path == target.path }
+        if (samePath.isNotEmpty()) return samePath.singleOrNull()
+        return compatible.singleOrNull()
+    }
+
+    private fun boundsMatch(a: NodeBounds, b: NodeBounds): Boolean =
+        kotlin.math.abs(a.left - b.left) <= 32 &&
+            kotlin.math.abs(a.top - b.top) <= 32 &&
+            kotlin.math.abs(a.right - b.right) <= 32 &&
+            kotlin.math.abs(a.bottom - b.bottom) <= 32
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseSpecProbePolicy.kt

@@ -0,0 +1,95 @@
+package cn.ilapage.goauto.agent.automation
+
+import org.json.JSONObject
+
+/**
+ * #334: a spec probe that produced zero color/size dimensions, or that never
+ * collected any dimensions because the collector itself failed (e.g. an
+ * over-swiped spec panel losing its headings — see
+ * [PddProductDetailCollector.moveSpecPanelToTop]), must fail explicitly
+ * rather than being reported as a normal `spec_probe_completed` empty
+ * result or a generic "no matchable spec" outcome.
+ *
+ * This lives outside [PurchaseRehearsalExecutor] on purpose: the executor's
+ * `probeSpecs` callback is opaque by contract (any JSON payload the caller
+ * wants to hand to the server), and its own unit tests exercise that
+ * contract with canned payloads unrelated to this device bug. The checks
+ * instead run once, at the point where
+ * [cn.ilapage.goauto.agent.service.AgentForegroundService] turns the real
+ * collector result into the outcome that gets persisted and reported.
+ * `collectPurchaseProbe` encodes a failed collector run as a
+ * `probeFailureCode`/`probeFailureMessage` JSON payload (still routed
+ * through the same opaque `String?` probe callback) instead of `null`, so
+ * [demote] can tell it apart from a genuinely empty-but-successful probe.
+ */
+object PurchaseSpecProbePolicy {
+    const val EMPTY_PROBE_CODE = "PURCHASE_SPEC_PROBE_EMPTY"
+    const val EMPTY_PROBE_MESSAGE = "规格探测未读取到任何颜色或尺码"
+    const val FAILED_PROBE_CODE = "PURCHASE_SPEC_PROBE_FAILED"
+
+    /** JSON field names used by [collectPurchaseProbeFailurePayload]-style encodings. */
+    const val PROBE_FAILURE_CODE_FIELD = "probeFailureCode"
+    const val PROBE_FAILURE_MESSAGE_FIELD = "probeFailureMessage"
+
+    /** Purchaser-readable messages for known collector failure codes; anything else falls back to a generic message that still includes the raw code. */
+    private val knownCollectorFailureMessages = mapOf(
+        "SPEC_PANEL_TOP_COLLAPSED" to "规格探测时规格面板被拖动，规格标题消失",
+    )
+
+    /** True when the probe JSON's `dimensions` array has no entries, or entries with no values. */
+    fun isDimensionsEmpty(probedSpecsJson: String?): Boolean {
+        if (probedSpecsJson.isNullOrBlank()) return true
+        return try {
+            val dimensions = JSONObject(probedSpecsJson).optJSONArray("dimensions") ?: return true
+            var total = 0
+            for (i in 0 until dimensions.length()) {
+                total += dimensions.optJSONObject(i)?.optJSONArray("values")?.length() ?: 0
+            }
+            total == 0
+        } catch (_: Exception) {
+            // Malformed payload cannot be trusted as a real, non-empty probe result.
+            true
+        }
+    }
+
+    /** Extracts a collector failure code from a probe JSON payload built by [encodeCollectorFailure], or null when the payload is not a failure encoding. */
+    fun extractCollectorFailureCode(probedSpecsJson: String?): String? {
+        if (probedSpecsJson.isNullOrBlank()) return null
+        return try {
+            JSONObject(probedSpecsJson).optString(PROBE_FAILURE_CODE_FIELD, "").takeIf(String::isNotBlank)
+        } catch (_: Exception) {
+            null
+        }
+    }
+
+    /** Builds the opaque probe JSON payload used to carry an explicit collector failure through the `probeSpecs: () -> String?` callback. */
+    fun encodeCollectorFailure(goodsId: String, collectorCode: String, collectorMessage: String): String =
+        JSONObject()
+            .put("goodsId", goodsId)
+            .put(PROBE_FAILURE_CODE_FIELD, collectorCode)
+            .put(PROBE_FAILURE_MESSAGE_FIELD, collectorMessage)
+            .toString()
+
+    private fun failureMessageFor(collectorCode: String): String =
+        knownCollectorFailureMessages[collectorCode] ?: "商品规格探测失败：$collectorCode"
+
+    /**
+     * Demotes a `spec_probe_completed` outcome that either carries an
+     * encoded collector failure, or collected zero dimensions, into an
+     * explicit failure. Any other outcome (including real failures reported
+     * some other way, or a probe that did collect dimensions) is returned
+     * unchanged.
+     */
+    fun demote(outcome: PurchaseExecutionOutcome): PurchaseExecutionOutcome {
+        if (outcome.resultType != "spec_probe_completed") return outcome
+        extractCollectorFailureCode(outcome.probedSpecs)?.let { collectorCode ->
+            return PurchaseExecutionOutcome("failed", FAILED_PROBE_CODE, failureMessageFor(collectorCode))
+        }
+        if (!isDimensionsEmpty(outcome.probedSpecs)) return outcome
+        return PurchaseExecutionOutcome("failed", EMPTY_PROBE_CODE, EMPTY_PROBE_MESSAGE)
+    }
+
+    /** @see demote */
+    @Deprecated("Use demote(outcome), which also handles encoded collector failures.", ReplaceWith("demote(outcome)"))
+    fun demoteIfEmpty(outcome: PurchaseExecutionOutcome): PurchaseExecutionOutcome = demote(outcome)
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/RuleContract.kt

@@ -150,11 +150,22 @@ object AgentCapabilities {
     const val PDD_PRODUCT_DETAIL_V1 = "collector.pdd.product-detail.v1"
     const val PDD_CURRENT_PAGE_SHARE_V1 = "collector.pdd.current-page-share.v1"
 
+    /**
+     * 图搜采集能力（#277）。
+     *
+     * `[必须]` 必须与服务端 `task.ImageSearchCapability` 逐字一致。
+     * `taskCompatible` 对 source='image_search' 的任务按该能力过滤：
+     * 设备不声明则图搜任务**永远不会被领取**，且是静默的——
+     * 任务停在 pending、不失败也不报错。
+     */
+    const val PDD_IMAGE_SEARCH_V1 = "pdd.image-search.v1"
+
     val supported: List<String> = listOf(
         SCHEMA_V2,
         SWIPE_V1,
         PDD_PRODUCT_DETAIL_V1,
         PDD_CURRENT_PAGE_SHARE_V1,
+        PDD_IMAGE_SEARCH_V1,
         PurchaseAgentCapabilities.REHEARSAL_V1,
         PurchaseAgentCapabilities.LIVE_V1,
         PurchaseAgentCapabilities.SPEC_PROBE_V1,

android/app/src/main/java/cn/ilapage/goauto/agent/network/AgentApiClient.kt

@@ -60,6 +60,14 @@ data class AgentTask(
     val status: String,
     val source: String,
     val replacementOriginType: String,
+    val imageSearch: ImageSearchImage?,
+)
+
+data class ImageSearchImage(
+    val imageUrl: String,
+    val mediaType: String,
+    val sizeBytes: Long,
+    val sha256: String,
 )
 
 data class CurrentPageIdentity(
@@ -203,6 +211,9 @@ class AgentApiException(
 ) : Exception(message)
 
 class AgentApiClient(private val serverUrl: String) {
+    fun backfillOrders(requestId: String, items: List<cn.ilapage.goauto.agent.automation.BackfillItem>, token: String): List<BackfillResult> =
+        parseBackfillResults(post("/api/agent/v1/purchase-tasks/order-backfill", backfillPayload(requestId, items), token))
+
     fun testConnection() {
         requireNotNull(request("GET", "/api/v1/health", null, null))
     }
@@ -226,6 +237,26 @@ class AgentApiClient(private val serverUrl: String) {
         )
     }
 
+    fun recoverRegistration(info: DeviceInfo, token: String?, recoveryCode: String): RegistrationResult {
+        require(recoveryCode.isNotBlank()) { "请输入管理员恢复码" }
+        val payload = JSONObject()
+            .put("requestId", UUID.randomUUID().toString())
+            .put("installId", info.installId)
+            .put("name", info.name)
+            .put("manufacturer", info.manufacturer)
+            .put("model", info.model)
+            .put("androidVersion", info.androidVersion)
+            .put("agentVersion", info.agentVersion)
+            .put("pddVersion", info.pddVersion)
+            .put("capabilities", JSONArray(info.capabilities))
+        val data = post("/api/agent/v1/register", payload, token, recoveryCode).getJSONObject("data")
+        return RegistrationResult(
+            deviceId = data.getLong("deviceId"),
+            deviceToken = data.optString("deviceToken").takeIf { it.isNotBlank() },
+            heartbeatIntervalSeconds = data.optInt("heartbeatIntervalSeconds", 15),
+        )
+    }
+
     fun heartbeat(token: String, currentTaskId: Long?, capabilities: List<String> = emptyList()): HeartbeatResult {
         val payload = JSONObject()
             .put("requestId", UUID.randomUUID().toString())
@@ -306,6 +337,32 @@ class AgentApiClient(private val serverUrl: String) {
         }
     }
 
+    /**
+     * 下载图搜参考图字节内容（#277）。只做网络传输，不做任何校验——校验交给
+     * `ImageSearchAssetPolicy.valid`（sha256/大小/JPEG 标记），保持单一职责。
+     */
+    fun downloadImageSearchReferenceImage(reference: ImageSearchImage, token: String): ByteArray {
+        val url = if (reference.imageUrl.startsWith("http")) reference.imageUrl else serverUrl + reference.imageUrl
+        val connection = (URL(url).openConnection() as HttpURLConnection).apply {
+            requestMethod = "GET"
+            connectTimeout = 10_000
+            readTimeout = 20_000
+            useCaches = false
+            setRequestProperty("Authorization", "Bearer $token")
+        }
+        return try {
+            val status = connection.responseCode
+            if (status !in 200..299) {
+                val body = connection.errorStream?.bufferedReader(Charsets.UTF_8)?.use { it.readText() }.orEmpty()
+                val json = runCatching { JSONObject(body) }.getOrElse { JSONObject() }
+                throw AgentApiException(status, json.optString("code", "HTTP_$status"), json.optString("message", "图搜参考图下载失败"), status >= 500)
+            }
+            connection.inputStream.use { it.readBytes() }
+        } finally {
+            connection.disconnect()
+        }
+    }
+
     fun nextTask(token: String): AgentTask? {
         val response = request("GET", "/api/agent/v1/tasks/next", null, token) ?: return null
         return task(response.getJSONObject("data"))
@@ -564,6 +621,7 @@ class AgentApiClient(private val serverUrl: String) {
         status = data.getString("status"),
         source = data.optString("source", "admin"),
         replacementOriginType = data.optString("replacementOriginType"),
+        imageSearch = data.optJSONObject("imageSearch")?.let { image -> ImageSearchImage(image.getString("imageUrl"), image.getString("mediaType"), image.getLong("sizeBytes"), image.getString("sha256")) },
     )
 
     private fun purchaseTask(data: JSONObject) = PurchaseAgentTask(
@@ -590,11 +648,11 @@ class AgentApiClient(private val serverUrl: String) {
         leaseVersion = data.getLong("leaseVersion"),
     )
 
-    private fun post(path: String, payload: JSONObject, token: String?): JSONObject {
-        return requireNotNull(request("POST", path, payload, token))
+    private fun post(path: String, payload: JSONObject, token: String?, recoveryCode: String? = null): JSONObject {
+        return requireNotNull(request("POST", path, payload, token, recoveryCode))
     }
 
-    private fun request(method: String, path: String, payload: JSONObject?, token: String?): JSONObject? {
+    private fun request(method: String, path: String, payload: JSONObject?, token: String?, recoveryCode: String? = null): JSONObject? {
         val connection = (URL(serverUrl + path).openConnection() as HttpURLConnection).apply {
             requestMethod = method
             connectTimeout = 10_000
@@ -605,6 +663,7 @@ class AgentApiClient(private val serverUrl: String) {
             setRequestProperty("Accept", "application/json")
             setRequestProperty("Cache-Control", "no-store")
             if (!token.isNullOrBlank()) setRequestProperty("Authorization", "Bearer $token")
+            if (!recoveryCode.isNullOrBlank()) setRequestProperty("X-GoAuto-Device-Recovery-Code", recoveryCode)
         }
         try {
             if (payload != null) {

android/app/src/main/java/cn/ilapage/goauto/agent/network/OrderBackfillUpload.kt

@@ -0,0 +1,98 @@
+package cn.ilapage.goauto.agent.network
+
+import cn.ilapage.goauto.agent.automation.BackfillItem
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.IOException
+import java.util.UUID
+
+data class BackfillResult(
+    val index: Int, val taskId: Long, val result: String, val code: String,
+    val status: String, val statusVersion: Long, val pddOrderNo: String?,
+    val orderSubmittedAt: String?, val timeSource: String,
+    val pddOrderAmountCent: Long? = null, val warningCode: String? = null, val warningMessage: String? = null,
+) {
+    val success get() = result in setOf("backfilled", "already_backfilled")
+    val needsReview get() = !success && code != "INTERNAL_ERROR" && code != "NETWORK_ERROR"
+    fun display(): String = if (success) {
+        val source = when (timeSource) {
+            "page" -> "页面下单时间"
+            "irreversible_at" -> "估算时间（提交订单时刻）"
+            else -> "已有时间（来源未知）"
+        }
+        "CG-$taskId：${if (result == "already_backfilled") "已回填" else "成功"}；$source ${orderSubmittedAt.orEmpty()}" +
+            (warningCode?.let { "；需人工检查（$it${warningMessage?.let { message -> "：$message" }.orEmpty()}）" } ?: "")
+    } else "${if (taskId > 0) "CG-$taskId" else "条目 ${index + 1}"}：${if (needsReview) "需人工检查" else "重试耗尽，未确认"}（$code）"
+}
+
+internal fun backfillPayload(requestId: String, items: List<BackfillItem>): JSONObject {
+    require(items.size in 1..50)
+    return JSONObject().put("requestId", requestId).put("items", JSONArray().apply {
+        items.forEach { item -> put(JSONObject().put("addressSuffix", item.addressSuffix).put("pddOrderNo", item.pddOrderNo).apply {
+            item.orderSubmittedAt?.let { put("orderSubmittedAt", it) }
+            item.pddOrderAmountCent?.let { put("pddOrderAmountCent", it) }
+        }) }
+    })
+}
+
+internal fun parseBackfillResults(data: JSONObject): List<BackfillResult> {
+    val items = data.getJSONArray("items")
+    return (0 until items.length()).map { index -> items.getJSONObject(index).let {
+        BackfillResult(it.getInt("index"), it.optLong("taskId"), it.getString("result"), it.getString("code"),
+            it.optString("status"), it.optLong("statusVersion"),
+            if (it.isNull("pddOrderNo")) null else it.optString("pddOrderNo"),
+            if (it.isNull("orderSubmittedAt")) null else it.optString("orderSubmittedAt"), it.optString("timeSource"),
+            if (it.isNull("pddOrderAmountCent")) null else it.optLong("pddOrderAmountCent"),
+            if (it.isNull("warningCode")) null else it.optString("warningCode"),
+            if (it.isNull("warningMessage")) null else it.optString("warningMessage"))
+    } }
+}
+
+/** Separate from the purchase outbox: only transport failures / INTERNAL_ERROR retry, three attempts total. */
+class OrderBackfillUpload(
+    private val submit: (String, List<BackfillItem>) -> List<BackfillResult>,
+    private val checkActive: () -> Unit,
+    private val pause: (Long) -> Unit = Thread::sleep,
+) {
+    fun upload(items: List<BackfillItem>, confirmed: (BackfillResult) -> Unit) {
+        var pending = items.mapIndexed { index, item -> index to item }
+        var requestId = UUID.randomUUID().toString()
+        repeat(3) { attempt ->
+            checkActive()
+            val results = try {
+                submit(requestId, pending.map { it.second }).also { values ->
+                    check(values.size == pending.size && values.map { it.index }.toSet() == pending.indices.toSet())
+                    values.filter { it.success }.forEach { value ->
+                        val input = pending[value.index].second
+                        check(value.taskId.toString() == input.addressSuffix.removePrefix("_cg") && value.pddOrderNo == input.pddOrderNo)
+                        check(value.status.isNotBlank())
+                    }
+                }
+            } catch (error: Exception) {
+                val code = when (error) {
+                    is AgentApiException -> error.code
+                    is IOException -> "NETWORK_ERROR"
+                    else -> throw error
+                }
+                if (code in setOf("INTERNAL_ERROR", "NETWORK_ERROR") && attempt < 2) {
+                    pause((attempt + 1) * 1_000L)
+                    return@repeat // same request ID for an unknown transport result
+                }
+                pending.forEach { (index, _) -> confirmed(BackfillResult(index, 0, "failed", code, "", 0, null, null, "")) }
+                return
+            }
+            // A completed HTTP response is evidence, even when cancellation arrived while waiting.
+            val retry = mutableListOf<Pair<Int, BackfillItem>>()
+            results.forEach { result ->
+                val original = pending[result.index]
+                if (!result.success && result.code == "INTERNAL_ERROR" && attempt < 2) retry += original
+                else confirmed(result.copy(index = original.first))
+            }
+            if (retry.isEmpty()) return
+            pending = retry
+            requestId = UUID.randomUUID().toString() // payload changed after partial acknowledgement
+            checkActive()
+            pause((attempt + 1) * 1_000L)
+        }
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/AgentDiagnosticStore.kt

@@ -30,6 +30,10 @@ enum class AgentDiagnosticReason {
     SPEC_PANEL_RESTORE_LIMIT,
     SPEC_PANEL_RESTORE_CONTAINER_UNAVAILABLE,
     SPEC_PANEL_RESTORE_GESTURE_FAILED,
+    /** #334: the spec panel already showed the topmost color heading; the top-restore swipe was skipped. */
+    SPEC_PANEL_TOP_ALREADY,
+    /** #334: a top-restore swipe made spec headings or dimensions vanish (the bottom sheet was dragged); swiping stopped. */
+    SPEC_PANEL_TOP_COLLAPSED,
     SPEC_PANEL_EVIDENCE_NOT_MATCHED,
     SPEC_ENTRY_CLICK_NO_EFFECT,
     SIZE_FOUND,

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/TaskHistoryCache.kt

@@ -11,6 +11,34 @@ import org.json.JSONObject
 class TaskHistoryCache(context: Context) {
     private val preferences = context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE)
 
+    /** Only acknowledged server facts may overwrite cached task facts. Never store scanned candidates. */
+    fun applyBackfill(result: cn.ilapage.goauto.agent.network.BackfillResult, environment: String) = synchronized(BACKFILL_LOCK) {
+        if (!result.success) {
+            if (result.needsReview) check(preferences.edit().putString("backfill_review_${result.taskId}_${result.code}",
+                JSONObject().put("taskId", result.taskId).put("code", result.code).put("environment", environment).toString()).commit())
+            return@synchronized
+        }
+        val values = JSONArray(preferences.getString(PURCHASE, "[]"))
+        for (index in 0 until values.length()) {
+            applyBackfillFacts(values.getJSONObject(index), result)
+        }
+        // Also retain the small acknowledged summary when this task is absent from downloaded history.
+        val confirmed = JSONObject().put("taskId", result.taskId).put("status", result.status)
+            .put("statusVersion", result.statusVersion).putNullable("pddOrderNo", result.pddOrderNo)
+            .putNullable("orderSubmittedAt", result.orderSubmittedAt).put("timeSource", result.timeSource)
+            .putNullable("pddOrderAmountCent", result.pddOrderAmountCent)
+            .putNullable("warningCode", result.warningCode).putNullable("warningMessage", result.warningMessage)
+            .put("environment", environment)
+        check(preferences.edit().putString(PURCHASE, values.toString())
+            .putString("backfill_confirmed_${result.taskId}", confirmed.toString()).commit())
+    }
+
+    fun backfillTimeSource(taskId: Long, environment: String): String? {
+        val raw = preferences.getString("backfill_confirmed_$taskId", null) ?: return null
+        val confirmed = runCatching { JSONObject(raw) }.getOrNull() ?: return null
+        return confirmed.optString("timeSource").takeIf { confirmed.optString("environment") == environment }
+    }
+
     fun saveCollection(days: Int, items: List<CollectionHistoryItem>) = save(COLLECTION, days, JSONArray().apply {
         items.forEach { item -> put(JSONObject()
             .put("taskId", item.taskId).put("attemptNumber", item.attemptNumber).put("status", item.status).put("source", item.source).put("goodsId", item.goodsId)
@@ -90,9 +118,21 @@ class TaskHistoryCache(context: Context) {
     private fun JSONObject.nullableLong(key: String): Long? = if (isNull(key)) null else optLong(key)
 
     private companion object {
+        val BACKFILL_LOCK = Any()
         const val PREFERENCES = "goauto_task_history_cache"
         const val COLLECTION = "collection"
         const val PURCHASE = "purchase"
         const val PAGE_SIZE = 20
     }
 }
+
+internal fun applyBackfillFacts(task: JSONObject, result: cn.ilapage.goauto.agent.network.BackfillResult) {
+    if (!result.success || task.optLong("taskId") != result.taskId) return
+    task.put("status", result.status).put("pddOrderNo", result.pddOrderNo ?: JSONObject.NULL)
+        .put("orderSubmittedAt", result.orderSubmittedAt ?: JSONObject.NULL)
+        .put("pddOrderAmountCent", result.pddOrderAmountCent ?: JSONObject.NULL)
+        .put("backfillWarningCode", result.warningCode ?: JSONObject.NULL)
+        .put("backfillWarningMessage", result.warningMessage ?: JSONObject.NULL)
+        .put("errorCode", JSONObject.NULL).put("errorMessage", JSONObject.NULL)
+        .put("retryable", false).put("retryDisabledReason", JSONObject.NULL)
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentForegroundService.kt

@@ -31,10 +31,14 @@ import cn.ilapage.goauto.agent.automation.PddLaunchResult
 import cn.ilapage.goauto.agent.automation.PddLinkLauncher
 import cn.ilapage.goauto.agent.automation.PddDetailEntryRunner
 import cn.ilapage.goauto.agent.automation.PddProductDetailCollector
+import cn.ilapage.goauto.agent.automation.PinduoduoImageSearchAssetStore
+import cn.ilapage.goauto.agent.automation.PinduoduoImageSearchAutomation
+import cn.ilapage.goauto.agent.automation.PreparedImageSearchAsset
 import cn.ilapage.goauto.agent.automation.PageEvidence
 import cn.ilapage.goauto.agent.automation.NodeSelector
 import cn.ilapage.goauto.agent.automation.CollectionRule
 import cn.ilapage.goauto.agent.automation.PurchaseAgentCapabilities
+import cn.ilapage.goauto.agent.automation.PurchaseSpecProbePolicy
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionOutcome
 import cn.ilapage.goauto.agent.automation.PurchaseLiveAutomation
@@ -57,6 +61,7 @@ import cn.ilapage.goauto.agent.persistence.AgentDiagnosticEvent
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticReason
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticStage
 import cn.ilapage.goauto.agent.persistence.SafeAgentDiagnosticRecorder
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePolicy
 import org.json.JSONArray
 import org.json.JSONObject
 import java.util.concurrent.Executors
@@ -74,6 +79,7 @@ class AgentForegroundService : Service() {
     private val taskExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val diagnosticExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val taskMutex = TaskExecutionMutex()
+    private val backfillGuard = OrderBackfillGuard(taskMutex)
     private val runningTaskId = AtomicReference<Long?>(null)
     private val working = AtomicBoolean(false)
     private val manualCheckRequested = AtomicBoolean(false)
@@ -131,6 +137,14 @@ class AgentForegroundService : Service() {
     }
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent?.action == ACTION_BACKFILL_STOP) {
+            backfillGuard.cancelled.set(true)
+            return START_STICKY
+        }
+        if (intent?.action == ACTION_BACKFILL_START) {
+            requestOrderBackfill(intent.getStringExtra("days").orEmpty(), intent.getLongExtra("confirmedAt", 0))
+            return START_STICKY
+        }
         if (intent?.action == ACTION_RECONNECT) registeredThisProcess.set(false)
         if (intent?.action == ACTION_CHECK_NOW) manualCheckRequested.set(true)
         if (intent?.action == ACTION_CURRENT_PAGE_COLLECTION) {
@@ -146,6 +160,7 @@ class AgentForegroundService : Service() {
     }
 
     override fun onDestroy() {
+        backfillGuard.cancelled.set(true)
         runCatching { connectivityManager.unregisterNetworkCallback(networkCallback) }
         cancelIdleReturn("服务已停止")
         collectionCooldownFuture.getAndSet(null)?.cancel(false)
@@ -164,7 +179,7 @@ class AgentForegroundService : Service() {
     override fun onBind(intent: Intent?): IBinder? = null
 
     private fun triggerSync() {
-        if (!working.compareAndSet(false, true)) return
+        if (!synchronized(taskMutex) { working.compareAndSet(false, true) }) return
         executor.execute {
             val manualCheck = manualCheckRequested.getAndSet(false)
             try {
@@ -187,11 +202,12 @@ class AgentForegroundService : Service() {
 
             if (!registeredThisProcess.get()) {
                 val registration = api.register(deviceInfo(), credentials?.token)
-                if (credentials == null) {
+                if (registration.deviceToken != null) {
                     val issuedToken = registration.deviceToken
-                        ?: error("注册请求已处理，但未返回新 Token；请联系管理员重新签发")
                     identityStore.saveCredentials(registration.deviceId, issuedToken)
                     credentials = identityStore.credentials() ?: error("设备凭据保存失败")
+                } else if (credentials == null) {
+                    error("注册请求已处理，但未返回新 Token；请联系管理员重新签发")
                 } else {
                     check(registration.deviceId == credentials.deviceId) { "服务端设备身份与本地不一致" }
                 }
@@ -254,13 +270,20 @@ class AgentForegroundService : Service() {
         flushPurchaseOutbox(api, token)
         val collectionCooldown = activeCollectionCooldown()
         val purchaseTask = api.nextPurchaseTask(token)
-        when (TaskDispatchPolicy.decide(purchaseTask != null, collectionCooldown != null)) {
+        when (TaskDispatchPolicy.decide(purchaseTask?.status, collectionCooldown != null)) {
             TaskDispatchDecision.RUN_PURCHASE -> {
                 cancelIdleReturn("收到新的采购任务")
                 releaseCollectionCooldownWakeLock()
                 schedulePurchaseTask(api, requireNotNull(purchaseTask), token)
                 return MANUAL_PURCHASE_TASK
             }
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH -> {
+                val waitingTask = requireNotNull(purchaseTask)
+                cancelIdleReturn("等待采购规格匹配")
+                stateStore.update("ONLINE", "采购任务 #${waitingTask.taskId} 正在匹配规格", tokenStored = true)
+                updateNotification("采购任务 #${waitingTask.taskId} 等待规格匹配")
+                return MANUAL_PURCHASE_MATCH_PENDING
+            }
             TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN -> {
                 val ticket = requireNotNull(collectionCooldown)
                 showCollectionCooldown(ticket)
@@ -298,6 +321,98 @@ class AgentForegroundService : Service() {
         })
     }
 
+    private fun publishBackfill(state: OrderBackfillState) {
+        backfillState = state
+        sendBroadcast(Intent(ACTION_BACKFILL_STATE).setPackage(packageName))
+        updateNotification(if (state.running) "订单回填 · 已检查 ${state.checked}" else "订单回填已停止，请查看采购页结果")
+    }
+
+    private fun requestOrderBackfill(days: String, confirmedAt: Long) {
+        // Refuse while polling/dispatch is in flight too: never queue behind another PDD operation.
+        val acquired = synchronized(taskMutex) {
+            !working.get() && purchaseStore.activeTaskId() == null && backfillGuard.tryAcquire()
+        }
+        if (!acquired) {
+            android.widget.Toast.makeText(this, "设备忙碌，请稍后操作", android.widget.Toast.LENGTH_SHORT).show()
+            return
+        }
+        try {
+            val window = cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, confirmedAt)
+            val server = settingsStore.serverUrl()
+            val credentials = identityStore.credentials() ?: error("设备尚未注册")
+            val accessibility = GoAutoAccessibilityService.instance ?: error("请先启用无障碍服务")
+            val started = SystemClock.elapsedRealtime()
+            cancelIdleReturn("人工订单回填")
+            publishBackfill(OrderBackfillState(running = true, message = "正在检查订单列表时序…"))
+            taskExecutor.execute {
+                var state = backfillState
+                fun checkActive() {
+                    check(!backfillGuard.cancelled.get() && !Thread.currentThread().isInterrupted) { "用户停止，未完整扫描" }
+                    check(SystemClock.elapsedRealtime() - started < cn.ilapage.goauto.agent.automation.OrderBackfillWindow.MAX_DURATION_MS) { "达到 10 分钟内部上限，未完整扫描" }
+                    check(settingsStore.serverUrl() == server && identityStore.credentials() == credentials) { "服务器或设备身份已变化，未完整扫描" }
+                }
+                try {
+                    acquireTaskWakeLock()
+                    val api = AgentApiClient(server)
+                    val uploader = cn.ilapage.goauto.agent.network.OrderBackfillUpload(
+                        submit = { id, items -> api.backfillOrders(id, items, credentials.token) },
+                        checkActive = ::checkActive,
+                    )
+                    val driver = object : cn.ilapage.goauto.agent.automation.BackfillDriver {
+                        override fun openOrders() {
+                            checkActive()
+                            startActivity(Intent(Intent.ACTION_VIEW, android.net.Uri.parse("https://mobile.yangkeduo.com/orders.html"))
+                                .setPackage(cn.ilapage.goauto.agent.automation.BackfillPagePolicy.PDD).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+                        }
+                        override fun capture() = accessibility.capture()
+                        override fun click(node: cn.ilapage.goauto.agent.automation.SnapshotNode): Boolean { checkActive(); return accessibility.clickBackfill(node) }
+                        override fun scroll(): Boolean { checkActive(); return accessibility.scrollBackfill() }
+                        override fun back(): Boolean {
+                            checkActive()
+                            cn.ilapage.goauto.agent.automation.BackfillPagePolicy.validate(capture())
+                            return accessibility.back()
+                        }
+                        override fun pause() { repeat(10) { checkActive(); Thread.sleep(100) } }
+                    }
+                    val reason = cn.ilapage.goauto.agent.automation.OrderBackfillScanner(driver, window, ::checkActive,
+                        submit = { item -> uploader.upload(listOf(item)) { result ->
+                            state = state.copy(success = state.success + if (result.result == "backfilled") 1 else 0,
+                                already = state.already + if (result.result == "already_backfilled") 1 else 0,
+                                failed = state.failed + if (!result.success) 1 else 0,
+                                evidence = state.evidence + result.display())
+                            // The frozen API receives all submissions. Never write an old environment's response into a new cache.
+                            if (settingsStore.serverUrl() == server && identityStore.credentials() == credentials) {
+                                cn.ilapage.goauto.agent.persistence.TaskHistoryCache(this).applyBackfill(result, "$server|${credentials.deviceId}")
+                            }
+                            publishBackfill(state)
+                            check(result.success || result.needsReview) { "网络或服务端瞬时错误重试耗尽，未完整扫描" }
+                        } },
+                        progress = { checked ->
+                            state = state.copy(checked = checked, message = if (window.nonDescending) cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED else "正在扫描（已读 $checked 单）…")
+                            publishBackfill(state)
+                        }).scan()
+                    state = state.copy(message = reason)
+                } catch (error: Exception) {
+                    // Never echo raw page text, HTTP bodies or credentials in UI/logs.
+                    val reason = if (error is IllegalStateException || error is IllegalArgumentException) error.message else null
+                    val message = reason?.takeIf { it.length < 100 } ?: "网络或页面异常"
+                    state = state.copy(message = message + if (message.contains("未完整扫描")) "" else "，未完整扫描")
+                } finally {
+                    val warning = if (window.nonDescending && !state.message.contains(cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED))
+                        "\n${cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED}" else ""
+                    try {
+                        publishBackfill(state.copy(running = false, message = state.message + warning))
+                    } finally {
+                        try { releaseTaskWakeLock() } finally { backfillGuard.release() }
+                    }
+                }
+            }
+        } catch (error: Exception) {
+            backfillGuard.release()
+            publishBackfill(OrderBackfillState(message = "回填未启动，请检查天数、设备连接与无障碍服务"))
+        }
+    }
+
     private fun requestCurrentPageCollection(
         requestId: String,
         replacementOriginType: String?,
@@ -405,6 +520,31 @@ class AgentForegroundService : Service() {
         })
     }
 
+    /**
+     * 把采购员看得懂的文案和内部原因拼在一起：文案在前，原始说法括注在后。
+     *
+     * 内部原因只描述页面形态与归位结果，不含凭据、账号、订单和个人数据（#294）。
+     */
+    private fun imageSearchFailureMessage(code: String, internal: String): String {
+        if (!code.startsWith("IMAGE_SEARCH")) return internal
+        val user = imageSearchUserMessage(code)
+        return if (internal.isBlank() || internal == user) user else "$user［$internal］"
+    }
+
+    /** #277：图搜任务失败码到人话文案的映射，采购员看得懂即可，不暴露内部状态机细节。 */
+    private fun imageSearchUserMessage(code: String): String = when (code) {
+        "IMAGE_SEARCH_PERMISSION_REQUIRED" -> "未授予相册权限，无法准备图搜参考图，请到“状态”页开启相册权限后重试。"
+        "IMAGE_SEARCH_ENTRY_NOT_FOUND" -> "打不开拍照搜索入口，请检查 PDD App 版本或手动确认后重试。"
+        "IMAGE_SEARCH_RESULTS_NOT_READY" -> "图搜结果页没有如期出现，请稍后重试。"
+        "IMAGE_SEARCH_CANDIDATE_CLICK_FAILED" -> "搜到了商品但打不开，请稍后重试或人工关联。"
+        "IMAGE_SEARCH_NO_CANDIDATES" -> "没有搜到相似商品，请确认参考图清晰或换一张图后重试。"
+        "IMAGE_SEARCH_CAMERA_BLOCKED" -> "拼多多摄像头一直识别不到东西，图搜页反复弹出重试提示。请把手机对着有内容的画面后重试。"
+        "IMAGE_SEARCH_ASSET_INVALID" -> "图片准备失败，请重新发起图搜任务。"
+        "IMAGE_SEARCH_ASSET_NOT_LATEST" -> "相册里有更新的照片或视频，无法确认图搜会用到我们准备的图片，请清理相册后重试。"
+        "IMAGE_SEARCH_AUTOMATION_UNAVAILABLE" -> "当前 Agent 版本尚未接入 PDD 图搜自动化，请使用普通采集任务。"
+        else -> "图搜任务失败，请稍后重试。"
+    }
+
     private fun currentPageUserMessage(code: String, fallback: String): String = when (code) {
         "DEVICE_BUSY" -> "设备正在执行任务，请稍后再试。"
         "AGENT_MANUAL_RULE_NOT_CONFIGURED" -> "请先配置 Agent 手动采集规则。"
@@ -433,8 +573,10 @@ class AgentForegroundService : Service() {
     }
 
     private fun executePurchaseTask(api: AgentApiClient, initial: PurchaseAgentTask, token: String) {
+        GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         var resultSafelyStored = false
+        val lastStep = AtomicReference("started")
         try {
             val claimed = if (initial.status == "pending") {
                 api.claimPurchaseTask(initial.taskId, UUID.randomUUID().toString(), token)
@@ -450,7 +592,7 @@ class AgentForegroundService : Service() {
             stateStore.update("BUSY", "正在执行${taskLabel}任务 #${task.taskId}", tokenStored = true)
             updateNotification("$taskLabel #${task.taskId}")
 
-            val outcome = if (!snapshotHashValid) {
+            val rawOutcome = if (!snapshotHashValid) {
                 PurchaseExecutionOutcome("failed", "PURCHASE_RULE_INVALID", "采购规则快照哈希无效")
             } else {
                 var parseFailure: PurchaseExecutionOutcome? = null
@@ -469,9 +611,13 @@ class AgentForegroundService : Service() {
                     } else {
                         PurchaseRehearsalExecutor(
                             driver = accessibility,
-                            openLink = { PddLinkLauncher(this).open(it) },
+                            openLink = { PddLinkLauncher(this).open(it, preferDirect = true) },
                             probeSpecs = { collectPurchaseProbe(accessibility, task, parsedRule) },
-                            stepChanged = { step -> purchaseStore.updateStep(task.taskId, task.taskAttemptId, step) },
+                            stepChanged = { step ->
+                                lastStep.set(step)
+                                purchaseStore.updateStep(task.taskId, task.taskAttemptId, step)
+                            },
+                            panelDiagnostic = { evidence -> Log.i("GoAutoPurchasePanel", "task=${task.taskId};$evidence") },
                             beforeOrderSubmit = { evidence ->
                                 val boundaryRequestId = UUID.randomUUID().toString()
                                 val finalEvidence = JSONObject()
@@ -507,10 +653,21 @@ class AgentForegroundService : Service() {
                     }
                 }
             }
+            // #334: a spec probe that read zero colors/sizes must fail explicitly
+            // instead of being reported as a normal, empty spec_probe_completed.
+            val outcome = PurchaseSpecProbePolicy.demote(rawOutcome)
             val requestId = UUID.randomUUID().toString()
             val payload = purchaseResultPayload(requestId, task.taskAttemptId, outcome)
             purchaseStore.completeAndEnqueue(task.taskId, task.taskAttemptId, requestId, payload)
             resultSafelyStored = true
+            PurchaseResultBubblePolicy.create(
+                taskId = task.taskId,
+                resultType = outcome.resultType,
+                lastStep = lastStep.get(),
+                resultMessage = outcome.message,
+            )?.let { presentation ->
+                GoAutoAccessibilityService.instance?.showPurchaseResultBubble(presentation)
+            }
             beginIdleReturnCooldown()
             flushPurchaseOutbox(api, token)
             val message = if (outcome.resultType == "failed") "${outcome.errorCode}：${outcome.message}" else outcome.message
@@ -538,6 +695,13 @@ class AgentForegroundService : Service() {
             collector = collector,
         )
         val result = PddProductDetailCollector(accessibility).collect(task.pddGoodsId, rule)
+        // #334: a collector failure (e.g. SPEC_PANEL_TOP_COLLAPSED) must not
+        // collapse into a generic "spec probe failed" outcome. Carry the
+        // real code/message through the opaque probeSpecs callback so
+        // PurchaseSpecProbePolicy.demote can surface it explicitly.
+        if (!result.successful) {
+            return PurchaseSpecProbePolicy.encodeCollectorFailure(task.pddGoodsId, result.code, result.message)
+        }
         val payload = result.payload ?: return null
         return JSONObject()
             .put("goodsId", task.pddGoodsId)
@@ -568,9 +732,10 @@ class AgentForegroundService : Service() {
                             "order_result_unknown",
                             readFailure?.code ?: "PURCHASE_ORDER_RESULT_UNKNOWN",
                             readFailure?.message ?: "无法确认订单是否创建，请人工检查",
+                            paymentPageObserved = readFailure?.paymentPageObserved ?: false,
                         )
                     } else {
-                        PurchaseExecutionOutcome("order_created", message = "订单已创建，等待人工检查和支付", pddOrderNo = evidence.orderNo, orderSubmittedAt = evidence.submittedAt)
+                        PurchaseExecutionOutcome("order_created", message = "订单已创建，等待人工检查和支付", pddOrderNo = evidence.orderNo, orderSubmittedAt = evidence.submittedAt, pddOrderAmountCent = evidence.pddOrderAmountCent)
                     }
                     val requestId = UUID.randomUUID().toString()
                     purchaseStore.completeAndEnqueue(interrupted.taskId, interrupted.attemptId, requestId, purchaseResultPayload(requestId, interrupted.attemptId, outcome))
@@ -609,6 +774,7 @@ class AgentForegroundService : Service() {
         initialTask: cn.ilapage.goauto.agent.network.AgentTask,
         token: String,
     ): TaskExecutionSummary {
+        GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         return try {
             executeTaskWhileAwake(api, initialTask, token)
@@ -684,6 +850,89 @@ class AgentForegroundService : Service() {
                 ).collect(identity.goodsId, rule)
                 if (!collection.successful) throw TaskFailure(collection.code, collection.message)
                 CollectionExecution(requireNotNull(collection.payload), collection.colorImages)
+            } else if (task.source == "image_search") {
+                // #277：相册权限是图搜可执行的前置条件。
+                if (cn.ilapage.goauto.agent.ui.MediaPermissionPolicy.current(this) ==
+                    cn.ilapage.goauto.agent.ui.MediaPermissionReadiness.NOT_GRANTED
+                ) {
+                    throw TaskFailure("IMAGE_SEARCH_PERMISSION_REQUIRED", imageSearchUserMessage("IMAGE_SEARCH_PERMISSION_REQUIRED"))
+                }
+                if (rule.schemaVersion != 2) {
+                    throw TaskFailure("RULE_INVALID", "图搜采集只支持新版采集规则")
+                }
+                val reference = task.imageSearch
+                    ?: throw TaskFailure("IMAGE_SEARCH_ASSET_INVALID", imageSearchUserMessage("IMAGE_SEARCH_ASSET_INVALID"))
+                val assetStore = PinduoduoImageSearchAssetStore(this)
+                var prepared: PreparedImageSearchAsset? = null
+                try {
+                    when (accessibility.restoreRecentPddPage(::launchPddToForeground)) {
+                        PddForegroundRestoreResult.READY -> Unit
+                        PddForegroundRestoreResult.INTENT_MISSING ->
+                            throw TaskFailure("PDD_APP_UNAVAILABLE", "没有找到拼多多应用，请确认已安装")
+                        PddForegroundRestoreResult.LAUNCH_FAILED ->
+                            throw TaskFailure("PDD_FOREGROUND_LAUNCH_FAILED", "无法打开拼多多，请手动打开商品页后重试")
+                        PddForegroundRestoreResult.TIMEOUT ->
+                            throw TaskFailure("CURRENT_PDD_PAGE_NOT_FOUND", "拼多多未能切换到前台")
+                    }
+                    val bytes = try {
+                        api.downloadImageSearchReferenceImage(reference, token)
+                    } catch (error: AgentApiException) {
+                        throw TaskFailure("IMAGE_SEARCH_ASSET_INVALID", imageSearchUserMessage("IMAGE_SEARCH_ASSET_INVALID"))
+                    }
+                    prepared = assetStore.prepare(bytes, reference)
+                        ?: throw TaskFailure("IMAGE_SEARCH_ASSET_INVALID", imageSearchUserMessage("IMAGE_SEARCH_ASSET_INVALID"))
+                    if (!assetStore.isMostRecent(prepared)) {
+                        throw TaskFailure("IMAGE_SEARCH_ASSET_NOT_LATEST", imageSearchUserMessage("IMAGE_SEARCH_ASSET_NOT_LATEST"))
+                    }
+                    val imageSearch = PinduoduoImageSearchAutomation(accessibility, accessibility::currentPackage)
+                    // `[必须]` 归位与选图是同一个调用：中间多一次无障碍树抓取就可能错过
+                    // 拼多多摄像头自动弹出重试弹窗前的约 4 秒窗口，详见 enterAndSelectImage。
+                    val entry = imageSearch.enterAndSelectImage(::launchPddToForeground, ::resetPddToHome)
+                    // `[必须]` 保留归位状态机的原始说法。IMAGE_SEARCH_ENTRY_NOT_FOUND 有两个
+                    // 来源——「找不到唯一可点的拍照搜索入口」和「归位失败（预算耗尽）」——
+                    // 统一文案会把两者抹平，排查任务 156 时只能靠失败耗时反推（#294）。
+                    // 括注写法与下面候选点击失败一致。
+                    if (!entry.successful) throw TaskFailure(entry.code, imageSearchFailureMessage(entry.code, entry.message))
+                    if (!imageSearch.waitForResultsPage()) {
+                        throw TaskFailure("IMAGE_SEARCH_RESULTS_NOT_READY", imageSearchUserMessage("IMAGE_SEARCH_RESULTS_NOT_READY"))
+                    }
+                    val candidate = imageSearch.openFirstCandidate()
+                    if (!candidate.successful) {
+                        // 保留执行器给出的具体原因（含 result/reason），排查时不必再猜卡在哪一步。
+                        throw TaskFailure(candidate.code, "${imageSearchUserMessage(candidate.code)}［${candidate.message}］")
+                    }
+                    // 接回现有的分享链接识别 + 商品详情采集链路（与 agent_current_page 完全一致）。
+                    val identityResult = CurrentPageIdentityRunner(
+                        driver = accessibility,
+                        readFreshClipboard = { copiedAt, timeout ->
+                            ClipboardRelayActivity.readFresh(this, copiedAt, timeout)
+                        },
+                        taskId = task.taskId,
+                        diagnostic = diagnosticRecorder::record,
+                    ).identify(rule)
+                    if (!identityResult.successful) throw TaskFailure(identityResult.code, identityResult.message)
+                    val identity = try {
+                        api.identifyCurrentPageCollectionTask(
+                            task.taskId,
+                            UUID.randomUUID().toString(),
+                            requireNotNull(identityResult.shareUrl),
+                            token,
+                        )
+                    } catch (error: AgentApiException) {
+                        throw TaskFailure(error.code, error.message)
+                    }
+                    val trace: (String) -> Unit = { message -> Log.i("GoAutoCollector", message) }
+                    val collection = PddProductDetailCollector(
+                        accessibility,
+                        trace = trace,
+                        taskId = task.taskId,
+                        diagnostic = diagnosticRecorder::record,
+                    ).collect(identity.goodsId, rule)
+                    if (!collection.successful) throw TaskFailure(collection.code, collection.message)
+                    CollectionExecution(requireNotNull(collection.payload), collection.colorImages)
+                } finally {
+                    assetStore.delete(prepared)
+                }
             } else if (rule.schemaVersion == 2) {
                 val trace: (String) -> Unit = { message -> Log.i("GoAutoCollector", message) }
                 val collection = PddDetailEntryRunner(
@@ -1014,10 +1263,15 @@ class AgentForegroundService : Service() {
             @Suppress("DEPRECATION")
             Notification.Builder(this)
         }
+        if (backfillState.running) {
+            val stop = PendingIntent.getService(this, 242, Intent(this, AgentForegroundService::class.java).setAction(ACTION_BACKFILL_STOP),
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+            builder.addAction(Notification.Action.Builder(null, "停止回填", stop).build())
+        }
         return builder
             .setSmallIcon(android.R.drawable.stat_notify_sync)
             .setContentTitle(getString(R.string.app_name))
-            .setContentText(content)
+            .setContentText(if (backfillState.running) "订单回填 · 已检查 ${backfillState.checked}" else content)
             .setContentIntent(pendingIntent)
             .setOngoing(true)
             .build()
@@ -1028,6 +1282,27 @@ class AgentForegroundService : Service() {
         getSystemService(NotificationManager::class.java).notify(NOTIFICATION_ID, notification(content))
     }
 
+    /**
+     * 把拼多多的返回栈清到根活动，等于回首页。
+     *
+     * `[必须]` 不能复用 [launchPddToForeground]：那个只带 FLAG_ACTIVITY_NEW_TASK，
+     * 会把已有任务**连同深层页面**一起恢复到前台，采集当前页的流程正需要这个行为。
+     * 归位要的是相反的效果，所以单独加 FLAG_ACTIVITY_CLEAR_TOP，两条路径各自保留（#292）。
+     */
+    private fun resetPddToHome(): PddLaunchResult {
+        val launchIntent = packageManager.getLaunchIntentForPackage(PDD_PACKAGE)
+            ?: return PddLaunchResult.INTENT_MISSING
+        launchIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
+        return runCatching { startActivity(launchIntent) }
+            .fold(
+                onSuccess = { PddLaunchResult.STARTED },
+                onFailure = {
+                    Log.w("GoAutoAgent", "failed to reset PDD to home", it)
+                    PddLaunchResult.FAILED
+                },
+            )
+    }
+
     private fun launchPddToForeground(): PddLaunchResult {
         val launchIntent = packageManager.getLaunchIntentForPackage(PDD_PACKAGE)
             ?: return PddLaunchResult.INTENT_MISSING
@@ -1043,6 +1318,11 @@ class AgentForegroundService : Service() {
     }
 
     companion object {
+        const val ACTION_BACKFILL_START = "cn.ilapage.goauto.agent.BACKFILL_START"
+        const val ACTION_BACKFILL_STOP = "cn.ilapage.goauto.agent.BACKFILL_STOP"
+        const val ACTION_BACKFILL_STATE = "cn.ilapage.goauto.agent.BACKFILL_STATE"
+        @Volatile var backfillState = OrderBackfillState()
+            private set
         const val ACTION_RECONNECT = "cn.ilapage.goauto.agent.RECONNECT"
         const val ACTION_CHECK_NOW = "cn.ilapage.goauto.agent.CHECK_NOW"
         const val ACTION_CHECK_RESULT = "cn.ilapage.goauto.agent.CHECK_RESULT"
@@ -1057,6 +1337,7 @@ class AgentForegroundService : Service() {
         const val MANUAL_EMPTY = "empty"
         const val MANUAL_COLLECTION_TASK = "collection_task"
         const val MANUAL_PURCHASE_TASK = "purchase_task"
+        const val MANUAL_PURCHASE_MATCH_PENDING = "purchase_match_pending"
         const val MANUAL_BUSY = "busy"
         const val MANUAL_CONFIG_REQUIRED = "config_required"
         const val MANUAL_AUTH_ERROR = "auth_error"

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentStateStore.kt

@@ -99,13 +99,19 @@ internal object CollectionCooldownPolicy {
 
 internal enum class TaskDispatchDecision {
     RUN_PURCHASE,
+    WAIT_FOR_PURCHASE_MATCH,
     WAIT_FOR_COLLECTION_COOLDOWN,
     CHECK_COLLECTION,
 }
 
+// 采集 > 图搜的优先级不在这里实现，也无法在这里实现：图搜任务就是 source =
+// "image_search" 的普通采集任务，由同一个 /tasks/next 端点下发，Agent 调用时
+// 服务端已经选好了行。该排序落在服务端 task.Service.Next 的 ORDER BY 里（#277）。
+
 internal object TaskDispatchPolicy {
-    fun decide(purchaseAvailable: Boolean, collectionCooldownActive: Boolean): TaskDispatchDecision = when {
-        purchaseAvailable -> TaskDispatchDecision.RUN_PURCHASE
+    fun decide(purchaseStatus: String?, collectionCooldownActive: Boolean): TaskDispatchDecision = when {
+        purchaseStatus == "spec_probe_pending" -> TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH
+        purchaseStatus != null -> TaskDispatchDecision.RUN_PURCHASE
         collectionCooldownActive -> TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN
         else -> TaskDispatchDecision.CHECK_COLLECTION
     }

android/app/src/main/java/cn/ilapage/goauto/agent/service/OrderBackfillGuard.kt

@@ -0,0 +1,22 @@
+package cn.ilapage.goauto.agent.service
+
+import java.util.concurrent.atomic.AtomicBoolean
+
+class OrderBackfillGuard(private val mutex: TaskExecutionMutex) {
+    private val active = AtomicBoolean(false)
+    val cancelled = AtomicBoolean(false)
+    fun tryAcquire(): Boolean {
+        if (!active.compareAndSet(false, true)) return false
+        if (!mutex.tryAcquire(RESERVATION)) {
+            active.set(false)
+            return false
+        }
+        cancelled.set(false)
+        return true
+    }
+    fun release() {
+        mutex.release(RESERVATION)
+        active.set(false)
+    }
+    companion object { const val RESERVATION = Long.MAX_VALUE - 1 }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/OrderBackfillState.kt

@@ -0,0 +1,14 @@
+package cn.ilapage.goauto.agent.service
+
+data class OrderBackfillState(
+    val running: Boolean = false,
+    val checked: Int = 0,
+    val success: Int = 0,
+    val already: Int = 0,
+    val failed: Int = 0,
+    val message: String = "",
+    val evidence: List<String> = emptyList(),
+) {
+    fun text(): String = "已检查 $checked · 成功 $success · 已回填 $already · 冲突/失败 $failed\n$message" +
+        if (evidence.isEmpty()) "" else "\n" + evidence.joinToString("\n")
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/PurchaseResultPayload.kt

@@ -16,9 +16,16 @@ internal fun purchaseResultPayload(
             put("errorCode", outcome.errorCode ?: "AGENT_EXECUTION_ERROR")
             put("errorMessage", outcome.message.take(1000))
         }
+        // 仅 order_result_unknown 有意义；服务端只在这个结果类型下读取，其它类型忽略。
+        if (outcome.resultType == "order_result_unknown" && outcome.paymentPageObserved) {
+            put("paymentPageObserved", true)
+        }
         outcome.probedSpecs?.let { put("probedSpecs", JSONObject(it)) }
         outcome.pddOrderNo?.let { put("pddOrderNo", it) }
         outcome.orderSubmittedAt?.let { put("orderSubmittedAt", it) }
         outcome.actualUnitPriceCent?.let { put("actualUnitPriceCent", it) }
+        if (outcome.resultType == "order_created") {
+            outcome.pddOrderAmountCent?.let { put("pddOrderAmountCent", it) }
+        }
     }
     .toString()

android/app/src/main/java/cn/ilapage/goauto/agent/ui/AccessibilityReadiness.kt

@@ -1,7 +1,12 @@
 package cn.ilapage.goauto.agent.ui
 
+import android.Manifest
 import android.content.ComponentName
 import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Build
 import android.provider.Settings
 import cn.ilapage.goauto.agent.automation.GoAutoAccessibilityService
 
@@ -51,3 +56,36 @@ object SettingsAvailabilityResolver {
     fun editable(stateCode: String, currentTaskId: Long?, testing: Boolean): Boolean =
         !testing && stateCode != "BUSY" && currentTaskId == null
 }
+
+/**
+ * 相册权限状态（#276）：`MainActivity.onCreate` 只在首次无条件弹一次系统授权框，
+ * 用户拒绝（尤其"不再询问"）后没有任何补救入口。这里补一个可复用的状态查询 +
+ * 引导跳转，供设置/状态页和图搜执行器共用，模式与 [AccessibilityReadinessDetector] 保持一致。
+ */
+enum class MediaPermissionReadiness {
+    GRANTED,
+    NOT_GRANTED,
+}
+
+object MediaPermissionPolicy {
+    /** 供图搜执行器调用的只读查询：未授权时应返回明确失败原因，不弹窗、不静默失败。 */
+    fun current(context: Context): MediaPermissionReadiness {
+        val permission = requiredPermission()
+        val granted = context.checkSelfPermission(permission) == PackageManager.PERMISSION_GRANTED
+        return if (granted) MediaPermissionReadiness.GRANTED else MediaPermissionReadiness.NOT_GRANTED
+    }
+
+    fun requiredPermission(): String =
+        if (Build.VERSION.SDK_INT >= 33) Manifest.permission.READ_MEDIA_IMAGES
+        else Manifest.permission.READ_EXTERNAL_STORAGE
+
+    /**
+     * "不再询问"之后系统弹窗不会再出现，只能引导用户去应用详情页手动开启。
+     * 调用方在 `shouldShowRequestPermissionRationale` 返回 false 且权限仍未授予时使用本方法。
+     */
+    fun appDetailsSettingsIntent(context: Context): Intent =
+        Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
+            data = Uri.fromParts("package", context.packageName, null)
+            addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+        }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/AgentStatusFragment.kt

@@ -70,8 +70,17 @@ class AgentStatusFragment : Fragment() {
     private lateinit var taskText: TextView
     private lateinit var accessibilityTitle: TextView
     private lateinit var accessibilityDetail: TextView
+    private lateinit var mediaPermissionTitle: TextView
+    private lateinit var mediaPermissionDetail: TextView
+    private lateinit var mediaPermissionAction: android.widget.Button
     private lateinit var deviceText: TextView
+    private val mediaPermissionRequestLauncher by lazy {
+        registerForActivityResult(androidx.activity.result.contract.ActivityResultContracts.RequestPermission()) {
+            refreshStatus()
+        }
+    }
     private var receiverRegistered = false
+    private var mediaPermissionRequestedOnce = false
 
     private val refresh = object : Runnable {
         override fun run() {
@@ -144,6 +153,21 @@ class AgentStatusFragment : Fragment() {
                 addView(accessibilityTitle)
                 addView(accessibilityDetail)
             }))
+            addView(context.card(context.cardColumn().apply {
+                addView(context.label("相册权限（图搜用）", 14f, context.getColor(R.color.agent_text_muted)))
+                mediaPermissionTitle = context.label("正在检查", 18f, context.getColor(R.color.agent_warning), true)
+                mediaPermissionDetail = context.label("—", 14f, context.getColor(R.color.agent_text_muted)).apply {
+                    setPadding(0, context.dp(6), 0, 0)
+                }
+                addView(mediaPermissionTitle)
+                addView(mediaPermissionDetail)
+                mediaPermissionAction = android.widget.Button(context).apply {
+                    text = "重新授权"
+                    setPadding(0, context.dp(8), 0, 0)
+                    setOnClickListener { requestMediaPermission() }
+                }
+                addView(mediaPermissionAction)
+            }))
         }
         refreshLayout = SwipeRefreshLayout(context).apply {
             setColorSchemeResources(R.color.agent_primary_light)
@@ -258,10 +282,44 @@ class AgentStatusFragment : Fragment() {
         }
         accessibilityDetail.text = AgentStatusTextPolicy.accessibilityDetail(readiness).orEmpty()
         accessibilityDetail.visibility = if (accessibilityDetail.text.isEmpty()) View.GONE else View.VISIBLE
+        val mediaReadiness = MediaPermissionPolicy.current(context)
+        when (mediaReadiness) {
+            MediaPermissionReadiness.GRANTED -> {
+                mediaPermissionTitle.text = "已授权"
+                mediaPermissionTitle.setTextColor(context.getColor(R.color.agent_primary_light))
+                mediaPermissionDetail.text = "图搜任务可以正常准备参考图"
+                mediaPermissionAction.visibility = View.GONE
+            }
+            MediaPermissionReadiness.NOT_GRANTED -> {
+                mediaPermissionTitle.text = "未授权"
+                mediaPermissionTitle.setTextColor(context.getColor(R.color.agent_error))
+                mediaPermissionDetail.text = "未授权时图搜任务会直接失败，不影响普通采集/采购"
+                mediaPermissionAction.visibility = View.VISIBLE
+            }
+        }
         val displayName = settingsStore.deviceName().ifBlank { "本机" }
         deviceText.text = "$displayName · ${state.deviceId.takeIf { it > 0 }?.let { "#$it" } ?: "未注册"}"
     }
 
+    private fun requestMediaPermission() {
+        val context = requireContext()
+        val permission = MediaPermissionPolicy.requiredPermission()
+        if (shouldShowRequestPermissionRationale(permission)) {
+            mediaPermissionRequestLauncher.launch(permission)
+            return
+        }
+        // 首次请求，或用户已选择"不再询问"：先尝试系统弹窗；若此前已经拒绝过一次且
+        // rationale 也不再展示（即"不再询问"状态），跳转到应用详情页由用户手动开启。
+        if (context.checkSelfPermission(permission) != android.content.pm.PackageManager.PERMISSION_GRANTED &&
+            !mediaPermissionRequestedOnce
+        ) {
+            mediaPermissionRequestedOnce = true
+            mediaPermissionRequestLauncher.launch(permission)
+        } else {
+            startActivity(MediaPermissionPolicy.appDetailsSettingsIntent(context))
+        }
+    }
+
     private fun registerCheckReceiver() {
         if (receiverRegistered) return
         val filter = IntentFilter(AgentForegroundService.ACTION_CHECK_RESULT)

android/app/src/main/java/cn/ilapage/goauto/agent/ui/PurchaseResultBubbleController.kt

@@ -0,0 +1,114 @@
+package cn.ilapage.goauto.agent.ui
+
+import android.content.Context
+import android.graphics.PixelFormat
+import android.graphics.drawable.GradientDrawable
+import android.os.Handler
+import android.os.Looper
+import android.view.Gravity
+import android.view.View
+import android.view.ViewGroup
+import android.view.WindowManager
+import android.widget.LinearLayout
+import android.widget.TextView
+import cn.ilapage.goauto.agent.R
+
+class PurchaseResultBubbleController(
+    private val context: Context,
+    private val canShow: () -> Boolean,
+) {
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private val windowManager = context.getSystemService(WindowManager::class.java)
+    private val session = PurchaseResultBubbleSession()
+    private var bubbleView: View? = null
+
+    fun show(presentation: PurchaseResultBubblePresentation) {
+        val revision = session.replace()
+        mainHandler.post {
+            if (!session.isCurrent(revision)) return@post
+            removeCurrentView()
+            if (!canShow()) return@post
+            val view = buildView(presentation)
+            runCatching { windowManager.addView(view, layoutParams()) }
+                .onSuccess {
+                    bubbleView = view
+                    mainHandler.postDelayed({
+                        if (session.isCurrent(revision)) {
+                            session.dismiss()
+                            removeCurrentView()
+                        }
+                    }, presentation.durationMillis)
+                }
+        }
+    }
+
+    fun dismiss() {
+        session.dismiss()
+        mainHandler.post(::removeCurrentView)
+    }
+
+    private fun buildView(presentation: PurchaseResultBubblePresentation): View {
+        val horizontalPadding = context.dp(16)
+        val verticalPadding = context.dp(12)
+        return LinearLayout(context).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(horizontalPadding, verticalPadding, horizontalPadding, verticalPadding)
+            elevation = context.dp(8).toFloat()
+            background = GradientDrawable().apply {
+                cornerRadius = context.dp(16).toFloat()
+                setColor(context.getColor(if (presentation.isFailure) R.color.purchase_result_failure_background else R.color.purchase_result_success_background))
+            }
+            contentDescription = "${presentation.title}。${presentation.message}"
+            importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_YES
+            descendantFocusability = ViewGroup.FOCUS_BLOCK_DESCENDANTS
+            addView(TextView(context).apply {
+                text = presentation.title
+                setTextColor(context.getColor(R.color.purchase_result_text))
+                textSize = 14f
+                setTypeface(typeface, android.graphics.Typeface.BOLD)
+                maxLines = 2
+                importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_NO
+            }, LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.WRAP_CONTENT))
+            addView(TextView(context).apply {
+                text = presentation.message
+                setTextColor(context.getColor(R.color.purchase_result_text_secondary))
+                textSize = 13f
+                maxLines = 3
+                importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_NO
+            }, LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.WRAP_CONTENT).apply {
+                topMargin = context.dp(4)
+            })
+        }
+    }
+
+    private fun layoutParams(): WindowManager.LayoutParams {
+        val availableWidth = context.resources.displayMetrics.widthPixels - context.dp(32)
+        return WindowManager.LayoutParams(
+            availableWidth.coerceAtMost(context.dp(360)),
+            WindowManager.LayoutParams.WRAP_CONTENT,
+            WindowManager.LayoutParams.TYPE_ACCESSIBILITY_OVERLAY,
+            WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE or
+                WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE or
+                WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL,
+            PixelFormat.TRANSLUCENT,
+        ).apply {
+            gravity = Gravity.TOP or Gravity.CENTER_HORIZONTAL
+            y = context.statusBarHeight() + context.dp(8)
+            windowAnimations = android.R.style.Animation_Toast
+        }
+    }
+
+    private fun removeCurrentView() {
+        val view = bubbleView ?: return
+        bubbleView = null
+        runCatching { windowManager.removeViewImmediate(view) }
+    }
+
+    private fun Context.dp(value: Int): Int = (value * resources.displayMetrics.density).toInt()
+
+    @Suppress("DiscouragedApi")
+    private fun Context.statusBarHeight(): Int {
+        val resourceId = resources.getIdentifier("status_bar_height", "dimen", "android")
+        return if (resourceId > 0) resources.getDimensionPixelSize(resourceId) else dp(24)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/PurchaseResultBubblePolicy.kt

@@ -0,0 +1,86 @@
+package cn.ilapage.goauto.agent.ui
+
+data class PurchaseResultBubblePresentation(
+    val title: String,
+    val message: String,
+    val isFailure: Boolean,
+    val durationMillis: Long,
+)
+
+object PurchaseResultBubblePolicy {
+    const val SUCCESS_DURATION_MILLIS = 3_000L
+    const val FAILURE_DURATION_MILLIS = 8_000L
+    private const val MAX_MESSAGE_LENGTH = 96
+
+    private val stepLabels = mapOf(
+        "started" to "准备采购",
+        "openProduct" to "打开商品",
+        "verifyProduct" to "核对商品",
+        "openSpecPanel" to "打开规格面板",
+        "selectSpec" to "选择颜色与尺码",
+        "setQuantity" to "设置数量",
+        "verifyUnitPrice" to "核对价格",
+        "verifyOrderSummary" to "核对订单",
+        "probeSpecs" to "采集规格",
+        "updateShippingAddress" to "更新收货地址",
+        "createOrder" to "创建待付款订单",
+        "order_submit_started" to "创建待付款订单",
+        "readOrderResult" to "读取订单编号和下单时间",
+    )
+
+    fun create(
+        taskId: Long,
+        resultType: String,
+        lastStep: String?,
+        resultMessage: String?,
+    ): PurchaseResultBubblePresentation? {
+        if (resultType == "spec_probe_completed") return null
+        val failure = resultType == "failed" || resultType == "order_result_unknown"
+        if (failure) {
+            val label = stepLabels[lastStep] ?: "处理采购任务"
+            return PurchaseResultBubblePresentation(
+                title = if (resultType == "order_result_unknown") "CG-$taskId 待人工核对｜$label" else "CG-$taskId 失败于：$label",
+                message = sanitize(resultMessage, "采购失败，请返回 Agent 查看详情"),
+                isFailure = true,
+                durationMillis = FAILURE_DURATION_MILLIS,
+            )
+        }
+        val successMessage = when (resultType) {
+            "order_created" -> "已获取订单编号和下单时间"
+            "rehearsal_completed" -> "商品、规格、数量和价格复核完成"
+            else -> sanitize(resultMessage, "采购结果已安全保存")
+        }
+        return PurchaseResultBubblePresentation(
+            title = "CG-$taskId 采购完成",
+            message = successMessage,
+            isFailure = false,
+            durationMillis = SUCCESS_DURATION_MILLIS,
+        )
+    }
+
+    private fun sanitize(value: String?, fallback: String): String {
+        val normalized = value.orEmpty()
+            .replace(Regex("https?://\\S+", RegexOption.IGNORE_CASE), "[链接已隐藏]")
+            .replace(Regex("(?i)(token|authorization|cookie)\\s*[:=]\\s*\\S+")) { match ->
+                "${match.groupValues[1]}=[已隐藏]"
+            }
+            .replace(Regex("[\\r\\n\\t]+"), " ")
+            .replace(Regex("\\s{2,}"), " ")
+            .trim()
+            .ifBlank { fallback }
+        return normalized.take(MAX_MESSAGE_LENGTH)
+    }
+}
+
+class PurchaseResultBubbleSession {
+    private var revision = 0L
+
+    @Synchronized
+    fun replace(): Long = ++revision
+
+    @Synchronized
+    fun dismiss(): Long = ++revision
+
+    @Synchronized
+    fun isCurrent(candidate: Long): Boolean = candidate == revision
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/TaskHistoryFragment.kt

@@ -36,8 +36,6 @@ import cn.ilapage.goauto.agent.network.HistoryPage
 import cn.ilapage.goauto.agent.network.HistoryColorImage
 import cn.ilapage.goauto.agent.network.PurchaseHistoryDetail
 import cn.ilapage.goauto.agent.network.PurchaseHistoryItem
-import cn.ilapage.goauto.agent.network.PurchaseResetResult
-import cn.ilapage.goauto.agent.network.PurchaseRetryResult
 import cn.ilapage.goauto.agent.persistence.TaskHistoryCache
 import cn.ilapage.goauto.agent.service.AgentForegroundService
 import cn.ilapage.goauto.agent.service.AgentSettingsStore
@@ -85,10 +83,12 @@ internal object CollectionResetPolicy {
 internal object PurchaseRetryPolicy {
     fun showsAction(status: String, retryable: Boolean): Boolean = status == "failed" && retryable
 
+    fun usesInPlaceReset(continuing: Boolean): Boolean = !continuing
+
     fun confirmationMessage(continuing: Boolean = false): String = if (continuing) {
         "替代商品已完成匹配。系统会保留原任务并创建一笔新采购任务；可能创建拼多多待付款订单，但不会支付。"
     } else {
-        "将使用服务端最新采购规则重跑当前任务，任务号和商品、规格、价格快照不变；可能创建拼多多待付款订单，但不会支付。"
+        "系统会复用原采购任务并开始新一次执行，使用当前有效采购规则，商品和规格等任务快照保持不变；可能创建拼多多待付款订单，但不会支付。"
     }
 }
 
@@ -141,8 +141,16 @@ class TaskHistoryFragment : Fragment() {
     private val imageLoader = HistoryImageLoader()
     private val imageRequests = mutableListOf<HistoryImageRequest>()
     private var currentPageReceiverRegistered = false
+    private var backfillPanel: LinearLayout? = null
     private val currentPageReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
+            if (intent?.action == AgentForegroundService.ACTION_BACKFILL_STATE) {
+                renderBackfill()
+                if (!collection && isResumed && !AgentForegroundService.backfillState.running) {
+                    detailState.taskId?.let(::loadPurchaseDetail) ?: load()
+                }
+                return
+            }
             if (intent?.action != AgentForegroundService.ACTION_CURRENT_PAGE_RESULT) return
             val message = intent.getStringExtra(AgentForegroundService.EXTRA_CURRENT_PAGE_MESSAGE).orEmpty()
             val taskId = intent.getLongExtra(AgentForegroundService.EXTRA_CURRENT_PAGE_TASK_ID, 0L)
@@ -182,6 +190,11 @@ class TaskHistoryFragment : Fragment() {
         pageColumn = context.column()
         pageColumn.addView(context.screenTitle(if (collection) "采集记录" else "采购记录"))
         pageColumn.addView(buildSearch())
+        if (!collection) {
+            backfillPanel = context.column(0)
+            pageColumn.addView(backfillPanel)
+            renderBackfill()
+        }
         pageColumn.addView(buildFilters())
         resultColumn = context.column(0).apply { setPadding(0, context.dp(12), 0, 0) }
         pageColumn.addView(resultColumn, resultColumn.fullWidth())
@@ -207,6 +220,7 @@ class TaskHistoryFragment : Fragment() {
     }
 
     override fun onDestroyView() {
+        backfillPanel = null
         requestGeneration++
         cancelImageRequests()
         super.onDestroyView()
@@ -273,6 +287,14 @@ class TaskHistoryFragment : Fragment() {
                     contentDescription = "采集当前拼多多商品"
                     setOnClickListener { confirmCurrentPageCollection() }
                 }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
+            } else {
+                row.addView(MaterialButton(context).apply {
+                    text = "回填"
+                    textSize = 14f
+                    minimumHeight = context.dp(48)
+                    contentDescription = "回填拼多多订单号和下单时间"
+                    setOnClickListener { showBackfillInput() }
+                }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
             }
             addView(row, row.fullWidth())
         }).apply {
@@ -280,6 +302,75 @@ class TaskHistoryFragment : Fragment() {
         }
     }
 
+    private fun showBackfillInput() {
+        if (AgentForegroundService.backfillState.running) {
+            toast("设备忙碌，请稍后操作")
+            return
+        }
+        val context = requireContext()
+        val input = TextInputEditText(context).apply {
+            setText("2")
+            inputType = android.text.InputType.TYPE_CLASS_NUMBER
+            minimumHeight = context.dp(48)
+            contentDescription = "回填天数"
+            selectAll()
+        }
+        val field = TextInputLayout(context).apply {
+            hint = "天数"
+            helperText = "从确认时刻往前 N×24 小时"
+            addView(input)
+        }
+        val dialog = MaterialAlertDialogBuilder(context).setTitle("回填订单")
+            .setView(context.cardColumn().apply { addView(field) })
+            .setNegativeButton("取消", null).setPositiveButton("确认", null).create()
+        dialog.setOnShowListener {
+            dialog.getButton(androidx.appcompat.app.AlertDialog.BUTTON_POSITIVE).setOnClickListener {
+                val days = input.text.toString().trim()
+                val now = System.currentTimeMillis()
+                if (runCatching { cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, now) }.isFailure) {
+                    field.error = "请输入正整数天数"
+                    return@setOnClickListener
+                }
+                val intent = Intent(context, AgentForegroundService::class.java)
+                    .setAction(AgentForegroundService.ACTION_BACKFILL_START).putExtra("days", days).putExtra("confirmedAt", now)
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) context.startForegroundService(intent) else context.startService(intent)
+                dialog.dismiss()
+            }
+        }
+        dialog.show()
+    }
+
+    private fun renderBackfill() {
+        val panel = backfillPanel ?: return
+        val context = context ?: return
+        val state = AgentForegroundService.backfillState
+        panel.removeAllViews()
+        if (state.message.isBlank()) return
+        panel.addView(context.card(context.cardColumn().apply {
+            addView(context.label(if (state.running) "正在回填订单" else "回填结果", 16f))
+            addView(context.label(state.copy(evidence = emptyList()).text(), 14f))
+            if (state.running) {
+                addView(MaterialButton(context).apply {
+                    text = "停止"
+                    minimumHeight = context.dp(48)
+                    setOnClickListener {
+                        context.startService(Intent(context, AgentForegroundService::class.java).setAction(AgentForegroundService.ACTION_BACKFILL_STOP))
+                        isEnabled = false
+                        text = "正在停止…"
+                    }
+                })
+            }
+            if (state.evidence.isNotEmpty()) addView(MaterialButton(context).apply {
+                text = "查看逐条结果"
+                minimumHeight = context.dp(48)
+                setOnClickListener {
+                    MaterialAlertDialogBuilder(context).setTitle("回填明细")
+                        .setMessage(state.evidence.joinToString("\n")).setPositiveButton("关闭", null).show()
+                }
+            })
+        }))
+    }
+
     private fun buildFilters(): View {
         val context = requireContext()
         val statuses = if (collection) {
@@ -427,6 +518,11 @@ class TaskHistoryFragment : Fragment() {
         return context.card(context.cardColumn().apply {
             val goodsLabel = item.goodsId.ifBlank { "未识别商品" }
             addView(context.label("#${item.taskId} · 第 ${item.attemptNumber} 次 · $goodsLabel", 17f, context.getColor(R.color.agent_text), true))
+            // #279：图搜任务和普通采集混在同一列表里，加一个行内标记让采购员看出这条商品是机器图搜找到的，
+            // 不改变既有 `collection` 布尔分叉的界面结构。
+            if (item.source == "image_search") {
+                addView(context.label("来源：图搜自动匹配", 13f, context.getColor(R.color.agent_text_muted)).apply { setPadding(0, context.dp(2), 0, 0) })
+            }
             addView(context.label("$status · ${formatTime(item.finishedAt ?: item.createdAt)}", 13f, statusColor(item.status)).apply { setPadding(0, context.dp(4), 0, 0) })
             addView(context.label(summary, 14f, context.getColor(R.color.agent_text_muted)).apply { setPadding(0, context.dp(8), 0, 0) })
             if (CollectionResetPolicy.showsListAction(item.status)) {
@@ -632,6 +728,7 @@ class TaskHistoryFragment : Fragment() {
     private fun registerCurrentPageReceiver() {
         if (currentPageReceiverRegistered) return
         val filter = IntentFilter(AgentForegroundService.ACTION_CURRENT_PAGE_RESULT)
+        filter.addAction(AgentForegroundService.ACTION_BACKFILL_STATE)
         if (Build.VERSION.SDK_INT >= 33) {
             requireContext().registerReceiver(currentPageReceiver, filter, Context.RECEIVER_NOT_EXPORTED)
         } else {
@@ -724,6 +821,12 @@ class TaskHistoryFragment : Fragment() {
             append("实际单价：${money(task.actualUnitPriceCent, task.currency)}\n")
             append("PDD 订单号：${task.pddOrderNo ?: "—"}\n")
             append("下单时间：${task.orderSubmittedAt?.let(::formatTime) ?: "—"}")
+            val environment = "${AgentSettingsStore(context).serverUrl()}|${runCatching { SecureDeviceStore(context).credentials()?.deviceId }.getOrNull()}"
+            when (TaskHistoryCache(context).backfillTimeSource(task.taskId, environment)) {
+                "page" -> append("（页面读取）")
+                "irreversible_at" -> append("（估算：提交订单时刻）")
+                "existing_unknown" -> append("（已有值，来源未知）")
+            }
         }
         resultColumn.addView(context.card(context.cardColumn().apply {
             addView(context.label("CG-${task.taskId}", 20f, context.getColor(R.color.agent_text), true))
@@ -748,7 +851,7 @@ class TaskHistoryFragment : Fragment() {
                 contentDescription = "重试采购任务 CG-${task.taskId}"
                 setOnClickListener { confirmPurchaseRetry(task) }
             }, collectionCardParams())
-            resultColumn.addView(context.centeredMessage("重试边界", "复用当前任务并刷新采购规则；不会执行支付。"))
+            resultColumn.addView(context.centeredMessage("重试边界", "复用当前任务并新增一次执行；使用当前有效采购规则，商品和规格快照不变，不会执行支付。"))
         } else if (!replacementInProgress && task.status == "failed") {
             val reason = task.retryDisabledReason?.takeIf(String::isNotBlank) ?: "请在管理端核对任务状态。"
             resultColumn.addView(context.centeredMessage("不可重试", reason))
@@ -866,22 +969,25 @@ class TaskHistoryFragment : Fragment() {
         val generation = ++requestGeneration
         showLoading(if (continuing) "正在提交继续采购请求…" else "正在提交重试请求…")
         Thread {
-            runCatching {
+            runCatching<Unit> {
                 val client = AgentApiClient(serverUrl)
                 val requestId = UUID.randomUUID().toString()
-                if (continuing) client.retryPurchaseTask(taskId, requestId, credentials.token)
-                else client.resetPurchaseTask(taskId, requestId, credentials.token)
-            }
-                .onSuccess { result ->
+                if (PurchaseRetryPolicy.usesInPlaceReset(continuing)) {
+                    val result = client.resetPurchaseTask(taskId, requestId, credentials.token)
                     resultColumn.post {
                         if (!isAdded || generation != requestGeneration) return@post
                         AgentForegroundService.start(requireContext())
-                        when (result) {
-                            is PurchaseRetryResult -> showPurchaseRetrySuccess(result.sourceTaskNo, result.taskNo, result.taskId)
-                            is PurchaseResetResult -> showPurchaseResetSuccess(result.taskNo, result.taskId, result.attemptNumber)
-                        }
+                        showPurchaseResetSuccess(result.taskNo, result.taskId, result.attemptNumber)
+                    }
+                } else {
+                    val result = client.retryPurchaseTask(taskId, requestId, credentials.token)
+                    resultColumn.post {
+                        if (!isAdded || generation != requestGeneration) return@post
+                        AgentForegroundService.start(requireContext())
+                        showPurchaseRetrySuccess(result.sourceTaskNo, result.taskNo, result.taskId)
                     }
                 }
+            }
                 .onFailure { error ->
                     resultColumn.post {
                         if (isAdded && generation == requestGeneration) {
@@ -892,14 +998,14 @@ class TaskHistoryFragment : Fragment() {
         }.start()
     }
 
-    private fun showPurchaseRetrySuccess(sourceTaskNo: String, taskNo: String, taskId: Long) {
+    private fun showPurchaseResetSuccess(taskNo: String, taskId: Long, attemptNumber: Int) {
         resultColumn.removeAllViews()
         resultColumn.addView(requireContext().centeredMessage(
-            "已创建新任务 $taskNo",
-            "旧任务 $sourceTaskNo 已保留。新任务将由当前设备按正常队列执行；系统不会支付。",
+            "$taskNo 已进入第 $attemptNumber 次执行",
+            "原采购任务已复用，并将由当前设备按正常队列执行；系统不会支付。",
         ))
         resultColumn.addView(MaterialButton(requireContext()).apply {
-            text = "查看新任务"
+            text = "查看当前任务"
             minimumHeight = requireContext().dp(48)
             setOnClickListener { loadPurchaseDetail(taskId) }
         }, collectionCardParams())
@@ -910,14 +1016,14 @@ class TaskHistoryFragment : Fragment() {
         }, collectionCardParams())
     }
 
-    private fun showPurchaseResetSuccess(taskNo: String, taskId: Long, attemptNumber: Int) {
+    private fun showPurchaseRetrySuccess(sourceTaskNo: String, taskNo: String, taskId: Long) {
         resultColumn.removeAllViews()
         resultColumn.addView(requireContext().centeredMessage(
-            "已加入重试队列 $taskNo",
-            "任务号保持不变，将使用最新采购规则进行第 $attemptNumber 次尝试；系统不会支付。",
+            "已创建新任务 $taskNo",
+            "旧任务 $sourceTaskNo 已保留。新任务将由当前设备按正常队列执行；系统不会支付。",
         ))
         resultColumn.addView(MaterialButton(requireContext()).apply {
-            text = "查看当前任务"
+            text = "查看新任务"
             minimumHeight = requireContext().dp(48)
             setOnClickListener { loadPurchaseDetail(taskId) }
         }, collectionCardParams())

android/app/src/main/res/values/colors.xml

@@ -8,4 +8,8 @@
     <color name="agent_text_muted">#CBD5E1</color>
     <color name="agent_warning">#FBBF24</color>
     <color name="agent_error">#F87171</color>
+    <color name="purchase_result_success_background">#166534</color>
+    <color name="purchase_result_failure_background">#991B1B</color>
+    <color name="purchase_result_text">#FFFFFF</color>
+    <color name="purchase_result_text_secondary">#F1F5F9</color>
 </resources>

android/app/src/test/java/cn/ilapage/goauto/agent/AgentCapabilitiesTest.kt

@@ -0,0 +1,27 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.AgentCapabilities
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class AgentCapabilitiesTest {
+
+    // #277: 服务端 taskCompatible 对 source='image_search' 的任务按这个能力过滤。
+    // 漏声明时图搜任务永远不会被领取，而且是静默的：任务停在 pending、
+    // 不失败也不报错。字符串必须与 task.ImageSearchCapability 逐字一致。
+    @Test
+    fun `supported capabilities include the image search capability the server gates on`() {
+        assertTrue(
+            "AgentCapabilities.supported 缺少 pdd.image-search.v1，图搜任务将无法被领取",
+            AgentCapabilities.supported.contains("pdd.image-search.v1"),
+        )
+    }
+
+    @Test
+    fun `supported capabilities have no duplicates`() {
+        assertTrue(
+            "能力清单出现重复项: " + AgentCapabilities.supported,
+            AgentCapabilities.supported.size == AgentCapabilities.supported.toSet().size,
+        )
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/CollectionCooldownPolicyTest.kt

@@ -86,15 +86,19 @@ class CollectionCooldownPolicyTest {
     fun `purchase keeps priority while collection waits for cooldown`() {
         assertEquals(
             TaskDispatchDecision.RUN_PURCHASE,
-            TaskDispatchPolicy.decide(purchaseAvailable = true, collectionCooldownActive = true),
+            TaskDispatchPolicy.decide(purchaseStatus = "pending", collectionCooldownActive = true),
+        )
+        assertEquals(
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH,
+            TaskDispatchPolicy.decide(purchaseStatus = "spec_probe_pending", collectionCooldownActive = true),
         )
         assertEquals(
             TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN,
-            TaskDispatchPolicy.decide(purchaseAvailable = false, collectionCooldownActive = true),
+            TaskDispatchPolicy.decide(purchaseStatus = null, collectionCooldownActive = true),
         )
         assertEquals(
             TaskDispatchDecision.CHECK_COLLECTION,
-            TaskDispatchPolicy.decide(purchaseAvailable = false, collectionCooldownActive = false),
+            TaskDispatchPolicy.decide(purchaseStatus = null, collectionCooldownActive = false),
         )
     }
 }

android/app/src/test/java/cn/ilapage/goauto/agent/OrderBackfillTest.kt

@@ -0,0 +1,292 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.network.*
+import cn.ilapage.goauto.agent.service.*
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+import java.io.IOException
+import java.util.TimeZone
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.Executors
+import java.util.concurrent.atomic.AtomicInteger
+
+class OrderBackfillTest {
+    private val zone = TimeZone.getTimeZone("Asia/Shanghai")
+    private fun time(raw: String): Long = BackfillDetailReader(zone).apply { accept("下单时间：$raw") }.finish().timeMillis!!
+    private val now = time("2026-09-08 12:00:00")
+
+    @Test fun `expanded detail reads order time not group time across frames`() {
+        val reader = BackfillDetailReader(zone)
+        reader.accept("测试地址_cg7\n订单编号：TEST-000007\n展开")
+        reader.accept("下单时间：2026-09-08 10:50:29\n拼单时间：2026-09-08 11:20:35")
+        val detail = reader.finish()
+        assertEquals("2026-09-08T10:50:29+08:00", detail.item!!.orderSubmittedAt)
+        assertEquals("_cg7", detail.item!!.addressSuffix)
+        assertNull(reader.finish().item)
+    }
+
+    @Test fun `paid amount accepts exact label formats and ignores unrelated prices`() {
+        for ((label, cents) in listOf("实付:,22.98元,(免运费)" to 2298L, "实付： 22元" to 2200L, "实付，22.9 元" to 2290L)) {
+            val detail = BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n¥999.00\n$label") }.finish()
+            assertEquals(cents, detail.item!!.pddOrderAmountCent)
+        }
+    }
+
+    @Test fun `paid amount ambiguity or malformed candidate omits only amount`() {
+        for (labels in listOf(
+            "实付：22.98元\n实付：23.00元",
+            "实付：22.98元\n实付：坏值元",
+            "实付：22.345元",
+            "实付：\n22.98元",
+            "未实付：99.00元\n预计实付：88.00元",
+        )) {
+            val detail = BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n下单时间：2026-09-08 10:00:00\n$labels") }.finish()
+            assertNotNull(detail.item)
+            assertNull(labels, detail.item!!.pddOrderAmountCent)
+            assertEquals("TEST-000007", detail.item!!.pddOrderNo)
+        }
+        val duplicate = BackfillDetailReader(zone).apply {
+            accept("_cg7\n订单号：TEST-000007\n实付：22.98元")
+            accept("实付：22.98元")
+        }.finish()
+        assertEquals(2298L, duplicate.item!!.pddOrderAmountCent)
+        val reused = BackfillDetailReader(zone)
+        reused.accept("_cg7\n订单号：TEST-000007\n实付：1.00元")
+        assertEquals(100L, reused.finish().item!!.pddOrderAmountCent)
+        reused.accept("_cg8\n订单号：TEST-000008\n实付：0元")
+        assertEquals(0L, reused.finish().item!!.pddOrderAmountCent)
+        reused.accept("_cg9\n订单号：TEST-000009\n实付：999999999999999999999999.99元")
+        assertNull(reused.finish().item!!.pddOrderAmountCent)
+    }
+
+    @Test fun `untagged order never becomes retained or uploaded candidate`() {
+        val reader = BackfillDetailReader(zone)
+        reader.accept("个人订单\n订单编号：PERSONAL-1\n下单时间：2026-09-08 10:00:00")
+        assertNull(reader.finish().item)
+        reader.accept("测试地址_cg7")
+        assertNull(reader.finish().item) // previous order number has been cleared
+        val uploaded = mutableListOf<BackfillItem>()
+        scanner(FakeDriver(tagged = false), uploaded).scan()
+        assertTrue(uploaded.isEmpty())
+    }
+
+    @Test fun `ambiguous and noncanonical suffixes are skipped and missing time remains optional`() {
+        for (suffix in listOf("_cg07", "_cg+7", "_cg７", "_cg7abc", "_cg7 _cg8")) {
+            assertNull(BackfillDetailReader(zone).apply { accept("$suffix\n订单号：TEST-000007") }.finish().item)
+        }
+        assertNull(BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n订单号：TEST-000008") }.finish().item)
+        val missing = BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n拼单时间：2026-09-08 10:00:00") }.finish()
+        assertNotNull(missing.item)
+        assertNull(missing.item!!.orderSubmittedAt)
+    }
+
+    @Test fun `rolling hours boundary and sampled descending cutoff`() {
+        val window = OrderBackfillWindow("2", now)
+        assertEquals(now - 48 * 3_600_000L, window.cutoff)
+        assertTrue(window.includes(window.cutoff))
+        assertFalse(window.includes(window.cutoff - 1))
+        repeat(4) { assertFalse(window.observe(window.cutoff + 10 - it)) }
+        assertTrue(window.observe(window.cutoff - 1))
+        assertEquals(Long.MIN_VALUE, OrderBackfillWindow("99999999999999999999999999", now).cutoff)
+    }
+
+    @Test fun `time reversal and missing times disable early stop`() {
+        val window = OrderBackfillWindow("2", now)
+        assertFalse(window.observe(now - 100))
+        assertFalse(window.observe(now))
+        repeat(10) { assertFalse(window.observe(window.cutoff - it - 1)) }
+        assertTrue(window.nonDescending)
+        val unknown = OrderBackfillWindow("2", now)
+        unknown.observe(null)
+        repeat(10) { assertFalse(unknown.observe(unknown.cutoff - it - 1)) }
+    }
+
+    @Test fun `scanner expands and stops after validated prefix passes rolling cutoff`() {
+        val driver = FakeDriver()
+        val items = mutableListOf<BackfillItem>()
+        val result = scanner(driver, items).scan()
+        assertEquals(5, driver.opened)
+        assertEquals(5, driver.expansions)
+        assertTrue(result.contains("已达指定天数"))
+        assertTrue(result.contains("未完整扫描"))
+        assertTrue(items.all { !it.orderSubmittedAt.orEmpty().contains("11:20") })
+    }
+
+    @Test fun `unordered list scans to internal cap and reports incomplete`() {
+        val window = OrderBackfillWindow("2", now)
+        val driver = FakeDriver(unordered = true)
+        val result = OrderBackfillScanner(driver, window, {}, {}, {}).scan()
+        assertTrue(window.nonDescending)
+        assertEquals(200, driver.opened)
+        assertTrue(result.contains("未完整扫描"))
+        assertTrue(result.contains(OrderBackfillWindow.UNORDERED))
+    }
+
+    @Test fun `mutex occupied rejects and simultaneous double tap has one winner and finally releases`() {
+        val mutex = TaskExecutionMutex()
+        val guard = OrderBackfillGuard(mutex)
+        mutex.tryAcquire(7)
+        assertFalse(guard.tryAcquire())
+        mutex.release(7)
+        val start = CountDownLatch(1)
+        val complete = CountDownLatch(2)
+        val won = AtomicInteger()
+        val pool = Executors.newFixedThreadPool(2)
+        repeat(2) { pool.execute { start.await(); if (guard.tryAcquire()) won.incrementAndGet(); complete.countDown() } }
+        start.countDown()
+        complete.await()
+        pool.shutdownNow()
+        assertEquals(1, won.get())
+        assertFalse(mutex.tryAcquire(8))
+        try { guard.cancelled.set(true); throw IllegalStateException("cancelled") } catch (_: IllegalStateException) { } finally { guard.release() }
+        assertNull(mutex.currentTaskId())
+        assertTrue(guard.tryAcquire())
+        assertFalse(guard.cancelled.get())
+        guard.release()
+    }
+
+    @Test fun `permanent business errors never retry regardless of server retryable flag`() {
+        val codes = listOf("PURCHASE_BACKFILL_SUFFIX_INVALID", "PURCHASE_TASK_NOT_FOUND", "PURCHASE_BACKFILL_DEVICE_MISMATCH",
+            "PURCHASE_STATE_CONFLICT", "PURCHASE_INVALID_REQUEST", "PURCHASE_ORDER_TIME_INVALID", "PURCHASE_ORDER_TIME_MISSING",
+            "PURCHASE_BACKFILL_ORDER_CONFLICT", "PURCHASE_BACKFILL_BATCH_CONFLICT", "PURCHASE_BACKFILL_ORDER_ALREADY_USED")
+        codes.forEach { code ->
+            var calls = 0
+            val results = mutableListOf<BackfillResult>()
+            OrderBackfillUpload({ _, _ -> calls++; listOf(failure(code)) }, {}, {}).upload(listOf(item), results::add)
+            assertEquals(1, calls)
+            assertTrue(results.single().display().contains("需人工检查"))
+        }
+        var calls = 0
+        OrderBackfillUpload({ _, _ -> calls++; throw AgentApiException(409, codes.first(), "hidden", true) }, {}, {})
+            .upload(listOf(item)) { assertTrue(it.needsReview) }
+        assertEquals(1, calls)
+    }
+
+    @Test fun `network and internal errors retry bounded with stable transport request id`() {
+        val ids = mutableListOf<String>()
+        val results = mutableListOf<BackfillResult>()
+        OrderBackfillUpload({ id, _ -> ids += id; throw IOException("private body") }, {}, {})
+            .upload(listOf(item), results::add)
+        assertEquals(3, ids.size)
+        assertEquals(1, ids.toSet().size)
+        assertFalse(results.single().needsReview)
+        assertFalse(results.single().display().contains("private"))
+        var calls = 0
+        OrderBackfillUpload({ _, _ -> calls++; listOf(failure("INTERNAL_ERROR")) }, {}, {})
+            .upload(listOf(item)) { assertTrue(it.display().contains("重试耗尽")) }
+        assertEquals(3, calls)
+    }
+
+    @Test fun `partial response only retries transient items and preserves acknowledged success`() {
+        val sizes = mutableListOf<Int>()
+        val results = mutableListOf<BackfillResult>()
+        val second = item.copy(addressSuffix = "_cg8", pddOrderNo = "TEST-000008")
+        OrderBackfillUpload({ _, items ->
+            sizes += items.size
+            if (items.size == 2) listOf(success(), failure("INTERNAL_ERROR").copy(index = 1))
+            else listOf(failure("PURCHASE_STATE_CONFLICT"))
+        }, {}, {}).upload(listOf(item, second), results::add)
+        assertEquals(listOf(2, 1), sizes)
+        assertTrue(results.first().success)
+        assertEquals(1, results.last().index)
+    }
+
+    @Test fun `cancellation prevents upload and invalid response cannot confirm cache`() {
+        var calls = 0
+        try {
+            OrderBackfillUpload({ _, _ -> calls++; listOf(success()) }, { error("stopped") }, {}).upload(listOf(item)) { fail() }
+            fail()
+        } catch (_: IllegalStateException) { }
+        assertEquals(0, calls)
+        try {
+            OrderBackfillUpload({ _, _ -> listOf(success().copy(taskId = 99)) }, {}, {}).upload(listOf(item)) { fail() }
+            fail()
+        } catch (_: IllegalStateException) { }
+    }
+
+    @Test fun `payload contains only suffix order and optional RFC3339 time`() {
+        val payload = backfillPayload("test", listOf(item))
+        assertEquals(setOf("requestId", "items"), payload.keySet())
+        assertEquals(setOf("addressSuffix", "pddOrderNo"), payload.getJSONArray("items").getJSONObject(0).keySet())
+        val parsed = parseBackfillResults(JSONObject("""{"items":[{"index":0,"taskId":7,"result":"backfilled","code":"BACKFILLED","status":"order_created","statusVersion":3,"pddOrderNo":"TEST-000007","orderSubmittedAt":"2026-09-08T10:00:00+08:00","timeSource":"irreversible_at","retryable":false}]}"""))
+        assertTrue(parsed.single().display().contains("估算"))
+        assertNull(parsed.single().pddOrderAmountCent)
+        assertNull(parsed.single().warningCode)
+        assertTrue(parsed.single().copy(timeSource = "page").display().contains("页面下单时间"))
+        val warning = parseBackfillResults(JSONObject("""{"items":[{"index":0,"taskId":7,"result":"already_backfilled","code":"ALREADY_BACKFILLED","status":"order_created","statusVersion":4,"pddOrderNo":"TEST-000007","pddOrderAmountCent":2298,"timeSource":"page","warningCode":"PURCHASE_BACKFILL_AMOUNT_CONFLICT","warningMessage":"已有不同实付金额，本次未覆盖","retryable":false}]}""")).single()
+        assertEquals(2298L, warning.pddOrderAmountCent)
+        assertTrue(warning.display().contains("PURCHASE_BACKFILL_AMOUNT_CONFLICT"))
+
+        val amountPayload = backfillPayload("test", listOf(item.copy(pddOrderAmountCent = 2298)))
+        assertEquals(2298L, amountPayload.getJSONArray("items").getJSONObject(0).getLong("pddOrderAmountCent"))
+    }
+
+    @Test fun `cache updates confirmed server facts only and clears old errors`() {
+        val task = JSONObject().put("taskId", 7).put("status", "order_result_unknown").put("errorCode", "OLD").put("errorMessage", "old")
+        cn.ilapage.goauto.agent.persistence.applyBackfillFacts(task, failure("PURCHASE_BACKFILL_ORDER_CONFLICT"))
+        assertEquals("order_result_unknown", task.getString("status"))
+        assertEquals("OLD", task.getString("errorCode"))
+        cn.ilapage.goauto.agent.persistence.applyBackfillFacts(task, success())
+        assertEquals("order_created", task.getString("status"))
+        assertEquals(item.pddOrderNo, task.getString("pddOrderNo"))
+        assertTrue(task.isNull("errorCode"))
+        assertTrue(task.isNull("errorMessage"))
+        assertFalse(task.getBoolean("retryable"))
+        val warning = success().copy(pddOrderAmountCent = 2298, warningCode = "PURCHASE_BACKFILL_AMOUNT_CONFLICT", warningMessage = "conflict")
+        cn.ilapage.goauto.agent.persistence.applyBackfillFacts(task, warning)
+        assertEquals(2298L, task.getLong("pddOrderAmountCent"))
+        assertEquals("PURCHASE_BACKFILL_AMOUNT_CONFLICT", task.getString("backfillWarningCode"))
+        assertTrue(task.isNull("errorCode"))
+    }
+
+    @Test fun `expansion requires order information and product snapshot row`() {
+        val expand = node("0/1", "展开")
+        assertNull(BackfillPagePolicy.expansion(page(node("0/0", "订单编号：TEST-000007"), expand)))
+        assertEquals(expand, BackfillPagePolicy.expansion(page(node("0/0", "订单编号：TEST-000007"), expand, node("0/2", "商品快照"))))
+    }
+
+    @Test fun `dangerous nodes ancestors and overlapping actions never become click targets`() {
+        BackfillPagePolicy.forbidden.forEach { label ->
+            val dangerous = node("0/0", label)
+            assertFalse(BackfillPagePolicy.safe(page(dangerous), dangerous))
+            val parent = node("0", "查看详情")
+            assertFalse(BackfillPagePolicy.safe(page(parent, dangerous), parent))
+            val adjacent = node("0/1", "查看详情")
+            assertFalse(BackfillPagePolicy.safe(page(adjacent, dangerous), adjacent))
+        }
+    }
+
+    private val item = BackfillItem("_cg7", "TEST-000007", null)
+    private fun failure(code: String) = BackfillResult(0, 7, "failed", code, "", 0, null, null, "")
+    private fun success() = BackfillResult(0, 7, "backfilled", "BACKFILLED", "order_created", 3, item.pddOrderNo, null, "page")
+    private fun scanner(driver: FakeDriver, items: MutableList<BackfillItem>) = OrderBackfillScanner(driver, OrderBackfillWindow("2", now), {}, items::add, {})
+    private fun node(path: String, label: String, selected: Boolean = false) = SnapshotNode(path, path.substringBeforeLast('/'), label, null, null, "View",
+        NodeBounds(0, 0, 200, 60), true, false, selected, false, true, true)
+    private fun page(vararg nodes: SnapshotNode) = UiSnapshot(BackfillPagePolicy.PDD, "com.xunmeng.pinduoduo.activity.NewPageActivity", nodes.toList())
+
+    private inner class FakeDriver(val tagged: Boolean = true, val unordered: Boolean = false) : BackfillDriver {
+        var opened = 0
+        var expansions = 0
+        var index = 0
+        var inDetail = false
+        var expanded = false
+        override fun openOrders() = Unit
+        override fun pause() = Unit
+        override fun capture(): UiSnapshot {
+            if (!inDetail) return page(node("0/0", "我的订单"), node("0/1", "全部", true), node("0/2", "查看详情"), node("0/2/0", "合成卡片 $index"))
+            val date = if (unordered && index == 1) "2026-09-08 11:00:00" else if (index < 4) "2026-09-08 10:00:00" else "2026-09-05 10:00:00"
+            return page(node("0/0", "订单详情"), node("0/1", "订单编号：TEST-${100000 + index}"),
+                node("0/2", if (tagged) "合成地址_cg${index + 1}" else "无后缀合成地址"),
+                node("0/4", "商品快照"),
+                node("0/3", if (expanded) "下单时间：$date\n拼单时间：2026-09-08 11:20:00" else "展开"))
+        }
+        override fun click(node: SnapshotNode): Boolean {
+            if (node.label == "展开") { expanded = true; expansions++ } else { inDetail = true; opened++ }
+            return true
+        }
+        override fun scroll() = false
+        override fun back(): Boolean { inDetail = false; expanded = false; index++; return true }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PddLaunchFallbackTest.kt

@@ -0,0 +1,25 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.PddLaunchFallback
+import org.junit.Assert.*
+import org.junit.Test
+
+class PddLaunchFallbackTest {
+    @Test fun directSuccessDoesNotStartBrowser() {
+        assertTrue(PddLaunchFallback.open(true, { true }, { error("browser must not start") }))
+    }
+    @Test fun missingHandlerFallsBackOnce() {
+        var browserCalls = 0
+        assertTrue(PddLaunchFallback.open(true, { throw IllegalStateException("no handler") }, { browserCalls++; true }))
+        assertEquals(1, browserCalls)
+    }
+    @Test fun rejectedDirectLaunchFallsBack() {
+        assertTrue(PddLaunchFallback.open(true, { false }, { true }))
+        assertFalse(PddLaunchFallback.open(true, { false }, { false }))
+    }
+    @Test fun collectionKeepsBrowserEntry() {
+        var directCalls = 0
+        assertTrue(PddLaunchFallback.open(false, { directCalls++; true }, { true }))
+        assertEquals(0, directCalls)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PddProductDetailCollectorTest.kt

@@ -11,6 +11,7 @@ import cn.ilapage.goauto.agent.automation.PddCollectorConfig
 import cn.ilapage.goauto.agent.automation.PddCollectorDriver
 import cn.ilapage.goauto.agent.automation.PddProductDetailCollector
 import cn.ilapage.goauto.agent.automation.PddScreenParser
+import cn.ilapage.goauto.agent.automation.PurchasePanelContext
 import cn.ilapage.goauto.agent.automation.SnapshotNode
 import cn.ilapage.goauto.agent.automation.SpecPanelType
 import cn.ilapage.goauto.agent.automation.SwipeDirection
@@ -26,6 +27,62 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PddProductDetailCollectorTest {
+    private fun prefixlessPanel(): UiSnapshot = UiSnapshot(PDD_PACKAGE, ACTIVITY, listOf(
+        node("root", "", 0, 0, 1080, 2376),
+        node("close", "关闭", 970, 270, 1050, 350, clickable = true),
+        node("info", "", 0, 770, 1080, 1157),
+        node("info/summary", "米白色（有里布） 2XL 建议131到150斤", 396, 878, 1053, 992, parentPath = "info"),
+        node("info/quantity", "1", 480, 1046, 561, 1121, className = "android.widget.EditText", parentPath = "info"),
+        node("minus", "减少数量", 396, 1046, 470, 1121, clickable = true),
+        node("plus", "增加数量", 570, 1046, 645, 1121, clickable = true),
+        node("scroll", "", 0, 1294, 1080, 2079, scrollable = true),
+        node("scroll/color-title", "颜色分类", 36, 1319, 216, 1380, parentPath = "scroll"),
+        node("scroll/color", "米白色（有里布）", 36, 1405, 352, 1808, clickable = true, selected = true, parentPath = "scroll"),
+        node("scroll/size-title", "尺码", 36, 1858, 126, 1911, parentPath = "scroll"),
+        node("scroll/size", "XL 建议111到130斤", 36, 1930, 440, 2015, clickable = true, parentPath = "scroll"),
+        node("payment", "微信支付", 112, 2100, 929, 2157),
+        node("submit", "提交订单", 375, 2225, 705, 2284, clickable = true),
+    ))
+
+    @Test fun `prefixless selected panel retains structural recognition and product summary`() {
+        val parsed = PddScreenParser.parse(prefixlessPanel(), config(), GOODS_ID, evidence())
+        assertEquals(SpecPanelType.NORMAL_SCROLLABLE, parsed.specPanelType)
+        assertEquals("米白色（有里布） 2XL 建议131到150斤", parsed.selectedSummary)
+    }
+
+    @Test fun `prefixless panel requires quantity and order evidence`() {
+        for (missing in listOf("plus", "submit", "payment")) {
+            val snapshot = prefixlessPanel()
+            val parsed = PddScreenParser.parse(snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == missing }), config(), GOODS_ID, evidence())
+            assertFalse(parsed.specPanelOpen)
+            assertEquals(null, parsed.selectedSummary)
+        }
+    }
+
+    @Test fun `ambiguous product summaries are not used`() {
+        val snapshot = prefixlessPanel()
+        val extra = node("info/other", "米白色（有里布） XL 建议111到130斤", 396, 800, 1053, 870, parentPath = "info")
+        val parsed = PddScreenParser.parse(snapshot.copy(nodes = snapshot.nodes + extra), config(), GOODS_ID, evidence())
+        assertEquals(null, parsed.selectedSummary)
+    }
+
+    @Test fun `scrolling away color heading and options preserves known purchase panel and summary`() {
+        val initial = prefixlessPanel()
+        val opened = PddScreenParser.parse(initial, config(), GOODS_ID, evidence())
+        val context = PurchasePanelContext(requireNotNull(opened.specPanelContainer), "米白色（有里布）")
+        val scrolled = initial.copy(nodes = initial.nodes.filterNot { it.path.startsWith("scroll/color") })
+        val continued = PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence(), context)
+        assertEquals(1, continued.panelHeadingCount)
+        assertTrue(continued.specPanelOpen)
+        assertEquals("米白色（有里布） 2XL 建议131到150斤", continued.selectedSummary)
+        assertTrue(continued.dimensions.none { it.key == "color" })
+        assertFalse(PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence()).specPanelOpen)
+        assertFalse(PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence(),
+            context.copy(container = context.container.copy(path = "other"))).specPanelOpen)
+        assertFalse(PddScreenParser.parse(scrolled.copy(nodes = scrolled.nodes.filterNot { it.path == "submit" }),
+            config(), GOODS_ID, evidence(), context).specPanelOpen)
+    }
+
     @Test
     fun `parser removes only trailing size price and keeps raw evidence`() {
         val snapshot = UiSnapshot(
@@ -367,6 +424,64 @@ class PddProductDetailCollectorTest {
         assertEquals("bottom_purchase", parsed.specEntrySource)
     }
 
+    @Test
+    fun bottomPurchaseEntriesPreferRightmostCandidate() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("buy-left", "单独购买", 446, 2000, 685, 2160, clickable = true),
+                node("buy-right", "发起拼单", 685, 2000, 1080, 2160, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("buy-right", parsed.specEntry?.path)
+        assertEquals("buy-right", parsed.specEntryClickTarget?.path)
+        assertEquals("bottom_purchase_rightmost", parsed.specEntrySource)
+        assertEquals(2, parsed.bottomPurchaseEntryCount)
+    }
+
+    @Test
+    fun equallyRightmostBottomPurchaseEntriesPreferSmallerArea() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("buy-large", "发起拼单", 685, 2000, 1080, 2160, clickable = true),
+                node("buy-small", "立即购买", 785, 2000, 980, 2140, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("buy-small", parsed.specEntry?.path)
+        assertEquals("bottom_purchase_rightmost", parsed.specEntrySource)
+    }
+
+    @Test
+    fun bottomPurchaseCandidatesStillExcludeReviewOrderAndPaymentContexts() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("reviews", "商品评价", 446, 1900, 685, 2160, clickable = true),
+                node("reviews/buy", "购买", 480, 2000, 650, 2100, parentPath = "reviews"),
+                node("order", "购买并提交订单", 685, 2000, 880, 2160, clickable = true),
+                node("payment", "购买后立即支付", 880, 2000, 1080, 2160, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals(null, parsed.specEntry)
+        assertEquals(0, parsed.bottomPurchaseEntryCount)
+    }
+
     @Test
     fun bottomPurchaseInsideReviewCardIsNeverSpecEntry() {
         val snapshot = UiSnapshot(
@@ -571,6 +686,74 @@ class PddProductDetailCollectorTest {
         assertTrue(parsed.dimensions.isEmpty())
     }
 
+    @Test
+    fun nonScrollableSelectorWithTwoDimensionsDoesNotRequireInitialSelectedSummary() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("color-heading", "颜色", 20, 420, 300, 470),
+                node("color", "豹纹", 20, 490, 300, 550, clickable = true),
+                node("size-heading", "尺码", 20, 650, 300, 700),
+                node("size", "均码", 20, 720, 300, 780, clickable = true),
+                node("quantity", "1", 480, 1400, 600, 1480, className = "android.widget.EditText"),
+                node("decrease", "减少数量", 360, 1400, 470, 1480, clickable = true),
+                node("increase", "增加数量", 610, 1400, 720, 1480, clickable = true),
+                node("order", "提交订单", 20, 1900, 1060, 2100, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertTrue(parsed.specPanelOpen)
+        assertEquals(SpecPanelType.NON_SCROLLABLE_CONFIRMATION, parsed.specPanelType)
+        assertFalse(parsed.hasSelectionSummary)
+        assertEquals(2, parsed.dimensions.size)
+        assertEquals(2, parsed.panelOptionCount)
+    }
+
+    @Test
+    fun nestedSelectionRowCombinesPrefixAndDimensionBeforeChoosingClickableParent() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("selection-row", "", 20, 720, 1060, 860, clickable = true),
+                node("selection-row/prefix", "请选择", 48, 750, 220, 810, parentPath = "selection-row"),
+                node("selection-row/dimension", "颜色分类", 240, 750, 480, 810, parentPath = "selection-row"),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("selection-row", parsed.specEntry?.path)
+        assertEquals("selection-row", parsed.specEntryClickTarget?.path)
+        assertEquals("nested_selection", parsed.specEntrySource)
+        assertEquals(1, parsed.nestedSpecEntryCount)
+    }
+
+    @Test
+    fun nestedSelectionSemanticsNeverAcceptsOrderOrPaymentContainer() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("unsafe", "", 20, 720, 1060, 860, clickable = true),
+                node("unsafe/prefix", "请选择", 48, 750, 220, 810, parentPath = "unsafe"),
+                node("unsafe/dimension", "颜色", 240, 750, 480, 810, parentPath = "unsafe"),
+                node("unsafe/order", "提交订单", 700, 750, 1020, 810, parentPath = "unsafe"),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals(null, parsed.specEntry)
+        assertEquals(0, parsed.nestedSpecEntryCount)
+    }
+
     @Test
     fun genericQuantityAndBuyControlsDoNotProveQuickConfirmation() {
         val snapshot = UiSnapshot(
@@ -791,6 +974,95 @@ class PddProductDetailCollectorTest {
         assertTrue(driver.captureCount > driver.clickCount)
     }
 
+    @Test
+    fun `spec panel already at top skips the restore swipe and still collects colors and sizes`() {
+        // Default fixture state already renders the color heading first (at
+        // top). #334: moveSpecPanelToTop must not issue any DOWN swipe in
+        // that case, since dragging an already-top panel can lose headings
+        // on a real device.
+        val driver = FakeCollectorDriver(
+            colorPages = listOf(listOf("红色", "蓝色")),
+            sizePages = listOf(listOf("S", "M")),
+            prices = mapOf("红色" to 1099L, "蓝色" to 1299L),
+        )
+        var clock = 0L
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val payload = requireNotNull(result.payload)
+        assertEquals(listOf("红色", "蓝色"), payload.colorPrices.map { it.color })
+        assertEquals(listOf("S", "M"), payload.dimensions.first { it.key == "size" }.values)
+        assertEquals(0, driver.swipes.count { it.first == SwipeDirection.DOWN })
+    }
+
+    @Test
+    fun `spec panel not at top restores with the original swipe behavior before collecting`() {
+        // The color heading is hidden until one DOWN (top-restore) swipe has
+        // happened, simulating a panel scrolled past its headings.
+        val driver = FakeCollectorDriver(
+            colorPages = listOf(listOf("红色", "蓝色")),
+            sizePages = listOf(listOf("S", "M")),
+            prices = mapOf("红色" to 1099L, "蓝色" to 1299L),
+            specPanelHidesColorInitially = true,
+        )
+        var clock = 0L
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val payload = requireNotNull(result.payload)
+        assertEquals(listOf("红色", "蓝色"), payload.colorPrices.map { it.color })
+        assertEquals(listOf("S", "M"), payload.dimensions.first { it.key == "size" }.values)
+        assertTrue(driver.swipes.count { it.first == SwipeDirection.DOWN } >= 1)
+    }
+
+    @Test
+    fun `spec headings vanishing after a restore swipe stops swiping and fails explicitly`() {
+        // The panel starts not-at-top (color heading hidden) so the restore
+        // swipe runs; after that swipe every heading and value disappears,
+        // simulating the bottom sheet being dragged off screen. #334
+        // requires the collector to stop and fail instead of reporting an
+        // empty successful result.
+        val driver = FakeCollectorDriver(
+            colorPages = listOf(listOf("红色", "蓝色")),
+            sizePages = listOf(listOf("S", "M")),
+            prices = mapOf("红色" to 1099L, "蓝色" to 1299L),
+            specPanelHidesColorInitially = true,
+            specPanelCollapsesAfterTopSwipe = true,
+        )
+        var clock = 0L
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }).collect(GOODS_ID, rule())
+
+        assertFalse(result.successful)
+        assertEquals("SPEC_PANEL_TOP_COLLAPSED", result.code)
+        assertEquals(1, driver.swipes.count { it.first == SwipeDirection.DOWN })
+    }
+
+    @Test
+    fun `a lower heading scrolling out of view after a restore swipe does not fail collection`() {
+        // Three-dimension panel not at top (color heading is present but has
+        // no values yet, so it does not become dimensions.first()). After the
+        // restore swipe, color values return but the third, lower "容量"
+        // heading scrolls out of view — a normal scroll-to-top effect. Total
+        // heading count drops, but color and size values are present the
+        // whole time, so this must NOT be treated as a collapsed panel.
+        val driver = FakeCollectorDriver(
+            colorPages = listOf(listOf("红色", "蓝色")),
+            sizePages = listOf(listOf("S", "M")),
+            prices = mapOf("红色" to 1099L, "蓝色" to 1299L),
+            extraDimension = true,
+            specPanelHidesColorInitially = true,
+            specPanelDropsExtraDimensionAfterTopSwipe = true,
+        )
+        var clock = 0L
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val payload = requireNotNull(result.payload)
+        assertEquals(listOf("红色", "蓝色"), payload.colorPrices.map { it.color })
+        assertEquals(listOf("S", "M"), payload.dimensions.first { it.key == "size" }.values)
+        assertTrue(driver.swipes.count { it.first == SwipeDirection.DOWN } >= 1)
+    }
+
     @Test
     fun `duplicate sizes after price cleanup reject the whole size dimension`() {
         val driver = FakeCollectorDriver(
@@ -861,7 +1133,9 @@ class PddProductDetailCollectorTest {
         assertTrue(result.successful)
         assertEquals(listOf("A色", "B色", "C色", "F色", "E色", "D色"), driver.clickedLabels)
         assertEquals(colors, requireNotNull(result.payload).dimensions.first { it.key == "color" }.values)
-        assertTrue(driver.swipes.any { it.first == SwipeDirection.DOWN && it.second != null })
+        // #334: the panel already shows the color heading at top, so
+        // moveSpecPanelToTop must not issue a needless DOWN restore swipe.
+        assertTrue(driver.swipes.none { it.first == SwipeDirection.DOWN })
         assertTrue(driver.swipes.any { it.first == SwipeDirection.RIGHT && it.second != null })
         assertTrue(driver.swipes.any { it.first == SwipeDirection.UP && it.second != null })
     }
@@ -1574,6 +1848,21 @@ class PddProductDetailCollectorTest {
         private val selectedSummaryPrefix: String = "已选",
         private val imageColorCards: Boolean = false,
         private val navigateAwayAfterColorClick: Boolean = false,
+        // #334: simulates a spec panel that is not scrolled to top yet: the
+        // color heading is present but has no values yet (so it is not the
+        // first parsed dimension), until one DOWN (top-restore) swipe has
+        // happened, after which color values render normally.
+        private val specPanelHidesColorInitially: Boolean = false,
+        // #334: simulates a bottom sheet dragged past its headings by a
+        // restore swipe — once at least one DOWN swipe has happened, every
+        // spec heading and value disappears from the panel.
+        private val specPanelCollapsesAfterTopSwipe: Boolean = false,
+        // #334: simulates a normal scroll-to-top on a multi-dimension panel
+        // where a lower, non-spec-value-bearing heading (here the extra
+        // "容量" dimension) scrolls out of view once the color heading is
+        // restored to top. Heading count drops but color/size values are
+        // untouched, so this must NOT be treated as a collapsed panel.
+        private val specPanelDropsExtraDimensionAfterTopSwipe: Boolean = false,
     ) : PddCollectorDriver {
         var captureCount = 0
         var clickCount = 0
@@ -1587,6 +1876,7 @@ class PddProductDetailCollectorTest {
         private var previousSelected: String? = null
         private var horizontalPage = 0
         private var verticalPage = 0
+        private var downSwipeCount = 0
         private var priceRead = 0
         private var panelOpen = !startWithPanelClosed
         private var reviewOpen = false
@@ -1649,12 +1939,16 @@ class PddProductDetailCollectorTest {
                 node("scroll", "", 0, 380, 1080, 1900, scrollable = scrollablePanel),
             )
             val continuationPage = hideDimensionHeadingsAfterFirstVerticalPage && verticalPage > 0
+            val panelCollapsedNow = specPanelCollapsesAfterTopSwipe && downSwipeCount >= 1
+            val hideColorNow = specPanelHidesColorInitially && downSwipeCount == 0
             val visibleColors = colorVerticalPages?.get(verticalPage.coerceAtMost(colorVerticalPages.lastIndex))
                 ?: colorPages[horizontalPage.coerceAtMost(colorPages.lastIndex)]
             val colorRowCount = (visibleColors.size + rowSize - 1) / rowSize
             val sizeHeadingTop = maxOf(700, 470 + colorRowCount * 90 + 20)
-            if (!continuationPage) {
+            if (!continuationPage && !panelCollapsedNow) {
                 nodes += node("scroll/color-heading", "颜色分类", 20, 400, 300, 450, parentPath = "scroll")
+            }
+            if (!continuationPage && !hideColorNow && !panelCollapsedNow) {
                 visibleColors
                     .filterNot { hideSelectedColorOption && it == selected }
                     .forEachIndexed { index, color ->
@@ -1694,21 +1988,23 @@ class PddProductDetailCollectorTest {
                     )
                 }
             }
-            if (!continuationPage) nodes += node("scroll/size-heading", sizeHeadingLabel, 20, sizeHeadingTop, 300, sizeHeadingTop + 50, parentPath = "scroll")
-            sizePages[verticalPage.coerceAtMost(sizePages.lastIndex)].forEachIndexed { index, size ->
-                nodes += node(
-                    "scroll/size-$size-$captureCount",
-                    size,
-                    30 + index * 230,
-                    sizeHeadingTop + 70,
-                    220 + index * 230,
-                    sizeHeadingTop + 140,
-                    clickable = true,
-                    selected = size == initialSelectedSize,
-                    parentPath = "scroll",
-                )
+            if (!continuationPage && !panelCollapsedNow) nodes += node("scroll/size-heading", sizeHeadingLabel, 20, sizeHeadingTop, 300, sizeHeadingTop + 50, parentPath = "scroll")
+            if (!panelCollapsedNow) {
+                sizePages[verticalPage.coerceAtMost(sizePages.lastIndex)].forEachIndexed { index, size ->
+                    nodes += node(
+                        "scroll/size-$size-$captureCount",
+                        size,
+                        30 + index * 230,
+                        sizeHeadingTop + 70,
+                        220 + index * 230,
+                        sizeHeadingTop + 140,
+                        clickable = true,
+                        selected = size == initialSelectedSize,
+                        parentPath = "scroll",
+                    )
+                }
             }
-            if (extraDimension) {
+            if (extraDimension && !(specPanelDropsExtraDimensionAfterTopSwipe && downSwipeCount >= 1)) {
                 nodes += node("scroll/capacity-heading", "容量", 20, 900, 300, 950, parentPath = "scroll")
                 nodes += node("scroll/capacity", "大容量", 30, 970, 220, 1040, clickable = true, parentPath = "scroll")
             }
@@ -1783,7 +2079,10 @@ class PddProductDetailCollectorTest {
                 SwipeDirection.LEFT -> horizontalPage = (horizontalPage + 1).coerceAtMost(colorPages.lastIndex)
                 SwipeDirection.UP -> verticalPage = (verticalPage + 1)
                     .coerceAtMost(maxOf(sizePages.lastIndex, colorVerticalPages?.lastIndex ?: 0))
-                SwipeDirection.DOWN -> verticalPage = (verticalPage - 1).coerceAtLeast(0)
+                SwipeDirection.DOWN -> {
+                    verticalPage = (verticalPage - 1).coerceAtLeast(0)
+                    downSwipeCount++
+                }
                 else -> Unit
             }
             return true

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseLiveAutomationTest.kt

@@ -1,6 +1,8 @@
 package cn.ilapage.goauto.agent
 
 import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.FreshClickOutcome
+import cn.ilapage.goauto.agent.automation.FreshClickReason
 import cn.ilapage.goauto.agent.automation.NodeBounds
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
 import cn.ilapage.goauto.agent.automation.PurchaseLiveAutomation
@@ -16,13 +18,191 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PurchaseLiveAutomationTest {
+    @Test
+    fun `two second payment transition and two needed scrolls yield order and payable amount without clicks`() {
+        val driver = ReadOnlyOrderDriver(paymentMs = 2500)
+        val order = PurchaseLiveAutomation(driver, pause = { driver.elapsed += it }).readOrderResult()
+        assertEquals("PDD-DEMO-325", order?.orderNo)
+        assertEquals("2026-09-19T03:21:43Z", order?.submittedAt)
+        assertEquals(1300L, order?.pddOrderAmountCent)
+        assertEquals(1, driver.backs)
+        assertEquals(2, driver.swipes)
+        assertEquals(0, driver.clicks)
+    }
+
+    @Test
+    fun `unpaid page arriving near original limit gets independent read budget`() {
+        val driver = ReadOnlyOrderDriver(preludeSamples = 58)
+        val order = PurchaseLiveAutomation(driver, pause = { driver.elapsed += it }).readOrderResult()
+        assertEquals("PDD-DEMO-325", order?.orderNo)
+        assertTrue(driver.captures > 60)
+        assertEquals(2, driver.swipes)
+        assertEquals(0, driver.clicks)
+    }
+
+    @Test
+    fun `unpaid scrolling is immediate and bounded when order never becomes visible`() {
+        val driver = ReadOnlyOrderDriver(requiredSwipes = 100)
+        val automation = PurchaseLiveAutomation(driver, pause = { driver.elapsed += it })
+        assertEquals(null, automation.readOrderResult())
+        assertEquals(4, driver.swipes)
+        assertEquals(0L, driver.firstSwipeAt)
+        assertTrue(driver.captures <= 30)
+        assertEquals(0, driver.clicks)
+    }
+
+    @Test
+    fun `already visible order never scrolls and missing or conflicting payable amount never blocks order`() {
+        val cases = listOf(
+            emptyList<String>() to null,
+            listOf("拼单价¥16", "平台优惠-¥3", "实付:13元") to null,
+            listOf("应付:13元", "应付:14元") to null,
+            listOf("应付:-13元", "应付:13.123元", "预计应付:13元") to null,
+            listOf("应付:999999999999999999999元") to null,
+            listOf("应付:13.20元", "应付:13.20元") to 1320L,
+            listOf("应付:0元") to 0L,
+        )
+        for ((amounts, expected) in cases) {
+            val driver = ReadOnlyOrderDriver(requiredSwipes = 0, amounts = amounts)
+            val order = PurchaseLiveAutomation(driver, pause = {}).readOrderResult()
+            assertEquals("PDD-DEMO-325", order?.orderNo)
+            assertEquals(expected, order?.pddOrderAmountCent)
+            assertEquals(0, driver.swipes)
+            assertEquals(0, driver.clicks)
+        }
+    }
+
+    private class ReadOnlyOrderDriver(
+        val paymentMs: Long = 0,
+        val preludeSamples: Int = 0,
+        val requiredSwipes: Int = 2,
+        val amounts: List<String> = listOf("拼单价¥16", "平台优惠-¥3", "已优惠3元使用3元平台无门槛券,应付:,13元,(免运费)"),
+    ) : PurchaseUiDriver by LiveDriver() {
+        var elapsed = 0L
+        var captures = 0
+        var backs = 0
+        var swipes = 0
+        var clicks = 0
+        var firstSwipeAt: Long? = null
+        override fun capture(): UiSnapshot {
+            captures++
+            if (captures <= preludeSamples) return UiSnapshot(PDD, ACTIVITY, emptyList())
+            if (elapsed < paymentMs) return UiSnapshot(PDD, "com.xunmeng.pinduoduo.app_pay.core.PayActivity", listOf(node("立即支付")))
+            return UiSnapshot(PDD, ACTIVITY, buildList {
+                add(node("待付款"))
+                // Amount scrolls away before the order fields become visible.
+                if (swipes == 0) amounts.forEach { add(node(it)) }
+                add(node("订单号：PDD-DEMO-325", swipes >= requiredSwipes))
+                add(node("下单时间：2026-09-19 11:21:43", swipes >= requiredSwipes))
+                add(node("去支付"))
+            })
+        }
+        override fun backPurchase(): Boolean { backs++; return true }
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean {
+            assertEquals(SwipeDirection.UP, direction)
+            assertTrue(elapsed >= paymentMs)
+            if (firstSwipeAt == null) firstSwipeAt = elapsed
+            swipes++
+            return true
+        }
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicks++
+            throw AssertionError("Read-only unpaid branch must never click")
+        }
+        private fun node(text: String, visible: Boolean = true) = SnapshotNode(
+            text, null, text, null, null, "android.widget.TextView",
+            NodeBounds(0, 100, 500, if (visible) 180 else 100),
+            false, false, false, false, true, visible,
+        )
+    }
+
+    @Test
+    fun `verified spec panel advances through one exact confirm target`() {
+        val driver = SpecConfirmationDriver()
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation()
+
+        assertEquals(listOf("确定"), driver.clicked)
+        assertEquals("order", driver.page)
+    }
+
+    @Test
+    fun `ambiguous missing and unchanged spec confirmation stop safely`() {
+        val ambiguous = SpecConfirmationDriver(confirmLabels = listOf("确定", "确认"))
+        val ambiguousError = runCatching { PurchaseLiveAutomation(ambiguous, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", ambiguousError.code)
+        assertTrue(ambiguous.clicked.isEmpty())
+
+        val missing = SpecConfirmationDriver(confirmLabels = emptyList(), specPanelScrollable = true)
+        val missingError = runCatching { PurchaseLiveAutomation(missing, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRM_TARGET_MISSING", missingError.code)
+        assertTrue(missing.clicked.isEmpty())
+
+        val unchanged = SpecConfirmationDriver(advanceAfterClick = false)
+        val unchangedError = runCatching { PurchaseLiveAutomation(unchanged, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_UNCONFIRMED", unchangedError.code)
+        assertEquals(listOf("确定"), unchanged.clicked)
+    }
+
+    @Test
+    fun `existing order confirmation does not click submit or payment controls`() {
+        val driver = SpecConfirmationDriver(startOnOrderPage = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation()
+
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `recorded exact selections allow one unique confirm on an unclassified pdd panel`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation(
+            allowUnclassifiedPanelWithSelectionProof = true,
+        )
+
+        assertEquals(listOf("确定"), driver.clicked)
+        assertEquals("order", driver.page)
+    }
+
+    @Test
+    fun `unclassified pdd panel without recorded selections remains blocked`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `recorded selections never authorize a generic unclassified pdd dialog`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true, unclassifiedHasPurchaseEvidence = false)
+        val error = runCatching {
+            PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation(
+                allowUnclassifiedPanelWithSelectionProof = true,
+            )
+        }.exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
     @Test
     fun `address is retagged verified and final order button can only be clicked once`() {
         val driver = LiveDriver()
         val automation = PurchaseLiveAutomation(driver, pause = {})
         val address = automation.updateShippingAddress("_cg11")
         assertEquals("广东省广州市天园街道骏景花园骏晖轩1202_cg11", address.expectedAddress)
-        assertEquals(1, driver.addressTaps)
+        // #335: the confirmation-page fixture now wraps the masked phone in a clickable
+        // row (required so the page satisfies #331 REQUIRED_EVIDENCE panel recognition,
+        // which finalSubmitTargets depends on). That changes address entry activation
+        // from a bare TAP to a CLICK through the row's path, same as production PDD rows.
+        assertEquals(0, driver.addressTaps)
+        assertEquals(1, driver.addressPathClicks)
         assertEquals("editor-address", driver.lastInputTargetPath)
         val final = automation.finalConfirmation(input(), address)
         assertEquals("_cg11", final.addressSuffix)
@@ -64,6 +244,31 @@ class PurchaseLiveAutomationTest {
         assertEquals(0, driver.submitClicks)
     }
 
+    @Test
+    fun `saved address returning to spec panel is recovered without pressing back`() {
+        val driver = LiveDriver(saveReturnsToSpecPanel = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+
+        val address = automation.updateShippingAddress("_cg91")
+        val final = automation.finalConfirmation(input().copy(addressSuffix = "_cg91"), address)
+
+        assertEquals("_cg91", final.addressSuffix)
+        assertEquals(0, driver.backCount)
+        assertEquals(1, driver.scopedSwipes)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `saved address stuck on spec panel fails without backing out or submitting`() {
+        val driver = LiveDriver(saveReturnsToSpecPanel = true, savedSpecPanelRecoveryStuck = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg92") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertEquals(0, driver.backCount)
+        assertEquals(0, driver.submitClicks)
+    }
+
     @Test
     fun `edit field containing suffix cannot impersonate post save evidence`() {
         val driver = LiveDriver(saveStaysInEdit = true)
@@ -120,6 +325,151 @@ class PurchaseLiveAutomationTest {
         assertFalse(driver.clicked.any { it.startsWith("微信") || it.contains("支付") })
     }
 
+    @Test
+    fun `payment page returns to folded unpaid order detail and scrolls to read evidence`() {
+        val driver = LiveDriver(chooserAfterSubmit = true, orderEvidenceBelowFold = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg54")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg54"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(2, driver.postSubmitBackCount)
+        assertEquals(1, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `successful order page enters the unique order detail before reading the result`() {
+        val driver = LiveDriver(orderDetailEntryAfterSubmit = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg56")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg56"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(1, driver.orderDetailEntryClicks)
+        assertEquals("order", driver.currentPage)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `order detail entered from success page scrolls only to reveal folded result evidence`() {
+        val driver = LiveDriver(orderDetailEntryAfterSubmit = true, orderDetailEvidenceBelowFold = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg58")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg58"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(1, driver.orderDetailEntryClicks)
+        assertEquals(1, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `unpaid order evidence on reused payment activity scrolls read only instead of backing out`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = listOf("order-folded-payment-activity"))
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg59")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg59"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals(0, driver.postSubmitBackCount)
+        assertEquals(1, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `ambiguous order detail entries stop without navigating`() {
+        val driver = LiveDriver(orderDetailEntryAfterSubmit = true, duplicateOrderDetailEntry = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg57")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg57"), address)
+        automation.submitOrderOnce()
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals("PURCHASE_ORDER_DETAIL_ENTRY_AMBIGUOUS", automation.lastOrderReadFailure?.code)
+        assertEquals(0, driver.orderDetailEntryClicks)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `payment transition frame after safe back reaches unpaid order evidence without payment clicks`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = listOf("payment", "payment", "order"))
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg55")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg55"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals("2026-08-21T02:30:00Z", order?.submittedAt)
+        assertEquals(1, driver.postSubmitBackCount)
+        assertEquals(0, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    // `[必须]` #302：卡在支付页放弃时，paymentPageObserved 必须为 true——这正是
+    // 「大概率已经下单只是没读到证据」的信号，区分于真的什么都没发生的失败。
+    @Test
+    fun `payment repeated failure marks paymentPageObserved so it can be triaged later`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = List(4) { "payment" })
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg55")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg55"), address)
+        automation.submitOrderOnce()
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals("PURCHASE_ORDER_PAYMENT_REPEATED", automation.lastOrderReadFailure?.code)
+        assertTrue(automation.lastOrderReadFailure?.paymentPageObserved ?: false)
+    }
+
+    // 从未出现过支付/待付款文案的失败不该被标记，否则这个字段就没有区分价值了。
+    @Test
+    fun `a failure that never saw the payment page leaves paymentPageObserved false`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = List(15) { "empty" })
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg30")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg30"), address)
+        automation.submitOrderOnce()
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals("PURCHASE_ORDER_EMPTY_TIMEOUT", automation.lastOrderReadFailure?.code)
+        assertFalse(automation.lastOrderReadFailure?.paymentPageObserved ?: true)
+    }
+
+    @Test
+    fun `continuous payment activity still stops at bounded post back samples without payment clicks`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = List(4) { "payment" })
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg55")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg55"), address)
+        automation.submitOrderOnce()
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals("PURCHASE_ORDER_PAYMENT_REPEATED", automation.lastOrderReadFailure?.code)
+        assertEquals(
+            "支付页安全返回后持续无订单证据，已停止自动核单" +
+                "[paymentBackAttempts=1;consecutivePaymentSamplesAfterBack=25]",
+            automation.lastOrderReadFailure?.message,
+        )
+        assertEquals(26, driver.postSubmitCaptureCount)
+        assertEquals(1, driver.postSubmitBackCount)
+        assertEquals(0, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
     @Test
     fun `WeChat login is not touched and PDD is restored once before reading order detail`() {
         val driver = LiveDriver(wechatLoginAfterSubmit = true)
@@ -283,6 +633,52 @@ class PurchaseLiveAutomationTest {
         assertTrue(driver.clicked.isEmpty())
     }
 
+    @Test
+    fun `duplicate masked phone nodes in one clickable address card are activated once`() {
+        val driver = LiveDriver(duplicatePhoneNodesSameCard = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94")
+
+        assertEquals(1, driver.clicked.count { it == "138****5678" })
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `duplicate semantic address cards in separate accessibility trees are activated once`() {
+        val driver = LiveDriver(duplicateSemanticAddressCards = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94")
+
+        assertEquals(1, driver.addressPathClicks)
+        assertEquals(1, driver.clicked.count { it == "138****5678" })
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `two independent address cards remain ambiguous without any click`() {
+        val driver = LiveDriver(duplicateAddressCards = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg95") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", error.code)
+        assertTrue(error.message.orEmpty().contains("phoneNodes=2;addressCards=2;tapTargets=2"))
+        assertFalse(error.message.orEmpty().contains("138"))
+        assertTrue(driver.clicked.isEmpty())
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `address entry path drift fails without fallback tap`() {
+        val driver = LiveDriver(duplicatePhoneNodesSameCard = true, addressEntryPathUnavailable = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_ENTRY_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+        assertEquals(1, driver.addressPathClicks)
+        assertEquals(0, driver.addressTaps)
+    }
+
     private fun input() = PurchaseExecutionInput(
         taskId = 11,
         executionMode = "live",
@@ -297,6 +693,78 @@ class PurchaseLiveAutomationTest {
         addressSuffix = "_cg11",
     )
 
+    private class SpecConfirmationDriver(
+        private val confirmLabels: List<String> = listOf("确定"),
+        private val advanceAfterClick: Boolean = true,
+        private val specPanelScrollable: Boolean = false,
+        private val unclassifiedSpecPanel: Boolean = false,
+        private val unclassifiedHasPurchaseEvidence: Boolean = true,
+        startOnOrderPage: Boolean = false,
+    ) : PurchaseUiDriver {
+        var page = if (startOnOrderPage) "order" else "spec"
+        val clicked = mutableListOf<String>()
+
+        override fun capture(): UiSnapshot = if (page == "order") {
+            snapshot(listOf(
+                node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)),
+                node("scroll", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 2100)),
+                node("summary", "已选 黑色 均码"),
+                node("quantity", "1", className = "android.widget.EditText"),
+                node("phone", "138****5678"),
+                node("submit", "提交订单", clickable = true),
+                node("payment", "微信支付"),
+            ))
+        } else {
+            snapshot(buildList {
+                add(node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)))
+                if (unclassifiedSpecPanel) {
+                    if (unclassifiedHasPurchaseEvidence) {
+                        add(node("price", "¥20.00"))
+                        add(node("quantity", "1", className = "android.widget.EditText"))
+                    }
+                    confirmLabels.forEachIndexed { index, label -> add(node("confirm-$index", label, clickable = true)) }
+                    return@buildList
+                }
+                if (specPanelScrollable) {
+                    add(node("scroll", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 1500)))
+                }
+                add(node("title", "确认款式"))
+                add(node("summary", "已选 黑色 均码"))
+                val parent = "scroll".takeIf { specPanelScrollable }
+                val prefix = if (specPanelScrollable) "scroll/" else ""
+                add(node("${prefix}color-heading", "颜色分类", parentPath = parent))
+                add(node("${prefix}color", "黑色", clickable = true, parentPath = parent))
+                add(node("${prefix}size-heading", "尺码", parentPath = parent))
+                add(node("${prefix}size", "均码", clickable = true, parentPath = parent))
+                add(node("quantity", "1", className = "android.widget.EditText"))
+                confirmLabels.forEachIndexed { index, label -> add(node("confirm-$index", label, clickable = true)) }
+            })
+        }
+
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicked += target.label
+            if (advanceAfterClick && target.label in confirmLabels) page = "order"
+            return FreshActionResult.SUCCESS
+        }
+
+        override fun tapPurchaseFresh(target: SnapshotNode) = FreshActionResult.FAILED
+        override fun inputFresh(target: SnapshotNode, value: String) = FreshActionResult.FAILED
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long) = false
+        override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long) = false
+        override fun backPurchase() = false
+
+        private fun snapshot(nodes: List<SnapshotNode>) = UiSnapshot(PDD, ACTIVITY, nodes)
+        private fun node(
+            path: String,
+            text: String,
+            clickable: Boolean = false,
+            scrollable: Boolean = false,
+            className: String = "android.widget.TextView",
+            bounds: NodeBounds = NodeBounds(20, 100, 900, 180),
+            parentPath: String? = null,
+        ) = SnapshotNode(path, parentPath, text, null, null, className, bounds, clickable, scrollable, false, false, true, true)
+    }
+
     private class LiveDriver(
         private val addressClipped: Boolean = false,
         private val duplicatePanels: Boolean = false,
@@ -308,8 +776,18 @@ class PurchaseLiveAutomationTest {
         private val saveStaysInEdit: Boolean = false,
         private val savedTransitionWithoutLegacyContext: Boolean = false,
         private val savedTransitionHidesSuffix: Boolean = false,
+        private val saveReturnsToSpecPanel: Boolean = false,
+        private val savedSpecPanelRecoveryStuck: Boolean = false,
+        private val duplicatePhoneNodesSameCard: Boolean = false,
+        private val duplicateSemanticAddressCards: Boolean = false,
+        private val duplicateAddressCards: Boolean = false,
+        private val addressEntryPathUnavailable: Boolean = false,
         private val wechatLoginAfterSubmit: Boolean = false,
         private val wechatRestoreStuck: Boolean = false,
+        private val orderEvidenceBelowFold: Boolean = false,
+        private val orderDetailEntryAfterSubmit: Boolean = false,
+        private val orderDetailEvidenceBelowFold: Boolean = false,
+        private val duplicateOrderDetailEntry: Boolean = false,
         postSubmitCaptureSequence: List<String> = emptyList(),
     ) : PurchaseUiDriver {
         private var page = "confirmation"
@@ -322,10 +800,12 @@ class PurchaseLiveAutomationTest {
         var scopedSwipes = 0
         var genericSwipes = 0
         var addressTaps = 0
+        var addressPathClicks = 0
         var lastInputTargetPath: String? = null
         var backCount = 0
         var postSubmitBackCount = 0
         var pddRestoreCount = 0
+        var orderDetailEntryClicks = 0
         var postSubmitCaptureCount = 0
         val currentPage: String get() = page
 
@@ -358,8 +838,36 @@ class PurchaseLiveAutomationTest {
                 node("transition-title", "选择收货信息"),
                 node("address-summary", if (savedTransitionHidesSuffix) "已保存的收货信息" else address.substring(address.lastIndexOf("_cg"))),
             ))
+            "post-save-spec" -> snapshot(listOf(
+                node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)),
+                node("panel", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 2100)),
+                node("panel-title", "确认款式", bounds = NodeBounds(20, 396, 300, 430)),
+                node("panel/price", "¥20.00", parentPath = "panel", bounds = NodeBounds(20, 460, 300, 520)),
+                node("panel/selected", "已选 黑色 XL", parentPath = "panel", bounds = NodeBounds(20, 540, 700, 600)),
+                node("panel/color-heading", "颜色分类", parentPath = "panel", bounds = NodeBounds(20, 650, 300, 700)),
+                node("panel/color", "黑色", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 720, 220, 790)),
+                node("panel/size-heading", "尺码", parentPath = "panel", bounds = NodeBounds(20, 850, 300, 900)),
+                node("panel/size", "XL", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 920, 220, 990)),
+                node("panel/quantity", "2", className = "android.widget.EditText", parentPath = "panel", bounds = NodeBounds(400, 1050, 600, 1120)),
+                node("panel/confirm", "确定", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 1200, 500, 1280)),
+                node("submit-parent", "", clickable = true, bounds = NodeBounds(20, 1900, 1000, 2100)),
+                node("submit", "提交订单", parentPath = "submit-parent", bounds = NodeBounds(520, 1940, 980, 2040)),
+            ))
             "order" -> snapshot(listOf(node("status", "待付款"), node("order", "订单号：PDD-202608210001"), node("time", "下单时间：2026-08-21 10:30:00"), node("pay", "立即支付", clickable = true)))
+            "order-folded" -> snapshot(listOf(node("status", "待付款"), node("pay", "立即支付", clickable = true)))
+            "order-folded-payment-activity" -> UiSnapshot(PDD, "com.xunmeng.pinduoduo.app_pay.core.PayActivity", listOf(
+                node("status", "待付款"), node("pay", "立即支付", clickable = true),
+            ))
             "order-no-time" -> snapshot(listOf(node("status", "待付款"), node("order", "订单号：PDD-202608210001"), node("pay", "去支付", clickable = true)))
+            "success" -> snapshot(buildList {
+                add(node("success-title", "购买成功"))
+                add(node("detail-parent", "", clickable = true))
+                add(node("detail", "查看订单", parentPath = "detail-parent"))
+                if (duplicateOrderDetailEntry) {
+                    add(node("detail-parent-2", "", clickable = true))
+                    add(node("detail-2", "订单详情", parentPath = "detail-parent-2"))
+                }
+            })
             "chooser" -> UiSnapshot(if (trustedChooser) "android" else "example.untrusted", "com.android.internal.app.ChooserActivity", listOf(
                 node("chooser-title", "选择要使用的应用"), node("wechat-1", "微信"), node("wechat-2", "微信分身"),
             ))
@@ -369,26 +877,61 @@ class PurchaseLiveAutomationTest {
             "unknown" -> UiSnapshot("example.untrusted", "example.untrusted.UnknownActivity", emptyList())
             "pdd-home" -> UiSnapshot(PDD, "com.xunmeng.pinduoduo.ui.activity.MainFrameActivity", listOf(node("home", "拼多多首页")))
             else -> {
+                // #335: the confirmation page must satisfy PddScreenParser's spec-panel
+                // recognition (#331 REQUIRED_EVIDENCE fallback: address entry + payment
+                // entry + one quantity input, all sharing the "panel" container) so the
+                // new bottom-most-clickable-node submit rule has a recognized panel to
+                // operate on. "panel/submit" keeps the legacy exact "提交订单" label so
+                // existing click-driven state transitions below stay unchanged.
                 val nodes = mutableListOf(
                     node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)),
-                    node("panel", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 2100)),
-                    node("price", "¥20.00"), node("selected", "已选 黑色 XL"),
-                    node("quantity", "2", className = "android.widget.EditText"),
-                    node("submit-parent", "", clickable = true), node("submit", "提交订单", parentPath = "submit-parent"),
+                    node("panel", "", scrollable = true, parentPath = "root", bounds = NodeBounds(0, 400, 1080, 2100)),
+                    node("panel/price", "¥20.00", parentPath = "panel", bounds = NodeBounds(20, 420, 300, 470)),
+                    node("panel/selected", "已选 黑色 XL", parentPath = "panel", bounds = NodeBounds(20, 480, 700, 530)),
+                    node("panel/quantity", "2", className = "android.widget.EditText", parentPath = "panel", bounds = NodeBounds(400, 560, 600, 620)),
+                    node("panel/payment-row", "", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 640, 1060, 710)),
+                    node("panel/payment-row/label", "微信支付", parentPath = "panel/payment-row", bounds = NodeBounds(40, 650, 300, 700)),
+                    node("panel/submit", "提交订单", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 1900, 1060, 2080)),
                 )
                 if (duplicatePanels) nodes += node("panel2", "", scrollable = true, bounds = NodeBounds(0, 500, 1080, 2000))
                 if (addressVisible) {
-                    nodes += node("phone", "138****5678")
+                    when {
+                        duplicateSemanticAddressCards -> {
+                            nodes += node("panel/address-layer-a", "", clickable = true, parentPath = "panel", bounds = NodeBounds(0, 820, 1080, 900))
+                            nodes += node("panel/address-layer-a/phone", "138****5678", parentPath = "panel/address-layer-a", bounds = NodeBounds(20, 830, 400, 860))
+                            nodes += node("panel/address-layer-a/detail", "广东省广州市天园街道骏景花园", parentPath = "panel/address-layer-a", bounds = NodeBounds(20, 862, 900, 898))
+                            nodes += node("panel/address-layer-b", "", clickable = true, parentPath = "panel", bounds = NodeBounds(0, 910, 1080, 990))
+                            nodes += node("panel/address-layer-b/phone", "138****5678", parentPath = "panel/address-layer-b", bounds = NodeBounds(20, 920, 400, 950))
+                            nodes += node("panel/address-layer-b/detail", "广东省广州市天园街道骏景花园", parentPath = "panel/address-layer-b", bounds = NodeBounds(20, 952, 900, 988))
+                        }
+                        duplicateAddressCards -> {
+                            nodes += node("panel/address-card-a", "", clickable = true, parentPath = "panel", bounds = NodeBounds(0, 820, 1080, 900))
+                            nodes += node("panel/address-card-a/phone", "138****5678", parentPath = "panel/address-card-a", bounds = NodeBounds(20, 830, 400, 860))
+                            nodes += node("panel/address-card-a/detail", "广东省广州市天园街道一号", parentPath = "panel/address-card-a", bounds = NodeBounds(20, 862, 900, 898))
+                            nodes += node("panel/address-card-b", "", clickable = true, parentPath = "panel", bounds = NodeBounds(0, 910, 1080, 990))
+                            nodes += node("panel/address-card-b/phone", "138****5678", parentPath = "panel/address-card-b", bounds = NodeBounds(20, 920, 400, 950))
+                            nodes += node("panel/address-card-b/detail", "广东省广州市天园街道二号", parentPath = "panel/address-card-b", bounds = NodeBounds(20, 952, 900, 988))
+                        }
+                        duplicatePhoneNodesSameCard -> {
+                            nodes += node("panel/address-card", "", clickable = true, parentPath = "panel", bounds = NodeBounds(0, 820, 1080, 900))
+                            nodes += node("panel/address-card/phone-a", "138****5678", parentPath = "panel/address-card", bounds = NodeBounds(20, 830, 400, 860))
+                            nodes += node("panel/address-card/phone-b", "138****5678", parentPath = "panel/address-card", bounds = NodeBounds(20, 862, 440, 892))
+                        }
+                        else -> {
+                            nodes += node("panel/address-row", "", clickable = true, parentPath = "panel", bounds = NodeBounds(0, 820, 1080, 900))
+                            nodes += node("panel/address-row/phone", "138****5678", parentPath = "panel/address-row", bounds = NodeBounds(20, 830, 400, 890))
+                        }
+                    }
                     val suffixStart = address.lastIndexOf("_cg")
                     val addressBody = if (suffixStart >= 0) address.substring(0, suffixStart) else address
                     val addressSuffix = if (suffixStart >= 0) address.substring(suffixStart) else ""
                     when {
                         hideConfirmationSuffix -> nodes += node("address", addressBody)
                         splitConfirmationAddress -> {
-                            nodes += node("address-body", addressBody, bounds = NodeBounds(20, 700, 900, 780))
-                            nodes += node("address-suffix", addressSuffix, bounds = NodeBounds(20, 780, 300, 840))
+                            nodes += node("address-body", addressBody, bounds = NodeBounds(20, 1000, 900, 1080))
+                            nodes += node("address-suffix", addressSuffix, bounds = NodeBounds(20, 1090, 300, 1150))
                             if (duplicateConfirmationSuffix) {
-                                nodes += node("address-suffix-2", addressSuffix, bounds = NodeBounds(500, 780, 780, 840))
+                                nodes += node("address-suffix-2", addressSuffix, bounds = NodeBounds(500, 1090, 780, 1150))
                             }
                         }
                         else -> nodes += node("address", address)
@@ -403,19 +946,38 @@ class PurchaseLiveAutomationTest {
             when (target.label) {
                 "138****5678" -> page = "panel"
                 "修改" -> page = "edit"
-                "保存" -> if (!saveStaysInEdit) page = if (savedTransitionWithoutLegacyContext) "saved-transition" else "panel"
+                "保存" -> if (!saveStaysInEdit) {
+                    page = when {
+                        saveReturnsToSpecPanel -> "post-save-spec"
+                        savedTransitionWithoutLegacyContext -> "saved-transition"
+                        else -> "panel"
+                    }
+                }
                 "提交订单" -> {
                     submitClicks++
                     page = when {
                         chooserAfterSubmit -> "chooser"
                         wechatLoginAfterSubmit -> "wechat-login"
+                        orderDetailEntryAfterSubmit -> "success"
                         else -> "order"
                     }
                 }
+                "查看订单", "订单详情" -> {
+                    orderDetailEntryClicks++
+                    page = if (orderDetailEvidenceBelowFold) "order-folded" else "order"
+                }
             }
             return FreshActionResult.SUCCESS
         }
 
+        override fun clickAddressEntryFresh(target: SnapshotNode): FreshClickOutcome {
+            addressPathClicks++
+            if (addressEntryPathUnavailable) {
+                return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+            }
+            return FreshClickOutcome(clickFresh(target), FreshClickReason.SUCCESS, 1, 1)
+        }
+
         override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult {
             addressTaps++
             clicked += target.label
@@ -428,10 +990,15 @@ class PurchaseLiveAutomationTest {
             address = value
             return FreshActionResult.SUCCESS
         }
-        override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean { genericSwipes++; return true }
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean {
+            genericSwipes++
+            if (page in setOf("order-folded", "order-folded-payment-activity") && direction == SwipeDirection.UP) page = "order"
+            return true
+        }
         override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
             scopedSwipes++
             if (target.path == "panel" && direction == SwipeDirection.DOWN) addressVisible = true
+            if (page == "post-save-spec" && direction == SwipeDirection.DOWN && !savedSpecPanelRecoveryStuck) page = "confirmation"
             return true
         }
         override fun backPurchase(): Boolean {
@@ -439,7 +1006,7 @@ class PurchaseLiveAutomationTest {
             if (page == "chooser" || page == "payment") postSubmitBackCount++
             page = when (page) {
                 "chooser" -> "payment"
-                "payment" -> "order"
+                "payment" -> if (orderEvidenceBelowFold) "order-folded" else "order"
                 else -> "confirmation"
             }
             return true

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseResultBubblePolicyTest.kt

@@ -0,0 +1,72 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePolicy
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubbleSession
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PurchaseResultBubblePolicyTest {
+    @Test
+    fun `spec probe does not display a final result bubble`() {
+        assertNull(PurchaseResultBubblePolicy.create(69, "spec_probe_completed", "probeSpecs", "规格已回传"))
+    }
+
+    @Test
+    fun `failure includes the real step and sanitized reason for eight seconds`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            69,
+            "failed",
+            "selectSpec",
+            "没有找到精确规格\n请重试 token=secret-value",
+        ))
+
+        assertEquals("CG-69 失败于：选择颜色与尺码", result.title)
+        assertEquals("没有找到精确规格 请重试 token=[已隐藏]", result.message)
+        assertTrue(result.isFailure)
+        assertEquals(8_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `unknown order result is presented as a failure requiring manual check`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            70,
+            "order_result_unknown",
+            "readOrderResult",
+            "无法确认订单是否创建，请人工检查",
+        ))
+
+        assertEquals("CG-70 待人工核对｜读取订单编号和下单时间", result.title)
+        assertTrue(result.isFailure)
+        assertEquals(8_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `successful order uses a short factual summary for three seconds`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            71,
+            "order_created",
+            "readOrderResult",
+            "ignored",
+        ))
+
+        assertEquals("CG-71 采购完成", result.title)
+        assertEquals("已获取订单编号和下单时间", result.message)
+        assertFalse(result.isFailure)
+        assertEquals(3_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `new result and dismiss invalidate an older scheduled bubble`() {
+        val session = PurchaseResultBubbleSession()
+        val first = session.replace()
+        val second = session.replace()
+        assertFalse(session.isCurrent(first))
+        assertTrue(session.isCurrent(second))
+
+        session.dismiss()
+        assertFalse(session.isCurrent(second))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseResultPayloadTest.kt

@@ -8,6 +8,16 @@ import org.junit.Assert.assertFalse
 import org.junit.Test
 
 class PurchaseResultPayloadTest {
+    @Test
+    fun `created order serializes optional payable total separately from unit price`() {
+        val outcome = PurchaseExecutionOutcome("order_created", message = "test", actualUnitPriceCent = 1600, pddOrderAmountCent = 1300)
+        val payload = JSONObject(purchaseResultPayload("r", "a", outcome))
+        assertEquals(1300L, payload.getLong("pddOrderAmountCent"))
+        assertEquals(1600L, payload.getLong("actualUnitPriceCent"))
+        assertFalse(JSONObject(purchaseResultPayload("r", "a", outcome.copy(pddOrderAmountCent = null))).has("pddOrderAmountCent"))
+        assertFalse(JSONObject(purchaseResultPayload("r", "a", outcome.copy(resultType = "order_result_unknown"))).has("pddOrderAmountCent"))
+    }
+
     @Test
     fun `unknown order result keeps stable failure and verified price without order fields`() {
         val payload = JSONObject(purchaseResultPayload(

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseRetryPolicyTest.kt

@@ -16,18 +16,22 @@ class PurchaseRetryPolicyTest {
     }
 
     @Test
-    fun `retry confirmation explains same task latest rule and no payment`() {
+    fun `ordinary retry uses same task new attempt and no payment`() {
         val message = PurchaseRetryPolicy.confirmationMessage()
-        assertTrue(message.contains("当前任务"))
-        assertTrue(message.contains("最新采购规则"))
-        assertFalse(message.contains("新采购任务"))
+        assertTrue(PurchaseRetryPolicy.usesInPlaceReset(continuing = false))
+        assertTrue(message.contains("复用原采购任务"))
+        assertTrue(message.contains("新一次执行"))
+        assertTrue(message.contains("当前有效采购规则"))
+        assertTrue(message.contains("任务快照保持不变"))
         assertTrue(message.contains("待付款订单"))
         assertTrue(message.contains("不会支付"))
+        assertFalse(message.contains("新采购任务"))
     }
 
     @Test
     fun `continue confirmation remains a new purchase task`() {
         val message = PurchaseRetryPolicy.confirmationMessage(continuing = true)
+        assertFalse(PurchaseRetryPolicy.usesInPlaceReset(continuing = true))
         assertTrue(message.contains("新采购任务"))
         assertTrue(message.contains("替代商品"))
         assertTrue(message.contains("不会支付"))

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseScrollLocatorTest.kt

@@ -0,0 +1,39 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.NodeBounds
+import cn.ilapage.goauto.agent.automation.PurchaseScrollCandidate
+import cn.ilapage.goauto.agent.automation.PurchaseScrollLocator
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class PurchaseScrollLocatorTest {
+    private val outer = PurchaseScrollCandidate("0/1", "RecyclerView", NodeBounds(0, 1038, 1080, 2079))
+    private val inner = PurchaseScrollCandidate("0/1/0", "RecyclerView", NodeBounds(36, 1149, 1080, 2007))
+
+    @Test fun nestedContainersWithNearbyCentersResolveOuter() {
+        assertEquals(outer, PurchaseScrollLocator.locate(outer, listOf(inner, outer)))
+    }
+
+    @Test fun pathDisambiguatesIdenticalBounds() {
+        val nested = outer.copy(path = "0/1/0")
+        assertEquals(outer, PurchaseScrollLocator.locate(outer, listOf(nested, outer)))
+    }
+
+    @Test fun changedPathRequiresUniqueFullBoundsMatch() {
+        val moved = outer.copy(path = "0/2")
+        assertEquals(moved, PurchaseScrollLocator.locate(outer, listOf(inner, moved)))
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(moved, moved.copy(path = "0/3"))))
+    }
+
+    @Test fun reusedPathWithDifferentGeometryIsRejected() {
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(inner.copy(path = outer.path))))
+    }
+
+    @Test fun classAndAllEdgesAreValidated() {
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(outer.copy(className = "ScrollView"))))
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(
+            outer.copy(bounds = NodeBounds(0, 1138, 1080, 1979)),
+        )))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseSpecProbePolicyTest.kt

@@ -0,0 +1,120 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.PurchaseExecutionOutcome
+import cn.ilapage.goauto.agent.automation.PurchaseSpecProbePolicy
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PurchaseSpecProbePolicyTest {
+
+    @Test
+    fun `zero dimensions is treated as empty`() {
+        assertTrue(PurchaseSpecProbePolicy.isDimensionsEmpty("""{"dimensions":[]}"""))
+    }
+
+    @Test
+    fun `dimensions with no values is treated as empty`() {
+        assertTrue(
+            PurchaseSpecProbePolicy.isDimensionsEmpty(
+                """{"dimensions":[{"key":"color","name":"颜色","values":[]},{"key":"size","name":"尺码","values":[]}]}""",
+            ),
+        )
+    }
+
+    @Test
+    fun `null blank or malformed payload is treated as empty`() {
+        assertTrue(PurchaseSpecProbePolicy.isDimensionsEmpty(null))
+        assertTrue(PurchaseSpecProbePolicy.isDimensionsEmpty(""))
+        assertTrue(PurchaseSpecProbePolicy.isDimensionsEmpty("not json"))
+    }
+
+    @Test
+    fun `dimensions with at least one value is not empty`() {
+        assertFalse(
+            PurchaseSpecProbePolicy.isDimensionsEmpty(
+                """{"dimensions":[{"key":"color","name":"颜色","values":["红色"]}]}""",
+            ),
+        )
+    }
+
+    @Test
+    fun `demote replaces an empty spec_probe_completed outcome with an explicit failure`() {
+        val outcome = PurchaseExecutionOutcome(
+            "spec_probe_completed",
+            message = "商品规格已回传，等待服务端匹配",
+            probedSpecs = """{"dimensions":[]}""",
+        )
+
+        val demoted = PurchaseSpecProbePolicy.demote(outcome)
+
+        assertEquals("failed", demoted.resultType)
+        assertEquals("PURCHASE_SPEC_PROBE_EMPTY", demoted.errorCode)
+        assertEquals("规格探测未读取到任何颜色或尺码", demoted.message)
+    }
+
+    @Test
+    fun `demote leaves a non-empty probe result unchanged`() {
+        val outcome = PurchaseExecutionOutcome(
+            "spec_probe_completed",
+            message = "商品规格已回传，等待服务端匹配",
+            probedSpecs = """{"dimensions":[{"key":"color","name":"颜色","values":["红色"]}]}""",
+        )
+
+        val demoted = PurchaseSpecProbePolicy.demote(outcome)
+
+        assertEquals(outcome, demoted)
+    }
+
+    @Test
+    fun `demote leaves other outcome types unchanged`() {
+        val outcome = PurchaseExecutionOutcome("failed", "PURCHASE_SPEC_NOT_MATCHED", "商品规格探测失败")
+
+        val demoted = PurchaseSpecProbePolicy.demote(outcome)
+
+        assertEquals(outcome, demoted)
+    }
+
+    @Test
+    fun `extractCollectorFailureCode reads the encoded collector failure code`() {
+        val payload = PurchaseSpecProbePolicy.encodeCollectorFailure("719834019024", "SPEC_PANEL_TOP_COLLAPSED", "回顶滑动导致规格标题消失，已停止滑动")
+
+        assertEquals("SPEC_PANEL_TOP_COLLAPSED", PurchaseSpecProbePolicy.extractCollectorFailureCode(payload))
+    }
+
+    @Test
+    fun `extractCollectorFailureCode returns null for a normal probe payload`() {
+        assertEquals(
+            null,
+            PurchaseSpecProbePolicy.extractCollectorFailureCode(
+                """{"dimensions":[{"key":"color","name":"颜色","values":["红色"]}]}""",
+            ),
+        )
+        assertEquals(null, PurchaseSpecProbePolicy.extractCollectorFailureCode(null))
+    }
+
+    @Test
+    fun `demote surfaces an encoded SPEC_PANEL_TOP_COLLAPSED collector failure with a purchaser-readable message`() {
+        val payload = PurchaseSpecProbePolicy.encodeCollectorFailure("719834019024", "SPEC_PANEL_TOP_COLLAPSED", "回顶滑动导致规格标题消失，已停止滑动")
+        val outcome = PurchaseExecutionOutcome("spec_probe_completed", message = "商品规格已回传，等待服务端匹配", probedSpecs = payload)
+
+        val demoted = PurchaseSpecProbePolicy.demote(outcome)
+
+        assertEquals("failed", demoted.resultType)
+        assertEquals("PURCHASE_SPEC_PROBE_FAILED", demoted.errorCode)
+        assertEquals("规格探测时规格面板被拖动，规格标题消失", demoted.message)
+    }
+
+    @Test
+    fun `demote falls back to a generic message for an unrecognized collector failure code`() {
+        val payload = PurchaseSpecProbePolicy.encodeCollectorFailure("719834019024", "RULE_NOT_MATCHED", "采集期间离开 PDD 商品详情页")
+        val outcome = PurchaseExecutionOutcome("spec_probe_completed", message = "商品规格已回传，等待服务端匹配", probedSpecs = payload)
+
+        val demoted = PurchaseSpecProbePolicy.demote(outcome)
+
+        assertEquals("failed", demoted.resultType)
+        assertEquals("PURCHASE_SPEC_PROBE_FAILED", demoted.errorCode)
+        assertTrue(demoted.message.contains("RULE_NOT_MATCHED"))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/SpecOptionDedupTest.kt

@@ -0,0 +1,86 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.PddScreenParser
+import cn.ilapage.goauto.agent.automation.PurchaseAgentCapabilities
+import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
+import cn.ilapage.goauto.agent.automation.PurchaseRehearsalExecutor
+import cn.ilapage.goauto.agent.automation.PurchaseRuleParser
+import cn.ilapage.goauto.agent.automation.PurchaseUiDriver
+import cn.ilapage.goauto.agent.automation.SnapshotNode
+import cn.ilapage.goauto.agent.automation.SwipeDirection
+import cn.ilapage.goauto.agent.automation.UiSnapshot
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** #332 spec-option dedup (task 535) and the selection-failure diagnostic. */
+class SpecOptionDedupTest {
+    private fun parse(snapshot: UiSnapshot) =
+        PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "719834019024", null)
+
+    @Test
+    fun `nested clickable nodes of one option block form one value`() {
+        val screen = parse(SpecPanelFixtures.taskOptionDedupSheet())
+        val colors = screen.dimensions.single { it.key == "color" }.values
+        val sizes = screen.dimensions.single { it.key == "size" }.values
+
+        assertEquals(listOf("兰条纹", "白条纹"), colors.map { it.text })
+        assertTrue(colors.single { it.text == "兰条纹" }.node.selected)
+        assertFalse(colors.single { it.text == "白条纹" }.node.selected)
+        assertEquals(5, sizes.size)
+        assertEquals(listOf("2XL建议130-150斤"), sizes.filter { it.node.selected }.map { it.rawText })
+    }
+
+    @Test
+    fun `unconfirmed selection reports parsed values selected flags and target`() {
+        // The click never changes the page, so the white option stays unselected.
+        val driver = object : PurchaseUiDriver {
+            var opened = false
+            override fun capture(): UiSnapshot =
+                if (opened) SpecPanelFixtures.taskOptionDedupSheet() else SpecPanelFixtures.productDetailPage()
+            override fun clickFresh(target: SnapshotNode): FreshActionResult {
+                if (target.label.startsWith("请选择")) opened = true
+                return FreshActionResult.SUCCESS
+            }
+            override fun tapPurchaseFresh(target: SnapshotNode) = FreshActionResult.FAILED
+            override fun inputFresh(target: SnapshotNode, value: String) = FreshActionResult.FAILED
+            override fun swipePurchase(direction: SwipeDirection, durationMs: Long) = false
+            override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long) = false
+            override fun backPurchase() = false
+        }
+        val diagnostics = mutableListOf<String>()
+
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_SELECTION_UNCONFIRMED", outcome.errorCode)
+        val evidence = diagnostics.last { it.startsWith("specSelectionUnconfirmed;") }
+        assertTrue(evidence, evidence.contains("dimension=color;target=白条纹;valueCount=2;values=兰条纹:t|白条纹:f"))
+        assertFalse(evidence.contains("****"))
+    }
+
+    private fun input() = PurchaseExecutionInput(
+        taskId = 332,
+        executionMode = "rehearsal",
+        phase = "purchase",
+        url = "https://mobile.yangkeduo.com/goods.html?goods_id=719834019024",
+        goodsId = "719834019024",
+        mappedColor = "白条纹",
+        mappedSize = "",
+        quantity = 1,
+        minUnitPriceCent = 1_000,
+        maxUnitPriceCent = 3_000,
+    )
+
+    private fun rule() = """{
+      "schemaVersion":1,
+      "ruleType":"pddPurchase",
+      "requiredCapabilities":["purchase.rehearsal.v1"],
+      "actions":[
+        {"type":"openProduct"},{"type":"verifyProduct"},{"type":"openSpecPanel"},{"type":"selectSpec"},
+        {"type":"setQuantity"},{"type":"verifyUnitPrice"},{"type":"verifyOrderSummary"}
+      ]
+    }"""
+}

android/app/src/test/java/cn/ilapage/goauto/agent/SpecPanelFixtures.kt

@@ -0,0 +1,317 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.NodeBounds
+import cn.ilapage.goauto.agent.automation.SnapshotNode
+import cn.ilapage.goauto.agent.automation.UiSnapshot
+
+/**
+ * Sanitized spec-panel fixtures (#332 option dedup, #331 recognition). The layout mirrors the structure of real
+ * PDD purchase sheets, but every name, phone number and address is fake.
+ */
+internal object SpecPanelFixtures {
+    const val PDD = "com.xunmeng.pinduoduo"
+    const val ACTIVITY = "com.xunmeng.pinduoduo.activity.NewPageActivity"
+    const val FAKE_PHONE = "139****0000"
+
+    class Tree(private val screenBottom: Int) {
+        val nodes = mutableListOf<SnapshotNode>()
+
+        init {
+            add("r", "", NodeBounds(0, 0, 1080, screenBottom), className = "android.widget.FrameLayout")
+        }
+
+        fun add(
+            path: String,
+            text: String,
+            bounds: NodeBounds,
+            className: String = "android.widget.TextView",
+            clickable: Boolean = false,
+            scrollable: Boolean = false,
+            selected: Boolean = false,
+            visible: Boolean = true,
+            enabled: Boolean = true,
+            description: String? = null,
+        ) {
+            val parent = path.substringBeforeLast('/', "").ifEmpty { null }
+            nodes += SnapshotNode(
+                path, parent, text, description, null, className, bounds,
+                clickable, scrollable, selected, false, enabled, visible,
+            )
+        }
+
+        fun snapshot(packageName: String = PDD, activity: String = ACTIVITY) = UiSnapshot(packageName, activity, nodes.toList())
+    }
+
+    /** Options for the purchase sheet shaped like the two unselected real samples. */
+    data class Sheet(
+        val screenBottom: Int = 2216,
+        val address: Boolean = true,
+        val payment: Boolean = true,
+        val quantityInput: Boolean = true,
+        val adjustButtons: Boolean = true,
+        val close: Boolean = true,
+        val summary: Boolean = true,
+        val sizeDimension: Boolean = true,
+        val listScrollable: Boolean = true,
+        /** "visible" = normal submit bar; "hidden" = Samsung-like 31px bar whose [0,0][0,0] label is not visible; "none". */
+        val submit: String = "visible",
+        val offset: Int = 0,
+        val colorLabels: List<String> = listOf("黑色 示例款", "卡其色 示例款"),
+        val sizeLabels: List<String> = listOf("S 建议75-90斤", "M 建议90-105斤", "L 建议105-115斤"),
+    )
+
+    fun sheet(options: Sheet = Sheet()): UiSnapshot {
+        val o = options.offset
+        val t = Tree(options.screenBottom)
+        t.add("r/sheet", "", NodeBounds(0, 84, 1080, options.screenBottom), "android.widget.LinearLayout", clickable = true)
+        t.add("r/sheet/top", "", NodeBounds(0, 219, 1080, 330), "android.widget.ViewSwitcher", clickable = true)
+        t.add("r/sheet/top/tags", "#示例标签#七天退换", NodeBounds(193, 240, 886, 308))
+        if (options.close) {
+            t.add("r/sheet/close", "", NodeBounds(975, 237, 1050, 312), "android.widget.ImageView", clickable = true, description = "关闭")
+        }
+        t.add("r/sheet/body", "", NodeBounds(0, 330, 1080, options.screenBottom), "android.view.ViewGroup", clickable = true)
+        if (options.address) {
+            // Address row: clickable row five levels above the masked phone text.
+            t.add("r/sheet/body/addr", "", NodeBounds(0, 330 + o, 1080, 484 + o), "android.view.ViewGroup", clickable = true)
+            t.add("r/sheet/body/addr/a", "", NodeBounds(0, 340 + o, 1080, 470 + o), "android.widget.LinearLayout")
+            t.add("r/sheet/body/addr/a/b", "", NodeBounds(36, 340 + o, 1044, 400 + o), "android.widget.LinearLayout")
+            t.add("r/sheet/body/addr/a/b/c", "", NodeBounds(36, 340 + o, 1044, 400 + o), "android.widget.LinearLayout")
+            t.add("r/sheet/body/addr/a/b/c/tag", "7天无理由退货", NodeBounds(138, 348 + o, 394, 394 + o))
+            t.add("r/sheet/body/addr/a/b/c/phone", "测试，$FAKE_PHONE，示例省示例市", NodeBounds(412, 346 + o, 993, 395 + o))
+            t.add("r/sheet/body/addr/a/detail", "示例区示例街道示例路1号", NodeBounds(132, 408 + o, 937, 457 + o))
+        }
+        t.add("r/sheet/body/image", "", NodeBounds(36, 638, 360, 962), "android.widget.FrameLayout", clickable = true, description = "商品主图")
+        t.add("r/sheet/body/price", "¥19.6", NodeBounds(384, 640, 523, 707))
+        if (options.summary) t.add("r/sheet/body/summary", "请选择: 颜色分类 尺码", NodeBounds(384, 791, 1068, 852))
+        t.add("r/sheet/body/qty", "", NodeBounds(384, 888, 633, 963), "android.widget.LinearLayout")
+        if (options.adjustButtons) {
+            t.add("r/sheet/body/qty/dec", "", NodeBounds(384, 888, 462, 963), "android.widget.ImageView", clickable = true, description = "减少数量")
+            t.add("r/sheet/body/qty/inc", "", NodeBounds(555, 888, 633, 963), "android.widget.ImageView", clickable = true, description = "增加数量")
+        }
+        if (options.quantityInput) {
+            t.add("r/sheet/body/qty/input", "1", NodeBounds(468, 888, 549, 963), "android.widget.EditText", clickable = true)
+        }
+        val list = "r/sheet/body/list"
+        t.add(list, "", NodeBounds(0, 1136, 1080, 2036), "androidx.recyclerview.widget.RecyclerView", scrollable = options.listScrollable)
+        t.add("$list/color", "", NodeBounds(0, 1136, 1080, 1686), "android.widget.LinearLayout")
+        t.add("$list/color/h", "颜色分类", NodeBounds(36, 1161, 216, 1222))
+        options.colorLabels.forEachIndexed { index, label ->
+            val step = if (options.colorLabels.size > 3) 258 else 346
+            val w = if (options.colorLabels.size > 3) 240 else 316
+            val left = 36 + index * step
+            val block = "$list/color/o$index"
+            t.add(block, "", NodeBounds(left, 1247, left + w, 1650), "android.view.ViewGroup", clickable = true, description = label)
+            t.add("$block/img", "", NodeBounds(left, 1247, left + w, 1563), "android.widget.ImageView", clickable = true, description = label)
+            t.add("$block/big", "", NodeBounds(left, 1247, left + 111, 1358), "android.widget.ImageView", clickable = true, description = "打开大图")
+            t.add("$block/l", "", NodeBounds(left, 1563, left + w, 1650), "android.widget.LinearLayout")
+            t.add("$block/l/t", label, NodeBounds(left, 1563, left + w, 1650), clickable = true)
+        }
+        if (options.sizeDimension) {
+            t.add("$list/size", "", NodeBounds(0, 1686, 1080, 2036), "android.widget.LinearLayout")
+            t.add("$list/size/row", "", NodeBounds(36, 1686, 1044, 1767), "android.widget.LinearLayout", clickable = true)
+            t.add("$list/size/row/h", "尺码", NodeBounds(36, 1700, 126, 1753))
+            t.add("$list/size/row/hint", "查看尺码建议", NodeBounds(150, 1702, 402, 1751))
+            options.sizeLabels.forEachIndexed { index, label ->
+                val top = 1779 + (index / 2) * 85
+                val left = 36 + (index % 2) * 420
+                t.add("$list/size/o$index", "", NodeBounds(left, top, left + 364, top + 80), "android.view.ViewGroup", clickable = true)
+                t.add("$list/size/o$index/t", label, NodeBounds(left, top, left + 364, top + 80), clickable = true)
+            }
+        }
+        if (options.payment) {
+            t.add("r/sheet/pay", "", NodeBounds(0, 2036, 1080, 2135), "android.view.ViewGroup", clickable = true)
+            t.add("r/sheet/pay/l", "", NodeBounds(94, 2057, 930, 2114), "android.widget.LinearLayout")
+            t.add("r/sheet/pay/l/t", "使用#微信支付，更换先用后付可0元下单", NodeBounds(112, 2057, 930, 2114))
+        }
+        when (options.submit) {
+            "visible" -> {
+                t.add("r/sheet/submit", "", NodeBounds(0, 2135, 1080, options.screenBottom), "android.widget.FrameLayout", clickable = true)
+                t.add("r/sheet/submit/l", "", NodeBounds(145, 2135, 934, options.screenBottom), "android.widget.LinearLayout")
+                t.add("r/sheet/submit/l/t", "选择颜色分类及尺码后，提交订单", NodeBounds(157, 2179, 922, options.screenBottom))
+            }
+            "hidden" -> {
+                t.add("r/sheet/submit", "", NodeBounds(0, options.screenBottom - 31, 1080, options.screenBottom), "android.widget.FrameLayout", clickable = true)
+                t.add("r/sheet/submit/l", "", NodeBounds(0, 0, 0, 0), "android.widget.LinearLayout", visible = false)
+                t.add("r/sheet/submit/l/t", "选择颜色分类及尺码后，提交订单", NodeBounds(0, 0, 0, 0), visible = false)
+            }
+        }
+        return t.snapshot()
+    }
+
+    /**
+     * Minimal fallback sheet: no bounded scrollable, a single heading, no
+     * summary, no +/- and no readable submit. Only the #331 required-evidence
+     * fallback can recognize it. (Not the goods 8580 shape; see [sample8580ShapedSheet].)
+     */
+    fun liveShapedSheet(options: Sheet = Sheet()): UiSnapshot = sheet(
+        options.copy(summary = false, listScrollable = false, sizeDimension = false, adjustButtons = false, submit = "hidden"),
+    )
+
+    /**
+     * Shape of the 13 goods 8580 failures reported in #331:
+     * `type=UNKNOWN;scrollables=1;headings=2;options=9;summary=false;quantity=true;orderAction=false;pageEvidenceMatched=true`.
+     * One bounded scrollable, two headings, nine options, +/- and input present,
+     * but no selection summary and no readable submit action.
+     */
+    fun sample8580ShapedSheet(options: Sheet = Sheet()): UiSnapshot = sheet(
+        options.copy(
+            summary = false,
+            submit = "hidden",
+            colorLabels = listOf("黑色 示例款", "卡其色 示例款", "白色 示例款", "灰色 示例款"),
+            sizeLabels = listOf("S 示例", "M 示例", "L 示例", "XL 示例", "2XL 示例"),
+        ),
+    )
+
+    /**
+     * #331 counter-example: a masked-phone row inside an address dialog, a
+     * payment row inside a separate payment dialog and a quantity input in a
+     * third place, together with a parsed option group. Every item exists but
+     * they do not share one panel container.
+     */
+    fun scatteredRequiredItemsPage(fullScreenWrapper: Boolean = false): UiSnapshot {
+        val t = Tree(2216)
+        val root = if (fullScreenWrapper) {
+            t.add("r/content", "", NodeBounds(0, 0, 1080, 2216), "android.widget.FrameLayout")
+            "r/content"
+        } else "r"
+        t.add("$root/addrDialog", "", NodeBounds(60, 200, 1020, 700), "android.widget.FrameLayout")
+        t.add("$root/addrDialog/title", "选择收货地址", NodeBounds(360, 220, 720, 290))
+        t.add("$root/addrDialog/row", "", NodeBounds(60, 320, 1020, 470), "android.view.ViewGroup", clickable = true)
+        t.add("$root/addrDialog/row/phone", "测试，$FAKE_PHONE，示例省示例市", NodeBounds(100, 340, 980, 400))
+        t.add("$root/payDialog", "", NodeBounds(60, 800, 1020, 1200), "android.widget.FrameLayout")
+        t.add("$root/payDialog/row", "", NodeBounds(60, 900, 1020, 1010), "android.view.ViewGroup", clickable = true)
+        t.add("$root/payDialog/row/t", "微信支付", NodeBounds(120, 920, 400, 990))
+        t.add("$root/other", "", NodeBounds(0, 1250, 1080, 2216), "android.widget.LinearLayout")
+        t.add("$root/other/close", "", NodeBounds(975, 1260, 1050, 1335), "android.widget.ImageView", clickable = true, description = "关闭")
+        t.add("$root/other/input", "1", NodeBounds(468, 1350, 549, 1425), "android.widget.EditText", clickable = true)
+        t.add("$root/other/h", "颜色分类", NodeBounds(36, 1500, 216, 1560))
+        t.add("$root/other/o0", "黑色 示例款", NodeBounds(36, 1600, 352, 1700), clickable = true)
+        t.add("$root/other/o1", "白色 示例款", NodeBounds(382, 1600, 698, 1700), clickable = true)
+        return t.snapshot()
+    }
+
+    /** Task 535 layout: the selected option block exposes an outer block, an image and an inner text with a badge. */
+    fun taskOptionDedupSheet(): UiSnapshot {
+        val t = Tree(2328)
+        t.add("r/sheet", "", NodeBounds(0, 120, 1080, 2328), "android.widget.LinearLayout", clickable = true)
+        t.add("r/sheet/close", "", NodeBounds(975, 273, 1050, 348), "android.widget.ImageView", clickable = true, description = "关闭")
+        t.add("r/sheet/body", "", NodeBounds(0, 366, 1080, 2328), "android.view.ViewGroup", clickable = true)
+        t.add("r/sheet/body/addr", "", NodeBounds(0, 366, 1080, 520), "android.view.ViewGroup", clickable = true)
+        t.add("r/sheet/body/addr/a", "", NodeBounds(0, 376, 1080, 510), "android.widget.LinearLayout")
+        t.add("r/sheet/body/addr/a/phone", "测试，$FAKE_PHONE，示例省示例市", NodeBounds(412, 382, 993, 431))
+        t.add("r/sheet/body/addr/a/detail", "示例区示例路2号", NodeBounds(132, 444, 993, 493))
+        t.add("r/sheet/body/price", "快抢光 ¥23.99", NodeBounds(396, 568, 722, 635))
+        t.add("r/sheet/body/selected", "#快抢光#兰条纹 2XL建议130-150斤", NodeBounds(396, 719, 1053, 781))
+        t.add("r/sheet/body/qty", "", NodeBounds(396, 817, 614, 895), "android.widget.LinearLayout")
+        t.add("r/sheet/body/qty/dec", "", NodeBounds(396, 817, 462, 895), "android.widget.ImageView", clickable = true, description = "减少数量")
+        t.add("r/sheet/body/qty/input", "1", NodeBounds(463, 817, 547, 895), "android.widget.EditText", clickable = true)
+        t.add("r/sheet/body/qty/inc", "", NodeBounds(548, 817, 614, 895), "android.widget.ImageView", clickable = true, description = "增加数量")
+        val list = "r/sheet/body/list"
+        t.add(list, "", NodeBounds(0, 933, 1080, 2079), "androidx.recyclerview.widget.RecyclerView", scrollable = true)
+        t.add("$list/color", "", NodeBounds(0, 933, 1080, 1483), "android.widget.LinearLayout")
+        t.add("$list/color/h", "颜色分类", NodeBounds(36, 958, 216, 1019))
+        val blue = "$list/color/o0"
+        t.add(blue, "", NodeBounds(36, 1044, 352, 1447), "android.view.ViewGroup", clickable = true, selected = true, description = "  兰条纹")
+        t.add("$blue/img", "", NodeBounds(36, 1044, 352, 1360), "android.widget.ImageView", clickable = true, selected = true, description = "  兰条纹")
+        t.add("$blue/big", "", NodeBounds(36, 1044, 147, 1155), "android.widget.ImageView", clickable = true, selected = true, description = "打开大图")
+        t.add("$blue/l", "", NodeBounds(36, 1339, 352, 1447), "android.widget.LinearLayout", selected = true)
+        t.add("$blue/l/t", "  兰条纹\n 零差评", NodeBounds(36, 1339, 352, 1447), clickable = true, selected = true)
+        val white = "$list/color/o1"
+        t.add(white, "", NodeBounds(382, 1044, 698, 1447), "android.view.ViewGroup", clickable = true, description = "白条纹")
+        t.add("$white/img", "", NodeBounds(382, 1044, 698, 1360), "android.widget.ImageView", clickable = true, description = "白条纹")
+        t.add("$white/big", "", NodeBounds(382, 1044, 493, 1155), "android.widget.ImageView", clickable = true, description = "打开大图")
+        t.add("$white/badge", "快要抢光", NodeBounds(521, 1044, 698, 1093))
+        t.add("$white/l", "", NodeBounds(382, 1339, 698, 1447), "android.widget.LinearLayout")
+        t.add("$white/l/t", "白条纹", NodeBounds(382, 1339, 698, 1447), clickable = true)
+        t.add("$list/size", "", NodeBounds(0, 1483, 1080, 1938), "android.widget.LinearLayout")
+        t.add("$list/size/row", "", NodeBounds(36, 1483, 1044, 1564), "android.widget.LinearLayout", clickable = true)
+        t.add("$list/size/row/h", "尺码", NodeBounds(36, 1497, 126, 1550))
+        listOf(
+            Triple("L建议100-115斤", NodeBounds(36, 1576, 371, 1661), false),
+            Triple("XL建议115-130斤", NodeBounds(401, 1576, 762, 1661), false),
+            Triple("2XL建议130-150斤", NodeBounds(36, 1691, 430, 1776), true),
+            Triple("3XL建议150-170斤", NodeBounds(460, 1691, 853, 1776), false),
+            Triple("4XL建议170-190斤", NodeBounds(36, 1806, 431, 1891), false),
+        ).forEachIndexed { index, (label, bounds, selected) ->
+            t.add("$list/size/o$index", "", bounds, "android.view.ViewGroup", clickable = true)
+            t.add("$list/size/o$index/t", label, bounds, clickable = true, selected = selected)
+        }
+        t.add("r/sheet/pay", "", NodeBounds(0, 2079, 1080, 2178), "android.view.ViewGroup", clickable = true)
+        t.add("r/sheet/pay/t", "使用#微信支付，更换先用后付可0元下单", NodeBounds(112, 2100, 930, 2157))
+        t.add("r/sheet/submit", "", NodeBounds(0, 2181, 1080, 2328), "android.widget.FrameLayout", clickable = true)
+        t.add("r/sheet/submit/t", "提交订单 ¥23.99", NodeBounds(365, 2225, 715, 2284))
+        return t.snapshot()
+    }
+
+    fun productDetailPage(): UiSnapshot {
+        val t = Tree(2216)
+        t.add("r/pager", "示例商品标题连衣裙夏季新款示例", NodeBounds(0, 84, 1080, 1100), "androidx.viewpager.widget.ViewPager")
+        t.add("r/price", "¥19.6", NodeBounds(36, 1120, 300, 1200))
+        t.add("r/sales", "已拼1万+件", NodeBounds(700, 1120, 1044, 1200))
+        t.add("r/deliver", "配送至 示例省示例市", NodeBounds(36, 1300, 1044, 1360))
+        t.add("r/spec", "请选择 颜色分类 尺码", NodeBounds(36, 1400, 1044, 1480), clickable = true)
+        t.add("r/review", "商品评价(2000+)", NodeBounds(36, 1500, 1044, 1580), clickable = true)
+        t.add("r/single", "单独购买", NodeBounds(420, 2080, 720, 2200), clickable = true)
+        t.add("r/group", "发起拼单", NodeBounds(740, 2080, 1060, 2200), clickable = true)
+        return t.snapshot()
+    }
+
+    fun reviewPage(): UiSnapshot {
+        val t = Tree(2216)
+        t.add("r/title", "商品评价", NodeBounds(400, 120, 680, 200))
+        t.add("r/all", "全部", NodeBounds(36, 260, 150, 320), clickable = true)
+        t.add("r/media", "有图/视频", NodeBounds(170, 260, 360, 320), clickable = true)
+        t.add("r/body", "质量不错，微信支付很方便", NodeBounds(36, 400, 1044, 500))
+        return t.snapshot()
+    }
+
+    fun addressListPage(): UiSnapshot {
+        val t = Tree(2216)
+        t.add("r/title", "收货地址", NodeBounds(400, 120, 680, 200))
+        listOf(0, 1).forEach { index ->
+            val top = 300 + index * 260
+            t.add("r/card$index", "", NodeBounds(0, top, 1080, top + 240), "android.view.ViewGroup", clickable = true)
+            t.add("r/card$index/phone", "测试 $FAKE_PHONE", NodeBounds(36, top + 20, 700, top + 80))
+            t.add("r/card$index/detail", "示例省示例市示例路${index + 1}号", NodeBounds(36, top + 100, 900, top + 160))
+            t.add("r/card$index/edit", "修改", NodeBounds(950, top + 20, 1044, top + 80), clickable = true)
+        }
+        return t.snapshot()
+    }
+
+    fun addressEditPage(): UiSnapshot {
+        val t = Tree(2216)
+        t.add("r/title", "修改收货地址", NodeBounds(360, 120, 720, 200))
+        t.add("r/name", "测试收货人", NodeBounds(180, 190, 900, 270), "android.widget.EditText", clickable = true)
+        t.add("r/phone", "13900000000", NodeBounds(180, 290, 900, 370), "android.widget.EditText", clickable = true)
+        t.add("r/detailLabel", "详细地址", NodeBounds(20, 400, 160, 460))
+        t.add("r/detail", "示例路1号", NodeBounds(180, 390, 900, 480), "android.widget.EditText", clickable = true)
+        t.add("r/save", "保存", NodeBounds(36, 2080, 1044, 2180), clickable = true)
+        return t.snapshot()
+    }
+
+    fun paymentMethodDialog(): UiSnapshot {
+        val t = Tree(2216)
+        t.add("r/title", "选择支付方式", NodeBounds(360, 1200, 720, 1280))
+        t.add("r/wechat", "", NodeBounds(0, 1300, 1080, 1420), "android.view.ViewGroup", clickable = true)
+        t.add("r/wechat/t", "微信支付", NodeBounds(120, 1330, 400, 1390))
+        t.add("r/later", "", NodeBounds(0, 1440, 1080, 1560), "android.view.ViewGroup", clickable = true)
+        t.add("r/later/t", "先用后付", NodeBounds(120, 1470, 400, 1530))
+        t.add("r/ok", "确定", NodeBounds(36, 2080, 1044, 2180), clickable = true)
+        return t.snapshot()
+    }
+
+    fun postSubmitPaymentPage(): UiSnapshot {
+        val t = Tree(2216)
+        t.add("r/amount", "¥19.60", NodeBounds(360, 300, 720, 400))
+        t.add("r/wechat", "", NodeBounds(0, 600, 1080, 720), "android.view.ViewGroup", clickable = true)
+        t.add("r/wechat/t", "微信支付", NodeBounds(120, 630, 400, 690))
+        t.add("r/pay", "立即支付", NodeBounds(36, 2080, 1044, 2180), clickable = true)
+        return t.snapshot(activity = "com.xunmeng.pinduoduo.app_pay.core.PayActivity")
+    }
+
+    fun quantityOnlyPage(): UiSnapshot {
+        val t = Tree(2216)
+        t.add("r/input", "1", NodeBounds(468, 888, 549, 963), "android.widget.EditText", clickable = true)
+        return t.snapshot()
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/SpecPanelRecognitionTest.kt

@@ -0,0 +1,879 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.SpecPanelFixtures.Sheet
+import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.NodeBounds
+import cn.ilapage.goauto.agent.automation.ParsedPddScreen
+import cn.ilapage.goauto.agent.automation.PddScreenParser
+import cn.ilapage.goauto.agent.automation.PurchaseAgentCapabilities
+import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
+import cn.ilapage.goauto.agent.automation.PurchaseLiveAutomation
+import cn.ilapage.goauto.agent.automation.PurchaseLiveException
+import cn.ilapage.goauto.agent.automation.PurchaseRehearsalExecutor
+import cn.ilapage.goauto.agent.automation.PurchaseRuleParser
+import cn.ilapage.goauto.agent.automation.PurchaseUiDriver
+import cn.ilapage.goauto.agent.automation.SnapshotNode
+import cn.ilapage.goauto.agent.automation.SpecPanelStabilityPolicy
+import cn.ilapage.goauto.agent.automation.SpecPanelType
+import cn.ilapage.goauto.agent.automation.SwipeDirection
+import cn.ilapage.goauto.agent.automation.UiSnapshot
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** #331 spec-panel recognition, same-container check, hints, bounded waits and strict submit targets. */
+class SpecPanelRecognitionTest {
+    private fun parse(snapshot: UiSnapshot) =
+        PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "719834019024", null)
+
+    // --- Recognition -------------------------------------------------------
+
+    @Test
+    fun `both sanitized unselected sheet samples are recognized as spec panels`() {
+        val first = parse(SpecPanelFixtures.sheet())
+        val samsung = parse(SpecPanelFixtures.sheet(Sheet(screenBottom = 2020, submit = "hidden")))
+
+        listOf(first, samsung).forEach { screen ->
+            assertTrue(screen.specPanelOpen)
+            assertTrue(screen.hasAddressEntry)
+            assertTrue(screen.hasPaymentEntry)
+            assertTrue(screen.hasQuantityInput)
+        }
+        // The zero-size submit label is not visible, so the submit action is absent.
+        assertFalse(samsung.hasOrderSubmitAction)
+    }
+
+    @Test
+    fun `live shaped samples are recognized only through the required evidence fallback`() {
+        listOf(2216, 2020).forEach { bottom ->
+            val screen = parse(SpecPanelFixtures.liveShapedSheet(Sheet(screenBottom = bottom)))
+
+            assertEquals(SpecPanelType.REQUIRED_EVIDENCE, screen.specPanelType)
+            assertTrue(screen.specPanelOpen)
+            assertEquals(0, screen.panelScrollableCount)
+            assertFalse(screen.hasSelectionSummary)
+            assertFalse(screen.hasQuantityControls)
+            assertFalse(screen.hasQuantityAdjustControls)
+            assertFalse(screen.hasOrderSubmitAction)
+            assertEquals(listOf("黑色 示例款", "卡其色 示例款"), screen.dimensions.single().values.map { it.text })
+        }
+    }
+
+    @Test
+    fun `zero size submit label sample is still recognized because submit is auxiliary`() {
+        val screen = parse(SpecPanelFixtures.liveShapedSheet(Sheet(screenBottom = 2020)))
+
+        assertFalse(screen.hasOrderSubmitAction)
+        assertEquals(SpecPanelType.REQUIRED_EVIDENCE, screen.specPanelType)
+    }
+
+    @Test
+    fun `missing address entry is not recognized`() {
+        val screen = parse(SpecPanelFixtures.liveShapedSheet(Sheet(address = false)))
+        assertFalse(screen.hasAddressEntry)
+        assertEquals(SpecPanelType.UNKNOWN, screen.specPanelType)
+    }
+
+    @Test
+    fun `missing payment entry is not recognized`() {
+        val screen = parse(SpecPanelFixtures.liveShapedSheet(Sheet(payment = false)))
+        assertFalse(screen.hasPaymentEntry)
+        assertEquals(SpecPanelType.UNKNOWN, screen.specPanelType)
+    }
+
+    @Test
+    fun `missing quantity input is not recognized`() {
+        val screen = parse(SpecPanelFixtures.liveShapedSheet(Sheet(quantityInput = false)))
+        assertFalse(screen.hasQuantityInput)
+        assertEquals(SpecPanelType.UNKNOWN, screen.specPanelType)
+    }
+
+    @Test
+    fun `required items without any auxiliary evidence are not recognized`() {
+        val t = SpecPanelFixtures.Tree(2216)
+        t.add("r/panel", "", NodeBounds(0, 300, 1080, 2216), "android.widget.LinearLayout")
+        t.add("r/panel/addr", "", NodeBounds(0, 330, 1080, 484), "android.view.ViewGroup", clickable = true)
+        t.add("r/panel/addr/phone", "测试，${SpecPanelFixtures.FAKE_PHONE}", NodeBounds(412, 346, 993, 395))
+        t.add("r/panel/qty", "1", NodeBounds(468, 888, 549, 963), "android.widget.EditText", clickable = true)
+        t.add("r/panel/pay", "", NodeBounds(0, 2036, 1080, 2135), "android.view.ViewGroup", clickable = true)
+        t.add("r/panel/pay/t", "使用微信支付", NodeBounds(112, 2057, 930, 2114))
+
+        val screen = parse(t.snapshot())
+
+        assertTrue(screen.hasRequiredPanelEvidence)
+        assertTrue(screen.requiredEvidenceSameContainer)
+        assertEquals(SpecPanelType.UNKNOWN, screen.specPanelType)
+    }
+
+    @Test
+    fun `quantity input alone is not recognized`() {
+        val screen = parse(SpecPanelFixtures.quantityOnlyPage())
+        assertTrue(screen.hasQuantityInput)
+        assertEquals(SpecPanelType.UNKNOWN, screen.specPanelType)
+        assertFalse(screen.specPanelOpen)
+    }
+
+    @Test
+    fun `non panel pages are never recognized as spec panels`() {
+        mapOf(
+            "product" to SpecPanelFixtures.productDetailPage(),
+            "review" to SpecPanelFixtures.reviewPage(),
+            "addressList" to SpecPanelFixtures.addressListPage(),
+            "addressEdit" to SpecPanelFixtures.addressEditPage(),
+            "paymentDialog" to SpecPanelFixtures.paymentMethodDialog(),
+            "paymentPage" to SpecPanelFixtures.postSubmitPaymentPage(),
+        ).forEach { (name, snapshot) ->
+            val screen = parse(snapshot)
+            assertEquals(name, SpecPanelType.UNKNOWN, screen.specPanelType)
+            assertFalse(name, screen.specPanelOpen)
+        }
+    }
+
+    @Test
+    fun `whole sheet clickable containers do not count as an address row`() {
+        val t = SpecPanelFixtures.Tree(2216)
+        t.add("r/sheet", "", NodeBounds(0, 84, 1080, 2216), "android.widget.LinearLayout", clickable = true)
+        t.add("r/sheet/phone", "测试，${SpecPanelFixtures.FAKE_PHONE}", NodeBounds(412, 346, 993, 395))
+        assertFalse(parse(t.snapshot()).hasAddressEntry)
+    }
+
+    @Test
+    fun `single dimension sheet without adjust buttons is recognized`() {
+        val screen = parse(SpecPanelFixtures.sheet(Sheet(sizeDimension = false, adjustButtons = false, summary = false, listScrollable = false, submit = "none")))
+
+        assertEquals(SpecPanelType.REQUIRED_EVIDENCE, screen.specPanelType)
+        assertEquals(listOf("color"), screen.dimensions.map { it.key })
+    }
+
+    @Test
+    fun `required evidence diagnostics hold booleans and counts only`() {
+        val screen = parse(SpecPanelFixtures.liveShapedSheet())
+        val summary = screen.requiredEvidenceSummary()
+
+        assertEquals("addr=1;pay=1;qin=1;adj=0;summary=0;close=1;submit=0;same=1", summary)
+        assertFalse(summary.contains("****"))
+        assertFalse(summary.contains("示例"))
+    }
+
+    @Test
+    fun `goods 8580 shaped sheet is recognized through the required evidence fallback`() {
+        val screen = parse(SpecPanelFixtures.sample8580ShapedSheet())
+
+        // Shape of the 13 live failures: scrollables=1;headings=2;options=9;
+        // summary=false;quantity=true;orderAction=false (was UNKNOWN before #331).
+        assertEquals(1, screen.panelScrollableCount)
+        assertEquals(2, screen.panelHeadingCount)
+        assertEquals(9, screen.panelOptionCount)
+        assertFalse(screen.hasSelectionSummary)
+        assertTrue(screen.hasQuantityControls)
+        assertFalse(screen.hasOrderSubmitAction)
+        assertEquals(SpecPanelType.REQUIRED_EVIDENCE, screen.specPanelType)
+        assertTrue(screen.requiredEvidenceSameContainer)
+    }
+
+    // --- Same panel container --------------------------------------------
+
+    @Test
+    fun `required items inside one panel container are recognized`() {
+        listOf(SpecPanelFixtures.liveShapedSheet(), SpecPanelFixtures.sample8580ShapedSheet()).forEach { snapshot ->
+            val screen = parse(snapshot)
+            assertTrue(screen.requiredEvidenceSameContainer)
+            assertEquals(SpecPanelType.REQUIRED_EVIDENCE, screen.specPanelType)
+        }
+    }
+
+    @Test
+    fun `address dialog payment dialog and a separate quantity input are not a spec panel`() {
+        listOf(false, true).forEach { wrapper ->
+            val screen = parse(SpecPanelFixtures.scatteredRequiredItemsPage(fullScreenWrapper = wrapper))
+
+            // Every required item exists somewhere on screen, plus auxiliary
+            // options and a close control, but not inside one panel container.
+            assertTrue(screen.hasAddressEntry)
+            assertTrue(screen.hasPaymentEntry)
+            assertTrue(screen.hasQuantityInput)
+            assertTrue(screen.dimensions.any { it.values.isNotEmpty() })
+            assertFalse(screen.requiredEvidenceSameContainer)
+            assertEquals(SpecPanelType.UNKNOWN, screen.specPanelType)
+            assertFalse(screen.specPanelOpen)
+            assertEquals(listOf(ParsedPddScreen.NOT_SAME_CONTAINER_HINT), screen.requiredEvidenceHints())
+        }
+    }
+
+    // --- Purchaser hints for missing required items --------------------------
+
+    @Test
+    fun `missing required items produce purchaser hints`() {
+        val noPay = parse(SpecPanelFixtures.sample8580ShapedSheet(Sheet(payment = false)))
+        val noAddr = parse(SpecPanelFixtures.sample8580ShapedSheet(Sheet(address = false)))
+        val noQty = parse(SpecPanelFixtures.sample8580ShapedSheet(Sheet(quantityInput = false)))
+
+        assertEquals(listOf("未找到支付入口：请确认 PDD 默认支付方式为微信支付"), noPay.requiredEvidenceHints())
+        assertEquals(listOf("未找到收货地址入口：请确认 PDD 已设置默认收货地址"), noAddr.requiredEvidenceHints())
+        assertEquals(listOf("未找到购买数量输入框"), noQty.requiredEvidenceHints())
+        assertTrue(parse(SpecPanelFixtures.sample8580ShapedSheet()).requiredEvidenceHints().isEmpty())
+        // Unrelated pages without any required item or option do not get environment hints.
+        assertTrue(parse(SpecPanelFixtures.reviewPage()).requiredEvidenceHints().isEmpty())
+    }
+
+    @Test
+    fun `spec panel evidence failure message carries the missing payment hint`() {
+        val driver = SpecEntryDriver(listOf(SpecPanelFixtures.sample8580ShapedSheet(Sheet(payment = false))))
+
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
+        assertTrue(outcome.message.orEmpty().contains("未找到支付入口：请确认 PDD 默认支付方式为微信支付"))
+        assertFalse(outcome.message.orEmpty().contains("****"))
+        assertEquals(0, driver.backs)
+    }
+
+    @Test
+    fun `spec panel evidence failure message carries the missing address and quantity hints`() {
+        mapOf(
+            Sheet(address = false) to "未找到收货地址入口：请确认 PDD 已设置默认收货地址",
+            Sheet(quantityInput = false) to "未找到购买数量输入框",
+        ).forEach { (options, hint) ->
+            val driver = SpecEntryDriver(listOf(SpecPanelFixtures.sample8580ShapedSheet(options)))
+            val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {})
+                .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+            assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
+            assertTrue(outcome.message.orEmpty(), outcome.message.orEmpty().contains(hint))
+        }
+    }
+
+    @Test
+    fun `address save timeout message carries the missing address hint`() {
+        val loading = SpecPanelFixtures.liveShapedSheet(Sheet(address = false))
+        val driver = AddressSaveDriver(listOf(loading)) { loading }
+
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg35") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertTrue(error.message.orEmpty().contains("未找到收货地址入口：请确认 PDD 已设置默认收货地址"))
+    }
+
+    // --- Bounded wait after the first spec-entry click -----------------------
+
+    @Test
+    fun `loading sheet is accepted after required evidence becomes complete and stable without back`() {
+        val loading = SpecPanelFixtures.liveShapedSheet(Sheet(address = false))
+        val ready = SpecPanelFixtures.liveShapedSheet()
+        val driver = SpecEntryDriver(listOf(loading, loading, loading, ready, ready))
+        val diagnostics = mutableListOf<String>()
+        val steps = mutableListOf<String>()
+
+        PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, stepChanged = steps::add, panelDiagnostic = diagnostics::add)
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertTrue(steps.contains("selectSpec"))
+        assertEquals(0, driver.backs)
+        assertTrue(diagnostics.any { it.startsWith("specPanelWait;outcome=opened;") && it.contains("backPressed=false") })
+    }
+
+    @Test
+    fun `always incomplete sheet fails explicitly at the wait bound without back`() {
+        val loading = SpecPanelFixtures.liveShapedSheet(Sheet(address = false))
+        val driver = SpecEntryDriver(listOf(loading))
+        val diagnostics = mutableListOf<String>()
+
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
+        assertEquals(0, driver.backs)
+        val timeout = diagnostics.single { it.startsWith("specPanelWait;outcome=timeout;") }
+        assertTrue(timeout.contains("waitedMs=${SpecPanelStabilityPolicy.WAIT_BOUND_MS};"))
+    }
+
+    @Test
+    fun `fallback sheet whose structure keeps changing is never accepted early`() {
+        val first = SpecPanelFixtures.liveShapedSheet(Sheet(screenBottom = 2216))
+        val second = SpecPanelFixtures.liveShapedSheet(Sheet(screenBottom = 2200))
+        assertEquals(SpecPanelType.REQUIRED_EVIDENCE, parse(second).specPanelType)
+        val driver = SpecEntryDriver(listOf(first, second), cycle = true)
+        val diagnostics = mutableListOf<String>()
+
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
+        assertEquals(0, driver.backs)
+        assertFalse(diagnostics.any { it.startsWith("specPanelWait;outcome=opened") })
+        assertTrue(diagnostics.any { it.contains("waitedMs=${SpecPanelStabilityPolicy.WAIT_BOUND_MS};") })
+    }
+
+    @Test
+    fun `stronger panel type is still accepted immediately`() {
+        val driver = SpecEntryDriver(listOf(SpecPanelFixtures.sheet()))
+        val diagnostics = mutableListOf<String>()
+        val steps = mutableListOf<String>()
+
+        PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, stepChanged = steps::add, panelDiagnostic = diagnostics::add)
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertTrue(steps.contains("selectSpec"))
+        assertFalse(diagnostics.any { it.startsWith("specPanelWait;") })
+    }
+
+    // --- Bounded wait after the address save ---------------------------------
+
+    @Test
+    fun `address save waits for the loading sheet without pressing back`() {
+        val loading = SpecPanelFixtures.liveShapedSheet(Sheet(address = false))
+        val driver = AddressSaveDriver(listOf(loading, loading, loading)) { expected -> readySheet(expected) }
+        val diagnostics = mutableListOf<String>()
+
+        val proof = PurchaseLiveAutomation(driver, pause = {}, panelDiagnostic = diagnostics::add).updateShippingAddress("_cg31")
+
+        assertEquals("_cg31", proof.suffix)
+        assertEquals(0, driver.backs)
+        val done = diagnostics.single { it.startsWith("addressSaveWait;") }
+        assertTrue(done.contains("outcome=final_evidence"))
+        assertTrue(done.contains("waitedMs=${2 * SpecPanelStabilityPolicy.ADDRESS_SAVE_POLL_MS};"))
+        assertTrue(done.contains("backPressed=false"))
+        assertFalse(diagnostics.any { it.contains("_cg31") || it.contains("示例") || it.contains("****") })
+    }
+
+    @Test
+    fun `address save with a sheet that never completes fails at the bound without back`() {
+        val loading = SpecPanelFixtures.liveShapedSheet(Sheet(address = false))
+        val driver = AddressSaveDriver(listOf(loading)) { loading }
+        val diagnostics = mutableListOf<String>()
+
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}, panelDiagnostic = diagnostics::add).updateShippingAddress("_cg32") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertEquals(0, driver.backs)
+        assertTrue(diagnostics.single().contains("outcome=timeout;waitedMs=${SpecPanelStabilityPolicy.WAIT_BOUND_MS};"))
+        assertFalse(error.message.orEmpty().contains("示例"))
+    }
+
+    @Test
+    fun `address save with an unstable fallback sheet does not decide early`() {
+        val first = SpecPanelFixtures.liveShapedSheet(Sheet(screenBottom = 2216))
+        val second = SpecPanelFixtures.liveShapedSheet(Sheet(screenBottom = 2200))
+        val driver = AddressSaveDriver(listOf(first, second), cycle = true) { first }
+        val diagnostics = mutableListOf<String>()
+
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}, panelDiagnostic = diagnostics::add).updateShippingAddress("_cg33") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertEquals(0, driver.backs)
+        assertTrue(diagnostics.single().contains("outcome=timeout"))
+    }
+
+    @Test
+    fun `address save with a stable fallback sheet is accepted as purchase panel without back`() {
+        val sheet = SpecPanelFixtures.liveShapedSheet()
+        val driver = AddressSaveDriver(listOf(sheet)) { sheet }
+        val diagnostics = mutableListOf<String>()
+
+        // The stable sheet has no saved suffix and no scroll region, so the
+        // existing in-panel restore path fails closed; it must not press Back.
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}, panelDiagnostic = diagnostics::add).updateShippingAddress("_cg34") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals(0, driver.backs)
+        assertTrue(diagnostics.single().contains("outcome=stable_required;waitedMs=${SpecPanelStabilityPolicy.ADDRESS_SAVE_POLL_MS};"))
+        assertNotEquals("PURCHASE_ADDRESS_UPDATE_FAILED", error.code)
+    }
+
+    // --- Strict final submit click -------------------------------------------
+
+    // #335: the order button's text keeps changing across PDD builds (促销文案/价格文案),
+    // so the click target is now the bottom-most clickable, enabled, non-zero-size node of
+    // a *recognized* spec panel, not a text match. These fixtures build on
+    // [SpecPanelFixtures.sheet] (address + payment + quantity present, so #331 recognizes
+    // the panel) with `submit = "none"` and then splice in the bottom-row scenario under
+    // test, mirroring how [readySheet] already extends a base fixture elsewhere in this file.
+
+    @Test
+    fun `an unrecognized page never yields a submit target`() {
+        // #335: the button's own text no longer has to match any known marker; this used
+        // to fail as "labelMismatch" and must now succeed instead (see the dedicated
+        // wording tests below). Only "the page is not a recognized spec panel" still blocks.
+        val driver = StaticDriver(SpecPanelFixtures.addressListPage())
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce() }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `a bottom node whose own label carries a payment word is never a click target`() {
+        val recognizedBase = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val snapshot = recognizedBase.copy(
+            nodes = recognizedBase.nodes + node("r/submit", "立即支付", NodeBounds(0, 2135, 1080, 2216), clickable = true, parent = "r"),
+        )
+        val driver = StaticDriver(snapshot)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce() }.exceptionOrNull() as? PurchaseLiveException
+
+        // The project-wide page-problem guard (pageProblem) rejects any visible payment
+        // wording before the submit-target logic even runs; either way, nothing is clicked.
+        assertEquals("PURCHASE_PAYMENT_FORBIDDEN", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `a bottom node whose subtree carries a payment word is never a click target`() {
+        val recognizedBase = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val snapshot = recognizedBase.copy(
+            nodes = recognizedBase.nodes + listOf(
+                node("r/submit", "", NodeBounds(0, 2135, 1080, 2216), clickable = true, parent = "r"),
+                node("r/submit/t", "确认支付 ¥23.99", NodeBounds(157, 2150, 922, 2210), parent = "r/submit"),
+            ),
+        )
+        val driver = StaticDriver(snapshot)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce() }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_PAYMENT_FORBIDDEN", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `a bottom node whose own label is go-pay is never a click target`() {
+        // "去支付" is not in PAYMENT_MARKERS (so the global pageProblem guard does not
+        // trip on it — a real 待付款/去支付 order-result page must stay usable), but it
+        // must still block the submit-target logic via SUBMIT_TARGET_BLOCKED_MARKERS.
+        val recognizedBase = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val snapshot = recognizedBase.copy(
+            nodes = recognizedBase.nodes + node("r/submit", "去支付", NodeBounds(0, 2135, 1080, 2216), clickable = true, parent = "r"),
+        )
+        val driver = StaticDriver(snapshot)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce() }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `a bottom node whose own label is pay-fee is never a click target`() {
+        // "付款" alone is not in PAYMENT_MARKERS either (UNPAID_MARKERS' "待付款" contains
+        // it, so adding it to PAYMENT_MARKERS would misclassify every unpaid-order page),
+        // but it must still block the submit-target logic here.
+        val recognizedBase = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val snapshot = recognizedBase.copy(
+            nodes = recognizedBase.nodes + node("r/submit", "付款", NodeBounds(0, 2135, 1080, 2216), clickable = true, parent = "r"),
+        )
+        val driver = StaticDriver(snapshot)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce() }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `an invisible payment word in the bottom node subtree still blocks the click`() {
+        // The project-wide pageProblem guard only scans *visible* labels; an invisible
+        // descendant would slip past it, so the submit-target logic must catch it on its
+        // own (#335 safety condition 3 covers "自身或子树文字" regardless of visibility).
+        val recognizedBase = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val hiddenPaymentText = SnapshotNode(
+            "r/submit/hidden", "r/submit", "输入支付密码", null, null, "android.widget.TextView",
+            NodeBounds(0, 0, 0, 0), false, false, false, false, true, false,
+        )
+        val snapshot = recognizedBase.copy(
+            nodes = recognizedBase.nodes + listOf(
+                node("r/submit", "", NodeBounds(0, 2135, 1080, 2216), clickable = true, parent = "r"),
+                node("r/submit/t", "提交订单", NodeBounds(157, 2150, 922, 2210), parent = "r/submit"),
+                hiddenPaymentText,
+            ),
+        )
+        val driver = StaticDriver(snapshot)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce() }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `zero size bottom node is ignored in favor of the next non-zero labelled node`() {
+        // The click target is the labelled LEAF node (#335 2nd revision); the button
+        // carries its own label directly here (no separate text child) to make the
+        // assertion check the real click target.
+        val base = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val snapshot = base.copy(
+            nodes = base.nodes + listOf(
+                node("r/real-submit", "选择颜色分类及尺码后，提交订单", NodeBounds(0, 2135, 1080, 2200), clickable = true, parent = "r"),
+                // Zero-*area* (right==left) and lower on screen: must never win despite
+                // having its own non-blank label and a clickable ancestor.
+                node("r/decoy", "¥0.0", NodeBounds(500, 2200, 500, 2216), clickable = true, parent = "r"),
+            ),
+        )
+        val driver = StaticDriver(snapshot)
+
+        PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce()
+
+        assertEquals(listOf("选择颜色分类及尺码后，提交订单"), driver.clicked)
+    }
+
+    @Test
+    fun `two side by side bottom buttons pick the rightmost and are reported as a tie`() {
+        val base = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val diagnostics = mutableListOf<String>()
+        val snapshot = base.copy(
+            nodes = base.nodes + listOf(
+                // Avoid quickBuyAliases ("现在买") in either label: it would flip specPanelType
+                // to QUICK_CONFIRMATION, which is intentionally outside the recognized set here.
+                node("r/a", "限时优惠 ¥19.6", NodeBounds(0, 2000, 540, 2216), clickable = true, parent = "r"),
+                node("r/b", "大促价，¥16.9", NodeBounds(540, 2000, 1080, 2216), clickable = true, parent = "r"),
+            ),
+        )
+        val driver = StaticDriver(snapshot)
+
+        PurchaseLiveAutomation(driver, pause = {}, panelDiagnostic = diagnostics::add).submitOrderOnce()
+
+        // r/b is the rightmost of the tied bottom row, so it is the one clicked.
+        assertEquals(listOf("大促价，¥16.9"), driver.clicked)
+        assertTrue(diagnostics.any { it.contains("outcome=ok") && it.contains("rowTie=1") })
+    }
+
+    @Test
+    fun `unique visible submit button is still clickable exactly once regardless of its wording`() {
+        val base = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val snapshot = base.copy(
+            nodes = base.nodes + node("r/submit", "提交订单", NodeBounds(0, 2135, 1080, 2216), clickable = true, parent = "r"),
+        )
+        val driver = StaticDriver(snapshot)
+
+        PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce()
+
+        assertEquals(listOf("提交订单"), driver.clicked)
+    }
+
+    @Test
+    fun `task 570 promo priced bottom row picks the bottom-right-most labelled leaf`() {
+        // #335 origin: goods 8580 task 570, the bottom button's text was split across
+        // three sibling text nodes ("大促价，" / "仅 ¥30.8" / "¥39.9") instead of one
+        // "提交订单"-prefixed label. This checks finalSubmitTargets' own choice at the
+        // SnapshotNode level (fast, no re-find simulation); the full live re-find +
+        // climb-to-clickable-ancestor path is covered separately below with
+        // ReFindingDriver, which is what actually caught the task 594 regression.
+        val base = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val snapshot = base.copy(
+            nodes = base.nodes + listOf(
+                node("r/submit", "", NodeBounds(0, 2181, 1080, 2216), clickable = true, parent = "r"),
+                node("r/submit/l1", "大促价，", NodeBounds(40, 2190, 300, 2210), parent = "r/submit"),
+                node("r/submit/l2", "仅 ¥30.8", NodeBounds(320, 2190, 600, 2210), parent = "r/submit"),
+                node("r/submit/l3", "¥39.9", NodeBounds(620, 2190, 780, 2210), parent = "r/submit"),
+            ),
+        )
+        val driver = StaticDriver(snapshot)
+
+        PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce()
+
+        // #335 2nd revision: the target is the labelled leaf (bottom edge tied across
+        // l1/l2/l3, rightmost wins), NOT the label-less "r/submit" container — a
+        // label-less target can never be re-found live (task 594).
+        assertEquals(listOf("¥39.9"), driver.clicked)
+    }
+
+    @Test
+    fun `task 570 leaf target is re-found live and the click lands on the clickable container`() {
+        // #335 2nd revision (task 594 real-device failure): StaticDriver's clickFresh just
+        // records target.label directly, so it cannot catch a target that a REAL driver
+        // could never re-find. ReFindingDriver instead emulates
+        // GoAutoAccessibilityService.clickFreshDetailed's real semantics: find the live
+        // node by (label, className, center within ±32), then climb to the nearest live
+        // clickable ancestor and click THAT.
+        val base = SpecPanelFixtures.sheet(Sheet(screenBottom = 2400, submit = "none"))
+        val snapshot = base.copy(
+            nodes = base.nodes + listOf(
+                node("r/sheet/submit", "", NodeBounds(0, 2181, 1080, 2328), clickable = true, parent = "r/sheet"),
+                node("r/sheet/submit/l1", "大促价，", NodeBounds(364, 2225, 568, 2284), parent = "r/sheet/submit"),
+                node("r/sheet/submit/l2", "仅 ¥30.8", NodeBounds(568, 2225, 748, 2284), parent = "r/sheet/submit"),
+                node("r/sheet/submit/l3", "¥39.9", NodeBounds(748, 2222, 896, 2287), parent = "r/sheet/submit"),
+            ),
+        )
+        val driver = ReFindingDriver(snapshot)
+
+        PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce()
+
+        // finalSubmitTargets aims at "r/sheet/submit/l3" ("¥39.9", the bottom-right-most
+        // labelled leaf); the real click must land on its clickable ancestor, the
+        // FrameLayout "r/sheet/submit" — not on the leaf itself.
+        assertEquals("r/sheet/submit", driver.clickedPath)
+    }
+
+    @Test
+    fun `Samsung 31px bottom bar with only a zero-size label fails explicitly instead of clicking the payment row above it`() {
+        // #335 (3rd revision): reviewer cross-check on real dumps found that on this
+        // Samsung sample the bottom-most row is a 31px FrameLayout whose only text node
+        // is [0,0][0,0] (invisible), while the payment-method row directly above it has a
+        // real, visible label ("使用#微信支付，更换先用后付可0元下单"). A naive whole-panel
+        // leaf scan falls through to that payment row's text and the climb lands the click
+        // on "change payment method" — which must never happen. SpecPanelFixtures'
+        // `submit = "hidden"` branch already models exactly this shape.
+        val snapshot = SpecPanelFixtures.sheet(Sheet(submit = "hidden"))
+        val diagnostics = mutableListOf<String>()
+        val driver = StaticDriver(snapshot)
+        val error = runCatching {
+            PurchaseLiveAutomation(driver, pause = {}, panelDiagnostic = diagnostics::add).submitOrderOnce()
+        }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+        assertTrue(diagnostics.any { it.contains("outcome=bottom_row_unlabelled") })
+    }
+
+    @Test
+    fun `a payment-method row as the bottom-most clickable row is never a submit target`() {
+        // Without a submit region at all, the payment-method row ("使用#微信支付，更换先用
+        // 后付可0元下单") is itself the bottom-most clickable row. It must be rejected by
+        // its own alias match, not merely skipped in favor of something else.
+        val snapshot = SpecPanelFixtures.sheet(Sheet(submit = "none"))
+        val diagnostics = mutableListOf<String>()
+        val driver = StaticDriver(snapshot)
+        val error = runCatching {
+            PurchaseLiveAutomation(driver, pause = {}, panelDiagnostic = diagnostics::add).submitOrderOnce()
+        }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+        assertTrue(diagnostics.any { it.contains("outcome=row_blocked") })
+    }
+
+    @Test
+    fun `a clickable node outside the recognized panel container is never chosen even if it is bottom most`() {
+        // A hand-built #331 REQUIRED_EVIDENCE panel ("r/panel", bounded, not full-screen)
+        // with its own valid submit row, plus an unrelated clickable bar further down the
+        // same accessibility tree but OUTSIDE "r/panel" — e.g. an underlying goods-detail
+        // page's "单独购买" bar still present behind the sheet. It is visually and
+        // structurally lower on screen (bottom=2400 vs the panel submit's bottom=2100),
+        // so a naive whole-screen "bottom-most clickable node" scan would wrongly pick it.
+        val t = SpecPanelFixtures.Tree(2400)
+        t.add("r/panel", "", NodeBounds(0, 300, 1080, 2100), "android.view.ViewGroup")
+        t.add("r/panel/close", "", NodeBounds(975, 320, 1050, 390), "android.widget.ImageView", clickable = true, description = "关闭")
+        t.add("r/panel/addr", "", NodeBounds(0, 340, 1080, 460), "android.view.ViewGroup", clickable = true)
+        t.add("r/panel/addr/phone", "测试，${SpecPanelFixtures.FAKE_PHONE}，示例省示例市", NodeBounds(40, 360, 900, 440))
+        t.add("r/panel/pay", "", NodeBounds(0, 500, 1080, 600), "android.view.ViewGroup", clickable = true)
+        t.add("r/panel/pay/t", "微信支付", NodeBounds(40, 520, 400, 580))
+        t.add("r/panel/qty", "1", NodeBounds(400, 650, 600, 720), "android.widget.EditText", clickable = true)
+        t.add("r/panel/submit", "提交订单", NodeBounds(0, 2020, 1080, 2100), "android.widget.FrameLayout", clickable = true)
+        // Outside "r/panel": lower on screen, but not part of the recognized panel.
+        t.add("r/outsideBar", "单独购买", NodeBounds(0, 2200, 1080, 2400), "android.widget.FrameLayout", clickable = true)
+        val snapshot = t.snapshot()
+
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        assertEquals(SpecPanelType.REQUIRED_EVIDENCE, screen.specPanelType)
+
+        val driver = StaticDriver(snapshot)
+        PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce()
+
+        assertEquals(listOf("提交订单"), driver.clicked)
+    }
+
+    @Test
+    fun `no determinable panel container fails explicitly instead of guessing`() {
+        // Recognized (NORMAL_SCROLLABLE, via the headed-scrollable + selection-summary
+        // branch, which does not require a quantity input at all) but with NO quantity
+        // input anywhere: panelContainerBounds cannot determine a container, so
+        // finalSubmitTargets must fail explicitly rather than fall back to a whole-screen
+        // scan that could pick an unrelated bottom-most clickable node.
+        val recognizedNoQuantity = SpecPanelFixtures.sheet(
+            Sheet(quantityInput = false, adjustButtons = false, submit = "none"),
+        )
+        val screen = PddScreenParser.parse(recognizedNoQuantity, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        assertEquals(SpecPanelType.NORMAL_SCROLLABLE, screen.specPanelType)
+
+        val snapshot = recognizedNoQuantity.copy(
+            nodes = recognizedNoQuantity.nodes + node("r/submit", "提交订单", NodeBounds(0, 2135, 1080, 2216), clickable = true, parent = "r"),
+        )
+        val driver = StaticDriver(snapshot)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).submitOrderOnce() }.exceptionOrNull() as? PurchaseLiveException
+
+        assertEquals("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", error?.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    // --- Helpers -------------------------------------------------------------
+
+    private fun readySheet(expected: String): UiSnapshot {
+        // #335 (3rd revision): [SpecPanelFixtures.liveShapedSheet] hardcodes a "hidden"
+        // 31px submit placeholder (its own separate `submit`-shape fixture concern,
+        // unrelated to this address-save-wait test). With the row-then-leaf submit-target
+        // rule that placeholder would tie with "r/final" on the bottom edge and can win
+        // the rightmost tie-break, so this helper builds the same shape directly with
+        // `submit = "none"` instead, leaving "r/final" as the only, unambiguous bottom row.
+        val base = SpecPanelFixtures.sheet(
+            Sheet(summary = false, listScrollable = false, sizeDimension = false, adjustButtons = false, submit = "none"),
+        )
+        val extra = listOf(
+            node("r/sheet/body/addr/a/saved", expected, NodeBounds(132, 460, 937, 480), parent = "r/sheet/body/addr/a"),
+            node("r/final", "", NodeBounds(600, 2150, 1060, 2216), clickable = true, parent = "r"),
+            node("r/final/t", "提交订单", NodeBounds(620, 2160, 1040, 2210), parent = "r/final"),
+        )
+        return base.copy(nodes = base.nodes + extra)
+    }
+
+    private fun input() = PurchaseExecutionInput(
+        taskId = 331,
+        executionMode = "rehearsal",
+        phase = "purchase",
+        url = "https://mobile.yangkeduo.com/goods.html?goods_id=719834019024",
+        goodsId = "719834019024",
+        mappedColor = "黑色 示例款",
+        mappedSize = "",
+        quantity = 1,
+        minUnitPriceCent = 1_000,
+        maxUnitPriceCent = 3_000,
+    )
+
+    private fun rule() = """{
+      "schemaVersion":1,
+      "ruleType":"pddPurchase",
+      "requiredCapabilities":["purchase.rehearsal.v1"],
+      "actions":[
+        {"type":"openProduct"},{"type":"verifyProduct"},{"type":"openSpecPanel"},{"type":"selectSpec"},
+        {"type":"setQuantity"},{"type":"verifyUnitPrice"},{"type":"verifyOrderSummary"}
+      ]
+    }"""
+
+    private open class BaseDriver : PurchaseUiDriver {
+        var backs = 0
+        val clicked = mutableListOf<String>()
+        override fun capture(): UiSnapshot = UiSnapshot(null, null, emptyList())
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicked += target.label
+            return FreshActionResult.SUCCESS
+        }
+        override fun tapPurchaseFresh(target: SnapshotNode) = FreshActionResult.FAILED
+        override fun inputFresh(target: SnapshotNode, value: String) = FreshActionResult.FAILED
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long) = false
+        override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long) = false
+        override fun backPurchase(): Boolean {
+            backs++
+            return false
+        }
+    }
+
+    private class StaticDriver(private val snapshot: UiSnapshot) : BaseDriver() {
+        override fun capture() = snapshot
+    }
+
+    /**
+     * #335 (2nd revision): emulates `GoAutoAccessibilityService.clickFreshDetailed`'s real
+     * re-find semantics against a fixed, static "live" node list — match by (own label,
+     * className, center within ±32 — every fixture node here already carries its own
+     * label so this is equivalent to `preferredOrDescendantLabel()`), then climb to the
+     * nearest clickable ancestor and click THAT, exactly like the real accessibility
+     * service. Exposes the PATH of the node that actually received the click, so a test
+     * can assert the tap landed on the container, not the labelled leaf `finalSubmitTargets`
+     * aimed at.
+     */
+    private class ReFindingDriver(private val liveSnapshot: UiSnapshot) : BaseDriver() {
+        var clickedPath: String? = null
+        override fun capture() = liveSnapshot
+
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            val byPath = liveSnapshot.nodes.associateBy { it.path }
+            val matches = liveSnapshot.nodes.filter { candidate ->
+                candidate.label == target.label && candidate.className == target.className &&
+                    kotlin.math.abs(candidate.bounds.centerX - target.bounds.centerX) <= 32 &&
+                    kotlin.math.abs(candidate.bounds.centerY - target.bounds.centerY) <= 32
+            }
+            if (matches.isEmpty()) return FreshActionResult.NOT_FOUND
+            if (matches.size != 1) return FreshActionResult.AMBIGUOUS
+            var node = matches.single()
+            if (target.clickable && !node.clickable) return FreshActionResult.NOT_FOUND
+            while (!node.clickable) {
+                node = node.parentPath?.let(byPath::get) ?: return FreshActionResult.FAILED
+            }
+            clickedPath = node.path
+            clicked += node.label
+            return FreshActionResult.SUCCESS
+        }
+    }
+
+    /** Product page first; after the spec-entry click it serves [panels] in order (the last repeats unless [cycle]). */
+    private class SpecEntryDriver(private val panels: List<UiSnapshot>, private val cycle: Boolean = false) : BaseDriver() {
+        private var opened = false
+        var panelCaptures = 0
+
+        override fun capture(): UiSnapshot {
+            if (!opened) return SpecPanelFixtures.productDetailPage()
+            val index = if (cycle) panelCaptures % panels.size else minOf(panelCaptures, panels.lastIndex)
+            panelCaptures++
+            return panels[index]
+        }
+
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicked += target.label
+            if (target.label.startsWith("请选择")) opened = true
+            return FreshActionResult.SUCCESS
+        }
+    }
+
+    /** Address flow driver: sheet -> address list -> editor -> [afterSave] samples -> [settled]. */
+    private class AddressSaveDriver(
+        private val afterSave: List<UiSnapshot>,
+        private val cycle: Boolean = false,
+        private val settled: (String) -> UiSnapshot,
+    ) : BaseDriver() {
+        private var page = "sheet"
+        private var address = "示例路1号-old"
+        private var afterSaveCaptures = 0
+
+        override fun capture(): UiSnapshot = when (page) {
+            "sheet" -> SpecPanelFixtures.sheet()
+            "list" -> SpecPanelFixtures.Tree(2216).apply {
+                add("r/title", "收货地址", NodeBounds(400, 120, 680, 200))
+                add("r/modify", "", NodeBounds(900, 300, 1044, 380), "android.view.ViewGroup", clickable = true)
+                add("r/modify/t", "修改", NodeBounds(920, 310, 1030, 370))
+            }.snapshot()
+            "edit" -> SpecPanelFixtures.Tree(2216).apply {
+                add("r/title", "修改收货地址", NodeBounds(360, 120, 720, 200))
+                add("r/detailLabel", "详细地址", NodeBounds(20, 400, 160, 460))
+                add("r/detail", address, NodeBounds(180, 390, 900, 480), "android.widget.EditText", clickable = true)
+                add("r/save", "", NodeBounds(36, 2080, 1044, 2180), "android.view.ViewGroup", clickable = true)
+                add("r/save/t", "保存", NodeBounds(400, 2100, 700, 2160))
+            }.snapshot()
+            else -> {
+                val index = afterSaveCaptures++
+                when {
+                    cycle -> afterSave[index % afterSave.size]
+                    index < afterSave.size -> afterSave[index]
+                    else -> settled(address)
+                }
+            }
+        }
+
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicked += target.label
+            when (target.label) {
+                "修改" -> page = "edit"
+                "保存" -> page = "saved"
+            }
+            return FreshActionResult.SUCCESS
+        }
+
+        override fun clickAddressEntryFresh(target: SnapshotNode): cn.ilapage.goauto.agent.automation.FreshClickOutcome {
+            page = "list"
+            return cn.ilapage.goauto.agent.automation.FreshClickOutcome(
+                FreshActionResult.SUCCESS,
+                cn.ilapage.goauto.agent.automation.FreshClickReason.SUCCESS,
+                1,
+                1,
+            )
+        }
+
+        override fun inputFresh(target: SnapshotNode, value: String): FreshActionResult {
+            address = value
+            return FreshActionResult.SUCCESS
+        }
+    }
+
+    private companion object {
+        fun node(path: String, text: String, bounds: NodeBounds, clickable: Boolean = false, parent: String?) = SnapshotNode(
+            path, parent, text, null, null, "android.widget.TextView", bounds, clickable, false, false, false, true, true,
+        )
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/automation/ImageSearchAssetPolicyTest.kt

@@ -0,0 +1,127 @@
+package cn.ilapage.goauto.agent.automation
+
+import cn.ilapage.goauto.agent.network.ImageSearchImage
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class ImageSearchAssetPolicyTest {
+
+    private fun jpegBytes(payloadSize: Int = 10): ByteArray {
+        val body = ByteArray(payloadSize) { 0x11 }
+        return byteArrayOf(0xff.toByte(), 0xd8.toByte()) + body + byteArrayOf(0xff.toByte(), 0xd9.toByte())
+    }
+
+    @Test
+    fun `valid returns true for matching jpeg with correct markers and hash`() {
+        val bytes = jpegBytes()
+        val reference = ImageSearchImage(
+            imageUrl = "https://example.com/a.jpg",
+            mediaType = "image/jpeg",
+            sizeBytes = bytes.size.toLong(),
+            sha256 = ImageSearchAssetPolicy.sha256(bytes),
+        )
+        assertTrue(ImageSearchAssetPolicy.valid(bytes, reference))
+    }
+
+    @Test
+    fun `valid rejects jpeg missing markers`() {
+        val bytes = ByteArray(20) { 0x11 } // no ff d8 / ff d9
+        val reference = ImageSearchImage(
+            imageUrl = "https://example.com/a.jpg",
+            mediaType = "image/jpeg",
+            sizeBytes = bytes.size.toLong(),
+            sha256 = ImageSearchAssetPolicy.sha256(bytes),
+        )
+        assertFalse(ImageSearchAssetPolicy.valid(bytes, reference))
+    }
+
+    @Test
+    fun `valid rejects size mismatch`() {
+        val bytes = jpegBytes()
+        val reference = ImageSearchImage(
+            imageUrl = "https://example.com/a.jpg",
+            mediaType = "image/jpeg",
+            sizeBytes = bytes.size.toLong() + 1,
+            sha256 = ImageSearchAssetPolicy.sha256(bytes),
+        )
+        assertFalse(ImageSearchAssetPolicy.valid(bytes, reference))
+    }
+
+    @Test
+    fun `valid rejects hash mismatch`() {
+        val bytes = jpegBytes()
+        val reference = ImageSearchImage(
+            imageUrl = "https://example.com/a.jpg",
+            mediaType = "image/jpeg",
+            sizeBytes = bytes.size.toLong(),
+            sha256 = "0".repeat(64),
+        )
+        assertFalse(ImageSearchAssetPolicy.valid(bytes, reference))
+    }
+
+    @Test
+    fun `valid rejects unsupported media type`() {
+        val bytes = jpegBytes()
+        val reference = ImageSearchImage(
+            imageUrl = "https://example.com/a.gif",
+            mediaType = "image/gif",
+            sizeBytes = bytes.size.toLong(),
+            sha256 = ImageSearchAssetPolicy.sha256(bytes),
+        )
+        assertFalse(ImageSearchAssetPolicy.valid(bytes, reference))
+    }
+
+    @Test
+    fun `valid rejects oversized payload`() {
+        val bytes = jpegBytes(ImageSearchAssetPolicy.MAX_BYTES)
+        val reference = ImageSearchImage(
+            imageUrl = "https://example.com/a.jpg",
+            mediaType = "image/jpeg",
+            sizeBytes = bytes.size.toLong(),
+            sha256 = ImageSearchAssetPolicy.sha256(bytes),
+        )
+        assertFalse(ImageSearchAssetPolicy.valid(bytes, reference))
+    }
+
+    @Test
+    fun `hasJpegMarkers detects ff d8 ff d9 boundaries`() {
+        assertTrue(ImageSearchAssetPolicy.hasJpegMarkers(jpegBytes()))
+        assertFalse(ImageSearchAssetPolicy.hasJpegMarkers(byteArrayOf(1, 2, 3)))
+    }
+
+    @Test
+    fun `targetScaledSize returns null when already above minimum edge`() {
+        assertNull(ImageSearchAssetPolicy.targetScaledSize(1200, 1200))
+        assertNull(ImageSearchAssetPolicy.targetScaledSize(960, 960))
+    }
+
+    @Test
+    fun `targetScaledSize scales up small square image to minimum edge`() {
+        val (w, h) = ImageSearchAssetPolicy.targetScaledSize(480, 480)!!
+        assertEquals(960, w)
+        assertEquals(960, h)
+    }
+
+    @Test
+    fun `targetScaledSize preserves aspect ratio for narrow image`() {
+        // width limits: scale = 960/100 = 9.6 -> height 200*9.6=1920
+        val (w, h) = ImageSearchAssetPolicy.targetScaledSize(100, 200)!!
+        assertEquals(960, w)
+        assertEquals(1920, h)
+    }
+
+    @Test
+    fun `targetScaledSize gives up when scaling would exceed max edge`() {
+        // width 10 -> scale 96 -> height 10*96=960 within max, but width*96=960... choose extreme
+        assertNull(ImageSearchAssetPolicy.targetScaledSize(1, 5000))
+    }
+
+    @Test
+    fun `targetScaledSize rejects non positive dimensions`() {
+        assertNull(ImageSearchAssetPolicy.targetScaledSize(0, 100))
+        assertNull(ImageSearchAssetPolicy.targetScaledSize(100, 0))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/automation/ImageSearchBackRecoveryTest.kt

@@ -0,0 +1,90 @@
+package cn.ilapage.goauto.agent.automation
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #292：返回键推不动页面时不得空转到预算耗尽。
+ *
+ * 真机任务 156（2026-09-16）停在 PDD 深层页面，归位状态机 15 秒内按满 50 次返回仍未回到
+ * 首页，报 IMAGE_SEARCH_ENTRY_NOT_FOUND。根因是 BACK 分支按完就走、固定 300ms 盲等，
+ * 抓到的是切换动画中间态，被归为 OTHER_PDD 后继续按。
+ */
+class ImageSearchBackRecoveryTest {
+
+    /** 一个永远停在「其它拼多多页面」的驱动：返回键按多少次都不改变页面形态。 */
+    private class StuckDriver : PddCollectorDriver {
+        var backCount = 0
+        override fun capture(): UiSnapshot = UiSnapshot(
+            packageName = "com.xunmeng.pinduoduo",
+            activityName = "com.xunmeng.pinduoduo.activity.NewPageActivity",
+            nodes = listOf(node("某个商品页")),
+        )
+        override fun clickFresh(target: SnapshotNode) = FreshActionResult.SUCCESS
+        override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?) = false
+        override fun pullDownGoodsPage() = false
+        override fun back(): Boolean { backCount++; return true }
+    }
+
+    private companion object {
+        fun node(text: String) = SnapshotNode(
+            path = "0", parentPath = null, text = text, contentDescription = null,
+            resourceId = null, className = "android.widget.TextView",
+            bounds = NodeBounds(0, 900, 200, 960),
+            clickable = false, scrollable = false, selected = false,
+            checked = false, enabled = true, visible = true,
+        )
+    }
+
+    @Test
+    fun `stalled backs trigger a clear-top relaunch instead of burning the budget`() {
+        val driver = StuckDriver()
+        var resets = 0
+        val automation = PinduoduoImageSearchAutomation(
+            driver = driver,
+            currentPackage = { "com.xunmeng.pinduoduo" },
+            pause = { /* 测试里不真的睡 */ },
+        )
+        val result = automation.enterAndSelectImage(
+            launchPdd = { PddLaunchResult.STARTED },
+            resetPddToHome = { resets++; PddLaunchResult.STARTED },
+        )
+
+        // 页面始终推不动，最终仍然明确失败——不静默成功、不无限重试。
+        assertEquals("IMAGE_SEARCH_ENTRY_NOT_FOUND", result.code)
+        // 关键：不再是「按满 50 次返回」，每 MAX_STALLED_BACKS 次就改用清栈重启。
+        assertTrue("返回推不动时应当改用清栈重启，实际重启 $resets 次", resets > 0)
+    }
+
+    @Test
+    fun `a back that does move the page does not count as stalled`() {
+        // 能推动页面时不应触发清栈重启：驱动第一次返回后就变成首页形态。
+        var moved = false
+        val driver = object : PddCollectorDriver {
+            override fun capture(): UiSnapshot = UiSnapshot(
+                packageName = "com.xunmeng.pinduoduo",
+                activityName = "com.xunmeng.pinduoduo.ui.activity.MainFrameActivity",
+                nodes = if (moved) {
+                    listOf(
+                        node("拍照搜索").copy(
+                            clickable = true,
+                            bounds = NodeBounds(900, 100, 1000, 200),
+                            contentDescription = "拍照搜索",
+                        ),
+                    )
+                } else {
+                    listOf(node("某个商品页"))
+                },
+            )
+            override fun clickFresh(target: SnapshotNode) = FreshActionResult.SUCCESS
+            override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?) = false
+            override fun pullDownGoodsPage() = false
+            override fun back(): Boolean { moved = true; return true }
+        }
+        var resets = 0
+        PinduoduoImageSearchAutomation(driver, { "com.xunmeng.pinduoduo" }, pause = {})
+            .enterAndSelectImage({ PddLaunchResult.STARTED }, { resets++; PddLaunchResult.STARTED })
+        assertEquals("页面被返回键推动了，不该触发清栈重启", 0, resets)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/automation/PinduoduoImageSearchAutomationTest.kt

@@ -0,0 +1,260 @@
+package cn.ilapage.goauto.agent.automation
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class ImageSearchRecoveryPolicyTest {
+
+    private val entryTexts = listOf("我的相册", "最近搜索", "历史浏览", "点击拍照", "最近项目")
+    private val resultsTexts = listOf("搜图片同款", "综合", "销量", "价格", "品牌")
+    private val retryTexts = listOf("请对准商品或码，保持手机稳定", "取消", "再试一次")
+    private val homeTexts = listOf("拍照搜索", "首页", "推荐")
+
+    @Test
+    fun `classify recognizes non-pdd package regardless of texts`() {
+        val kind = ImageSearchRecoveryPolicy.classify("com.android.launcher", entryTexts, 0, hasClickableCameraEntry = false)
+        assertEquals(ImageSearchPageKind.NON_PDD, kind)
+    }
+
+    @Test
+    fun `classify recognizes image search entry page`() {
+        val kind = ImageSearchRecoveryPolicy.classify("com.xunmeng.pinduoduo", entryTexts, 0, hasClickableCameraEntry = false)
+        assertEquals(ImageSearchPageKind.IMAGE_SEARCH_ENTRY, kind)
+    }
+
+    @Test
+    fun `classify recognizes results page over other markers`() {
+        val kind = ImageSearchRecoveryPolicy.classify("com.xunmeng.pinduoduo", resultsTexts, 4, hasClickableCameraEntry = false)
+        assertEquals(ImageSearchPageKind.IMAGE_SEARCH_RESULTS, kind)
+    }
+
+    @Test
+    fun `classify recognizes retry dialog`() {
+        val kind = ImageSearchRecoveryPolicy.classify("com.xunmeng.pinduoduo", retryTexts, 0, hasClickableCameraEntry = false)
+        assertEquals(ImageSearchPageKind.RETRY_DIALOG, kind)
+    }
+
+    @Test
+    fun `classify recognizes order confirm page by read-only markers without treating them as click targets`() {
+        val kind = ImageSearchRecoveryPolicy.classify("com.xunmeng.pinduoduo", listOf("提交订单", "收货地址"), 0, hasClickableCameraEntry = false)
+        assertEquals(ImageSearchPageKind.ORDER_CONFIRM, kind)
+        // order confirm only ever maps to BACK -- never a click action.
+        assertEquals(ImageSearchRecoveryAction.BACK, ImageSearchRecoveryPolicy.nextAction(kind))
+    }
+
+    @Test
+    fun `classify recognizes home page only when a clickable camera entry exists`() {
+        val kind = ImageSearchRecoveryPolicy.classify(
+            "com.xunmeng.pinduoduo", homeTexts, 0, hasClickableCameraEntry = true,
+        )
+        assertEquals(ImageSearchPageKind.HOME, kind)
+    }
+
+    // 真机核对（2026-09-15）：个人中心 tab 的根节点也带 content-desc='拍照搜索'，
+    // 覆盖全屏且不可点，而 visibleTexts() 会把 contentDescription 当文本收集。
+    // 只看文案会把个人中心判成首页，几何兜底随后会点到「设置」。
+    @Test
+    fun `classify refuses home when camera text is present but nothing clickable carries it`() {
+        val kind = ImageSearchRecoveryPolicy.classify(
+            "com.xunmeng.pinduoduo", homeTexts, 0, hasClickableCameraEntry = false,
+        )
+        assertEquals(ImageSearchPageKind.OTHER_PDD, kind)
+    }
+
+    @Test
+    fun `classify falls back to other pdd page`() {
+        val kind = ImageSearchRecoveryPolicy.classify("com.xunmeng.pinduoduo", listOf("商品详情", "加入购物车"), 0, hasClickableCameraEntry = false)
+        assertEquals(ImageSearchPageKind.OTHER_PDD, kind)
+    }
+
+    @Test
+    fun `nextAction maps each page kind to the expected recovery action`() {
+        assertEquals(ImageSearchRecoveryAction.NONE, ImageSearchRecoveryPolicy.nextAction(ImageSearchPageKind.IMAGE_SEARCH_ENTRY))
+        assertEquals(ImageSearchRecoveryAction.CLICK_CAMERA, ImageSearchRecoveryPolicy.nextAction(ImageSearchPageKind.HOME))
+        assertEquals(ImageSearchRecoveryAction.LAUNCH_PDD, ImageSearchRecoveryPolicy.nextAction(ImageSearchPageKind.NON_PDD))
+        assertEquals(ImageSearchRecoveryAction.BACK, ImageSearchRecoveryPolicy.nextAction(ImageSearchPageKind.IMAGE_SEARCH_RESULTS))
+        // RETRY_DIALOG 不再是 BACK，理由见下方 retry dialog must be dismissed by cancel。
+        assertEquals(ImageSearchRecoveryAction.DISMISS_RETRY_DIALOG, ImageSearchRecoveryPolicy.nextAction(ImageSearchPageKind.RETRY_DIALOG))
+        assertEquals(ImageSearchRecoveryAction.BACK, ImageSearchRecoveryPolicy.nextAction(ImageSearchPageKind.OTHER_PDD))
+    }
+
+    @Test
+    fun `recovery budget caps at the documented limit`() {
+        assertFalse(ImageSearchRecoveryPolicy.exceedsRecoveryBudget(ImageSearchRecoveryPolicy.MAX_RECOVERY_ACTIONS - 1))
+        assertTrue(ImageSearchRecoveryPolicy.exceedsRecoveryBudget(ImageSearchRecoveryPolicy.MAX_RECOVERY_ACTIONS))
+    }
+
+    // `[必须]` 2026-09-15 真机实测：按 BACK 对这个弹窗完全无效，前后两次 uiautomator
+    // dump 逐字节相同；唯一出口是点「取消」。此前把它映射成 BACK，导致任务在弹窗上
+    // 空转直到预算耗尽、报 IMAGE_SEARCH_ENTRY_NOT_FOUND，而弹窗一直留在屏幕上。
+    @Test
+    fun `retry dialog must be dismissed by cancel, never by back`() {
+        val kind = ImageSearchRecoveryPolicy.classify(
+            "com.xunmeng.pinduoduo", retryTexts, 0, hasClickableCameraEntry = false,
+        )
+        assertEquals(ImageSearchPageKind.RETRY_DIALOG, kind)
+        assertEquals(
+            ImageSearchRecoveryAction.DISMISS_RETRY_DIALOG,
+            ImageSearchRecoveryPolicy.nextAction(kind),
+        )
+    }
+
+    // 其余需要归位的页面仍然用返回，不受上面那条影响。
+    @Test
+    fun `other pages still recover by back`() {
+        for (kind in listOf(
+            ImageSearchPageKind.IMAGE_SEARCH_RESULTS,
+            ImageSearchPageKind.ORDER_CONFIRM,
+            ImageSearchPageKind.OTHER_PDD,
+        )) {
+            assertEquals(
+                "$kind 的归位动作被改动了",
+                ImageSearchRecoveryAction.BACK,
+                ImageSearchRecoveryPolicy.nextAction(kind),
+            )
+        }
+    }
+
+    // 关闭弹窗会退出图搜回到首页，重新进入又会撞上同一个约 4 秒的摄像头识别窗口，
+    // 因此必须有独立且很小的上限，不能落在通用的 50 次预算里空转数分钟。
+    @Test
+    fun `retry dialog recovery budget is separate and small`() {
+        assertTrue(
+            "弹窗恢复上限必须显著小于通用恢复预算",
+            ImageSearchRecoveryPolicy.MAX_RETRY_DIALOG_RECOVERIES in
+                1 until ImageSearchRecoveryPolicy.MAX_RECOVERY_ACTIONS / 5,
+        )
+    }
+}
+
+class ImageSearchCandidatePolicyTest {
+
+    private fun card(top: Int, left: Int, ad: Boolean = false, loaded: Boolean = true) =
+        ImageSearchResultCard(top = top, left = left, width = 535, height = 764, texts = if (ad) listOf("广告", "¥19.9") else listOf("¥19.9"), imageLoaded = loaded)
+
+    @Test
+    fun `picks the first card in reading order`() {
+        val cards = listOf(card(top = 1085, left = 0), card(top = 312, left = 0), card(top = 312, left = 545))
+        val chosen = ImageSearchCandidatePolicy.firstOpenableCandidate(cards)
+        assertEquals(312, chosen?.top)
+        assertEquals(0, chosen?.left)
+    }
+
+    @Test
+    fun `skips ad cards and takes the next candidate`() {
+        val cards = listOf(
+            card(top = 312, left = 0),
+            card(top = 312, left = 545, ad = true),
+            card(top = 1085, left = 0, ad = true),
+            card(top = 1085, left = 545),
+        )
+        val chosen = ImageSearchCandidatePolicy.firstOpenableCandidate(cards)
+        assertEquals(312, chosen?.top)
+        assertEquals(0, chosen?.left)
+    }
+
+    @Test
+    fun `tolerates a candidate whose image has not finished loading`() {
+        val cards = listOf(card(top = 312, left = 0, loaded = false))
+        val chosen = ImageSearchCandidatePolicy.firstOpenableCandidate(cards)
+        assertEquals(312, chosen?.top)
+    }
+
+    @Test
+    fun `returns null when every candidate is an ad`() {
+        val cards = listOf(card(top = 312, left = 0, ad = true), card(top = 312, left = 545, ad = true))
+        assertNull(ImageSearchCandidatePolicy.firstOpenableCandidate(cards))
+    }
+
+    @Test
+    fun `returns null for an empty candidate list`() {
+        assertNull(ImageSearchCandidatePolicy.firstOpenableCandidate(emptyList()))
+    }
+}
+
+class ImageSearchClickTargetTest {
+
+    private fun node(top: Int, left: Int, right: Int, bottom: Int, text: String?) = SnapshotNode(
+        path = "0/$top/$left", parentPath = "0", text = text, contentDescription = null,
+        resourceId = null, className = "android.widget.TextView",
+        bounds = NodeBounds(left, top, right, bottom),
+        clickable = false, scrollable = false, selected = false, checked = false,
+        enabled = true, visible = true,
+    )
+
+    // 真机 dump（2026-09-15）的第一张卡片：[0,600] 535x764。
+    private val card = ImageSearchResultCard(top = 600, left = 0, width = 535, height = 764, texts = emptyList())
+
+    // `[必须]` 卡片容器自身无文案，label 为空串；clickFreshDetailed 重找时用的是
+    // preferredOrDescendantLabel()（会挖子孙），两者永远对不上，直接 TARGET_NOT_FOUND。
+    // 所以点击目标必须是卡片内有文案的子节点。
+    @Test
+    fun `click target is the topmost labelled node inside the card`() {
+        val nodes = listOf(
+            node(600, 0, 535, 1364, null),          // 卡片容器本身，无文案
+            node(1100, 20, 300, 1140, "¥21.8"),
+            node(1000, 20, 500, 1060, "港风时尚"),  // 最靠上的有文案节点
+        )
+        val target = ImageSearchCandidatePolicy.clickTargetInside(card, nodes)
+        assertEquals("港风时尚", target?.label)
+    }
+
+    // 相邻卡片的文案不得被当成本卡片的内容。真机上右侧卡片从 x=545 开始。
+    @Test
+    fun `nodes outside the card bounds are ignored`() {
+        val nodes = listOf(node(1000, 565, 1040, 1060, "森系假两件"))
+        assertNull(ImageSearchCandidatePolicy.clickTargetInside(card, nodes))
+    }
+
+    @Test
+    fun `card without any labelled child yields no target`() {
+        assertNull(ImageSearchCandidatePolicy.clickTargetInside(card, listOf(node(700, 10, 500, 900, null))))
+    }
+}
+
+class ImageSearchMediaRecencyPolicyTest {
+
+    @Test
+    fun `is most recent when our entry sorts first`() {
+        val entries = listOf(
+            ImageSearchMediaEntry(id = 100, dateAdded = 2_000),
+            ImageSearchMediaEntry(id = 90, dateAdded = 1_000),
+        )
+        assertTrue(ImageSearchMediaRecencyPolicy.isMostRecent(entries, ownId = 100))
+    }
+
+    @Test
+    fun `fails when a newer video sorts ahead of our image`() {
+        // Regression for pitfall 2: the recent-items grid mixes photos and videos; if a
+        // freshly-recorded video is newer than the jpeg we wrote, we must not claim first slot.
+        val entries = listOf(
+            ImageSearchMediaEntry(id = 101, dateAdded = 3_000), // newer video, not ours
+            ImageSearchMediaEntry(id = 100, dateAdded = 2_000), // our prepared jpeg
+        )
+        assertFalse(ImageSearchMediaRecencyPolicy.isMostRecent(entries, ownId = 100))
+    }
+
+    @Test
+    fun `fails when our own entry is missing from the query result`() {
+        val entries = listOf(ImageSearchMediaEntry(id = 5, dateAdded = 1_000))
+        assertFalse(ImageSearchMediaRecencyPolicy.isMostRecent(entries, ownId = 100))
+    }
+
+    @Test
+    fun `fails on an empty media list rather than guessing`() {
+        assertFalse(ImageSearchMediaRecencyPolicy.isMostRecent(emptyList(), ownId = 100))
+    }
+
+    @Test
+    fun `ties break by id so a same-timestamp newer insert still wins`() {
+        val entries = listOf(
+            ImageSearchMediaEntry(id = 101, dateAdded = 2_000),
+            ImageSearchMediaEntry(id = 100, dateAdded = 2_000),
+        )
+        assertFalse(ImageSearchMediaRecencyPolicy.isMostRecent(entries, ownId = 100))
+        assertTrue(ImageSearchMediaRecencyPolicy.isMostRecent(entries, ownId = 101))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/automation/PinduoduoImageSearchCriteriaTest.kt

@@ -0,0 +1,64 @@
+package cn.ilapage.goauto.agent.automation
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PinduoduoImageSearchCriteriaTest {
+
+    @Test
+    fun `isImageSearchEntryPage requires all four signals`() {
+        val complete = listOf("我的相册", "最近搜索", "历史浏览", "点击拍照即可开始识别")
+        assertTrue(PinduoduoImageSearchCriteria.isImageSearchEntryPage(complete))
+
+        val missingHint = listOf("我的相册", "最近搜索", "历史浏览")
+        assertFalse(PinduoduoImageSearchCriteria.isImageSearchEntryPage(missingHint))
+
+        val alternateHint = listOf("我的相册", "最近搜索", "历史浏览", "开启相机权限")
+        assertTrue(PinduoduoImageSearchCriteria.isImageSearchEntryPage(alternateHint))
+
+        val thirdHintVariant = listOf("我的相册", "最近搜索", "历史浏览", "拍摄清晰照片即可进行自动识别")
+        assertTrue(PinduoduoImageSearchCriteria.isImageSearchEntryPage(thirdHintVariant))
+    }
+
+    @Test
+    fun `isImageSearchResultsPage requires title and enough sort controls`() {
+        assertTrue(PinduoduoImageSearchCriteria.isImageSearchResultsPage(listOf("搜图片同款"), sortControlCount = 3))
+        assertFalse(PinduoduoImageSearchCriteria.isImageSearchResultsPage(listOf("搜图片同款"), sortControlCount = 2))
+        assertFalse(PinduoduoImageSearchCriteria.isImageSearchResultsPage(listOf("其他标题"), sortControlCount = 5))
+    }
+
+    @Test
+    fun `isRetryDialog requires hint text plus both buttons`() {
+        val texts = listOf("请对准商品或码，保持手机稳定", "取消", "再试一次")
+        assertTrue(PinduoduoImageSearchCriteria.isRetryDialog(texts))
+        assertFalse(PinduoduoImageSearchCriteria.isRetryDialog(listOf("请对准商品或码，保持手机稳定", "取消")))
+        assertFalse(PinduoduoImageSearchCriteria.isRetryDialog(listOf("取消", "再试一次")))
+    }
+
+    @Test
+    fun `firstRecentImageGridCell picks topmost then leftmost four column cell`() {
+        val screenWidth = 1080
+        val cellWidth = screenWidth / 4 // 270
+        val candidates = listOf(
+            PinduoduoImageSearchCriteria.GridCandidate(top = 200, left = cellWidth, width = cellWidth, height = cellWidth),
+            PinduoduoImageSearchCriteria.GridCandidate(top = 100, left = cellWidth * 2, width = cellWidth, height = cellWidth),
+            PinduoduoImageSearchCriteria.GridCandidate(top = 100, left = 0, width = cellWidth, height = cellWidth),
+            // not a 4-column cell (too narrow height ratio)
+            PinduoduoImageSearchCriteria.GridCandidate(top = 50, left = 0, width = cellWidth, height = 10),
+        )
+        val result = PinduoduoImageSearchCriteria.firstRecentImageGridCell(candidates, screenWidth)
+        assertTrue(result != null)
+        assertTrue(result!!.top == 100 && result.left == 0)
+    }
+
+    @Test
+    fun `firstRecentImageGridCell returns null when nothing matches grid shape`() {
+        val screenWidth = 1080
+        val candidates = listOf(
+            PinduoduoImageSearchCriteria.GridCandidate(top = 0, left = 0, width = 1080, height = 100),
+        )
+        assertNull(PinduoduoImageSearchCriteria.firstRecentImageGridCell(candidates, screenWidth))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/service/TaskDispatchPolicyTest.kt

@@ -0,0 +1,50 @@
+package cn.ilapage.goauto.agent.service
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class TaskDispatchPolicyTest {
+
+    // 四条既有路径的回归。图搜任务由服务端 ORDER BY 垫底（见
+    // task.Service.Next），客户端这里不参与来源优先级，保持四分支不变。
+
+    @Test
+    fun `spec probe pending waits for purchase match regardless of cooldown`() {
+        assertEquals(
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH,
+            TaskDispatchPolicy.decide("spec_probe_pending", collectionCooldownActive = false),
+        )
+        assertEquals(
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH,
+            TaskDispatchPolicy.decide("spec_probe_pending", collectionCooldownActive = true),
+        )
+    }
+
+    @Test
+    fun `any other purchase status runs purchase`() {
+        assertEquals(
+            TaskDispatchDecision.RUN_PURCHASE,
+            TaskDispatchPolicy.decide("matched", collectionCooldownActive = false),
+        )
+        assertEquals(
+            TaskDispatchDecision.RUN_PURCHASE,
+            TaskDispatchPolicy.decide("matched", collectionCooldownActive = true),
+        )
+    }
+
+    @Test
+    fun `no purchase status and cooldown active waits for cooldown`() {
+        assertEquals(
+            TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN,
+            TaskDispatchPolicy.decide(null, collectionCooldownActive = true),
+        )
+    }
+
+    @Test
+    fun `no purchase status and no cooldown checks collection`() {
+        assertEquals(
+            TaskDispatchDecision.CHECK_COLLECTION,
+            TaskDispatchPolicy.decide(null, collectionCooldownActive = false),
+        )
+    }
+}

chrome-extension/.gitignore

@@ -0,0 +1 @@
+node_modules/

chrome-extension/README.md

@@ -0,0 +1,7 @@
+# GoAuto PDD 订单回填扩展
+
+Manifest V3 轻量扩展。用户在已登录的 PDD 我的订单页手动开始；扩展读取必要订单事实，先完成本次范围内的 CG 冲突聚合，再通过已授权 Admin Origin 的客户端密钥接口分批提交。
+
+密钥只保存在扩展可信上下文，内容脚本不能读取；网络请求禁止重定向且不携带 Cookie。当前自动化测试只使用合成文本与合成 DOM fixture，不包含真实订单、地址、Cookie 或网页 HTML。
+
+开发验证：`npm test`。解压安装、真实 PDD 遍历和真实 Admin 上传必须另行授权，本仓库验证不会执行这些动作。

chrome-extension/content.js

@@ -0,0 +1,9 @@
+"use strict";const Core=self.GoAutoBackfillCore,SAFE=/^(订单详情|查看详情)$/,RISK=/(付款|支付|确认收货|退款|售后|取消订单|更多)/,END=/^(没有更多了|没有更多|已经到底了)$/,LOGIN=/(请登录|登录后查看|验证码|安全验证)/;
+const txt=e=>(e?.innerText||e?.textContent||"").trim(),vis=e=>{const r=e.getBoundingClientRect();return r.width>0&&r.height>0},clickable=e=>e.closest("button,a,[role=button],[tabindex]");
+function entries(){const explicit=[...document.querySelectorAll("button,a,[role=button],[tabindex],div,span")].filter(e=>vis(e)&&SAFE.test(txt(e))).map(clickable).filter(Boolean).filter(e=>!RISK.test(txt(e)));if(explicit.length)return[...new Set(explicit)];return[...document.querySelectorAll(".react-base-list > div")].map(card=>[...card.children].slice(1).find(row=>vis(row)&&row.querySelector("img")&&!RISK.test(txt(row)))).filter(Boolean)}
+function summary(){const b=txt(document.body);return{ok:true,entryCount:entries().length,endEvidence:[...document.querySelectorAll("div,span,p")].some(e=>vis(e)&&END.test(txt(e))),loginExpired:LOGIN.test(b),empty:/^(暂无订单|没有订单)$/m.test(b),scrollY,scrollHeight:document.documentElement.scrollHeight}}
+function labelValue(labels){for(const n of document.querySelectorAll("div,span,p,li")){const own=txt(n).replace(/[：:]$/u,"").trim();if(!labels.includes(own))continue;const row=n.parentElement,parts=[...row.children].filter(x=>x!==n).map(x=>txt(x).replace(/复制\s*$/u,"").trim()).filter(Boolean);if(parts.length)return parts.join("")}return""}
+function paidValue(){for(const n of document.querySelectorAll("div,span,p,li")){if(!["实付","实际支付"].includes(txt(n).replace(/[：:]$/u,"").trim()))continue;for(const x of n.parentElement.children){const value=txt(x);if(x!==n&&Core.moneyCent(value)!=null)return value}}return""}
+async function detail(){const controls=[...new Set([...document.querySelectorAll("button,[role=button],[tabindex],div,span")].filter(e=>vis(e)&&/^(展开|展开收货信息|展开订单信息|查看完整信息|订单信息)$/.test(txt(e))).map(clickable).filter(Boolean).filter(e=>!RISK.test(txt(e))))];for(const control of controls.slice(0,2)){control.click();await new Promise(r=>setTimeout(r,100))}let stable=0,last="",until=Date.now()+5000;while(Date.now()<until){await new Promise(r=>setTimeout(r,250));const order=labelValue(["订单号"]),time=labelValue(["下单时间","创建时间"]),v=`${order}|${time}`;stable=order&&time&&v===last?stable+1:0;last=v;if(stable>=2)break}return{address:txt(document.body),orderNo:labelValue(["订单号"]),submittedAt:labelValue(["下单时间","创建时间"]),paidAmount:paidValue()}}
+chrome.runtime.onMessage.addListener((m,_s,reply)=>{if(m?.source!=="goauto-service"||!["LIST","SCROLL","OPEN_ENTRY","DETAIL","RESTORE"].includes(m.type))return;(async()=>{if(m.type==="LIST")return summary();if(m.type==="SCROLL"){scrollTo({top:document.documentElement.scrollHeight,behavior:"instant"});return summary()}if(m.type==="RESTORE"){scrollTo({top:Number(m.scrollY)||0,behavior:"instant"});return summary()}if(m.type==="OPEN_ENTRY"){const e=entries();if(!e[m.index])throw Error("安全的订单详情入口不存在");e[m.index].click();return{ok:true}}if(LOGIN.test(txt(document.body)))return{ok:false,loginExpired:true};return{ok:true,classified:Core.classifyDetail(await detail())}})().then(reply).catch(e=>reply({ok:false,error:e.message}));return true});
+if(typeof module!=="undefined")module.exports={entries,summary,labelValue,paidValue,detail};

chrome-extension/core.js

@@ -0,0 +1,15 @@
+(function(root){"use strict";
+const MAX_BATCH=50,CG=/_cg([1-9]\d*)\b/ig,TERMINAL=new Set(["completed","incomplete","stopped","failed"]);
+function normalizeOrigin(raw){const u=new URL(String(raw||"").trim());if(!/^https?:$/.test(u.protocol)||u.username||u.password||u.pathname!=="/"||u.search||u.hash)throw Error("Admin Origin 必须是 http(s) 根地址");return u.origin}
+function addressSuffixes(v){return[...new Set([...String(v||"").matchAll(CG)].map(m=>`_cg${m[1]}`))]}
+function addressSuffix(v){const a=addressSuffixes(v);return a.length===1?a[0]:""}
+function moneyCent(v){const m=String(v||"").trim().replace(/,/g,"").match(/^(?:¥|￥)?\s*(0|[1-9]\d*)(?:\.(\d{1,2}))?\s*元?$/);return m?Number(m[1])*100+Number((m[2]||"").padEnd(2,"0")):null}
+function normalizeOrderNo(v){const s=String(v||"").replace(/\s*复制\s*$/u,"").trim();return/^[A-Za-z0-9-]{1,100}$/.test(s)?s:""}
+function normalizeTime(v){const m=String(v||"").trim().match(/^(\d{4})[-/.年](\d{1,2})[-/.月](\d{1,2})日?\s+(\d{1,2}):(\d{2})(?::(\d{2}))?$/);if(!m)return null;const p=n=>String(n).padStart(2,"0"),d=new Date(`${m[1]}-${p(m[2])}-${p(m[3])}T${p(m[4])}:${m[5]}:${p(m[6]||0)}+08:00`);return Number.isNaN(d.valueOf())?null:d.toISOString()}
+function classifyDetail(f){const s=addressSuffixes(f.address||""),item={addressSuffix:s.length===1?s[0]:"",pddOrderNo:normalizeOrderNo(f.orderNo),orderSubmittedAt:normalizeTime(f.submittedAt),pddOrderAmountCent:f.paidAmount==null||f.paidAmount===""?null:moneyCent(f.paidAmount)};if(s.length>1)return{kind:"error",code:"CG_AMBIGUOUS",item};if(!s.length)return{kind:"skip",code:"CG_MISSING",item};if(!item.pddOrderNo)return{kind:"error",code:"ORDER_NO_INVALID",item};if(!item.orderSubmittedAt)return{kind:"error",code:"ORDER_TIME_INVALID",item};if(f.paidAmount!=null&&f.paidAmount!==""&&item.pddOrderAmountCent==null)return{kind:"error",code:"ORDER_AMOUNT_INVALID",item};return{kind:"candidate",code:"",item}}
+function aggregate(rows){const cs=rows.filter(x=>x.kind==="candidate").map(x=>x.item),cg=new Map,orders=new Map,uniq=new Map;for(const x of cs){if(!cg.has(x.addressSuffix))cg.set(x.addressSuffix,new Set);if(!orders.has(x.pddOrderNo))orders.set(x.pddOrderNo,new Set);cg.get(x.addressSuffix).add(x.pddOrderNo);orders.get(x.pddOrderNo).add(x.addressSuffix);uniq.set(`${x.addressSuffix}\0${x.pddOrderNo}`,x)}const cc=new Set([...cg].filter(([,v])=>v.size>1).map(([k])=>k)),oc=new Set([...orders].filter(([,v])=>v.size>1).map(([k])=>k));return{ready:[...uniq.values()].filter(x=>!cc.has(x.addressSuffix)&&!oc.has(x.pddOrderNo)),cgConflicts:[...cc],orderConflicts:[...oc],skippedNoCG:rows.filter(x=>x.code==="CG_MISSING").length,localErrors:rows.filter(x=>x.kind==="error")}}
+function batches(a,n=MAX_BATCH){const o=[];for(let i=0;i<a.length;i+=n)o.push(a.slice(i,i+n));return o}
+function inWindow(x,start,days){return new Date(x.orderSubmittedAt).valueOf()>=new Date(start).valueOf()-Number(days)*86400000}
+function validPddURL(v){try{const u=new URL(v);return u.protocol==="https:"&&u.hostname==="mobile.yangkeduo.com"}catch(_){return false}}
+function trustedUISender(s,id){try{const u=new URL(s.url);return s?.id===id&&!s.tab&&u.protocol==="chrome-extension:"&&u.hostname===id}catch(_){return false}}
+const api={MAX_BATCH,normalizeOrigin,addressSuffixes,addressSuffix,moneyCent,normalizeOrderNo,normalizeTime,classifyDetail,aggregate,batches,inWindow,validPddURL,trustedUISender,terminal:p=>TERMINAL.has(p)};if(typeof module!=="undefined")module.exports=api;root.GoAutoBackfillCore=api})(typeof self!=="undefined"?self:globalThis);

chrome-extension/manifest.json

@@ -0,0 +1,16 @@
+{
+  "manifest_version": 3,
+  "name": "GoAuto PDD 订单回填",
+  "version": "0.1.0",
+  "description": "手动扫描最近 PDD 订单并将必要订单事实回填到已授权的 GoAuto Admin。",
+  "permissions": ["storage", "tabs"],
+  "host_permissions": ["https://mobile.yangkeduo.com/*"],
+  "optional_host_permissions": ["https://*/*", "http://*/*"],
+  "background": {"service_worker": "service-worker.js"},
+  "action": {"default_popup": "popup.html"},
+  "content_scripts": [{
+    "matches": ["https://mobile.yangkeduo.com/*"],
+    "js": ["core.js", "content.js"],
+    "run_at": "document_idle"
+  }]
+}

chrome-extension/package-lock.json

@@ -0,0 +1,545 @@
+{
+  "name": "goauto-pdd-order-backfill",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "goauto-pdd-order-backfill",
+      "version": "0.1.0",
+      "devDependencies": {
+        "jsdom": "^26.1.0"
+      }
+    },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
+      }
+    },
+    "node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/cssstyle": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
+      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^3.2.0",
+        "rrweb-cssom": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/data-urls": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
+      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/html-encoding-sniffer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
+      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-encoding": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/jsdom": {
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
+      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssstyle": "^4.2.1",
+        "data-urls": "^5.0.0",
+        "decimal.js": "^10.5.0",
+        "html-encoding-sniffer": "^4.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.16",
+        "parse5": "^7.2.1",
+        "rrweb-cssom": "^0.8.0",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^5.1.1",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^7.0.0",
+        "whatwg-encoding": "^3.1.1",
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.1.1",
+        "ws": "^8.18.0",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nwsapi": {
+      "version": "2.2.27",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.27.tgz",
+      "integrity": "sha512-gQPNF78qebCQ6tvVFBYrvJdBNOrYZm90ZlXgpIFm06p6qHDHq/XC4TnJftN6OMbxVE0UTBAoRgcsDeJBBooITw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/parse5": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/rrweb-cssom": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
+      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tldts": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
+      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^6.1.86"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
+      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tough-cookie": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
+      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^6.1.32"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    }
+  }
+}

chrome-extension/package.json

@@ -0,0 +1 @@
+{"name":"goauto-pdd-order-backfill","private":true,"version":"0.1.0","scripts":{"test":"node --test test/*.test.js"},"devDependencies":{"jsdom":"^26.1.0"}}

chrome-extension/popup.css

@@ -0,0 +1 @@
+:root{font-family:Arial,sans-serif;color:#134e4a;background:#f0fdfa}body{margin:0;width:390px}main{padding:20px}h1{font-size:24px;margin:0 0 6px}.muted,.help{color:#64748b;font-size:12px}label{display:block;font-weight:700;margin-top:14px}input{box-sizing:border-box;width:100%;height:42px;margin-top:6px;border:1px solid #cbd5e1;border-radius:8px;padding:0 12px;font-size:14px}.notice{margin:18px 0;padding:12px;border:1px solid #99f6e4;border-radius:10px;background:#fff;font-size:12px;line-height:1.5}button{width:100%;height:46px;border:0;border-radius:10px;background:#0d9488;color:#fff;font-weight:700;font-size:15px;cursor:pointer;margin-top:10px}.secondary{background:#fff;color:#0d9488;border:1px solid #0d9488}button:disabled,input:disabled{opacity:.55;cursor:not-allowed}#error{color:#b91c1c;font-size:12px}#status{white-space:pre-line;font-size:13px;line-height:1.6;margin-top:12px}

chrome-extension/popup.html

@@ -0,0 +1,9 @@
+<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><link rel="stylesheet" href="popup.css"><title>PDD 订单回填</title></head><body>
+<main><h1>PDD 订单回填</h1><p class="muted">扫描最近订单，聚合冲突后分批上传 Admin。</p>
+<label>Admin Origin<input id="origin" type="url" placeholder="https://admin.example.internal"></label>
+<label>客户端密钥<input id="key" type="password" autocomplete="off" placeholder="仅保存在扩展可信上下文"></label>
+<p class="help">密钥需授权：采购管理 → 回填。</p>
+<label>最近天数<input id="days" type="number" min="1" max="30" value="2"></label>
+<div class="notice">开始后冻结配置与时间窗口；完成扫描并聚合冲突后才上传。</div>
+<button id="start">开始扫描并上传</button><button id="stop" class="secondary">停止</button>
+<p id="error" role="alert"></p><section id="status" aria-live="polite"></section><button id="retry" class="secondary" hidden>重试可重试项</button><ol id="results"></ol></main><script src="core.js"></script><script src="popup.js"></script></body></html>

chrome-extension/popup.js

@@ -0,0 +1,6 @@
+"use strict";const Core=self.GoAutoBackfillCore,$=id=>document.getElementById(id);let timer;
+const command=(type,data={})=>new Promise(resolve=>chrome.runtime.sendMessage({source:"goauto-popup",type,...data},resolve));
+async function load(){const c=await chrome.storage.local.get(["adminOrigin","clientKey","days"]);$("origin").value=c.adminOrigin||"";$("key").value=c.clientKey||"";$("days").value=c.days||2;await refresh();timer=setInterval(refresh,750)}
+async function refresh(){const q=await command("STATUS"),r=q?.run;if(!r){$("status").textContent="空闲";return}const busy=!Core.terminal(r.phase),complete=r.scanComplete?"已确认列表末尾":"未完整扫描";$("status").textContent=`状态：${r.phase}（${complete}）\n已读 ${r.stats.read} · 可提交 ${r.stats.ready} · 已写入 ${r.stats.written}\n冲突 ${r.stats.conflicts} · 无 CG 跳过 ${r.stats.skippedNoCG}${r.incompleteReason?`\n${r.incompleteReason}`:""}${r.error?`\n${r.error.message}`:""}`;for(const id of["origin","key","days","start"])$(id).disabled=busy;$("stop").disabled=!busy;$("retry").hidden=!(r.phase==="incomplete"&&r.batches?.some(b=>b.status==="retryable"));const pending=(r.batches||[]).filter(b=>b.status==="retryable").flatMap(b=>b.results||[]),errors=(r.localErrors||[]).map((x,i)=>({index:i,result:"local_error",code:x.code}));$("results").replaceChildren(...[...(r.results||[]),...pending,...errors].map(x=>{const li=document.createElement("li");li.textContent=`第 ${Number(x.index)+1} 项：${x.result} / ${x.code}`;return li}))}
+$("start").addEventListener("click",async()=>{try{$("error").textContent="";const origin=Core.normalizeOrigin($("origin").value),clientKey=$("key").value.trim(),days=Number($("days").value);if(!clientKey||!Number.isInteger(days)||days<1||days>30)throw Error("请填写密钥，最近天数须为 1–30");if(!await chrome.permissions.request({origins:[`${origin}/*`]}))throw Error("未授予此 Admin Origin 的访问权限");await chrome.storage.local.setAccessLevel({accessLevel:"TRUSTED_CONTEXTS"});await chrome.storage.local.set({adminOrigin:origin,clientKey,days});const[tab]=await chrome.tabs.query({active:true,currentWindow:true}),res=await command("START",{tabId:tab.id,clientKey,frozen:{origin,days,startedAt:new Date().toISOString()}});if(!res?.ok)throw Error(res?.error||"启动失败");await refresh()}catch(e){$("error").textContent=e.message}});
+$("stop").addEventListener("click",async()=>{await command("STOP");await refresh()});$("retry").addEventListener("click",async()=>{await command("RETRY");await refresh()});addEventListener("unload",()=>clearInterval(timer));load();

chrome-extension/service-worker.js

@@ -0,0 +1,24 @@
+"use strict";importScripts("core.js");const Core=self.GoAutoBackfillCore,STATE="orderBackfillRun",SECRET="orderBackfillSecret";let active=null,starting=false;
+const delay=ms=>new Promise(r=>setTimeout(r,ms)),uuid=()=>crypto.randomUUID();
+async function secure(){await chrome.storage.local.setAccessLevel({accessLevel:"TRUSTED_CONTEXTS"});await chrome.storage.session.setAccessLevel({accessLevel:"TRUSTED_CONTEXTS"})}
+chrome.runtime.onInstalled.addListener(secure);chrome.runtime.onStartup.addListener(()=>{secure();resume()});secure();
+async function getRun(){return(await chrome.storage.session.get(STATE))[STATE]||null}async function getSecret(){return(await chrome.storage.session.get(SECRET))[SECRET]||null}
+async function write(run){const latest=await getRun();if(latest&&latest.id!==run.id)throw Error("运行已被替换");if(latest?.stopRequested)run.stopRequested=true;await chrome.storage.session.set({[STATE]:run})}
+async function cancelled(run){const latest=await getRun();return!latest||latest.id!==run.id||latest.stopRequested}
+async function send(run,type,extra={}){if(await cancelled(run))throw Object.assign(Error("已停止"),{code:"STOPPED"});let done=false,value,error;chrome.tabs.sendMessage(run.tabId,{source:"goauto-service",type,...extra}).then(v=>{done=true;value=v},e=>{done=true;error=e});const end=Date.now()+(self.__GOAUTO_TEST_TIMEOUT__||15000);while(!done&&Date.now()<end){if(await cancelled(run))throw Object.assign(Error("已停止"),{code:"STOPPED"});await delay(100)}if(!done){if(await cancelled(run))throw Object.assign(Error("已停止"),{code:"STOPPED"});throw Object.assign(Error("页面响应超时"),{code:"CONTENT_TIMEOUT"})}if(error)throw error;return value}
+async function loaded(tabId,timeout=15000){const end=Date.now()+timeout;while(Date.now()<end){if((await chrome.tabs.get(tabId)).status==="complete"){await delay(300);return}await delay(200)}throw Object.assign(Error("页面加载超时"),{code:"PAGE_TIMEOUT"})}
+async function navigated(run,from,timeout=15000){const end=Date.now()+timeout;while(Date.now()<end){if(await cancelled(run))throw Object.assign(Error("已停止"),{code:"STOPPED"});const tab=await chrome.tabs.get(run.tabId);if(tab.url!==from&&tab.status==="complete"){await delay(300);return}await delay(150)}throw Object.assign(Error("订单详情未打开"),{code:"DETAIL_NOT_OPENED"})}
+async function returnList(run){await chrome.tabs.goBack(run.tabId);await loaded(run.tabId);const tab=await chrome.tabs.get(run.tabId);if(!tab.url.startsWith(run.listURL.split("?")[0]))await chrome.tabs.update(run.tabId,{url:run.listURL});await loaded(run.tabId);await send(run,"RESTORE",{scrollY:run.scrollY})}
+function isListURL(raw){try{return new URL(raw).pathname==="/orders.html"}catch(_){return false}}
+function prepare(run){const inRange=run.rows.filter(x=>x.kind!=="candidate"||Core.inWindow(x.item,run.frozen.startedAt,run.frozen.days));const grouped=Core.aggregate(inRange);run.localErrors=grouped.localErrors;run.stats.ready=grouped.ready.length;run.stats.conflicts=grouped.cgConflicts.length+grouped.orderConflicts.length;run.stats.skippedNoCG=grouped.skippedNoCG;run.batches=Core.batches(grouped.ready).map((items,i)=>({index:i,requestId:uuid(),status:"pending",items,results:[],attempts:0}));}
+function validate(payload,count){const items=payload?.data?.items;if(!Array.isArray(items)||items.length!==count)throw Object.assign(Error("服务端返回结果不完整"),{code:"INVALID_RESPONSE"});const seen=new Set;for(const x of items){if(!Number.isInteger(x.index)||x.index<0||x.index>=count||seen.has(x.index)||(x.taskId!=null&&(!Number.isInteger(x.taskId)||x.taskId<0))||typeof x.result!=="string"||typeof x.code!=="string"||typeof x.retryable!=="boolean")throw Object.assign(Error("服务端返回结果索引或字段无效"),{code:"INVALID_RESPONSE"});seen.add(x.index)}return items.sort((a,b)=>a.index-b.index)}
+async function post(run,batch){const secret=await getSecret();if(!secret||secret.runId!==run.id||secret.origin!==run.frozen.origin)throw Error("冻结的运行凭据不可用");const ctl=new AbortController,t=setTimeout(()=>ctl.abort(),self.__GOAUTO_TEST_TIMEOUT__||15000);try{const res=await fetch(`${run.frozen.origin}/api/client/v1/purchase-tasks/order-backfill`,{method:"POST",redirect:"error",cache:"no-store",credentials:"omit",signal:ctl.signal,headers:{Authorization:`Bearer ${secret.clientKey}`,"Content-Type":"application/json"},body:JSON.stringify({requestId:batch.requestId,items:batch.items})});if(!res.ok)throw Object.assign(Error(res.status===401?"客户端密钥无效":res.status===403?"密钥未授权采购管理 → 回填":`提交失败 (${res.status})`),{code:`HTTP_${res.status}`,retryable:res.status>=500});return validate(await res.json(),batch.items.length)}catch(e){if(e.name==="AbortError")throw Object.assign(Error("提交超时，可用相同批次标识重试"),{code:"TIMEOUT",retryable:true});throw e}finally{clearTimeout(t)}}
+async function execute(run){try{
+ if(run.phase==="scanning"){let stalled=0;while(run.entryCount<500){const view=await send(run,"LIST");if(view.loginExpired)throw Object.assign(Error("PDD 登录失效或出现安全验证"),{code:"LOGIN_EXPIRED"});if(view.empty){run.scanComplete=true;break}run.entryCount=Math.max(run.entryCount,view.entryCount);run.scrollY=view.scrollY;if(view.endEvidence){run.scanComplete=true;break}const before=run.entryCount;await send(run,"SCROLL");await delay(500);const after=await send(run,"LIST");if(after.loginExpired)throw Object.assign(Error("PDD 登录失效或出现安全验证"),{code:"LOGIN_EXPIRED"});run.entryCount=Math.max(run.entryCount,after.entryCount);run.scrollY=after.scrollY;if(after.endEvidence){run.scanComplete=true;break}stalled=run.entryCount===before?stalled+1:0;await write(run);if(stalled>=3){run.incompleteReason="未看到列表末尾标记";break}}if(run.entryCount>=500)run.incompleteReason="达到单次 500 条有界扫描上限";run.phase="reading";run.detailState="list";await write(run)}
+ if(run.phase==="reading"){while(run.cursor<run.entryCount){if(await cancelled(run))throw Object.assign(Error("已停止"),{code:"STOPPED"});let tab=await chrome.tabs.get(run.tabId);if(isListURL(tab.url)&&run.detailState==="returning"){run.cursor++;run.detailState="list";await write(run);continue}if(isListURL(tab.url)){await send(run,"RESTORE",{scrollY:run.scrollY});run.detailState="opening";await write(run);await send(run,"OPEN_ENTRY",{index:run.cursor});await navigated(run,tab.url);run.detailState="detail";await write(run)}else if(run.detailState==="list"){await chrome.tabs.update(run.tabId,{url:run.listURL});await loaded(run.tabId);continue}if(run.detailState!=="returning"){const d=await send(run,"DETAIL");if(d.loginExpired)throw Object.assign(Error("PDD 登录失效或出现安全验证"),{code:"LOGIN_EXPIRED"});if(!d.ok)throw Error(d.error||"订单详情读取失败");run.rows.push(d.classified);run.stats.read++;run.detailState="returning";await write(run)}await returnList(run);run.cursor++;run.detailState="list";await write(run)}run.phase="aggregating";await write(run)}
+ if(run.phase==="aggregating"){prepare(run);run.phase="submitting";await write(run)}
+ if(run.phase==="submitting"){for(const b of run.batches){if(b.status==="confirmed")continue;if(await cancelled(run))throw Object.assign(Error("已停止"),{code:"STOPPED"});b.status="sending";b.attempts++;await write(run);try{b.results=await post(run,b);if(b.results.some(x=>x.retryable)){b.status="retryable";b.error={code:"ITEM_RETRYABLE",message:"服务端返回可重试项"};run.phase="incomplete";run.incompleteReason=b.error.message;await write(run);return}b.status="confirmed";run.results.push(...b.results);run.stats.written+=b.results.filter(x=>x.result==="backfilled"||x.result==="already_backfilled").length}catch(e){b.status=e.retryable?"retryable":"failed";b.error={code:e.code||"SUBMIT_FAILED",message:e.message};run.phase=e.retryable?"incomplete":"failed";run.incompleteReason=e.retryable?e.message:run.incompleteReason;await write(run);return}await write(run)}run.phase=run.scanComplete?"completed":"incomplete";await write(run)}
+ }catch(e){run.phase=e.code==="STOPPED"?"stopped":e.code==="LOGIN_EXPIRED"?"failed":"failed";run.error={code:e.code||"RUN_FAILED",message:e.message};if(e.code==="LOGIN_EXPIRED")run.incompleteReason=e.message;await write(run)}finally{active=null}}
+function resume(){if(active)return;active=(async()=>{const r=await getRun();if(r&&!Core.terminal(r.phase))await execute(r)})().finally(()=>active=null)}
+async function start(tabId,frozen,key){const old=await getRun();if(old&&!Core.terminal(old.phase))throw Error("已有回填任务正在运行");const tab=await chrome.tabs.get(tabId);if(!Core.validPddURL(tab.url)||!/\/orders\.html/.test(new URL(tab.url).pathname))throw Error("请在 PDD 我的订单页开始");const run={id:uuid(),tabId,listURL:tab.url,phase:"scanning",frozen:{origin:Core.normalizeOrigin(frozen.origin),days:frozen.days,startedAt:frozen.startedAt},entryCount:0,cursor:0,scrollY:0,rows:[],results:[],batches:[],localErrors:[],stats:{read:0,ready:0,written:0,conflicts:0,skippedNoCG:0},scanComplete:false,incompleteReason:"",stopRequested:false,error:null};await chrome.storage.session.set({[SECRET]:{runId:run.id,origin:run.frozen.origin,clientKey:key}});await chrome.storage.session.set({[STATE]:run});resume();return run}
+chrome.runtime.onMessage.addListener((m,s,reply)=>{if(m?.source!=="goauto-popup")return;(async()=>{if(!Core.trustedUISender(s,chrome.runtime.id))throw Error("拒绝非扩展界面的控制消息");if(m.type==="STATUS")return{ok:true,run:await getRun()};if(m.type==="START"){if(starting)throw Error("已有回填任务正在启动");starting=true;try{return{ok:true,run:await start(m.tabId,m.frozen,m.clientKey)}}finally{starting=false}}if(m.type==="STOP"){const r=await getRun();if(r&&!Core.terminal(r.phase)){r.stopRequested=true;await write(r)}return{ok:true,run:await getRun()}}if(m.type==="RETRY"){const r=await getRun();if(!r||r.phase!=="incomplete"||!r.batches?.some(b=>b.status==="retryable"))throw Error("没有可重试批次");r.stopRequested=false;r.phase="submitting";await write(r);resume();return{ok:true,run:r}}throw Error("未知命令")})().then(reply).catch(e=>reply({ok:false,error:e.message}));return true});resume();

chrome-extension/test/core.test.js

@@ -0,0 +1,9 @@
+const test=require('node:test'),assert=require('node:assert/strict'),c=require('../core');
+test('requires one unambiguous strict CG suffix',()=>{assert.deepEqual(c.addressSuffixes('A_cg123'),['_cg123']);assert.deepEqual(c.addressSuffixes('_cg123 / _cg456'),['_cg123','_cg456']);assert.equal(c.addressSuffix('_cg01'),'')});
+test('amount accepts exact value and rejects truncation negative or estimate text',()=>{assert.equal(c.moneyCent('￥22.34'),2234);assert.equal(c.moneyCent('22.345'),null);assert.equal(c.moneyCent('-22.34'),null);assert.equal(c.moneyCent('预估实付 22.34'),null)});
+test('order number removes only copy tail and rejects prose',()=>{assert.equal(c.normalizeOrderNo('ABC-123 复制'),'ABC-123');assert.equal(c.normalizeOrderNo('ABC-123 其他'),'')});
+test('classification counts no CG before time validation',()=>{const x=c.classifyDetail({address:'普通地址',orderNo:'A1',submittedAt:'',paidAmount:''});assert.deepEqual([x.kind,x.code],['skip','CG_MISSING'])});
+test('CG without order number is explicit error',()=>{const x=c.classifyDetail({address:'地址_cg123',orderNo:'',submittedAt:'2026-09-18 10:00',paidAmount:''});assert.equal(x.code,'ORDER_NO_INVALID')});
+test('aggregation detects CG and reused-order conflicts before dedupe',()=>{const f=(cg,no)=>({kind:'candidate',item:{addressSuffix:cg,pddOrderNo:no,orderSubmittedAt:'2026-09-18T02:00:00.000Z',pddOrderAmountCent:null}}),x=c.aggregate([f('_cg123','A'),f('_cg123','B'),f('_cg456','C'),f('_cg789','C')]);assert.deepEqual(x.cgConflicts,['_cg123']);assert.deepEqual(x.orderConflicts,['C']);assert.equal(x.ready.length,0)});
+test('batches never exceed fifty',()=>assert.deepEqual(c.batches(Array.from({length:101}),50).map(x=>x.length),[50,50,1]));
+test('trusted UI sender cannot be PDD content sender',()=>{assert.equal(c.trustedUISender({id:'id',url:'chrome-extension://id/popup.html'},'id'),true);assert.equal(c.trustedUISender({id:'id',url:'https://mobile.yangkeduo.com/orders.html',tab:{}},'id'),false)});

chrome-extension/test/dom.test.js

@@ -0,0 +1,5 @@
+const test=require('node:test'),assert=require('node:assert/strict'),fs=require('node:fs'),path=require('node:path'),{JSDOM}=require('jsdom'),Core=require('../core');
+function load(name){const d=new JSDOM(fs.readFileSync(path.join(__dirname,'fixtures',name),'utf8'),{url:'https://mobile.yangkeduo.com/orders.html'});global.document=d.window.document;global.window=d.window;global.scrollY=0;global.scrollTo=()=>{};d.window.HTMLElement.prototype.getBoundingClientRect=()=>({width:100,height:20});global.self={GoAutoBackfillCore:Core};global.chrome={runtime:{onMessage:{addListener(){}}}};delete require.cache[require.resolve('../content')];return require('../content')}
+test('synthetic list exposes one product row, excluding header and payment',()=>{const x=load('list.html');assert.equal(x.entries().length,1);assert.equal(x.entries()[0].className,'product');assert.equal(x.summary().endEvidence,true)});
+test('synthetic detail parses label siblings, not estimated-payment prose',async()=>{const x=load('detail.html'),f=await x.detail(),r=Core.classifyDetail(f);assert.equal(r.kind,'candidate');assert.equal(r.item.addressSuffix,'_cg123');assert.equal(r.item.pddOrderNo,'ABC-123');assert.equal(r.item.pddOrderAmountCent,2234)});
+test('detail expands address and order controls and waits for delayed fields',async()=>{const x=load('detail-delayed.html');document.getElementById('address').onclick=()=>setTimeout(()=>document.getElementById('address-fields').innerHTML='<div><span>收货地址</span><span>合成路_cg123</span></div>',150);document.getElementById('order').onclick=()=>setTimeout(()=>document.getElementById('order-fields').innerHTML='<div><span>订单号：</span><span>ABC-123</span><i>复制</i></div><div><span>下单时间：</span><span>2026-09-18 10:00:00</span></div>',300);const r=Core.classifyDetail(await x.detail());assert.equal(r.kind,'candidate');assert.equal(r.item.pddOrderNo,'ABC-123')});

chrome-extension/test/fixtures/detail-delayed.html

@@ -0,0 +1 @@
+<!doctype html><body><button id="address">展开收货信息</button><button id="order">展开订单信息</button><section id="address-fields"></section><section id="order-fields"></section></body>

chrome-extension/test/fixtures/detail.html

@@ -0,0 +1 @@
+<!doctype html><body><button>展开收货信息</button><section><div><span>收货地址</span><span>合成路_cg123</span></div><div><span>订单号</span><span>ABC-123</span><i>复制</i></div><div><span>下单时间</span><span>2026-09-18 10:00:00</span></div><div><span>实付</span><span>22.34</span></div></section></body>

chrome-extension/test/fixtures/list.html

@@ -0,0 +1 @@
+<!doctype html><body><div class="react-base-list"><div class="synthetic-card"><div class="shop"><img alt="合成店铺"></div><div class="product"><img alt="合成商品"></div><div>实付</div><div>立即付款</div></div></div><p>没有更多了</p></body>

chrome-extension/test/worker.test.js

@@ -0,0 +1,12 @@
+const test=require('node:test'),assert=require('node:assert/strict'),fs=require('node:fs'),vm=require('node:vm'),path=require('node:path'),{webcrypto}=require('node:crypto'),Core=require('../core');
+const source=fs.readFileSync(path.join(__dirname,'..','service-worker.js'),'utf8');
+function harness({initial={},content,fetcher,initialURL='https://mobile.yangkeduo.com/orders.html'}={}){const session={...initial},listeners=[];let tabURL=initialURL;const area={async get(k){if(Array.isArray(k))return Object.fromEntries(k.map(x=>[x,session[x]]));return{[k]:session[k]}},async set(v){Object.assign(session,v)},async setAccessLevel(){}};const events=()=>({addListener(){}});const chrome={runtime:{id:'extid',onInstalled:events(),onStartup:events(),onMessage:{addListener(fn){listeners.push(fn)}}},storage:{session:area,local:area},tabs:{async get(){return{id:7,url:tabURL,status:'complete'}},async sendMessage(_id,m){return content?content(m):{ok:true,empty:true,entryCount:0,endEvidence:true,scrollY:0}},async update(_id,v){if(v.url)tabURL=v.url},async goBack(){tabURL='https://mobile.yangkeduo.com/orders.html'}}};const ctx={self:null,chrome,URL,AbortController,setTimeout,clearTimeout,fetch:fetcher||global.fetch,crypto:webcrypto,console,__GOAUTO_TEST_TIMEOUT__:5};ctx.self=ctx;ctx.importScripts=()=>ctx.self.GoAutoBackfillCore=Core;vm.runInNewContext(source,ctx);const send=(m,s={id:'extid',url:'chrome-extension://extid/popup.html'})=>new Promise(resolve=>listeners[0](m,s,resolve));return{session,send}}
+const sleep=ms=>new Promise(r=>setTimeout(r,ms));
+test('rejects content sender, serializes START, and persists stopped terminal',async()=>{const h=harness({content:async()=>new Promise(()=>{})});let r=await h.send({source:'goauto-popup',type:'START',tabId:7,clientKey:'k',frozen:{origin:'https://admin.test',days:2,startedAt:new Date().toISOString()}},{id:'extid',url:'https://mobile.yangkeduo.com/orders.html',tab:{}});assert.equal(r.ok,false);r=await h.send({source:'goauto-popup',type:'START',tabId:7,clientKey:'k',frozen:{origin:'https://admin.test',days:2,startedAt:new Date().toISOString()}});assert.equal(r.ok,true);const second=await h.send({source:'goauto-popup',type:'START',tabId:7,clientKey:'k2',frozen:{origin:'https://other.test',days:2,startedAt:new Date().toISOString()}});assert.equal(second.ok,false);await h.send({source:'goauto-popup',type:'STOP'});await sleep(120);assert.equal(h.session.orderBackfillRun.phase,'stopped')});
+test('runtime error persists failed terminal state',async()=>{const h=harness({content:async()=>{throw Error('synthetic failure')}});await h.send({source:'goauto-popup',type:'START',tabId:7,clientKey:'k',frozen:{origin:'https://admin.test',days:2,startedAt:new Date().toISOString()}});await sleep(120);assert.equal(h.session.orderBackfillRun.phase,'failed');assert.equal(h.session.orderBackfillRun.error.message,'synthetic failure')});
+test('restart resumes stable batch with frozen origin/key and validates response',async()=>{let call;const stable='00000000-0000-4000-8000-000000000316',item={addressSuffix:'_cg123',pddOrderNo:'A',orderSubmittedAt:'2026-09-18T02:00:00Z',pddOrderAmountCent:null},run={id:'run1',tabId:7,listURL:'https://mobile.yangkeduo.com/orders.html',phase:'submitting',frozen:{origin:'https://frozen.test',days:2,startedAt:'2026-09-18T03:00:00Z'},batches:[{index:0,requestId:stable,status:'sending',items:[item],results:[],attempts:1}],results:[],rows:[],localErrors:[],stats:{read:1,ready:1,written:0,conflicts:0,skippedNoCG:0},scanComplete:true,stopRequested:false};const h=harness({initial:{orderBackfillRun:run,orderBackfillSecret:{runId:'run1',origin:'https://frozen.test',clientKey:'secret'}},fetcher:async(url,o)=>{call={url,auth:o.headers.Authorization,body:JSON.parse(o.body)};return{ok:true,async json(){return{data:{items:[{index:0,taskId:123,result:'backfilled',code:'BACKFILLED',retryable:false}]}}}}}});await sleep(10);assert.equal(call.url,'https://frozen.test/api/client/v1/purchase-tasks/order-backfill');assert.equal(call.auth,'Bearer secret');assert.equal(call.body.requestId,stable);assert.equal(h.session.orderBackfillRun.phase,'completed')});
+test('timeout remains retryable and does not confirm batch',async()=>{const item={addressSuffix:'_cg123',pddOrderNo:'A'},run={id:'run2',tabId:7,listURL:'https://mobile.yangkeduo.com/orders.html',phase:'submitting',frozen:{origin:'https://frozen.test',days:2,startedAt:'2026-09-18T03:00:00Z'},batches:[{index:0,requestId:'run2:batch:0',status:'pending',items:[item],results:[],attempts:0}],results:[],rows:[],localErrors:[],stats:{read:1,ready:1,written:0,conflicts:0,skippedNoCG:0},scanComplete:true,stopRequested:false};const h=harness({initial:{orderBackfillRun:run,orderBackfillSecret:{runId:'run2',origin:'https://frozen.test',clientKey:'secret'}},fetcher:(_u,o)=>new Promise((_r,reject)=>o.signal.addEventListener('abort',()=>reject(Object.assign(Error('abort'),{name:'AbortError'}))))});h.session.__unused=1;await sleep(30);assert.notEqual(h.session.orderBackfillRun.batches[0].status,'confirmed')});
+test('retryable item response remains resumable and unconfirmed',async()=>{const item={addressSuffix:'_cg123',pddOrderNo:'A'},run={id:'run3',tabId:7,listURL:'https://mobile.yangkeduo.com/orders.html',phase:'submitting',frozen:{origin:'https://frozen.test',days:2,startedAt:'2026-09-18T03:00:00Z'},batches:[{index:0,requestId:'00000000-0000-4000-8000-000000000317',status:'pending',items:[item],results:[],attempts:0}],results:[],rows:[],localErrors:[],stats:{read:1,ready:1,written:0,conflicts:0,skippedNoCG:0},scanComplete:true,stopRequested:false};const h=harness({initial:{orderBackfillRun:run,orderBackfillSecret:{runId:'run3',origin:'https://frozen.test',clientKey:'secret'}},fetcher:async()=>({ok:true,async json(){return{data:{items:[{index:0,taskId:123,result:'failed',code:'INTERNAL',retryable:true}]}}}})});await sleep(15);assert.equal(h.session.orderBackfillRun.phase,'incomplete');assert.equal(h.session.orderBackfillRun.batches[0].status,'retryable');assert.equal(h.session.orderBackfillRun.results.length,0)});
+test('scan compares after lazy load and reaches explicit end evidence',async()=>{let count=1;const h=harness({content:async m=>{if(m.type==='SCROLL'){setTimeout(()=>count++,20);return{ok:true}}if(m.type==='LIST')return{ok:true,entryCount:count,endEvidence:count>=4,scrollY:count*100};return new Promise(()=>{})}});await h.send({source:'goauto-popup',type:'START',tabId:7,clientKey:'k',frozen:{origin:'https://admin.test',days:2,startedAt:new Date().toISOString()}});await sleep(3200);assert.equal(h.session.orderBackfillRun.entryCount,4);assert.equal(h.session.orderBackfillRun.scanComplete,true);assert.notEqual(h.session.orderBackfillRun.incompleteReason,'未看到列表末尾标记')});
+test('reading restart after saved row on list advances cursor without duplicate',async()=>{const saved={kind:'skip',code:'CG_MISSING',item:{}},run={id:'read1',tabId:7,listURL:'https://mobile.yangkeduo.com/orders.html',phase:'reading',detailState:'returning',entryCount:1,cursor:0,scrollY:0,rows:[saved],results:[],batches:[],localErrors:[],stats:{read:1,ready:0,written:0,conflicts:0,skippedNoCG:0},frozen:{origin:'https://admin.test',days:2,startedAt:new Date().toISOString()},scanComplete:true,stopRequested:false};const h=harness({initial:{orderBackfillRun:run,orderBackfillSecret:{runId:'read1',origin:'https://admin.test',clientKey:'k'}}});await sleep(20);assert.equal(h.session.orderBackfillRun.cursor,1);assert.equal(h.session.orderBackfillRun.rows.length,1);assert.equal(h.session.orderBackfillRun.phase,'completed')});
+test('reading restart on detail finishes current row then returns to list',async()=>{const run={id:'read2',tabId:7,listURL:'https://mobile.yangkeduo.com/orders.html',phase:'reading',detailState:'detail',entryCount:1,cursor:0,scrollY:200,rows:[],results:[],batches:[],localErrors:[],stats:{read:0,ready:0,written:0,conflicts:0,skippedNoCG:0},frozen:{origin:'https://admin.test',days:2,startedAt:new Date().toISOString()},scanComplete:true,stopRequested:false};const h=harness({initialURL:'https://mobile.yangkeduo.com/order.html',initial:{orderBackfillRun:run,orderBackfillSecret:{runId:'read2',origin:'https://admin.test',clientKey:'k'}},content:async m=>m.type==='DETAIL'?{ok:true,classified:{kind:'skip',code:'CG_MISSING',item:{}}}:{ok:true}});await sleep(1100);assert.equal(h.session.orderBackfillRun.cursor,1);assert.equal(h.session.orderBackfillRun.rows.length,1);assert.equal(h.session.orderBackfillRun.phase,'completed')});

docs/00-project-profile.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Project-Profile
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Project-Profile.-
-wiki_revision: 6207da4ffac6b5821eda7869b9ea335b7585826d
-synchronized_at: 2026-08-31T16:06:21Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:14:21Z
 <!-- gitea-wiki-mirror:end -->
 
 # 项目档案
@@ -21,16 +21,20 @@ synchronized_at: 2026-08-31T16:06:21Z
 | 后续设计范围 | 从 SYB 创建采购任务、创建待付款订单、物流采集与自动回填 |
 | 预计规模 | 20 台 Android；每天约 100 个采集任务、200 个采购任务 |
 
+## 项目治理模式
+
+GoAuto 默认采用轻量治理：文案、注释、格式、局部样式或布局、预期行为明确的小 Bug，以及不改变接口、数据结构、权限和安全边界的单模块低风险调整可以直接实施，无需为了留痕补建工单。完整独立需求、新页面、跨模块功能，以及涉及 API、数据结构、权限、安全、迁移或范围不明确的变化必须建立单元工单。采购、创建订单、真实个人或生产数据、权限、安全、并发、迁移、删除、发布和不可逆操作始终升级为高风险，必须具备对象和范围明确的人工授权；已有有效授权时不机械重复确认，范围或环境发生实质变化时重新确认。永久禁止付款以及设备、隐私、AI 和真机安全红线不可裁剪。
+
 ## 建设基线
 
 | 基线 | 来源与版本 | 许可证 / 使用方式 | GoAuto 适配 |
 |---|---|---|---|
-| DevHarness | `D:\OPC\dev_harness`，目标提交 `4bbacf4d7fb265984396bb5589c544105043fa0b` | 开发流程与文档模板 | 2026-08-27 升级（#114）：在 #76 已采用的单人工单事实源基础上，增量加入部署模板、Gitea MCP 与最小工单读取、线上原型默认审核与按需 HTML 导出、PowerShell UTF-8/ExecutionPolicy 边界；继续保留 GoAuto 专用安全与设计门禁 |
+| DevHarness | `D:\OPC\dev_harness`，目标提交 `ecab899` | 开发流程与文档模板 | 2026-09-05 升级（#221）：在既有单人工单事实源基础上，选择性加入轻量治理、明确授权边界、中文默认沟通、Windows PowerShell 安全规则，以及按 revision 增量同步与显式深度检查；继续保留 GoAuto 专用高风险与安全门禁 |
 | 服务端 | `go-admin` v2.3.0 | 上游开源管理端基线；升级时复核许可证和安全公告 | 保留认证、菜单、配置和管理端基础能力，新增 GoAuto 业务模块 |
 | 管理端 | `go-admin-ui` v3.0.0，`web/package.json` 标注 MIT | Vue 管理界面基线 | 保留应用外壳与通用组件，新增 GoAuto 页面 |
 | Android | 原生 Kotlin Agent | 自研业务客户端 | 通过管理员明确配置的 HTTP 或 HTTPS Origin 直连服务端，不保留 Windows 桌面 Client/ADB 作为生产拓扑 |
 
-升级必须比较当前记录的目标提交与新的明确提交，不能笼统复制“最新版”。本次上一基线为 `bfdf648962d11a8024f62768380d8571e1f45f68`，目标为 `4bbacf4d7fb265984396bb5589c544105043fa0b`，区间共 13 个提交；更早基线 `b1f500128d6eb100985792d4a715db8b6b5ae203` 的适配见 #47。模板内容一律按 GoAuto 事实改写：不复制 DevHarness 的项目事实、任务记录、占位部署参数或历史归档；`harness.py` 继续校验 GoAuto 实际核心页面与产品 README，GoAuto 更严格的付款、订单、设备、数据和真机门禁继续优先。
+升级必须比较当前记录的目标提交与新的明确提交，不能笼统复制“最新版”。本次上一基线为 `4bbacf4d7fb265984396bb5589c544105043fa0b`，目标为 `ecab899`，选择性适配其后的 7 个提交；更早基线适配见 #47 与 #114。模板内容一律按 GoAuto 事实改写：不复制 DevHarness 的项目事实、任务记录、占位部署参数或历史归档；`harness.py` 继续校验 GoAuto 实际核心页面与产品 README，GoAuto 更严格的付款、订单、设备、数据和真机门禁继续优先。
 
 ## 交付单元
 
@@ -57,6 +61,7 @@ synchronized_at: 2026-08-31T16:06:21Z
 ## 环境与凭据
 
 - 服务端正式环境默认必须使用 HTTPS。仅当管理员接受 Device Token、任务内容和执行结果明文传输风险，并显式设置 `GOAUTO_ALLOW_INSECURE_AGENT_HTTP=true` 时，Agent `/api/agent/v1/**` 可通过 HTTP；管理端和第三方服务不因此放宽。
+- #237 客户端密钥例外（用户 2026-09-07 明确接受风险）：提交 `71f7751` 起，管理员密钥管理及 `/api/client/v1` 默认兼容 HTTP/HTTPS，无开关；HTTP 明文传输密钥及业务数据，建议优先 HTTPS。实际迁移部署仍须单独授权；此例外不改变其他第三方服务的安全边界。
 - 每台设备使用独立 Device Token；Token 只存安全配置，不进入仓库。
 - PDD 账号密码、Cookie、验证码和用户个人数据不得进入日志。
 - 根目录 `gitea.env` 是本机工单访问配置，已被 Git 忽略。

docs/01-workflow.md

@@ -2,12 +2,18 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Development-Workflow
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Development-Workflow.-
-wiki_revision: 3167457d79824afe532dd5560990af8a485a57d1
-synchronized_at: 2026-08-27T09:37:51Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:14:27Z
 <!-- gitea-wiki-mirror:end -->
 
 # 开发工作流
 
+## 语言与术语
+
+- 用户可以使用中文、英文或合理的中英混合语言交流；默认使用中文分析、回复、编写工单和维护内部项目文档。
+- 代码标识符、命令、参数、路径、文件名、API 名称、协议名、日志和错误原文保持原样；必要时补充简短中文解释。
+- 用户明确要求某次回复或交付物使用其他语言时，按该次要求执行，不改写接口契约或影响搜索和执行的原文。
+
 ## 事实来源
 
 | 信息 | 唯一事实来源 |
@@ -18,7 +24,7 @@ synchronized_at: 2026-08-27T09:37:51Z
 | 源码、迁移、测试、版本绑定分析、本地原型和核心 Wiki 镜像 | Git |
 | 可编辑交互设计 | QuantUX；App ID、版本、链接和确认状态记录在工单 |
 
-核心页面通过 `wiki-docs.json` 显式映射，固定执行 Wiki → `docs/` 单向同步。既有 Wiki 任务归档和 `docs/task/` 只作历史兼容；标准任务不创建或导出，只有用户明确要求专项快照时才使用 `archive` / `export`。
+核心页面通过 `wiki-docs.json` 显式映射，固定执行 Wiki → `docs/` 单向同步。日常 `sync` 与 `sync --check` 先比较页面 revision，revision 未变化时不重复下载正文；疑似镜像损坏或需要完整核对时显式使用 `sync --deep-check`。既有 Wiki 任务归档和 `docs/task/` 只作历史兼容；标准任务不创建或导出，只有用户明确要求专项快照时才使用 `archive` / `export`。
 
 ## 权威源与事实边界
 
@@ -53,6 +59,19 @@ synchronized_at: 2026-08-27T09:37:51Z
 - 每个核心页面写入后必须在线回读并取得 revision。页面缺失、回读失败或没有 revision 时停止初始化。
 - 产品编码前运行 `python dev_scripts/harness.py sync --verify`；全部成功才表示初始化完成。
 
+## 项目治理模式与不可裁剪底线
+
+GoAuto 默认采用轻量治理。文案、注释、格式、局部样式或布局、预期行为明确的小 Bug，以及不改变接口、数据结构、权限和安全边界的单模块低风险调整可以直接实施，无需为了留痕补建工单。完整独立需求、新页面、跨模块功能，以及 API、数据结构、权限、安全、迁移或范围不明确的变化必须建单。
+
+采购、创建订单、真实个人或生产数据、权限、安全、并发、数据库迁移、删除数据、发布和其他不可逆操作始终升级为高风险。无论任务采用何种最小门禁，凭据保护、永久禁止付款、个人与生产数据最小化、设备互斥、Agent 禁止 OCR/VLM、控件树与整屏截图禁存、工作区保护、真实测试和人工验收均不可裁剪。
+
+### 明确授权后的执行
+
+- 当前聊天中用户给出的明确指令，或 Gitea 工单中能够归属于有权人工的明确授权，可以作为执行依据，不要求把同一授权重复复制到工单后再次确认。
+- 授权必须能识别操作、对象和范围；Agent 自动生成的工单、草稿、摘要或对用户意图的转述不能单独构成人工授权。
+- 获得有效授权后，只核对准确目标、授权范围和当前状态等最小必要前提，不得仅因操作不可逆而重复询问或拒绝。
+- 授权不自动覆盖相邻对象或后续任务；环境、对象、范围或影响发生实质变化时重新确认。平台自身强制的审批、安全策略或权限限制继续有效。
+
 ## 工单与设计证据双门禁
 
 正式实施前先判断是否需要工单，再判断需要什么设计证据。工单不能替代原型确认，原型也不能替代技术方案、安全检查和单元工单。

docs/02-architecture-and-code-map.md

@@ -2,16 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Architecture-and-Code-Map
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: 2864a22f9e0f54a0663a56ab27d4b84052be3aac
-synchronized_at: 2026-09-01T15:31:13Z
-<!-- gitea-wiki-mirror:end -->
-
-<!-- gitea-wiki-mirror:start -->
-generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
-wiki_page: Architecture-and-Code-Map
-wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: dc5ccd2104e8ded715c0c0bb23d3827dc9a7fd7a
-synchronized_at: 2026-08-29T01:39:35Z
+wiki_revision: 504e1ffaa2cf1989f55048ac7067d8af50fe3bf3
+synchronized_at: 2026-09-22T02:56:22Z
 <!-- gitea-wiki-mirror:end -->
 
 # 架构与代码地图
@@ -76,6 +68,8 @@ Android Portal/Agent
 | `pdd_account` | 可选的账号调度引用，只保存名称和状态，不保存凭据 |
 | `purchase_task` | 商品外键和不可变快照、执行模式、状态/租约 guard、价格边界、订单、人工支付复核、物流与回填事实 |
 | `purchase_task_attempt` | `task_id + attempt_id` 幂等执行记录、阶段、规则哈希、固化规格决策和结构化错误 |
+
+> #241 新增：`server/app/goauto/purchase/order_backfill.go` 与 `order_backfill_handler.go` 提供 `POST /api/agent/v1/purchase-tasks/order-backfill`（Device Token 鉴权，逐条事务、逐条结果）；`server/app/goauto/models/purchase_order_guard.go` 在 `PurchaseTask.BeforeSave` 上全局强制订单号唯一，以 `purchase_rule_setting` 单例行串行化订单号分配，避免新增唯一索引迁移；`purchasecontract.ParseAddressSuffix` 为 `AddressSuffix` 的反解，通过回比而非负向前瞻实现（Go RE2 不支持前瞻）。
 | `ai_matching_setting` | 唯一单例的启用状态、OpenAI-compatible Base URL、模型、超时、内部部署明文 API Key 和更新人；仅管理员设置接口可以读取该字段 |
 
 `collection_task` 的状态仅为 `pending`、`running`、`completed`、`completed_partial`、`failed`。设备身份和心跳表属于 Agent 领取任务的必要基础，不承载 PDD 业务数据。
@@ -326,3 +320,203 @@ PddProductDetailCollector
 - `shopee_spec_auto_match_work_item` 按蝦皮商品唯一保存输入指纹、尝试次数、下次尝试时间和逐商品租约。已完成或低置信度/无结果的相同输入不重复调用 AI；规格、关联或 AI 设置更新时间变化后才允许重新处理。
 - 迁移 `1788290000000_shopee_spec_auto_match.go` 幂等创建两张表并写入调用目标 `GoAutoShopeeSpecAutoMatch`。系统任务默认关闭，默认 Cron 为每小时第 15 分钟、每批最多 20 个商品。
 - Admin 蝦皮商品列表通过异步手动接口启动同一批次并轮询最近运行摘要；该入口仅管理员可用，不创建采购任务、订单，不调用 Android Agent，也不执行付款。
+
+## SYB 异常规格 AI 定时解析（#198）
+
+- `server/app/goauto/sybimport/ai_parse_batch.go` 以 SYB 明细为单位执行“确定性重解析 → 封闭候选 AI 解析”，与 #195 的“蝦皮规格 → PDD 规格”任务保持独立。
+- `syb_spec_ai_parse_run` 保存全局批次、活动槽、租约与结构化计数；`syb_spec_ai_parse_work_item` 按 `syb_product_id` 唯一保存输入指纹、尝试次数、冷却和逐行租约。
+- `syb_product` 的 `ai_confirmed`、置信度、限长理由、确认时间和隐藏输入指纹记录 AI 确认事实；`parse_status` 仍只记录确定性解析器结果，`manually_confirmed` 仍只代表人工决定。
+- Provider 只接收单条 `productSpec` 和关联蝦皮商品的颜色/尺码候选；返回值必须逐字属于对应候选。采购可信门禁接受仍有效的 AI 确认，但候选消失后立即 fail-closed。
+
+## 定时任务持久化执行历史（#199）
+
+- `server/app/jobs/execution_log.go` 为 Exec 与 HTTP 两类调度入口统一记录一次执行生命周期；`server/app/jobs/models/sys_job_execution_log.go` 对应表 `sys_job_execution_log`，保存执行标识、任务/调用目标快照、定时触发类型、开始/结束时间、耗时、`running` / `succeeded` / `failed` / `interrupted` 状态及脱敏错误码和摘要。
+- 服务启动时按当前“每个数据库一个调度器实例”的拓扑，把上次进程遗留的 `running` 记录安全收敛为 `interrupted`；任务删除后历史仍保留并可只读查询。
+- `GET /api/v1/sysjob/:id/execution-logs` 由 `server/app/jobs/service/execution_log.go`、`apis/execution_log.go` 和 `router/sys_job.go` 提供任务级分页、状态与开始时间过滤；沿用隐藏菜单 `JobLog` 的角色菜单绑定和精确 GET 权限。Web 入口为 `web/src/views/schedule/index.vue` 的单选“日志”按钮，详情页为 `web/src/views/schedule/log.vue`。
+- 执行历史明确不保存任务参数、AI Provider 地址或密钥、第三方原始响应和业务原始载荷；当前不提供删除、保留期限自动化、WebSocket 实时流或立即执行动作。
+- 追加迁移为 `server/cmd/migrate/migration/version-local/1788357000000_sys_job_execution_log.go`：创建执行历史表、登记只读 API、关联 `JobLog` 菜单，并只给迁移前已绑定该菜单的角色补充精确 Casbin 权限。
+
+## 客户端密钥访问架构（#237）
+
+代码基线 `71f7751`（含用户确认的默认 HTTP/HTTPS 兼容），2026-09-07 完成 Server/Web 代码与隔离测试；本机迁移、管理员菜单写入与 Server/Web 启动已于 2026-09-07 授权完成，真实 HTTP 管理列表和模块目录加载通过；线上仍未部署。
+
+- `server/app/goauto/clientkey` 管理独立密钥、授权及审计；`clientapi/routes.go` 的显式 Inventory 将 `/api/client/v1` 映射到既有业务处理器，绝不转发任意 Admin 路由。
+- `clientapi/gateway.go` 默认接受 HTTP 与 HTTPS，无协议开关或转发协议头门禁，按 Bearer 密钥、模块及能力顺序校验，每次请求读取数据库，无授权缓存。`common/clientprincipal` 传递独立客户端身份，不生成或伪装管理员 JWT。
+- `client_api_key` 保存名称、随机 256 位密钥的 SHA-256 摘要、前缀、授权 JSON、启用状态、版本、创建/修改人和最后使用时间；完整密钥仅创建响应一次返回。`client_api_key_audit` 保存管理变更和客户端请求元数据，不保存请求正文、查询参数、响应正文或凭据。
+- 编辑与停用采用启用状态和 version 条件更新，并与变更审计同事务提交；冲突返回 409。业务执行前先持久化请求审计意图，失败则不执行业务。完成后更新状态；更新失败或进程中断可能留下 status=0，表示结果待核对，不能据此自动重放。
+- 部分既有业务操作人字段使用该密钥最近授权管理员的 ID 兼容现有外键；实际调用方以独立审计的 key_id 为准，不能把业务字段当成人工操作证据。
+- Admin 页面 `web/src/views/goauto/client-keys/index.vue` 复用创建/编辑授权弹窗；菜单位于“采采管理”，仅管理员可见。新追加迁移 `1788798000000_client_api_key.go` 创建两表及管理员菜单，不改 Android。
+
+## 采购规格面板预滑动兼容（#238）
+
+代码基线 `58a6c1c`，Android 0.9.60 / versionCode 73（构建完成不等同于已安装/发布）。`PurchaseRehearsalExecutor.applyPostAction` 对 `openSpecPanel.swipeAfter` 只兼容解析、不执行机械预滑动，`waitAfterMs` 保留；首趟继续原 `probeSpecs` 遍历，第二趟继续原 `selectSpec` 精确查找与容器内有界滚动。其他动作的后置滑动仍沿用既有执行语义，失败不会被统一忽略。
+
+`GoAutoAccessibilityService.swipePurchase` 的失败分类由 `PurchaseSwipeFailureReason` 枚举提供；共享 `swipeNode` 仅增加可选分类回调，不改变手势目标、轨迹、1500ms 回调等待或其他调用者行为。`GoAutoPurchasePanel` 日志经 `AgentForegroundService` 关联 task、attempt、device 与规则快照哈希，新增预滑动跳过/必需滑动失败标量；不记录节点文字、坐标、原始控件树、截图或凭据。
+
+Server/Web、数据库和任务快照不变；旧 APK 仍有预滑动行为，必须更新 Agent 才生效。相关验证在 `PurchaseRehearsalExecutorTest`，Android 全量测试与 APK 构建入口不变。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；代码已实现不代表当前线上已部署。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+入口为 `SyncWithShopSnapshot → loadDailyList → importSyncPage`；`server/app/goauto/sybimport/sync_page.go` 封装页事务和提交后计数；`import_handler.go` 判定终态，`sync_run.go` 保存及筛选，Web 复用 `web/src/views/goauto/syb-sync-runs/index.vue`。
+
+## Android 连续临时采集收尾（#250）
+
+当前实现绑定 `37e8b56`（Agent 0.9.72 / 85），用户确认 v5 按次数返回后切回 Agent。仅 Android，无 Admin/API/权限/数据库迁移；取代 v1～v4 首页导航。
+
+- `AgentSettingsFragment` 在采集间隔后复用卡片和 SwitchMaterial；仅开启显示“返回次数”按钮，Material 单选框选择 1～5 次（默认 3），立即保存或取消。成功无常驻反馈，错误/忙碌显示原因。任务忙碌禁用，弹窗选定时再检查。
+- `AgentSettingsStore` 在私有 `goauto_agent_settings` 保存 `continuous_collection`（false）与 `continuous_collection_return_count`（3）；次数越界或读取错误回落 3，写入失败恢复旧值，无网络加载。
+- `requestCurrentPageCollection` 保留原范围判断；`executeTask` 在采集开始固定次数。`executeTaskWhileAwake` 提交结果、结束图片上传后返回 resultStatus；`ContinuousCollectionPolicy.finish` 仅对完整确认成功调用新 `PddCollectionReturnNavigator`。失败/部分成功不导航。冷却间隔不变，连续模式不启动旧 idle-return。
+- 删除 `PddCollectionHomeNavigator` 和专属首页/搜索层判据。新导航器仅使用 capture/back、当前包名、openAgentPreservingTab；1～5 次 Back，每次后 500ms，前台离开 PDD 终止剩余 Back；保留风险场景停止。最后打开 Agent 并等待 500ms 验证包名，不验证 PDD 首页。仍在原任务互斥与唤醒锁范围内完成，结束后原 finally 释放。
+- `GoAutoCollector` 日志关联 taskId、attemptNumber、deviceId、规则快照 SHA-256；记录 continuousReturn、configuredBacks、固定 reason 和 actions。原因含 count_completed、left_pdd、back_failed、unsafe_page、agent_launch_failed、agent_not_confirmed、navigation_exception、invalid_count；actions 为 Back 尝试数，不代表最终页面。无节点文字、树、截图或个人数据落盘；不扩大采购诊断存储。
+- `ContinuousCollectionTest` 覆盖范围/终态、1～5 次、无变化仍按次数、前台变化、风险、动作/启动失败、包名确认和异常；`ContinuousCollectionSettingsTest` 覆盖开关与次数持久化、默认/越界/写入失败。`:app:testDebugUnitTest :app:assembleDebug` 376 项通过。旧首页专属测试随旧行为替换，新版未安装，UI 大字体/横屏、多设备和完整采集真机链路尚未验证。
+
+## SYB 存疑规格候选解析（#251）
+
+实现绑定 `64b4205`，仅 Server `app/goauto/sybimport`；无 API 字段、数据库迁移、权限、并发模式或 UI 变化。
+
+- `parse_candidates.go: ParseWithCandidates` 先运行原 `Parse`，仅 uncertain 时解码并校验已存 SpecsJSON；复用 `closedShopeeCandidates` 提取颜色/尺码封闭候选，拒绝未知有值角色/重复角色。完整候选组合与原文归一比较唯一时确认，其他情况返回原 ParseResult。
+- `ApplyDetail` 在加载既有蝦皮商品后、写入规格前调用；`Reparse` 在保留人工/AI 确认保护后加载关联候选调用。新增 ParseResult 私有 matchedCandidates 标记，使 `mergeParsedSpec` 对已经存在的候选直接返回，避免按维度名重复合并或改变映射。
+- #198 `ProcessSpecAIParseRun → Reparse` 自然接入确定性优化，仍需 AI 的记录沿用原后续步骤，不新增异步任务/Provider 调用/接口。
+- 验证 `go test ./app/goauto/sybimport ./app/goauto/aimatching ./app/goauto/shopeeproduct ./app/goauto/purchase` 和 `go build ./...` 通过；新增候选正反/格式/组合色/单维度、歧义/空值、同步重解析一致、人工保护及无需调用 AI 测试。AI 原有置信度/失败重试测试改用仍需语义理解的合成输入，继续验证原分支。
+- 本轮只使用本地测试数据与 httptest AI，未触发真实 SYB 同步、外部 AI、采购、数据库迁移或服务重启；线上及历史数据效果尚待授权验证。
+
+
+## 蝦皮详情匹配等待与回读（#254）
+
+实现绑定 `9088e6b`（2026-09-10，分支 fix/254-match-loading）；已通过合成数据测试，尚未合并 main 或发布线上。
+
+- Server `shopeeproduct.Service.DetailWithAutoMatchBudget` 为详情 GET 附加派生的整次匹配预算，不返回 Provider、Key 等配置。`AutoMatchMappings` 读取 AI 设置 T，使用 2T+10 秒的单个父 context；颜色、尺码、保存及结果回读共用剩余时间。初始配置读取也受有界 context 约束，读取耗时从后续预算扣除。
+- 批量定时匹配调用内部 `autoMatchMappings` 并继续使用原 MaxProviderTimeout=600 秒，不随本次详情入口调整；候选建议与其他 AI 功能不改。
+- Web `ShopeeProductDetailDrawer` 在提交前以普通 GET 刷新商品与预算，仅 auto-match POST 使用 (2T+20) 秒超时。准备失败/缺少预算时不发 POST；旧 Server 必须先更新，不能只发布新版 Web。
+- 加载状态同时绑定商品加载代次和操作序号。关闭/切换立即结束该页面等待状态；同商品重开读取详情，旧响应/旧 finally 不得污染新操作。匹配期间禁止在当前抽屉编辑映射，原人工草稿放弃确认保留。
+- POST 未正常返回时只回读详情及关联 PDD，不自动重发 POST；回读失败结束转圈并保留刷新入口。GET 沿用单请求10秒超时，完整结果回读最多两次串行 GET，不是无限等待。
+- 验证：Go shopeeproduct/aimatching/clientapi 测试与 go build；Web `node --test tests/unit/shopee-match-lifecycle.test.cjs`，Playwright shopee-match-lifecycle 与 shopee-pdd-picker，受影响 ESLint 与 build:prod。
+
+
+## SYB 行内一键关联最近采集（#253）
+
+实现绑定 `b1594dc`，2026-09-10；分支 feat/253-one-click-link，包含 #254 依赖。已完成合成数据测试及构建，未合并 main、未部署，不代表当前线上已具备此能力。
+
+- Web `syb-products/index.vue` 在“去关联”旁增加“一键关联＋下拉箭头”，共享 `quick-link.js` 页面级状态。`quick-link-device-preference.js` 按当前浏览器来源、API环境、用户ID保存设备ID，独立于批量采购偏好；不存密钥或商品数据。首次主动作选机继续原行，箭头选机只保存偏好。
+- Server `shopeeproduct/latest_collection.go` 复用 LinkPDD 的可选 Admin 模式。短事务核对 SYB→Shopee、未关联/规格版本、设备状态，选择并锁定最新 completed/completed_partial 的 agent_current_page 任务及其 PDD；仅完整采集、active且有可用颜色或尺码时更新，WHERE pdd_product_id IS NULL 不覆盖其他操作者的关联。响应保留该事务产生的规格版本及来源task/device/PDD，不能用后续GET替换冻结上下文再自动匹配。
+- 不新增表、迁移、路由或权限对账。原手动关联/替换请求不变；共享 Handler 明确拒绝 Client API 使用此跨模块模式，不能借 Shopee-only write grant 读取 SYB/设备上下文。来源任务原规则快照不改，taskId 可回溯既有采集证据。
+- 关联后读取现有采购准备；需要人工确认或不具备AI资格时停止自动链路并保留关联，其他情况调用原 AutoMatchMappings，沿用 #254 动态预算及原事务保存/上下文冲突保护。最后刷新实际处理阶段，不调用创建采购/订单接口。
+- 运行期间冻结行、商品、手机；前端重复主动作禁用，切换偏好仍只影响未来操作。卸载或 keep-alive deactivated 令旧操作失效，禁止旧回调继续下一步；不声称已经取消服务端在途写入。异常仅有限GET回读和刷新，不自动重发POST。
+- 验证命令：Server `go test -p 1 ./...`、`go build ./...`；Web `node --test tests/unit/syb-quick-link.test.cjs tests/unit/shopee-match-lifecycle.test.cjs`、`pnpm exec playwright test tests/e2e/syb-quick-link.spec.ts tests/e2e/shopee-match-lifecycle.spec.ts --workers=1`、受影响文件 ESLint、`pnpm build:prod`。SQLite 单连接并发测试不代替生产 MySQL 行锁验收；真实AI、生产数据、跨设备人工闭环待验证。
+
+## SYB 行内一键替换（#258）
+
+实现绑定 `2b01974`；部署与验收见 #258 发布证据。本节补充 #253，不改变原未关联入口。
+
+- `syb-products/quick-link.js` 复用分体按钮、设备偏好和匹配/回读流程；已关联且允许处理阶段时同位置显示一键替换。先只读预览，固定任务、目标商品及规格版本；不同商品一次确认，同商品不重绑。
+- `shopeeproduct/latest_collection.go` 在原 latestCollection 增加可选 replacement 模式。预览和提交均短事务锁定 SYB、Shopee、原PDD、设备、来源采集与目标PDD，核对旧关联及上下文。提交按预览 taskId 读取，不重新挑选后来采集的商品。
+- Admin 路由注入 `purchase.ValidateQuickReplacement`，在事务内复用采购准备数据集及处理阶段计算，不调用 AI。缺少校验函数拒绝替换；客户端密钥不注入且仍拒绝 latestCollection。无新路由、权限、表或迁移。
+- 关联完成后才执行现有 AI 匹配，不在数据库事务中等待 Provider；同一 SYB 正式采购创建与替换共用 SYB 行锁。历史采购快照不变。SQLite 合成测试覆盖冲突与串行并发请求，不能替代生产 MySQL 多连接锁验收。
+
+## 辅助信息缺失的采集关联（#259）
+
+实现绑定 `e467706`，仅 Server；部署/验收见 #259。替代 #253/#258 中“部分完成一律拒绝”的限制，不改变 completed 原有路径。
+
+- completed_partial 的 missing 必须是非空合法列表且仅包含 salesText、shopName、reviewCount，才进入辅助信息兼容检查；title、规格/价格缺失、遍历截断、SKU数量上限及未知原因仍拒绝。
+- `shopeeproduct/partial_collection.go` 核对本次 task 的维度和值、可售SKU的完整标记/规格引用/非负价格、本次颜色价格，以及当前档案可选值由本次有效SKU覆盖，不能借旧档案合并残留的规格或价格通过。真实单维度允许，不虚构另一维度；本次明确报告缺少规格仍拒绝。
+- 一键关联、替换预览及确认提交共用验证。失败沿用409 LATEST_COLLECTION_UNAVAILABLE及现有提示，不回退更早采集、不换手机。状态 completed_partial 和 missing 原样保留；辅助字段缺失仍可在任务详情查看。
+- 无接口字段、数据库迁移、Android/Web或权限变更；普通人工关联与采购/AI资格不变。不将“允许关联”视为“已匹配或已采购”。
+
+## 采购单标题面板与地址就绪等待（#260、#261）
+
+实现绑定 #260 `3c1ffa4`（执行器回归测试 `7de4318`）、#261 `5ea07f1`，Android 0.9.74 / versionCode87，基于0.9.73。安装及真实采购验收以工单证据为准；不代表 main 的 Android 已整合这些分支。
+
+- 采购仅在安全规格入口点击返回SUCCESS后，记录本次页面包名/Activity作为内存上下文；开始新执行或页面身份改变时清除。`PddScreenParser` 的新增 purchaseEntryContext 默认关闭，仅该采购执行器传入；普通解析和采集原判定保留。
+- 当前仍为同一PDD Activity、商品ID非空、没有页面风险、没有选中摘要，且唯一有标题规格滚动区、一个维度有值，同时具有关闭、数量、支付展示区域与下单操作证据时，单标题可识别为NORMAL_SCROLLABLE。只是允许进入既有精确规格探测/选择，不执行下单或付款，不全局认可UNKNOWN，不增加入口重复点击或滑动。
+- 地址入口点击原有1000ms保留；地址列表等待增加唯一修改目标要求。点击修改和保存由500ms改为1000ms，其他通用动作间隔不变，无新配置项。
+- 修改后不再只见“详细地址”文字就立即写入。最多50次、每次间隔200ms读取（不含读取耗时），检查PDD页面风险；唯一可见启用有内容的详细地址EditText，连续两次路径、边界、内容及Activity相同才继续原输入流程。始终零个/多个或不稳定时失败，不取第一个候选。
+- 输入内容生成、输入后回读、保存后退出及返回规格面板、最终复核和单次下单边界不变。新增本机脱敏诊断 addressEditorCandidates / addressEditorPolls 两个整数，与task/attempt/device/ruleHash关联；不记录地址内容、原始树或整屏截图。
+- 仅Android；无Server/Web、共享API字段、数据库迁移或权限变化。真实采购、地址写入及订单创建不作为自动安装验证，不执行付款。
+
+### v2 商品入口补点与地址返回等待（#260、#261）
+
+2026-09-10 实现绑定 #260 `713111d`、#261 `d0a82f3`，Android 0.9.75 / versionCode88；真实采购效果以工单验收为准，非 main 合并声明。
+
+- 入口恢复不再把全页面支付方式展示文案单独视为支付页。当前包名/Activity、商品标题和安全入口必须与点击前一致，入口唯一且可用；已打开面板、关闭控件、数量、选中摘要、订单操作、风险/评价页面仍拒绝恢复。支付 Activity 或明确支付、订单、地址文本继续阻止补点。仅允许既有一次重新定位后的规格入口中心手势，随后仍验证面板，不循环、不扩展到地址保存或下单。
+- 保存地址后的确认读取、必要时一次返回后的确认读取，增加最多50次、间隔200ms的有界就绪检查，页面捕获耗时另计。连续两次同一Activity满足原地址回读与确认面板条件后继续；完整信息不要求滚动区域。已明确到地址列表时保留原返回路径，不等待列表出现下单按钮；返回后增加1000ms缓冲。
+- 就绪检查不修改原地址回读和结构下单入口规则；超时后只对既有识别的面板、唯一可用滚动区域执行原有有限滚动。零/多个区域仍失败，不凭地址入口或未知底部节点授权下单。最终精确规格、数量、价格、地址与单次下单边界不变。
+- 私有采购诊断新增布尔 savedAddressMatched、savedPanelMatched；整数 savedLegacySubmitCandidates、savedAddressCards、savedAddressTargets、savedScrollCandidates、savedConfirmationPolls。只记录标量并绑定task/attempt/device/ruleHash，不保存地址、原始树或整屏图。
+- CG109 v1现场读取未达到空闲状态，不能确认原失败具体缺哪项证据；v2覆盖迟到确认节点及可观测性，不将合成测试通过冒充真机修复验收。无Server/Web/API/迁移/权限变化，不需要服务器重启。
+
+## 探测到正式采购的单次面板交接（#262）
+
+2026-09-10 实现绑定 `2ea32fd`，Android0.9.76/code89；基于#260/#261，未声明合并main或真实采购验收通过。
+
+- AgentForegroundService通过PurchaseProbeHandoff只在成功spec_probe且结束后新快照仍识别PDD规格面板时保留一次性内存交接。仅taskId/goodsId/ruleHash/deviceId、Activity、前台revision和单调时钟时间，不保留控件节点、地址或选中状态，不落盘；有效期180秒。
+- 正式阶段消费时检查同任务/商品/规则/设备、前台revision及时间，消费后即清除。失配/超时/无任务或采集任务调度/结果异常/进程重启均不能沿用；普通手动再试不会继承已消费交接。现有服务端租约、互斥和匹配等待策略不变。
+- 有交接时，执行器恢复限定的purchaseEntryContext，最多10次、间隔200ms新读取（捕获耗时另计）；连续两次相同PDD Activity且具备既有商品/面板证据才跳过openProduct。空树可有限等待，其他应用/Activity改变/页面风险立即拒绝复用。没有交接时保留原一次判断路径；不把UNKNOWN当成功，不跳过正式精确规格/数量/价格/地址或下单验证。
+- 私有诊断新增handoffPresent、productReused布尔值，reusePolls整数及reuseReason固定枚举legacy_evidence/page_problem/page_changed/handoff_ready/evidence_timeout。仍绑定task/attempt/device/ruleHash，无敏感文本。
+- 无Server/Web、共享API或数据库变化，不需重启服务器。只有合成测试验证；原CG107/108日志证实两阶段，但未记录旧版重开判断，不把上下文丢失假设宣称为唯一现场根因。
+
+## 人工订单回填金额扩展（#306）
+
+实现绑定 8c01329（2026-09-18），分支 feat/306-order-paid-amount；待验收、未部署。复用 #241/#242 链路，不改普通采购提交和扫描器导航。
+
+- Android automation/OrderBackfillPolicy.kt：BackfillDetailReader 在订单内收集唯一“实付”金额，使用 BigDecimal 精确转换为人民币分；BackfillItem 增加可选 pddOrderAmountCent。
+- Android network/OrderBackfillUpload.kt 与 persistence/TaskHistoryCache.kt：上传可选金额，读取并缓存 Server 确认金额和独立警告；不把成功警告改为任务失败。
+- Server models/purchase.go：purchase_task.pdd_order_amount_cent 为 nullable BIGINT、非负；与 actual_unit_price_cent 独立。追加迁移 1789800100000_purchase_order_amount.go 使用版本内的局部表模型，仅扩展 purchase_task；历史值 NULL，不回填猜测金额。
+- Server purchase/order_backfill.go：原有逐条事务/设备与订单号保护内补齐空金额；相同值幂等，异值保留并警告；已 order_created 同号任务也能补写。purchase/admin_query.go 输出金额。
+- Web views/goauto/purchase-tasks/index.vue：复用现有订单 state-card 显示 CNY 实付价格或“尚未获取”；列表结构不变。
+- 本次不修改 SYB 客户端或 #305，金额不进入 SYB 请求。
+
+验证覆盖 Android 解析/载荷/回执缓存、Server 幂等/冲突/旧请求和局部 SQLite 迁移、Web 金额/空值展示；真机端到端、实际 MySQL 迁移和发布须另行授权，不能以本地测试替代。
+
+## SYB 单号回填持久队列（#305）
+
+实现绑定 e89de1a（2026-09-18，未部署），仅 Server/Web；Android 复用现有普通结果与人工订单回填。
+
+- purchase/lifecycle.go、purchase/order_backfill.go → ensureOrderWriteback：与订单事实同事务建立 pending，purchase_task_id 唯一；外部失败不撤销已提交的订单事实。
+- models/purchase_order_writeback.go：purchase_order_writeback 保存不可变 stock/detail/单号快照、状态、attempt_count、write_started、租约、脱敏错误和完成时间；purchase_order_writeback_command 保存 requestId/输入摘要/逐项接受结果；purchase_order_writeback_lease 保存全局单例租约。追加迁移 1789800200000，不改旧物流字段，不批量排入历史订单。
+- purchase/order_writeback.go：批量命令事务/幂等/条件校验和 Admin 状态投影；order_writeback_handler.go/router.go 暴露 Admin 补偿；access/purchaser.go 纳入原采购权限启动对账目录。
+- purchase/order_writeback_worker.go：由 cmd/api/server.go 每数据库启动一个3秒轮询 worker；数据库2分钟单例租约使跨进程及不同任务的相同SYB明细写入串行。写前核对当前任务/关联快照，持久化写入起始标记，并验证租约所有者/剩余时间；不持有数据库事务跨网络请求。失联running恢复只回读，unknown不自动调度；其他同目标未确认写入阻止新写。
+- sybclient/order_number.go：一次 POST updateDetailPurchaseCode，不跟随重定向、不使用读接口重试策略。会话仅从现有 SessionStore 恢复，不在 worker 自动登录/OCR；外部原始错误不写入任务原因。
+- Web purchase-tasks API/页面：共享勾选、按动作筛选、独立状态列/详情及逐项接受结果；付款和物流流程保持原样。
+- 验证入口：go test ./app/goauto/purchase ./app/goauto/sybclient ./app/goauto/access ./app/goauto/migrations ./cmd/migrate/migration/version-local；Web tests/e2e/purchase-order-writeback.spec.ts。测试只使用隔离SQLite和fake/httptest，不代表MySQL多实例或真实SYB验收。
+
+### 会话类失败自动重试（#330）
+
+- purchase/order_writeback_worker.go：restoreOrderWritebackClient 在 ImportCookiesJSON 后调用 sybclient.CheckSession，UserID<=0 显式判不可用；finishSessionUnavailable 复用 lease_expires_at 作为退避到期时间（maxSessionRetryAttempts=6，sessionRetryBackoff 5/10/15/30/30m），领取条件增加 failed+SYB_SESSION_UNAVAILABLE+到期+未达上限。无迁移。
+- purchase/order_writeback.go：会话类失败的 CanSubmit 不受退避租约限制；手工重新提交 attempt_count 置 0。
+- 验证：go test ./app/goauto/purchase（含 httptest 模拟 /am/user/get 与断言 syb_session 未删除）。
+
+## Chrome PDD 订单回填扩展（#316）
+
+- `chrome-extension/` 是独立 Manifest V3 交付单元：popup 只负责配置、启动/停止、状态轮询和逐项结果；content script 只在 `mobile.yangkeduo.com` 的隔离世界中按可见 DOM 串行读取；service worker 负责持久运行状态、聚合冲突和分批提交。
+- 列表遍历限定虚拟列表订单卡片的商品行，排除店铺头和支付、确认收货、退款、售后、取消、更多等动作区；详情只展开收货/订单信息。未看到明确列表末尾证据时必须标记未完整扫描，不得宣称全量。
+- 客户端密钥与冻结的 Admin Origin 只保存在扩展可信上下文；content script 无权读取。请求禁用 Cookie 与重定向，批次最多 50 条，稳定 UUID 可在 service worker 重启或超时后重放；已确认批次不重复计数。
+- 服务端 `POST /api/client/v1/purchase-tasks/order-backfill` 复用 Agent 回填事务校验，但使用独立 client principal，不伪造 Device Token 或 deviceId。Agent 路径仍严格保持设备归属校验及失败后按设备范围回读。
+
+## 下单结果读取及应付总额链路（#325）
+
+分支 fix/325-order-result，2026-09-19，尚未发布及真实下单验收。PurchaseLiveAutomation.readOrderResult 采用25次支付页返回后采样、首次待付款页独立30次采样/最多4次按需滑动；原过渡60次与总90次采样上限保留有界终止。parsePayableAmount只从本次只读标签集合提取明确应付总额。
+
+数据链路：PurchaseOrderEvidence.pddOrderAmountCent → PurchaseExecutionOutcome → service/PurchaseResultPayload.kt → purchase.ResultRequest → lifecycle.go 的 order_created 分支 → 既有 purchase_task.pdd_order_amount_cent。重启只读核单也沿用同一可选字段。复用已有结果Outbox、幂等哈希和订单号唯一性；不新增表、配置、任务或SYB金额字段。未修改我的订单回填、Chrome扩展和Web，不能将旧入口的实付含义描述为本次已改成应付。
+
+## Admin 订单资料补全与一致回填资格（#326）
+
+实现3a2472d（2026-09-19），Server/Web，未合并发布；无迁移、无Android/插件改动。
+
+- purchase/types.go ManualRequest 增加可选 pddOrderAmountCent；manual.go ResolveUnknown 复用既有行锁事务和模型单号保护，扩展为未知结果确认或已创建订单补缺。仅此操作启用新增重放内容校验和事务内 ensureOrderWriteback，其他人工付款/取消/授权流程不新增入队副作用。
+- order_writeback.go 的任务资格去掉 order_created 限制；validOrderWritebackTarget 统一有效 stock/detail 边界。OrderWritebackViews 一次批量读取关联而非逐行查询，RequestOrderWriteback 和 worker 执行前再次检查。队列结构、租约、外部写入协议不变。
+- web/src/views/goauto/purchase-tasks/index.vue 沿用原详情/弹窗/resolve-unknown API，新增缺字段补录入口、整数分转换、完整性展示及失败保留输入，不增加数据库状态或新的权限资源。旧未知结果请求不带金额继续兼容。
+- 回归：server go test -p 1 ./app/goauto/purchase ./app/goauto/clientapi ./app/goauto/sybclient；Web 生产构建及 tests/e2e/purchase-order-writeback.spec.ts 的6项隔离浏览器测试。真实SYB接口用fake/httptest替代，未执行付款、采购或线上写入。
+
+## 规格面板识别回退与选项去重（#331/#332）
+
+- `automation/PddProductDetailCollector.kt`：`SpecPanelType.REQUIRED_EVIDENCE` 回退分支（地址入口/支付入口/唯一数量输入框 + 同一面板容器 + ≥1 辅助证据）；`ParsedPddScreen` 增加 `hasAddressEntry`、`hasPaymentEntry`、`hasQuantityInput`、`hasQuantityAdjustControls`、`quantityInputCount` 与 `requiredEvidenceSummary()`；`SpecPanelStabilityPolicy`（等待上限 5000ms，地址返回采样 200ms）；规格值按选项块合并（`optionBlock`）。
+- `automation/PurchaseRehearsalExecutor.kt`：`waitForSpecPanel` 对回退类型要求连续两次结构一致；`selectionFailureEvidence` 选中失败诊断。
+- `automation/PurchaseLiveAutomation.kt`：`waitForSettledPanelAfterAddressSave` 保存地址后稳定等待（不按返回键）；`finalSubmitTargets` 拒绝零尺寸文字/容器；新增构造参数 `panelDiagnostic`（仅布尔/计数）。
+- 测试：`SpecPanelRecognitionTest`、`SpecOptionDedupTest`、`SpecPanelFixtures`（脱敏构造样本）。

docs/03-business-rules-and-glossary.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Business-Rules-and-Glossary
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Business-Rules-and-Glossary.-
-wiki_revision: 0e1df62c48aeba32a7d5e4956783f0af68e8e658
-synchronized_at: 2026-09-01T15:31:24Z
+wiki_revision: 7bb3997cfbe96343f63d4f6ef80201146c27c142
+synchronized_at: 2026-09-22T02:56:27Z
 <!-- gitea-wiki-mirror:end -->
 
 # 业务规则与术语
@@ -31,16 +31,20 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 关联 PDD 商品时校验目标存在且非 `disabled`；不提供手工输入商品 ID 的入口，只能通过搜索选择。
 - 参考售价 `sale_price_cent` 为整数分，`currency` 为 ISO 4217 代码；币种取系统配置默认值，不逐商品选择，缺省回退为 `TWD`。
 - 规格值来源分 `import`（SYB 导入，不可人工删除，只能清除映射）与 `manual`（人工添加，可删除）；导入与人工值按「维度 + 名称」合并，不重复创建。
-- 映射来源分 `manual`（人工，允许创建时即为已确认）、`exact_match`（名称标准化后唯一一致）、`ai_match`（AI 建议）。通用 `SetMapping` 入口仍将 `exact_match` 与 `ai_match` 一律写为 `pending`，必须人工确认后才生效；#188 的 SYB 商品页批量 AI 匹配与 #194 的 Admin 蝦皮商品详情一键匹配是两个独立例外。#188 的进入条件已由 #190 放开：只要蝦皮与 PDD 关联完整、PDD 当前为 `active` 且能给出可选颜色/尺码候选、并且已解析出至少一个目标颜色或尺码，即可进入批量匹配。解析状态（含 `parse_status=uncertain` 与 `failed`）、PDD 含颜色尺码之外的可选规格、蝦皮档案中未找到目标颜色或尺码、缺少完整可售 SKU 组合证据，自 #190 起都不再阻断匹配；本项目为内部系统，由此产生的“以错误目标规格进行匹配并保存映射”的风险由人工承担。唯一确定性 `exact_match` 不调用外部 AI，可直接保存为 `confirmed`；其余结果只有在 `ai_match` 置信度存在且达到服务端阈值、理由非空、返回值属于当前可选候选并命中同一个可售颜色+尺码组合时，才可直接持久化为 `confirmed`。低置信度、无组合证据、无效组合或 Provider 异常不得改写现有映射。
+- 映射来源分 `manual`（人工，允许创建时即为已确认）、`exact_match`（名称标准化后唯一一致）、`ai_match`（AI 建议）。通用 `SetMapping` 入口仍将 `exact_match` 与 `ai_match` 一律写为 `pending`，必须人工确认后才生效；#188 的 SYB 商品页批量 AI 匹配与 #194 的 Admin 蝦皮商品详情一键匹配是两个独立例外。#188 的进入条件已由 #190 放开：只要蝦皮与 PDD 关联完整、PDD 当前为 `active` 且能给出可选颜色/尺码候选、并且已解析出至少一个目标颜色或尺码，即可进入批量匹配。解析状态（含 `parse_status=uncertain` 与 `failed`）、PDD 含颜色尺码之外的可选规格、蝦皮档案中未找到目标颜色或尺码、缺少完整可售 SKU 组合证据，自 #190 起都不再阻断匹配；本项目为内部系统，由此产生的“以错误目标规格进行匹配并保存映射”的风险由人工承担。唯一确定性 `exact_match` 不调用外部 AI，可直接保存为 `confirmed`；SYB 商品页批量 `ai_match` 只要 Provider 成功返回规格结果且理由非空、返回值属于当前可选候选即可直接持久化为 `confirmed`，置信度仅记录供审计、不作为放行门槛。若当前 PDD 档案存在完整可售颜色+尺码 SKU 组合证据，结果还必须命中其中同一个组合；人工录入或外部导入导致组合证据缺失时不阻断保存或创建采购。无结果、已有组合证据中的无效组合或 Provider 异常不得改写现有映射。
 - 颜色映射只能从关联 PDD 商品当前可选颜色中选择，不允许自由输入；未使用颜色优先显示，已被其他蝦皮颜色使用的颜色仍可选择并显示占用者，因此支持多对一。
 - Admin 蝦皮商品详情只保留一个“一键匹配颜色和尺码”入口。已确认且目标仍存在的映射保留；名称标准化后的唯一确定结果直接写为 `exact_match + confirmed`；其余只有在 AI 置信度达到服务端当前阈值、理由非空、返回值仍属于当前可选候选时才写为 `ai_match + confirmed`。低置信度或无结果保持未匹配；Provider 失败、AI 未启用、关联或规格上下文变化时本次不写入。操作前有未保存的人工修改时禁用一键匹配；保存只改映射，不改蝦皮或 PDD 原始规格。
 - PDD 重新采集或更换关联后，目标规格仍存在则映射继续有效；目标规格消失时详情标记“已失效”，服务端拒绝保存不存在的目标，采购预检和创建也拒绝使用失效映射并提示重新选择。
 - 批量软删除逐条校验引用（虾皮商品被 SYB 明细或采购任务引用时不可删除）并逐条返回结果；已删除商品默认不出现在列表，可筛选查看并恢复。
 
+- #257：蝦皮颜色与尺码建议/一键匹配先保留仍有效的已确认映射，再复用相同标准化比较：简体、空白、全半角与大小写统一。颜色标准化后仅命中一个当前可选 PDD 候选时，不调用 AI，建议标为 matched，一键匹配按既有流程保存 exact_match + confirmed；未命中或多个不同候选标准化后相同，仍走原 AI 与置信度/候选校验。只转换比较键，蝦皮/PDD 原规格名不改，映射目标保存 PDD 原始候选名称；不引入颜色同义词猜测、不自动重算历史映射。
+
 ## SYB 商品明细
 
 - 一行对应 SYB 一条明确的商品/颜色/尺码/数量明细；唯一键为「蝦皮订单号 `code` + 来源明细 `id`」组合，不是全局唯一 ID（未在多货运单样本中验证过全局唯一性）。
 - `productSpec` 自由文本解析：按最后一个逗号切分为颜色/尺码 → 剥离【】备注 → 判断残留分隔符；解析状态分 `success`/`uncertain`/`failed`，永不猜测原文中不存在的颜色或尺码。
+
+- 采购放行不以 uncertain 单独阻断：success 与已提取出至少一个非空颜色或尺码的 uncertain 明细，都可继续进入规格匹配和采购预检；只有 failed 或颜色、尺码均为空的异常明细才要求人工处理。uncertain 状态与解析说明继续保留供审计，不会自动猜测规格。
 - 只有 `success` 状态的解析结果会合并进虾皮商品档案的规格值（来源标记 `import`）；`uncertain`/`failed` 只停留在明细行上供人工复核，不污染共享档案。
 - 金额单位按接口分别定义：`/am/stock/detail/listByStock` 的 `productPrice` 是十进制金额，与 `/am/stock/list` 的 `amtOrder`（×100 整数）不是同一套换算，不可共用。
 - 关联虾皮商品档案：命中存活记录直接关联；命中软删除记录则复活并保留原有人工映射；均不存在时创建最小档案。命中既有档案时只补写为空的参考图与售价，不覆盖人工修改过的标题、店铺和映射。
@@ -56,24 +60,32 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 对采购人员展示的阶段固定为：待人工处理、未关联 PDD、PDD 待采集、PDD 采集中、PDD 采集失败、规格待匹配、可创建采购、已创建任务、采购成功、待人工核对。
 - 主阶段优先级为：待人工核对 → 采购成功 → 已创建任务 → 待人工处理 → 未关联 PDD → PDD 待采集/采集中/采集失败 → 规格待匹配 → 可创建采购。每行只显示一个阶段和对应下一步。
 - “待人工核对”表示订单结果不明确，必须先人工核查并禁止自动重试；“采购成功”表示已取得 PDD 订单号和下单时间，不代表已经支付。
+- 一个 PDD 订单号只能属于一个采购任务，该唯一性在采购任务保存路径上全局强制（#241）。人工处理结果未知、取消及 lifecycle 保存路径撞号时返回 `PURCHASE_ORDER_NUMBER_ALREADY_USED`，提示订单号已属于哪个任务，由采购员人工核对，不静默覆盖原值。
+- 不可逆边界之后的 `order_created` 结果回传是上述规则的例外：此时 PDD 真单已创建，发现订单号已属于其他任务时不回滚、不判失败，而是把任务降级为 `order_result_unknown`，冲突订单号以「读到订单号 X，但该号已属于任务 CG-yy」保存在任务与 attempt 的 `error_message`，`pdd_order_no` 留空以维持唯一性，保留下单时间与不可逆时间，进入既有人工处理结果未知通道。首要目标是保住「真单已存在」这一事实，不制造无记录的真实订单。
+- Agent 可按收货地址后缀 `_cg<任务号>` 批量回填订单号与下单时间（#241）。
+- Agent 侧回填为**人工触发的只读扫描**（#242）：入口在采购记录页搜索按钮右侧，输入天数（默认 2）后确认启动。天数口径为滚动 N×24 小时，基准是页面读到的下单时间。采集、采购、回填三者互斥，复用既有任务互斥锁并加原子防重入，忙碌时拒绝启动而不排队、不抢占。
+- 回填扫描不假设订单列表有序：只有连续观察到至少 5 单且下单时间严格递减、期间无缺失时间时，才允许「超过指定时间即停止」；一旦出现时间回升或缺失，改为扫至内部上限并明确标记「未完整扫描」，不得把不完整结果显示为已扫完。内部上限用于限制设备占用，不作为用户可配置的门禁。
+- 回填扫描全程只读：确认收货、申请退款、催发货、去支付、立即支付、提交订单、付款、退款、取消订单、再次购买、删除订单永久排除为点击目标；点击目标必须自身可点、子树不含上述词，且不与任何含上述词的可见控件几何重叠；不得按固定坐标盲点。遇登录、验证码或风控立即停止并报告。
+- 解析不出规范后缀的订单一律跳过，其订单数据不缓存、不上传、不入日志；上传载荷只含后缀、订单号、可选下单时间，以及 #306 的可选实付金额。本地缓存只采纳服务端确认的事实，并区分页面读到的真实时间与 `irreversible_at` 回落估算值。后缀只承载任务号，请求不含地址全文或收件人信息；只允许回填该设备自己的正式采购任务；页面下单时间优先，缺失时回落该任务的 `irreversible_at` 并标记时间来源，两者皆空则该条失败。
 - 已失败、已取消或演练完成的旧采购任务不单独占用主阶段；当前数据仍满足条件时恢复显示“可创建采购”，旧任务继续在采购管理留痕和按既有规则处理。
 - 未选择处理阶段时，商品列表仍先返回，当前页阶段和采购准备继续异步批量读取且不调用 AI Provider；选择阶段筛选时，服务端必须先对完整查询结果派生并筛选阶段，再计算总数和分页，不能只过滤当前页。
 
 ## SYB 店铺过滤
 
 - `syb_shop` 保存允许导入的 SYB 店铺；店铺名比较前统一去除首尾空白、转换全角/半角字符并忽略大小写。规范化后同名的店铺只能保留一条有效记录。
+- 版本迁移会对历史存活店铺回填 `normalized_name = Normalize(display_name)`；回填只改匹配键且可重复执行。若两个存活店铺回填后会得到同一键，迁移必须整体失败并保留原数据，管理员先人工消除歧义后再执行，不能静默合并、删除或改变店铺启用状态。
 - 店铺可以从 SYB 真实货运单列表发现，也允许管理员手工补充。只有管理员可以新增、改名、启停和软删除，采购员等其他角色只读。
 - 没有任何启用店铺时，导入必须在读取凭据、建立会话、验证码 OCR 和任意 SYB 网络请求之前失败，并给出“请先启用店铺”的可读提示。
-- 同步必须先拉取并校验当天原始全量列表的总数、分页和唯一 ID，再按本次同步开始时固定的启用店铺快照过滤；过滤不能降低完整性校验的请求范围或容量上限。
+- 同步先预检全范围总数及上限，每页校验原始列表条数、合法 ID 和重复，再按冻结店铺快照获取明细并页事务保存；整日结束核对总数。过滤不能降低完整性校验范围，已保存不能冒充整日完整（#239，c6a962d，已于 2026-09-08 随 d403f3b 部署线上）。
 - 只有列表与明细响应的店铺名都非空且命中启用快照时才允许写入。明细店铺名为空、变化为未启用店铺或无法匹配时跳过，并计入跳过数量。
 - 停用或软删除店铺只影响后续导入，不删除历史 SYB 商品、虾皮商品或任务数据。已有错误导入数据的清理必须先给出精确 SQL 和影响行数，再由用户单独确认。
 
 ## SYB 后台导入记录
 
-- 导入由管理员创建，创建成功后立即转入后台执行；页面关闭不取消任务。采购员等其他已登录角色可以查看同步记录，不能开始导入。
+- 导入允许管理员和采购员（purchaser）创建，创建成功后立即转入后台执行；页面关闭不取消任务。其他已登录角色只能查看同步记录，不能开始导入（#236）。
 - 系统同一时刻只运行一个 SYB 导入任务。`syb_sync_run` 的唯一执行槽负责跨进程互斥，内存锁减少同一进程内的竞争；服务重启后遗留的执行中记录标记为“已中断”。
 - 导入失败或中断时保留已写入商品，记录明确的失败原因和已处理进度；重新导入相同范围按「订单号 + 明细 ID」覆盖，不产生重复商品。
-- 每条同步记录保存本次启用店铺集合的 SHA-256 哈希以及各店铺“已导入/已跳过”数量，不保存账号、密码、Cookie、验证码图片或 SYB 原始响应。
+- 创建同步记录时冻结本次启用店铺的规范化匹配集合、展示名称快照及 SHA-256 哈希；后台执行必须只使用这一份快照，不得在开始后重新读取 `syb_shop`。同步详情保存并返回快照可用标记、快照店铺名称、哈希及各店铺“已导入/已跳过”数量。#212 之前的历史记录只有哈希和统计，明确标记为无完整快照。上述记录不保存账号、密码、Cookie、Token、验证码图片或 SYB 原始响应。
 - 后台任务创建前的内部失败仍向普通用户显示“服务端处理失败”，但使用稳定错误码区分阶段：店铺预检为 `SYNC_SHOP_PREFLIGHT_FAILED`，同步记录创建为 `SYNC_RUN_CREATE_FAILED`。服务端只记录阶段和经过脱敏、截断的底层原因，不记录请求体、凭据、Cookie、Token、验证码或原始响应。
 
 ## 采集规则
@@ -84,14 +96,18 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 删除采用软删除；删除后不能创建新任务，但已有任务继续执行自身快照。
 - 商品详情步骤应声明精确 `activityName`，并与包名和唯一控件共同作为页面证据；进入 PDD 登录 Activity 必须返回 `PDD_LOGIN_REQUIRED`，不能提交采集成功。
 - 唯一文字节点不可点击时，Agent 只可点击其最近的可点击父容器；不得改点兄弟节点或相似文字。
-- 商品页规格入口只接受带明确选择语义的规格摘要，或底部真实“购买/拼单”文字按钮；评价、评论、晒单、问答区域及其父容器一律排除。商品评价页与详情页共用 Activity 时，首次误触只允许安全返回并重新定位一次，重复误触明确失败；点击无变化、误入评价页和面板结构无法确认使用不同错误码。
+- 商品页规格入口只接受带明确选择语义的规格摘要，或底部真实“购买/拼单”文字按钮。若“请选择”和颜色/尺码语义分散在同一可点击父容器的子节点中，也只能在该容器唯一、位于非底部动作区且同时具备两类语义时作为规格入口；规则别名只能收窄已识别的安全候选，不能按页面原始文字扩张。底部购买入口在通过全部安全过滤后仍存在多个候选时，按最右优先（`centerX` 降序，并列时可点击面积升序）确定性选出唯一入口，不再因候选不唯一直接失败；该情形记为 `bottom_purchase_rightmost`，唯一候选仍记为 `bottom_purchase`。“单独购买”与“发起拼单”打开同一规格面板，但对应不同成交形态与价格，最右优先是经人工确认的取舍。评价、评论、晒单、问答、订单、提交订单、支付和付款区域及其父容器一律排除。商品评价页与详情页共用 Activity 时，首次误触只允许安全返回并重新定位一次，重复误触明确失败；点击无变化、误入评价页和面板结构无法确认使用不同错误码。
 - v2 规则使用类型化动作和固定阶段钩子。已由 Agent 支持的选择器、别名、超时、滑动方向和有限次数可以只更新规则；新增动作类型或页面算法才需要升级 Agent。
 - v2 任务首次未进入精确商品详情页时，可以按规则显式重开同一浏览器 URL 一次；登录、验证码、风控、无效链接和详情页内采集失败不触发该恢复。
 - 假售罄恢复只使用主商品规格/购买强证据判断页面是否正常；顶部“相似商品”可以作为受控兜底证据，推荐卡片的标题、价格和销量不得冒充主商品证据。
 - 商品规格遍历必须用已识别规格节点锁定横向颜色容器和纵向面板容器；颜色按视觉行蛇形遍历，滑动完成后重新读取节点，尺码只读并允许在标题滚出后沿已锁定容器续页。
 - PDD 已选规格的订单确认形态只可由详情页、选择摘要、唯一数量控件、支付区、唯一底部提交动作和唯一主要滚动容器的组合证据确认；底部提交动作只读且永久禁止点击。Agent 只在该已确认容器内最多三次向下拖动回顶，每次重新读取节点；“参考分类”作为尺码的精确标题别名处理。
+
+- PDD 完整规格选择器若无主滚动容器且尚未选择规格而没有已选摘要，仍可识别为非滚动规格面板，但必须同时出现至少两个已解析维度、至少两个可选项、唯一数量控件和唯一底部订单动作；缺少其中任一强证据时保持未识别。该订单动作仍仅作页面证据，永久禁止点击。
 - Agent 可扩展，但规则必须按任务类型授权：采集规则不能创建订单，采购规则只能使用独立审核的创建订单能力。当前项目不实现支付动作、入口或测试；支付、下单和订单相关文字可以作为只读页面证据配置，但不得成为点击目标。后续支付能力必须单独评估并至少具备显式能力位、服务端开关、单笔金额上限和人工授权。
 
+- #256（Android 0.9.73，实现 43703e0）：采集执行器可识别无“已选/请选择”摘要且当前仅一个规格标题的滚动规格面板。必须匹配 PDD 包名、任务详情 Activity 与选择器，无登录/验证等异常，并同时具备唯一有界规格滚动区域、唯一标题及非空候选、关闭、唯一数量输入/增减、支付区和唯一下方提交订单只读动作；缺失任一证据仍拒绝。此分支只由采集上下文启用，不生成虚假选中摘要，采购与其他解析调用维持原条件。订单动作仍仅作只读证据，采集绝不点击。
+
 ## 采集任务
 
 - 任务与结果共用 `collection_task` 主表，不建立独立 `collection_result` 主表。
@@ -135,27 +151,27 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 演练规则在服务端契约层拒绝改地址、创建订单和核单动作；正式动作还必须通过版本化能力协商。规则只包含类型化动作，禁止任意脚本。
 - 价格保护保存参考单价、最低单价、最高单价和币种，执行时以 PDD App 实际单价判断；价格越界明确失败，不考虑优惠券。
 - Admin 从 SYB 当前页选择商品，可在“创建采购”和“重新解析”两种批量用途间切换；采购模式只允许选择预检合格行，表头全选不跨页。批量预检和正式创建均最多 100 条并逐条重新校验，每条 SYB 明细只创建一个独立任务；部分失败不回滚其他成功项。
-- SYB 商品列表在列表数据返回后立即展示，采购准备状态独立异步加载；只读批量预检只执行批量数据库读取、已确认映射和本地确定性识别，禁止调用 AI Provider。未保存的确定性结果仍显示“规格待匹配”，不能作为“可创建采购”的依据。SYB 批量创建采购按最新数据完整复核，只有目标颜色和尺码都已保存为确认映射，且共同命中最近一次成功或部分成功采集中的完整可售 SKU 组合时才允许创建；否则必须先执行批量 AI 匹配或人工确认，不能把未匹配明细带入采购任务内的人工匹配步骤。
+- SYB 商品列表在列表数据返回后立即展示，采购准备状态独立异步加载；只读批量预检只执行批量数据库读取和本地确定性识别，禁止调用 AI Provider。自 #215 起，未保存或已失效的长期规格映射不再阻断创建采购；满足商品关联、PDD 状态、价格、规则、设备和订单安全门禁后即可创建任务，每个新 SYB 采购任务都在首个 attempt 以当次 PDD 页面候选重新决策。
 - SYB 商品页的 PDD 采集资格独立于采购处理阶段：只要已关联的 PDD 商品未停用、没有 `pending` / `running` 采集任务且存在可用采集规则，即可创建采集任务；因此已完成采集并进入“可创建采购”的商品也可以重新采集。相同 PDD 商品在批量创建前按商品去重，服务端创建时仍按最新状态复核。
 - 批量创建读取管理员选定的当前采购规则并重新执行契约校验，每条任务保存不可变快照；当前规则缺失或无效时明确阻断，不回退到代码常量。设备默认人工指定，也可以留空由符合能力的空闲设备领取。
 - 批量创建的价格保护来自 PDD 商品档案而不是 SYB/Shopee 的 TWD 售价：当前采购规则可用 `priceGuard.minRatio`（0.1～1.0）和 `maxRatio`（1.0～3.0）配置比例，缺省仍为 0.2 / 1.5；最低价向下取整、最高价向上取整到人民币分。已确认颜色映射时按该颜色计算，待规格探测时以全部可用颜色的最低/最高价计算，参考价取最高价；没有可用颜色价格时不能创建。
-- 地址后缀为 `_cg{purchase_task.id}`。选好规格和数量后，Agent 仍停留在当前规格/下单面板；若收货地址被面板裁切，只允许在唯一、可见且占据主要宽度的纵向滚动容器内有限向下拉动来显示地址，禁止按页面最大滚动区域盲目滑动。Agent 只在唯一地址入口、唯一修改按钮和唯一详细地址输入框均成立时修改；脱敏手机号文字本身不可点击时，仍以该唯一文字节点的中心坐标执行一次精确手势点击，不沿用可能覆盖整个下单面板的可点击祖先。“修改”“保存”和“提交订单”等文字节点即使依赖可点击父节点，也必须保留原始文字节点作为每次重新定位的锚点，父节点只用于验证存在可点击路径。近乎完全重叠的无障碍重复节点按一个目标处理，仍有多个独立目标或页面切换超时则明确失败。按首个 `-` 或 `_` 截取地址主体后追加当前后缀，保存后必须回读完整新地址。修改或回读失败时禁止创建订单，地址全文和控件树不落库。
+- 地址后缀为 `_cg{purchase_task.id}`。精确规格、数量、价格和摘要核验通过后，若仍处于已识别的规格面板，Agent 只允许点击唯一、可见、启用、可点击且文案精确命中“确定/确认”别名的规格确认控件；不得点击提交订单、确认购买、付款、支付、地址修改或地址保存控件，也不使用中心手势兜底。点击后必须重新读取并确认已出现订单确认页或地址入口强证据，否则明确失败。进入订单确认页后，若收货地址被面板裁切，只允许在唯一、可见且占据主要宽度的纵向滚动容器内有限向下拉动来显示地址，禁止按页面最大滚动区域盲目滑动。Agent 只在唯一地址入口、唯一修改按钮和唯一详细地址输入框均成立时修改；脱敏手机号文字本身不可点击时，仍以该唯一文字节点的中心坐标执行一次精确手势点击，不沿用可能覆盖整个下单面板的可点击祖先。“修改”“保存”和“提交订单”等文字节点即使依赖可点击父节点，也必须保留原始文字节点作为每次重新定位的锚点，父节点只用于验证存在可点击路径。近乎完全重叠的无障碍重复节点按一个目标处理，仍有多个独立目标或页面切换超时则明确失败。按首个 `-` 或 `_` 截取地址主体后追加当前后缀，保存后必须回读完整新地址。修改或回读失败时禁止创建订单，地址全文和控件树不落库。
 - 地址编辑页可以同时存在收货人、手机号和详细地址等多个输入框；Agent 只选择与“详细地址”标签纵向重叠且位于其右侧的唯一输入框，不能用页面输入框总数或顺序猜测。
 - 点击创建订单前，Agent 必须先在本地事务保存 `order_submit_started`、不可逆时间、稳定请求 ID 和不含地址全文的最终确认快照，再用同一请求 ID通知服务端；两侧成功后才允许精确点击唯一创建订单按钮一次。
 - 进入不可逆边界后，进程重启、断网、点击结果不明或无法取得唯一订单号/下单时间时只允许只读核单并进入 `order_result_unknown`，禁止再次点击；任务与订单正式关联仍以完整 PDD 订单号为准。
-- 创建订单后出现 Android 多微信应用选择器时，Agent 只有在系统包和 `ChooserActivity` / `ResolverActivity` 白名单、已知选择器标题、微信候选三类证据同时成立时，才允许按一次返回，绝不点击微信候选。若已进入真实微信包 `com.tencent.mm`，Agent 不点击、不输入、不登录、不支付、不强制停止微信，只允许用一次无参数 PDD 启动 Intent 把既有 PDD 任务栈拉回前台；第二次仍见微信或拉起失败即保持结果未知。回到 PDD 已知支付 Activity 或明确支付动作页面后最多再返回一次，再只读读取唯一订单号和下单时间；任一页面不在白名单、恢复动作重复、无法到达订单详情或结果不唯一时保持 `order_result_unknown`，禁止重下单或支付。
+- 创建订单后出现 Android 多微信应用选择器时，Agent 只有在系统包和 `ChooserActivity` / `ResolverActivity` 白名单、已知选择器标题、微信候选三类证据同时成立时，才允许按一次返回，绝不点击微信候选。若已进入真实微信包 `com.tencent.mm`，Agent 不点击、不输入、不登录、不支付、不强制停止微信，只允许用一次无参数 PDD 启动 Intent 把既有 PDD 任务栈拉回前台；第二次仍见微信或拉起失败即保持结果未知。回到 PDD 已知支付 Activity 或明确支付动作页面后最多再返回一次，再只读读取唯一订单号和下单时间；下单成功页仅可点击唯一、精确的“查看订单”或“订单详情”入口一次，进入 PDD 订单详情后才允许有限向上手势下翻读取折叠内容。PDD 页面出现“待付款”“待支付”“订单编号”或“下单时间”等订单结果信号时，该只读信号优先于复用的支付 Activity 名称：允许在唯一主要纵向容器内有限下翻并重新读取，仍不得点击支付；没有任何订单结果信号的支付页或未知页面不得盲目滑动。入口缺失或不唯一、点击后未出现详情证据、任一页面不在白名单、恢复动作重复或结果不唯一时保持 `order_result_unknown`，禁止重下单或支付。
 - Agent 本地 SQLite/Outbox 负责断网和重启恢复，服务端以 `task_id + task_attempt_id` 幂等接收并保存最终事实。
 - 人工支付复核只记录 `paid` / `unpaid`；系统不执行或识别支付。快递单号与回填状态属于采购任务，后续物流工单实现。
 - 采购任务领取时同时占用设备租约和可选 PDD 账号租约；租约过期后才可释放并重新领取。设备还存在采集任务时不能领取采购任务。
-- 采购规格由服务端按顺序决策：先使用已确认的人工映射；否则仅在同一规格角色的可选 PDD 原始标签中做唯一确定性匹配（繁体转简体、空格/全半角/大小写统一，以及公斤/斤换算）；仍无唯一结果才调用已启用的服务端 AI。AI 必须返回候选集中的原始标签，候选不完整、歧义、AI 无结果或服务不可用均明确失败，不派发第二趟、更不创建订单。
+- 自 #215 起，每个新 SYB 采购任务无论是否存在已确认长期映射，都先由 Agent 在当次 PDD 规格面板内有界遍历颜色和尺码并回传原始候选。服务端只以任务冻结的 SYB 目标规格与当次候选先做唯一确定性匹配（繁体转简体、空格/全半角/大小写统一，以及公斤/斤换算），仍无唯一结果才调用已启用的服务端 AI。AI 必须逐字返回当次候选集中的原始标签；候选不完整、集合外返回、歧义、AI 无结果或服务不可用均明确失败，不派发第二趟、更不创建订单。
 - Agent 选择服务端下发的精确颜色或尺码时，只能在已确认打开的规格面板内有限纵向滑动、每次重新读取可选节点并按完整原始文字点击；连续没有新证据或达到上限即停止，不得点击相近规格。第一趟探测并固化规格后，第二趟仍无法精确选择而再次提交探测时，服务端必须明确失败并释放活动槽，保留第一次决策证据，禁止清空决策、循环派发或进入地址与创建订单动作。
 - 采购 Agent 在确认进入 PDD 商品页后、打开规格前，复用采集侧的假售罄识别；规格面板已打开且当前解析到的规格值全部不可选时也按售罄处理。两种情况都只允许关闭规格面板后对商品页执行一次有界恢复（默认下拉 2 次、间隔 1000 毫秒、等待 2000 毫秒），恢复动作失败或恢复后仍售罄时返回 `PDD_GOODS_SOLD_OUT`，恢复后商品页证据丢失时按页面规则不匹配失败；不得继续选择规格、修改地址或创建订单。该失败码继续进入既有替代商品资格判定。
-- 规格映射不完整、已保存的确认映射对当前 PDD 档案失效、确定性匹配失败、PDD 档案为待采集或没有规格时，规则必须具有 `purchase.spec-probe.v1`；自 #190 起前两种情况不再拒绝创建，而是把 `spec_source` 降级为 `unresolved` 并交由规格探测解析，规则不具备该能力时仍然拒绝创建；第一趟只探测规格并释放租约，服务端固化同一 attempt 的决策后才派发第二趟。Android 不自行匹配或猜测；其只接收服务端已经固化的精确原始规格标签。
+- 所有新 SYB 采购任务的规则都必须具有 `purchase.spec-probe.v1`；创建时任务级 `mappedColor` / `mappedSize` 为空且 `spec_source=unresolved`，长期映射和 PDD 档案候选都不能跳过首趟探测。第一趟只探测规格并释放租约，服务端固化同一 attempt 的决策后才派发第二趟；探测阶段从服务端拒绝进入 `order_submit_started`。Android 不自行匹配或猜测，只在第二趟接收并精确选择服务端固化的当次 PDD 原始标签。
 - Agent 提交的相同 attempt 最终结果只能写入一次；相同请求重放返回原事实，不同内容拒绝覆盖。`order_result_unknown` 不参与自动派发，只能人工解除。
 - 已创建订单默认禁止再次采购；管理员或采购员可以做一次性重新采购授权，新任务创建成功时在同一事务消耗授权，旧任务和旧订单保留。已标记为已支付的订单不能授权或创建重新采购任务。
 - 人工回填候选只允许从已支付订单选择；同一 SYB 明细后来选择的订单覆盖旧候选，但不删除旧订单事实。
 - Admin 采购管理只查看和处理已有任务，不提供创建入口或支付按钮；单条和批量采购任务都从 SYB 商品列表发起。订单结果未知时必须先人工核对并解除；处于该状态时页面不提供重新采购授权。
-- 采购失败任务可在采购管理当前页批量勾选重试，最多 100 条。重试不修改旧任务，而是用当前 SYB/PDD 档案、当前规格映射、当前价格保护和当前采购规则创建新的 `pending` 任务，并生成新任务编号与地址后缀；来源蝦皮订单号沿用失败任务的不可变快照。
+- 采购失败任务可在采购管理当前页批量勾选重试，最多 100 条。重试不修改旧任务，而是用当前 SYB/PDD 档案、目标规格、当前价格保护和当前采购规则创建新的 `pending` 任务，并生成新任务编号与地址后缀；来源蝦皮订单号沿用失败任务的不可变快照。新任务不复用旧任务或长期档案的执行规格，仍必须先完成当次真机规格探测。
 - 只有正式采购、未进入不可逆边界、没有订单号或下单时间、且仍是同一 SYB 最新记录的 `failed` 任务可重试。原设备离线、停用、忙碌或能力不足时该项失败且不自动换机；未指定设备时仍由空闲设备领取。
 - 批量重试逐项处理并允许部分成功；同一请求幂等重放不会重复创建。失败任务不再使用一次性重新采购授权，该授权只保留给已经创建过订单且满足条件的任务。
 
@@ -163,7 +179,7 @@ synchronized_at: 2026-09-01T15:31:24Z
 
 - 管理端固定支持 `admin`（管理员）和 `purchaser`（采购员）两类业务角色；用户必须绑定一个存在且启用的角色，`role_id=0` 或停用角色不能创建或保存。
 - 采购员可读取设备状态，维护 PDD/虾皮商品和规格映射，查看与修正 SYB 商品，读取 SYB 店铺及同步记录，读取采集规则，创建/重置/删除采集任务，并创建、查看、重试及人工处理采购任务。
-- 仅管理员可管理用户、角色、菜单、接口、部门和岗位；停用设备或吊销 Device Token；新增、改名、启停、删除或发现 SYB 店铺；手动启动 SYB 同步；新增、编辑或删除采集规则；保存或测试 AI Provider 配置。
+- 仅管理员可管理用户、角色、菜单、接口、部门和岗位；停用设备或吊销 Device Token；新增、改名、启停、删除或发现 SYB 店铺；新增、编辑或删除采集规则；保存或测试 AI Provider 配置。
 - AI 规格匹配菜单对采购员硬排除：采购员不显示该菜单，角色配置也不能为采购员选中该模块；既有 API 权限不变，仍只允许读取是否启用，不得读取 Provider 地址、模型、API Key，也不得保存或测试。
 - GoAuto 菜单由代码维护的模块定义幂等写入系统菜单和菜单/API 关联；迁移只为采购员追加首次引入且默认开放的模块，不会把采购员人工取消勾选的既有模块重新加回。
 - 采购员 Casbin API 白名单由代码权限矩阵全量重建，不从角色菜单勾选反推；减少权限时旧策略必须删除。菜单勾选只控制可见模块，不能扩大采购员 API 权限。
@@ -225,7 +241,7 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 定时任务失败时明确记录失败原因，不自动重试。服务重启后由既有启动恢复逻辑处理遗留的运行中记录。
 - 单次同步内部的 SYB 只读请求（货运单总数、列表和明细）遇到暂时网络故障、5xx 或异常响应时最多执行 3 次，分别退避 1 秒、2 秒，单次 HTTP 总超时 60 秒；这不等于失败任务自动重试。明确未登录、业务失败、数据完整性错误以及任何写操作均不自动重试。
 - SYB 商品页不再提供“导入”和“同步记录”快捷按钮，也不查询、展示或轮询同步状态；后台同步成功、失败或中断均不在商品页弹出消息，商品数据由用户主动查询或刷新获取。
-- 独立“SYB 同步记录”页面是同步结果的唯一 Web 展示位置，保留运行状态、进度、数量、失败原因和店铺统计；go-admin 定时任务中的 `GoAutoSYBHourlySync` 提供“执行记录”入口。管理员可在同步记录页人工发起覆盖昨天和今天的同步，采购员只读；人工与定时同步共用导入服务、执行记录和互斥，不排队、不并发，也不立即重试。
+- 独立“SYB 同步记录”页面是同步结果的唯一 Web 展示位置，保留运行状态、进度、数量、失败原因和店铺统计；go-admin 定时任务中的 `GoAutoSYBHourlySync` 提供“执行记录”入口。管理员和采购员可在同步记录页人工发起覆盖昨天和今天的同步，其他角色只读（#236）；人工与定时同步共用导入服务、执行记录和互斥，不排队、不并发，也不立即重试。
 
 
 ## cmautobuy 商品导入
@@ -251,16 +267,14 @@ synchronized_at: 2026-09-01T15:31:24Z
 
 ## Agent 受控重试采购
 
-- 当前设备只可就地重跑自身最近 30 天内、服务端标记 `retryable=true` 的正式采购失败任务；列表和详情都只能发起单任务重试，不支持多选、批量或自动重试。
-- 普通“重试采购”复用原 `purchase_task.id`，不新建任务，不改变商品、虾皮/SYB 身份、目标规格、已映射规格、价格保护、地址后缀与其他业务快照。重试只把任务恢复为 `pending`，清理错误、租约和运行守卫。
-- 重试时刷新服务端当前采购规则及其类型、schema 和能力要求。#127 尚未实施前，当前规则仍为服务端内置规则；#127 完成后才切换为数据库单例设置，不能在本工单提前引入第二事实源。
-- 新规则下发前必须重新校验原设备在线、空闲且具备全部能力。规则不可用或能力不匹配时拒绝重试，原任务保持失败状态。
-- 已出现 `order_submit_started` 证据，或存在不可逆时间、订单提交请求、PDD 订单号、下单时间的任务一律拒绝就地重试，并提示走既有“授权重新采购”流程，防止重复下单。
-- 每次成功受理就地重试都会为同一任务预建一个新的 `pending` attempt，保存本次规则哈希；正常 Start 复用并转为 `running`。因此尝试次数、每次规则哈希和失败原因均可追溯，且不限制人工重试次数。
-- `requestId` 按“任务 + 请求”幂等；相同请求重放不重复修改任务或增加 attempt。
-- Agent 详情显示已尝试次数与上次失败原因。确认界面必须说明同一任务使用最新规则重跑、可能创建待付款订单且系统不会支付。
-- “继续采购”与普通“重试采购”语义不同：替代商品匹配完成后的“继续采购”继续调用既有 `AgentRetry → BatchRetry → Create`，保留旧任务并按当前替代商品档案创建新任务；Admin 批量重试同样继续创建新任务。二者均不得改成就地更新旧任务。
-- 取消订单、修改既有订单和支付仍禁止；真机重跑可能进入创建待付款订单流程，执行前必须再次取得人工授权。
+- 当前设备只可重试自身最近 30 天内、服务端标记 `retryable=true` 的正式采购失败任务；列表和详情都只能发起单任务重试，不支持多选、批量或自动重试。
+- 普通“重试采购”调用就地 `/reset`：复用原 `purchase_task.id`，只新增 attempt；新 attempt 使用当前有效采购规则和最新版 Agent 代码，商品、目标规格、执行规格、数量、价格、地址及既有规格决策等业务快照保持不变。
+- 就地重试不恢复已经消耗的真机规格探测资格；目标规格存在但对应执行规格为空时必须拒绝，不能进入正式采购阶段。需要按替代商品或已变化业务规格重新决策时，必须走明确的新任务流程。
+- 已出现 `order_submit_started` 证据，或存在不可逆时间、订单提交请求、PDD 订单号、下单时间的任务一律拒绝重试，并提示走既有“授权重新采购”流程，防止重复下单。
+- `requestId` 按“任务 + 重置请求”幂等；相同请求重放返回同一 task ID 和 attempt，不重复递增。
+- Android 只在服务端 `retryable=true` 且状态为 `failed` 时显示普通“重试采购”。确认和成功反馈必须说明复用原任务、新增一次执行、使用当前规则但业务快照不变、可能创建待付款订单且系统不会支付。
+- `/reset` 不得把“目标规格存在但对应执行规格为空”的任务恢复到正式采购阶段；此类异常快照必须拒绝，并提示使用明确的新任务流程。
+- 替代商品匹配完成后的“继续采购”继续调用 `AgentRetry → BatchRetry → Create`，按当前档案创建不同 task ID；Admin 批量重试也保持新任务语义。取消订单、修改既有订单和支付仍禁止。真机重试可能进入创建待付款订单流程，执行前必须再次取得人工授权。
 
 ## Agent 状态页手动检查任务
 
@@ -318,7 +332,7 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 一个 PDD 商品可能被多个虾皮商品共用，因此规格匹配按受影响的每个虾皮商品分项记录。主表只表达总体进度；Agent 展示和“继续采购”资格必须读取当前任务对应虾皮商品的分项状态。
 - 选错替代商品时，连续执行 B→C 不等于撤销 A→B，因为 B 可能还关联其他虾皮商品。正确纠错语义是把原 A→B 记录置为 `superseded`，再建立 A→C，并只处理原记录分项中冻结的影响集合。
 - 创建请求按 `create_request_id` 幂等；重放时源商品、替代商品、来源类型、来源任务、采集证据和发起设备必须一致，否则返回幂等冲突，不能静默覆盖。
-- `created_by_device_id` 只代表 Agent 设备。当前系统没有设备到采购员账号的绑定，多人多机场景若需要个人责任追踪，必须另建工单实现设备绑定操作员。
+- `created_by_device_id` 只代表 Agent 设备。设备可由管理员绑定到一个采购员账号；一个采购员可拥有多台设备，一台设备最多归属一个采购员，也允许暂不归属。SYB 商品一键关联/替换按当前采购员选择的归属设备读取该设备最新临时采集，不使用其他账号或其他设备的全局最新记录。
 
 
 ## PDD 商品替换生效与规格匹配（#131）
@@ -331,12 +345,16 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 自动确认必须保存来源、实际置信度和脱敏限长原因；人工确认完成后同步对应分项及主表总体状态。worker 不得覆盖已由人工改变的映射。
 - 纠错不能简单执行 B→C；必须把原 A→B 记录置为 `superseded`，建立 A→C，并只处理原记录冻结的虾皮商品影响集合。
 
-## 创建采购任务时的异步规格匹配（#148）
+## 历史：创建采购任务时的异步规格匹配（#148，#215 后仅兼容存量）
 
-- 创建任务继续同步使用已确认映射和唯一确定性 `exact_match`；只有需要外部 AI 时，任务与 `purchase_spec_match_work_item` 在同一事务创建，接口立即返回。活动工作项或 `manual_required` 未处理前，`Next`、`Claim`、`Start` 均拒绝任务。
-- AI 结果只固化到采购任务快照，不自动写回虾皮商品长期规格映射。`ai_match` 必须达到设置阈值、严格属于当前候选、原因非空且写入前输入指纹未变化；否则转人工，Agent 不猜测。
-- provider 网络、超时或 5xx 按 30 秒、2 分钟、10 分钟退避，最多尝试 3 次；预算内恢复会自动继续，耗尽后转 `manual_required`。Admin 可重新入队或从当前候选人工选择。
-- 异步 provider 单次调用最长 60 秒，即 `min(配置超时, 60 秒)`；设置页测试连接仍使用完整配置超时。取消任务会同时终结活动工作项，输入变化会关闭旧工作项并要求重新入队。
+- #215 起，新建 SYB 采购任务不再根据 PDD 档案创建 `purchase_spec_match_work_item`，也不在首次派发前调用外部 AI；规格决策统一来自首趟真机探测的当次候选。
+- 部署前已存在的匹配工作项继续保留审计、恢复、重试和人工处理能力；其 AI 封闭候选、置信度、输入指纹、退避和最长 60 秒调用边界不变，但不能成为新任务跳过当次探测的依据。
+
+## SYB 采购强制当次规格探测（#215）
+
+- 每个新 SYB 采购任务固定执行“首趟只读探测 → 服务端确定性优先/必要时 AI → 固化任务级精确规格 → 第二趟正式采购”。首趟只打开一次浏览器商品链接；匹配期间当前设备保留给同一任务，不领取其他采购或采集任务。连续进入第二趟且当前仍有 PDD 商品页或规格面板强证据时复用当前页、不再次打开链接；手动同任务重试，或当前处于 Agent、其他应用及缺少上述强证据时，重新打开任务固化的商品 URL。复用或重开均不严格核验标题、goodsId 或页面指纹，但仍要求 PDD 包名与商品/规格/订单页面结构安全证据。已有长期映射只作商品档案事实，不直接进入任务执行规格。
+- 首趟候选与 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和幂等结果哈希关联；第二趟失败不得回到首趟循环探测。备货 `stock/direct_select` 没有 SYB 目标规格，继续使用用户逐字选择的档案规格，不进入本规则。
+- 候选和 Provider 结果仅保存颜色、尺码原始标签及结构化决策，不保存控件树、整屏截图、账号、地址、订单或支付数据；付款仍永久禁止。
 
 ## Agent 手动采集替代商品（#130）
 
@@ -386,6 +404,13 @@ synchronized_at: 2026-09-01T15:31:24Z
 - Agent APK 版本由管理员在设备页抽屉中上传、核对并显式设为当前。服务端从 APK Manifest 读取整数 `versionCode` 和 `versionName`，保存 SHA-256、大小、说明和创建人；APK 位于非公开目录，Admin 与设备下载均需认证。
 - Agent 只以整数 `versionCode` 判断更新。启动时静默检查一次，设置页可手动检查、显示下载进度并取消；下载完成必须校验大小和 SHA-256。设备有活动任务时禁止检查、下载和安装；安装始终交给 Android 系统确认，项目不绕过未知来源权限。
 
+## Android 采购规格动作安全执行（#214）
+
+- 规格入口与精确规格选择统一按“重新定位唯一目标 → 执行一次无障碍点击 → 读取新页面验证”执行；不得复用旧无障碍节点，不选择相近规格，也不在多候选时默认点击第一个。
+- 无障碍点击后页面完全无变化时，只允许对解析器已确认的安全规格入口或服务端下发且唯一命中的精确规格执行一次中心手势兜底。目标必须可见、启用、边界有效，手势后仍须以规格面板强证据或精确选中证据确认结果。
+- 页面发生变化但规格面板强证据不足时，默认明确失败；#243 的同商品页安全入口恢复是限定例外：确认包/Activity 未变、商品标题非空且未变、入口来源与语义未变，无面板、关闭、数量、已选、支付、订单或页面异常信号时，重新定位入口并最多执行一次受控手势。整页普通动态节点变化不单独阻断该恢复；入口缺失或显式/嵌套入口歧义仍拒绝。商品标题一致是当前上下文约束，不宣称已从页面核验 goods_id。诊断只记录入口来源、点击结果/原因、恢复结果和面板数量/布尔等无敏感标量。原始控件树、节点文字集合和整屏截图仍不得保存或上传。
+- 规格已处于精确选中状态时不得重复点击。规格查找只在解析器唯一识别的规格面板容器内有限滚动，每次滚动后重新定位容器与目标；容器缺失、歧义、到边或验证失败均 fail-closed。
+- 中心手势兜底不得用于修改/保存地址、创建或提交订单、订单详情入口以及任何支付/付款目标；正式创建订单的一次性不可逆门禁与永久禁止支付规则不变。
 ## PDD 商品反向关联与继续订单采购（#161）
 
 - 一个 PDD 商品可被多个虾皮商品共用。PDD 详情返回全部关联虾皮商品摘要；订单行由独立统一分页接口读取，不按虾皮商品伪造嵌套分页。
@@ -401,3 +426,257 @@ synchronized_at: 2026-09-01T15:31:24Z
 - 定时与管理员手动执行共用全局活动槽和逐商品工作状态。单批默认最多 20 个商品；同一规格上下文与 AI 设置更新时间未变化时，已完成、低置信度或无结果商品不重复调用 AI。
 - Provider 临时失败最多尝试 3 次，间隔至少 60 分钟；输入变化后重新计算指纹并允许重新处理。运行记录只保存结构化计数和脱敏限长错误，不保存 API Key、Provider 原始响应、商品原始 JSON 或个人数据。
 - 系统定时任务迁移后默认关闭，须由管理员明确启用。该能力仅维护蝦皮与 PDD 颜色/尺码映射，不创建采购任务、PDD 订单，不触发 Agent，也不执行付款。
+
+## SYB 异常采购规格 AI 解析（#198）
+
+- SYB 采购规格采用两阶段流程：先把货运单明细 `productSpec` 解析为目标颜色/尺码，再由 #195 把蝦皮规格匹配到 PDD 规格；两阶段不得混为同一匹配事实。
+- 定时任务只处理未人工确认且确定性解析为 `uncertain` / `failed` 的明细。每条先重跑确定性解析；空 `productSpec`、无关联蝦皮商品、无颜色/尺码候选或同一角色存在多个候选维度时不调用 AI，继续人工处理。
+- AI 只在关联蝦皮商品的封闭候选集合中返回原始颜色/尺码，并必须提供达到当前自动确认阈值的置信度和非空理由；集合外值、缺失角色、低置信度、歧义、无结果和输入漂移都不得确认。
+- `parse_status` 保留确定性解析器结论；AI 与人工确认分别记录，人工优先级最高。重复同步不得覆盖人工值；完全相同输入保留 AI 值，来源或关联变化会清除旧 AI 确认。
+- 同一输入的低置信度或无结果不重复调用 Provider；临时故障至少 60 分钟后重试，最多 3 次。任务不创建采集/采购任务、订单，不执行 Android 动作或付款。
+
+## 设备身份恢复
+
+- 管理员可在设备管理对未停用设备发起“重置设备身份”。此动作不删除设备记录、不改变设备 ID、能力或已绑定的待领取任务；它立即使旧 Token 无效，并只生成一次、有效期 10 分钟的恢复码。
+- 恢复码仅显示给发起操作的管理员一次，服务端只保存摘要；不得进入列表、日志、任务记录、Android 持久化或普通接口。手机操作员必须在同一安装实例的 Agent 设置中手动输入。
+- 服务端只接受同一 `installId`、未过期且尚未使用的恢复码完成重新注册，成功后签发新 Token 并使恢复码失效。过期、重复使用、installId 不符或停用均明确失败；不能通过清空数据、直接改库或“吊销 Token”恢复原任务归属。
+
+- 自 #223 起，任务创建时把与冻结 SYB 目标对应的已确认商品规格映射保存为不可变的探测指导快照，但仍不得跳过首趟真机探测。探测完成后，每个角色先验证快照映射能否按既有规范化规则唯一对应当次候选，能对应时固化当次候选原文；不能对应时只对该未解决角色执行确定性匹配，仍无结果才调用 AI。已解决角色不重复交给 AI，任一最终值仍必须逐字属于当次候选；历史映射失效、规范化后歧义或角色不符时不得复用。候选完整但无法决策时提示“已采集到当前规格，但未能确定颜色或尺码映射”，不再误报候选不存在。
+
+## 采购商品深链入口（#232）
+
+- Android 采购新任务（含探测与人工重试）打开商品时，优先使用指定 PDD 包名的 ACTION_VIEW，并设置 NEW_TASK 与 CLEAR_TASK，以清理旧任务栈后交付该任务链接。清理的是 Activity 返回历史，不是清除应用数据或强制停止进程。
+- 直接启动失败（包括无可处理 Activity）时回退既有浏览器入口；启动请求被接受后仍由执行器验证稳定商品页面，停留首页不会仅因启动成功而判定完成。
+- 清栈不用于改地址后返回、下单后回到 PDD、订单核查；采集入口继续使用既有浏览器流程，避免绕过规则中的浏览器步骤。
+- 当前通用商品页面结构验证不能独立证明页面 goods_id；解析结果携带的任务 goodsId 不是页面回读证据。首次直接深链上线仍需以实际目标商品真机核对，ADB 实验不替代 Agent 上下文验证。
+## SYB 批量采购设备偏好（#233）
+
+- SYB 商品页“批量创建采购任务”按当前登录用户 ID、当前浏览器来源与 API 环境记住最近一次设备选择；主动清空也记忆为不指定设备。只保存设备 ID，不保存 Token、账号凭据或订单信息。
+- 弹窗打开后先按现有在线/可选/采购能力条件加载设备，再恢复选择并以相同设备预检。记忆设备当前不可用时保留偏好并提示用户重新选择或明确清空，不静默切换设备或自动领取。
+- 预检加载中、失败或记忆设备不可用时不能提交；过期预检结果不覆盖新的设备选择。服务端原有设备及采购资格校验不变。
+- 偏好只作用于此入口，不影响采集、其他创建入口和采购重试。浏览器存储失败时仍允许手动操作；刷新或关闭再打开浏览器可恢复，清理浏览器数据或沿用现有退出登录清理存储行为后需重新选择。
+
+## 客户端密钥与可编辑模块授权（#237）
+
+以下为提交 `71f7751` 已实现的规则；2026-09-07 本机已迁移并验证管理页面可用，2026-09-08 已随 d403f3b 完成线上迁移与部署，真实客户端密钥执行闭环尚未验证。
+
+- 仅管理员创建、查看、编辑授权或停用密钥。首版不提供密钥改名、到期、轮换、恢复启用、删除或任意接口授权。
+- 模块选择复用“采集采购/采采管理”现有 12 个业务模块；分组勾选只影响当前子模块，新菜单不会自动获得授权。客户端密钥管理、系统账号权限及支付不在可授权模块中。
+- 勾选模块默认只读，至少保留一个模块。读写仅开放清单中的普通写操作；同步、采集、采购、删除、导入、重解析、匹配、回写及切换当前采购规则分别独立授权，默认关闭。没有普通写接口的模块不允许勾选读写。
+- 编辑既有密钥不会更换密钥，名称和前缀只读；移除模块同时移除其动作。取消保留原授权；失败保留输入；版本冲突要求刷新重开。停用不可编辑或恢复。
+- 保存后新请求按最新授权校验，已经通过校验的在途请求可能完成，不追溯回滚。模块授权不是行级、店铺级或租户隔离，授予读取即允许读取该模块明确接口可返回的业务范围。
+- 用户于 2026-09-07 明确接受明文风险：密钥管理及客户端接口默认兼容 HTTP/HTTPS，无需开关。HTTP 会明文传输密钥与业务数据，建议优先使用 HTTPS；兼容不改变管理员身份与模块授权边界。
+- 客户端与 Admin 登录 JWT、Agent Device Token 独立。响应排除凭据及原始载荷字段；AI 设置只返回 enabled，不开放 Provider 配置读写或连接测试。设备仅开放列表，不开放身份重置、令牌或解锁接口。
+- 执行动作复用既有业务门禁、幂等参数及状态机；客户端采购 batch-retry 沿用 Admin 原有语义，不等同于 Agent 就地 reset。授权重采购、支付复核、取消订单等未列入接口不开放；永久禁止付款。
+- 创建响应丢失时不可找回完整密钥，应核对列表并停用可能已创建的记录，再明确创建新密钥，不能盲目自动重试。完整密钥只在创建结果弹窗内存中显示，关闭或离开页面清空，不写浏览器持久存储。
+
+## 打开采购规格面板后按需滚动（#238）
+
+- Android 0.9.60 / versionCode 73，代码 `58a6c1c` 起，规则 `openSpecPanel.swipeAfter` 保留格式校验与旧快照兼容，但不执行打开面板后的固定次数预滑动；不以“必须滑两次成功”作为进入规格探测/选择的条件。动作后的 `waitAfterMs` 仍生效。
+- 首趟规格探测和第二趟精确选择仍使用各自既有的按需横向/纵向、有界与稳定终止策略。取消预滑动不等于不探测隐藏规格，也不等于只看首屏。目标不存在、歧义、页面证据不足或必要的有界查找失败时仍明确失败。
+- 此调整覆盖所有已经安全识别打开的面板，不再仅特判 NON_SCROLLABLE_CONFIRMATION；不弱化面板验证、精确选中、地址、价格、任务租约、创建订单边界或禁止支付规则。
+- 其他动作的后置滑动沿用原行为，必需滑动失败仍返回 RULE_ACTION_FAILED。旧规则 JSON 不回写、不迁移；原任务 ID、历史 attempt、商品与规格快照不变。旧 APK 行为不变，需升级 Agent；本单未改线上规则或执行 CG68 真机采购。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；2026-09-08 已随 d403f3b 部署线上，未手动触发真实同步验收；#240 上游尾页超时尚未修复。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+
+## 商品页动态变化下的采购入口恢复（#243）
+
+实现 ec8b14a，Android 0.9.61/versionCode 74；已构建、未安装或真机验收。规格探测和正式采购共用入口函数，面板已打开时不新增点击；仍在同一商品上下文且安全入口存在时，一次重新定位手势恢复不再依赖整页完全静止。手势后仍未打开则报告入口无效果，不循环点击。恢复不能用于地址、创建订单、支付或未知面板，不修改面板分类器及正式下单边界。CG82/CG85 原首次点击未生效的底层原因尚待新日志和授权真机验证。
+
+
+## 同一颜色卡片重复选中节点（#244）
+
+实现 93aab6a，Android 0.9.62/versionCode 75；已构建并授权覆盖安装，真实采购效果待验收。仅在颜色维度完整精确目标已选中、但存在非目标已选候选时，识别同一卡片重复表达：卡片必须是滚动容器直接子级的可点击非滚动 android.view.ViewGroup，节点父链明确、可见启用且边界包含；其他冲突节点仅可为该卡片自身或其中的 ImageView。另一文字选项、另一张卡片、多个精确目标、目标未选中、父链/边界不明均不适用例外。额外核对内存源节点以拒绝被解析器按同名去重隐藏的跨卡片目标；不保存原始树。
+
+不删除规格数字、不模糊匹配、不改变通用解析器、尺码确认、摘要兜底、入口/滚动/地址/价格/创建订单。没有非目标选中冲突时继续原判断；仅把同卡片容器/图片的重复选中表达从冲突中排除，不新增点击。
+
+
+## 精确规格不可用与入口恢复诊断（#245）
+
+实现 ca815c3，Android 0.9.63/versionCode 76；已通过单元测试并构建，未安装、未进行真实采购验收。入口恢复沿用 #243 条件，拒绝时通过 entryRecovery=rejected;reason=<固定原因码> 区分页面身份、商品上下文、面板/支付区域、数量/摘要、标题、入口来源/文案、歧义、规则别名及可用性；不放宽条件，不新增点击。
+
+在规格面板识别出唯一完整精确候选且 available=false 时，立即返回既有 PURCHASE_SPEC_SAFE_TARGET_MISSING，提示目标颜色/尺码已售罄或当前不可选，未创建订单；已选中目标同样不能绕过不可用检查。只记录 dimension 和 exact_target_unavailable 固定结构证据，不记录规格原文或原始树。原有纵向与横向定位在此条件下本就停止，不能将本改动描述为修复“已识别售罄仍继续搜索”。未识别精确候选时继续既有有界搜索，不推断售罄，不替换规格；解析器、匹配规则、滚动预算、地址与下单流程不变。
+
+## 改地址返回后的动态提交按钮（#248）
+
+实现绑定 `c80c746`，Android 0.9.66 / versionCode 79；已通过 353 项 Android 单元测试并构建，尚未安装或进行真实采购验收。
+
+- 地址回读与最终提交按钮定位分开判断。旧“提交订单”“现在买，仅”“确认购买”识别继续优先；存在旧文案候选但歧义时不使用结构补充选择其中一个。地址确实缺失时保留既有有限恢复；地址及采购面板上下文已确认后，不因底部按钮文字变化而滚动规格列表。按钮缺失或不唯一使用 `PURCHASE_SUBMIT_TARGET_AMBIGUOUS` 提示按钮问题，不误报地址保存超时。
+- 结构补充只属于当前执行器中已完成地址修改后的返回流程，不能由其他页面或旧执行的地址证明启用。当前须为 PDD、地址后缀按既有规则回读唯一、地址入口唯一，并存在唯一数量输入或已选摘要；通过地址入口与该证据的最近共同祖先确定整个采购弹层，不把颜色/尺码滚动区域当成弹层。排除全屏大祖先、地址编辑、已知支付 Activity 及订单结果/支付页面，后续定位要求 Activity 与地址返回时一致。
+- 旧文案无候选时，只接受弹层底部固定区域内一个独立、可见启用、非滚动的可点击容器；不在规格滚动区内选择按钮，不取控件树末项，不使用固定屏幕点击坐标。文字与人民币金额子节点合并为一个按钮；支持如“复购价，”及非支付展示文字变化，但单独价格、多个操作按钮或支付/付款/地址/返回等非提交动作均不放行。
+- 地址返回检查、最终复核和提交共用目标定位。结构路径保留原文字节点为重新定位锚点，由已有无障碍点击重新查找其可点击父级；不新增下单手势兜底。最终复核成功后才允许该结构路径提交；提交前再次检查路径、类别、文字与边界，发生变化即停止；复核失败清除本地结构提交锚点。
+- 既有规格、数量、价格和地址复核，任务租约、服务端/本地不可逆边界及单次提交规则不变。结构识别不支持支付，不增加采购员操作、配置或审批；不改变 Admin、接口、数据库、规则 JSON、通用解析器及滑动执行器。原始控件树、整屏截图、地址全文和凭据不得落盘或上传。
+
+## 临时采集连续模式（#250）
+
+当前实现绑定 `37e8b56`，Agent 0.9.72 / versionCode 85。2026-09-09 用户批准 v5：按配置次数返回后切回 Agent，替代此前“识别并停留 PDD 首页”的方案；不保证 PDD 最终停在首页。代码、376 项 Android 单测及 Debug 构建通过，新版设置与完整真机闭环待验收。
+
+- 连续采集默认关闭，本机即时保存，失败恢复原值；开启后显示返回次数选择，1～5 次、默认 3，取消不改，写入失败恢复旧值。任务忙碌时开关和次数均禁用，选择提交时再次检查；无新增权限。只用于本次人工新建普通临时采集（source=agent_current_page、attemptNumber=1、无替换来源），Admin 下发、重试、替代与采购不参与。
+- 单任务执行开始固定返回次数。完整 completed、服务端提交确认且既有图片上传流程结束后，执行有限 Back，每次后等待 500ms；不要求识别商品/搜索/相机/首页，也不要求画面发生变化。图片上传仍沿用既有非致命行为，不因收尾更改结果。
+- 每次 Back 前检查前台仍为 PDD，读取页面后再次检查；离开 PDD 则停止余下 Back。次数完成、离开 PDD 或 Back 动作失败后，尝试打开 Agent 保持原 Tab，等待 500ms 并验证前台包名。动作失败不重试，不把请求启动成功直接当作切回成功。
+- 沿用风险页安全边界：登录/验证码/风控、地址编辑、订单详情或支付等证据时保留现场，不发送 Back 或强行切回；Activity 缺失、读取异常明确停止。以上例外不引入首页门禁。
+- 导航在原任务互斥和唤醒锁内完成，不变更租约/调度。返回失败只显示人工处理提示，不把成功采集改为失败或自动重采。
+- 失败、部分成功、提交未确认保留现场，不运行返回步骤，也不触发旧空闲返回倒计时。关闭开关保持原流程，采集间隔不变。
+- 不自动拍照、搜索或创建下一任务，不涉及采购/订单/付款；不使用深链、浏览器、OCR/VLM 或坐标兜底。
+
+## SYB 存疑规格候选核对（#251）
+
+实现绑定 `64b4205`，基线 main `fdd26af`；2026-09-09 代码与本地测试/构建通过，未部署、未重跑生产历史数据。
+
+- 原 Parse 的成功与失败行为不变，仅 uncertain 明细增加既有蝦皮规格候选核对。比较完整原文，沿用【备注】清理，允许全角逗号、逗号两侧空白及连续空白归一；颜色尺码可正序或倒序，使用逗号或空白分隔，只有唯一完整组合才改为 success。返回既有候选标签，不改写标签，不删除加号、不截断体重说明、不做近似匹配。
+- 单规格只有在候选确实仅包含该角色时通过；有两个角色时不能用单值补猜另一个角色。空/损坏候选、校验不通过、同角色多维、未知有值维度、多种组合或归一化碰撞，均保留原结果。候选必须已存在，不能用本次待确认输入生成候选再自我证明。
+- 同步入库 ApplyDetail、手动 Reparse 共用；成功核对不再次合并规格，因此不新增重复维度、不覆盖已有映射。人工确认仍优先，默认 Reparse 跳过人工与 AI 已确认值；原文保留。
+- #198 批处理原本先 Reparse，所以可直接复用本优化：能确定的不用调用 AI；仍不确定的按原 AI 流程处理。没有新增调度、调用额度或同步等待，不自动开启已有任务。
+- 不取消 uncertain/failed 状态，不改变采购可信度/可采购规则，不实现一键关联 PDD。部署后新同步或显式重新解析会使用新逻辑；本次没有执行生产批量更新。
+
+
+## 蝦皮详情匹配等待与回读（#254）
+
+实现绑定 `9088e6b`（2026-09-10，分支 fix/254-match-loading）；已通过合成数据测试，尚未合并 main 或发布线上。
+
+- AI 设置中的 timeoutSeconds=T 仍是单次 Provider 请求的上限。详情一键匹配的整次预算为 2T+10 秒，浏览器 POST 等待上限为 2T+20 秒；例如 T=60 时130/140秒，T=180时370/380秒。只保留现有一个 AI 设置入口，不新增时间配置框，也不自动改变管理员已保存的 T。
+- 超时上限不是固定等待。颜色/尺码串行执行且共用整次预算；正常部分匹配仍按原事务保存合格结果，AI异常在保存前返回时不提交本轮新映射。既有置信度、候选、人工确认映射保护和采购资格不变。
+- 前端超时、关闭或切换详情不代表后端已取消、未保存或已回滚；必须以回读结果为准，无法回读显示结果未确认，不自动重复匹配、不自动创建采购。
+- 单商品详情的成功/失败/超时/关闭重开都必须结束失效的等待状态；旧请求不得覆盖新商品或新操作。匹配进行期间本抽屉不能人工改映射，已有未保存草稿仍按原确认流程处理。
+- UI匹配提示的等待上限仅指POST，不含提交前GET及结果核对GET；结果核对也有限时，不能让失败提示再次陷入无限转圈。
+
+
+## SYB 行内一键关联最近采集（#253）
+
+实现绑定 `b1594dc`，2026-09-10；分支 feat/253-one-click-link，包含 #254 依赖。已完成合成数据测试及构建，未合并 main、未部署，不代表当前线上已具备此能力。
+
+- 未关联 PDD 且既有处理阶段提供“去关联”的 SYB 行可用一键关联；原人工入口不删除。首次点击选择采集手机后继续当前行，后续使用记忆手机；小箭头查看/切换手机，保存只修改全行共用偏好。取消不改变偏好、不执行关联。与批量采购设备选择互不影响。
+- 以所选手机的临时采集 source=agent_current_page 为范围，从 completed、completed_partial 中按 finished_at DESC、id DESC 取最新一条；失败/待执行/执行中不参与。最新为部分成功或商品停用、无可用规格时明确停止，不回退更旧商品，不切换其他手机。离线手机允许使用已有成功结果，停用或已删除手机需要重新选择。
+- 主动作开始冻结行、蝦皮商品和设备；服务端关联事务固定来源采集任务、PDD商品与规格版本。仅未关联时自动写入，已有或被其他操作改变的关联不覆盖。关联作用于蝦皮商品，因此共用该蝦皮档案的其他 SYB 明细也受影响；切换手机不会重绑已有商品，也不会改变在途操作。
+- 先保存关联，再复用现有颜色/尺码自动匹配及保存。有效已确认映射保留；普通部分匹配保存合格结果，AI故障不提交本轮新映射，但已保存关联保留。后续可从“去匹配”或详情人工继续。failed 且无人工/AI确认时不能自动跳过人工解析；uncertain 不统一拦截，仍以原采购准备规则为准。
+- 操作完成不保证立即可采购，必须刷新现有处理阶段；缺规格、缺映射、解析需确认或其他原资格不满足时继续显示真实待处理阶段。不自动创建采购任务、不下单、不支付。
+- 请求超时/网络中断只做有限回读，不重复提交；读回失败明确结果未确认，避免无限转圈。离开页面不代表后端停止或回滚。普通用户沿用现有采购员权限，无新管理员专属开关。
+
+## SYB 已关联商品的一键替换（#258）
+
+实现绑定 `2b01974`；部署与验收见 #258 发布证据。
+
+- 复用一键关联及小箭头的位置，保留原查看 PDD 商品。PDD 待采集、采集失败、停用或缺价格的对应处理阶段可替换；采集中、已创建/运行采购、成功或结果未知不开放。服务端提交时再次检查，不能只相信按钮。
+- 复用每用户/浏览器/API环境的手机偏好；首次选择继续当前行，小箭头仅切换偏好。预览仅选所选手机最新 completed/completed_partial 临时采集，部分成功或不可用不回退旧商品。确认后固定来源任务和目标，不改用新采集；来源状态、设备、目标规格或旧关联改变时拒绝。
+- 不同商品显示一次确认，包含旧/新商品、手机和共享蝦皮档案影响；取消不写入。同商品不弹替换确认且不重写关联，只继续匹配。共享该蝦皮档案的 SYB 明细使用新关联，历史采购任务快照不改。
+- 沿用既有更换关联和有效映射检查，再复用自动匹配保存。部分匹配、AI失败或解析需人工处理时保留已保存关联，显示真实处理阶段，不保证立即可采购、不自动创建采购。
+- 网络异常只有限回读，区分目标商品、仍为原商品和其他关联，不把“已有某个关联”误报为本次替换成功；不自动重发写请求。没有新增后台作业、订单或付款操作。
+
+## 辅助信息缺失的采集关联（#259）
+
+实现绑定 `e467706`，仅 Server；部署/验收见 #259。替代 #253/#258 中“部分完成一律拒绝”的限制，不改变 completed 原有路径。
+
+- completed_partial 的 missing 必须是非空合法列表且仅包含 salesText、shopName、reviewCount，才进入辅助信息兼容检查；title、规格/价格缺失、遍历截断、SKU数量上限及未知原因仍拒绝。
+- `shopeeproduct/partial_collection.go` 核对本次 task 的维度和值、可售SKU的完整标记/规格引用/非负价格、本次颜色价格，以及当前档案可选值由本次有效SKU覆盖，不能借旧档案合并残留的规格或价格通过。真实单维度允许，不虚构另一维度；本次明确报告缺少规格仍拒绝。
+- 一键关联、替换预览及确认提交共用验证。失败沿用409 LATEST_COLLECTION_UNAVAILABLE及现有提示，不回退更早采集、不换手机。状态 completed_partial 和 missing 原样保留；辅助字段缺失仍可在任务详情查看。
+- 无接口字段、数据库迁移、Android/Web或权限变更；普通人工关联与采购/AI资格不变。不将“允许关联”视为“已匹配或已采购”。
+
+## 采购单标题面板与地址就绪等待（#260、#261）
+
+实现绑定 #260 `3c1ffa4`（执行器回归测试 `7de4318`）、#261 `5ea07f1`，Android 0.9.74 / versionCode87，基于0.9.73。安装及真实采购验收以工单证据为准；不代表 main 的 Android 已整合这些分支。
+
+- 采购仅在安全规格入口点击返回SUCCESS后，记录本次页面包名/Activity作为内存上下文；开始新执行或页面身份改变时清除。`PddScreenParser` 的新增 purchaseEntryContext 默认关闭，仅该采购执行器传入；普通解析和采集原判定保留。
+- 当前仍为同一PDD Activity、商品ID非空、没有页面风险、没有选中摘要，且唯一有标题规格滚动区、一个维度有值，同时具有关闭、数量、支付展示区域与下单操作证据时，单标题可识别为NORMAL_SCROLLABLE。只是允许进入既有精确规格探测/选择，不执行下单或付款，不全局认可UNKNOWN，不增加入口重复点击或滑动。
+- 地址入口点击原有1000ms保留；地址列表等待增加唯一修改目标要求。点击修改和保存由500ms改为1000ms，其他通用动作间隔不变，无新配置项。
+- 修改后不再只见“详细地址”文字就立即写入。最多50次、每次间隔200ms读取（不含读取耗时），检查PDD页面风险；唯一可见启用有内容的详细地址EditText，连续两次路径、边界、内容及Activity相同才继续原输入流程。始终零个/多个或不稳定时失败，不取第一个候选。
+- 输入内容生成、输入后回读、保存后退出及返回规格面板、最终复核和单次下单边界不变。新增本机脱敏诊断 addressEditorCandidates / addressEditorPolls 两个整数，与task/attempt/device/ruleHash关联；不记录地址内容、原始树或整屏截图。
+- 仅Android；无Server/Web、共享API字段、数据库迁移或权限变化。真实采购、地址写入及订单创建不作为自动安装验证，不执行付款。
+
+### v2 商品入口补点与地址返回等待（#260、#261）
+
+2026-09-10 实现绑定 #260 `713111d`、#261 `d0a82f3`，Android 0.9.75 / versionCode88；真实采购效果以工单验收为准，非 main 合并声明。
+
+- 入口恢复不再把全页面支付方式展示文案单独视为支付页。当前包名/Activity、商品标题和安全入口必须与点击前一致，入口唯一且可用；已打开面板、关闭控件、数量、选中摘要、订单操作、风险/评价页面仍拒绝恢复。支付 Activity 或明确支付、订单、地址文本继续阻止补点。仅允许既有一次重新定位后的规格入口中心手势，随后仍验证面板，不循环、不扩展到地址保存或下单。
+- 保存地址后的确认读取、必要时一次返回后的确认读取，增加最多50次、间隔200ms的有界就绪检查，页面捕获耗时另计。连续两次同一Activity满足原地址回读与确认面板条件后继续；完整信息不要求滚动区域。已明确到地址列表时保留原返回路径，不等待列表出现下单按钮；返回后增加1000ms缓冲。
+- 就绪检查不修改原地址回读和结构下单入口规则；超时后只对既有识别的面板、唯一可用滚动区域执行原有有限滚动。零/多个区域仍失败，不凭地址入口或未知底部节点授权下单。最终精确规格、数量、价格、地址与单次下单边界不变。
+- 私有采购诊断新增布尔 savedAddressMatched、savedPanelMatched；整数 savedLegacySubmitCandidates、savedAddressCards、savedAddressTargets、savedScrollCandidates、savedConfirmationPolls。只记录标量并绑定task/attempt/device/ruleHash，不保存地址、原始树或整屏图。
+- CG109 v1现场读取未达到空闲状态，不能确认原失败具体缺哪项证据；v2覆盖迟到确认节点及可观测性，不将合成测试通过冒充真机修复验收。无Server/Web/API/迁移/权限变化，不需要服务器重启。
+
+## 探测到正式采购的单次面板交接（#262）
+
+2026-09-10 实现绑定 `2ea32fd`，Android0.9.76/code89；基于#260/#261，未声明合并main或真实采购验收通过。
+
+- AgentForegroundService通过PurchaseProbeHandoff只在成功spec_probe且结束后新快照仍识别PDD规格面板时保留一次性内存交接。仅taskId/goodsId/ruleHash/deviceId、Activity、前台revision和单调时钟时间，不保留控件节点、地址或选中状态，不落盘；有效期180秒。
+- 正式阶段消费时检查同任务/商品/规则/设备、前台revision及时间，消费后即清除。失配/超时/无任务或采集任务调度/结果异常/进程重启均不能沿用；普通手动再试不会继承已消费交接。现有服务端租约、互斥和匹配等待策略不变。
+- 有交接时，执行器恢复限定的purchaseEntryContext，最多10次、间隔200ms新读取（捕获耗时另计）；连续两次相同PDD Activity且具备既有商品/面板证据才跳过openProduct。空树可有限等待，其他应用/Activity改变/页面风险立即拒绝复用。没有交接时保留原一次判断路径；不把UNKNOWN当成功，不跳过正式精确规格/数量/价格/地址或下单验证。
+- 私有诊断新增handoffPresent、productReused布尔值，reusePolls整数及reuseReason固定枚举legacy_evidence/page_problem/page_changed/handoff_ready/evidence_timeout。仍绑定task/attempt/device/ruleHash，无敏感文本。
+- 无Server/Web、共享API或数据库变化，不需重启服务器。只有合成测试验证；原CG107/108日志证实两阶段，但未记录旧版重开判断，不把上下文丢失假设宣称为唯一现场根因。
+
+## PDD 订单实付价格（#306）
+
+实现绑定 8c01329（2026-09-18），待验收，尚未部署。人工“我的订单”回填除订单号和下单时间外，可提交唯一、合法的“实付”价格。它是订单展示总额，人民币分，独立存为 purchase_task.pdd_order_amount_cent；actual_unit_price_cent 仍是下单前观察的商品单价，二者不互相推算。
+
+不判断是否付款，不改变人工支付复核状态。没看到实付、格式异常或多个不同实付值时，仅跳过金额，订单号和时间照常按原规则回填。采购员可稍后再点既有“回填”，为空金额补写；已有相同值幂等，不同值保留旧值并返回金额冲突提示，不撤销正确订单事实。只允许当前设备自己的、原有允许状态的任务；不新增 attempt 或采购动作。
+
+金额仅保存 Admin；#305 订单号回写 SYB 的数据流不得使用该字段或将其映射为 cost，金额缺失/冲突不得成为订单号回写的前置条件。本单不代表 #305 已实现。Admin 现有订单详情卡片增加“实付价格”，缺失显示“尚未获取”，不新增列表列、入口或支付动作。安全点击集合及不保存原始控件树/个人信息的规则不变。
+
+## PDD 订单号自动回填 SYB（#305）
+
+实现绑定 e89de1a（2026-09-18），代码与隔离测试已完成，真实迁移/发布/SYB写入尚未验证。以下补充 #306 的单号后续流程，不改变其金额规则。
+
+正式 SYB 订单采购取得 PDD 单号（普通结果或人工遍历回填）后，在订单事实的同一个数据库事务中保存独立回填记录，后台异步写入对应 stock_id + detail_id。已人工回填相同单号也幂等确保记录存在；不重新采购，不等待支付复核。备货、演练、未取得单号或关联失效不回填；不自动扫描历史单据，历史补偿由采购管理勾选发起。
+
+写前精确回读唯一目标明细：同单号且 purchasePlatform=pdd 直接成功；非空不同单号/不兼容平台标记 conflict，不覆盖。远端为空才允许一次写请求，写后回读确认才成功。未知结果不得自动重复写；重启恢复的 running 只回读，不能因租约过期盲重发。失败/unknown 可人工补偿，仍先回读，且在途租约未到期时不能再发起。
+
+订单回填状态独立于采购成功、支付复核及物流 writeback_status。实付金额只存 Admin，SYB cost=0 为接口固定参数，不以金额推断付款。SYB 接口会同时更新采购状态/平台/时间，不能视作纯展示修改。
+
+采购管理增加独立状态列、批量回填和详情补偿；复用既有访问权限，不增支付确认或审批。批量受理与最终成功分开展示；重试采购和回填分别筛选勾选项。远端无原子CAS，对系统外人工并发修改/超长延迟请求不能承诺绝对互斥；有冲突应人工核对，禁止强制覆盖。
+### SYB 会话类失败的有界自动重试（#330）
+
+实现 01510a8/08b7095（2026-09-21，已合并 main，未部署、未生产验证）。回填 worker 从缓存会话恢复客户端后调用 SYB 会话校验；会话缺失/过期、串号失效、校验网络错误等均记为 `SYB_SESSION_UNAVAILABLE`，error_message 只记录类别和“将自动重试；如持续失败请恢复登录后重试”，不含原始错误。该类失败发生在任何写入之前，最多自动重试 6 次，退避 5/10/15/30/30 分钟（约 90 分钟，大于一个整点同步周期），达上限保持 failed 等人工。会话仍只由每小时 SYB 同步刷新；回填不登录、不 OCR、不删除或写入会话。其他失败码仍不自动重试。退避期内可手工重新回填，手工提交重置尝试次数。历史失败记录不会被自动领取。
+
+## Agent 回填订单入口兼容（#307）
+
+- 打开我的订单后最多采样8次，每次间隔1秒，连续两次订单导航结构一致才继续；登录/风控仍立即停止，超时给出明确原因。
+- 保留全部标签selected=true的原路径。PDD不提供selected属性时，要求订单标题、唯一全部标签以及同排至少两个订单状态标签；仅该安全导航标签允许一次中心手势，不扩大到订单卡片、地址、支付或其他操作。
+- 本轮主动点击全部后复核订单导航结构；本轮上下文不能跨扫描复用，出现其他已选中订单状态时停止。卡片识别与支付禁令保持不变。
+- 回填结束/失败通过现有通知与Toast显示脱敏原因；详细结果仍在Agent采购页。本变更不调整服务端回填接口、采集或采购流程。
+
+## 下单后待付款核单与应付金额（#325）
+
+实现分支 fix/325-order-result，2026-09-19；未部署、未真机验收。下单点击及不可逆边界不改。已知 PayActivity 允许一次原有 Back，随后从3次放宽为25次200ms采样（约5秒等待，不含页面捕获耗时），持续无证据仍为 PURCHASE_ORDER_PAYMENT_REPEATED。微信恢复、系统选择器、空窗口和陌生应用的既有边界保留。
+
+过渡阶段最多60次采样。首次识别到待付款证据后单独分配30次采样预算，不被之前绕路消耗，不因文字反复出现重置；核单总采样上限90次。缺少唯一订单号或时间时立即向上滑动读取下方内容，最多4次、手势400ms、每次后等500ms；读全立即停止，已有完整字段不滑动。该待付款读取分支不点击任何控件，也不点击付款。纯支付页不使用该滑动分支；出现可读待付款证据优先于复用的 Activity 名称。按采样间隔约18秒加有限手势/额外等待，实际耗时还含capture等调用；未改变2分钟任务租约或5分钟唤醒锁，也不宣称新增了执行器总体墙钟超时机制。
+
+应付金额从同一订单的可见标签集合中读取，兼容“应付:,13元”等标点；不跨无关联节点拼接，不读拼单价、优惠或实付。父子重复同金额去重，多值/缺失/无效/溢出省略，不因金额失败丢弃订单号与时间。仅存Admin，不推断支付、不改SYB金额、不修改地址行为。历史回填及界面语义未在本单统一，详见API契约#325补充。
+
+## 采购订单资料完整性及简化单号回填（#326）
+
+用户2026-09-19确认内部系统简化流程，原型v1通过。实现3a2472d，尚未发布或真实SYB验收。
+
+采购任务保存 PDD 订单号、下单时间和订单金额即为资料完整，不检查是否已付款；金额0元有效。复用 pddOrderNo/orderSubmittedAt/pddOrderAmountCent，金额以人民币分存储。order_created 不改义，仍是已创建订单事实；缺金额展示“订单信息待补全”，不能当作采购失败再次下单。页面统一称“订单金额”，其来源可能是#325应付或既有回填实付，不能将历史值统一称已付金额。
+
+Admin 复用未知结果处理弹窗增加金额输入，并为 live 已创建且缺资料任务提供“补全订单信息”；已有字段只读、缺项可填。保存中禁用提交，失败保留输入；沿用既有权限，不增加审批。非执行中的未知结果人工确认与已有订单资料补全都会事务内保证单号回填记录，不修改支付复核或触发设备操作。
+
+SYB 回填与资料完整性独立：正式SYB任务已有单号且仍关联有效明细即可入队，不要求 order_created 状态、时间、金额、付款确认或地址后缀。只有订单号上传SYB；沿用同号成功、异号冲突不覆盖及既有在途防重复规则，不倒扫历史任务。历史补偿仍手动勾选，已成功或在途任务不可重复发起。
+
+自动下单读取和Admin补录是后续目标来源；本单尚未删除插件或Agent我的订单回填，不能宣称上游地址后缀已取消或历史错误归属已修复。金额缺失不得自动采购，订单号唯一归属保护和永久不付款规则不变。
+
+## 采购管理已回填 SYB 筛选（#327）
+
+实现368f2c2，2026-09-19，尚未发布。采购管理现有“状态”下拉框增加“已回填 SYB”，用户选择后点击原查询按钮，按PDD单号回填队列成功记录筛选；不是新的采购任务状态，也不表示物流回填成功或已付款。
+
+筛选后仍展示原采购状态与独立SYB单号回填状态，已成功任务不因查询而允许重复回填。清空或重置恢复原列表，查询回到第一页，其他条件继续叠加。沿用既有下拉框、空/加载/失败状态及权限，不新增页面、审批、数据字段或外部动作。
+
+## 规格面板识别与选项去重（#331/#332）
+
+实现 `0edc78a`（#332）、`d8382e6`（#331），2026-09-22 已合并 main 并发布 Server（Android 0.9.60 仅安装到设备 8）；真机采购效果未验证。
+
+- 规格面板识别在原有判定之后新增回退类型 `REQUIRED_EVIDENCE`：**必须**同时存在收货地址入口（打码手机号所在可点击行）、支付方式修改入口（支付别名所在可点击行）和唯一可用的数量输入框，三者须位于同一规格面板容器内；另需至少一项辅助证据（规格选项、已选/请选择摘要、关闭、加减数量、提交订单）。加减按钮不再是必备条件。原有已识别的面板分类不变。
+- 地址入口只判断存在与否，不读取、不记录、不上传地址内容；诊断只输出布尔值与计数。
+- 点击规格入口后、保存地址返回后，若面板仅靠回退类型识别，须连续两次采样结构一致才继续，上限 5 秒；等待期间不按返回键，超时明确失败。稳定且明显不是采购面板的页面（如地址列表）沿用原返回路径。
+- 提交订单点击保持严格并进一步收紧：必须唯一、可点击、文字匹配，且文字节点及其可点击容器尺寸非零。
+- 规格选项解析：同一选项块（外层可点击块与其内部文字）只计一个值，文字优先取外层块；不做“零差评/快要抢光”等标签清洗。选中确认失败时诊断列出该维度解析值（截断）、选中状态和目标值。
+- 缺少必备证据时，失败信息附带可读提示，例如“未找到支付入口：请确认 PDD 默认支付方式为微信支付”“未找到收货地址入口：请确认 PDD 已设置默认收货地址”“未找到购买数量输入框”。
+
+### 采购手机环境前提
+执行采购的 Android 手机必须：PDD App 已登录、微信已登录、PDD 已设置默认收货地址、PDD 默认支付方式为微信支付。规格面板的地址与支付证据依赖该前提；不为支付宝等其他支付方式补充识别别名（有意决定）。条件不满足时 Agent 明确失败，不自动登录、不切换支付方式、不填写地址。

docs/04-local-development-and-verification.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Local-Development-and-Verification
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Local-Development-and-Verification.-
-wiki_revision: 0bb8d63fe2a3c6b1021bfa18800f5062de726868
-synchronized_at: 2026-08-31T16:06:55Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:14:42Z
 <!-- gitea-wiki-mirror:end -->
 
 # 本地开发与验证
@@ -24,6 +24,32 @@ T01 已建立可执行的三端骨架。建议从仓库根目录运行统一脚
 - 不得仅为设置编码重复启动一层 PowerShell；嵌套进程会增加启动时间、转义复杂度和错误定位成本。
 - 代码发现优先使用项目配置的代码图工具；检索字符串、配置和非代码文件，或图工具不足时使用 `rg`。
 
+### PowerShell 语法与外部命令
+
+- Windows 命令不得默认套用 Bash 语法；复杂正则优先先赋给变量或使用 `rg -e`，避免在多层引号中继续嵌套。
+- 多行 Python 或 JSON 正文使用单引号 PowerShell here-string，避免 `$()`、反引号和变量被 PowerShell 提前展开：
+
+```powershell
+$script = @'
+print("保持原文")
+'@
+$script | python -
+```
+
+- `foreach`、`if` 等语句块应保留在同一个 PowerShell 解析上下文中；需要收集表达式结果时使用数组表达式：
+
+```powershell
+$items = @(foreach ($path in $paths) {
+    if (Test-Path -LiteralPath $path) { Get-Item -LiteralPath $path }
+})
+```
+
+- `rg` 使用真实目录配合 `-g/--glob`，不要把 Bash 风格通配路径作为目录参数：
+
+```powershell
+rg -n -g '*.md' 'sync --check' docs
+```
+
 ### 文件编码与控制台输出
 
 文件解码和控制台输出是两个边界。读取 UTF-8 文本时，在命令支持的情况下显式指定字面路径与编码：
@@ -309,3 +335,18 @@ adb shell am start -n cn.ilapage.goauto.agent/.MainActivity
 - APK 文件目录使用 `GOAUTO_AGENT_RELEASE_DIR`；缺省为服务端工作目录下 `var/goauto-agent-releases`，不得映射成公开静态目录。部署需让 Admin/API 进程对该目录具有创建、写入、读取和删除临时失败文件的权限。
 - 真机发布验证前确认设备空闲，再由管理员上传一个签名一致、versionCode 更高的 APK并显式设为当前。依次验证启动静默提示、设置页手动检查、下载进度/取消、断网、哈希不一致删除、未知来源引导和系统确认安装。任务执行中全部更新动作必须被阻止，心跳与前台服务继续运行。
 - 上传或设为当前属于发布动作，安装会改变设备应用版本；没有用户独立授权时不得执行。安装后系统可能关闭无障碍服务，只能由用户在系统设置重新开启。
+
+## Chrome 订单回填扩展验证（#316）
+
+从仓库根目录执行：
+
+```powershell
+cd chrome-extension
+npm install
+npm test
+node --check service-worker.js
+node --check content.js
+node --check popup.js
+```
+
+自动化测试只使用合成 DOM 与 Chrome API mock，覆盖列表商品行负向选择、双展开与延迟字段、解析/冲突、启动互斥、停止、错误终态、扫描延迟增长、详情恢复、提交恢复、冻结配置、超时和可重试项。真实 PDD 浏览器点击、扩展安装和真实 Admin 上传不属于自动化验证，必须取得独立授权并在结果中明确区分。

docs/05-common-changes.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Common-Changes
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Common-Changes.-
-wiki_revision: b7d5520da954c544248e979c4ababb86d2784a43
-synchronized_at: 2026-08-27T09:38:36Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:14:50Z
 <!-- gitea-wiki-mirror:end -->
 
 # 常见修改指南

docs/06-troubleshooting.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Troubleshooting
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Troubleshooting
-wiki_revision: a8d4790811aa825c78830cb9c71c6b21723e4584
-synchronized_at: 2026-08-28T03:35:05Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:14:54Z
 <!-- gitea-wiki-mirror:end -->
 
 # 故障排查
@@ -85,3 +85,22 @@ sqlite3 -readonly agent-diagnostics.db "SELECT task_id,reason,color_row_count,co
 ```
 
 读取时记录设备、Agent 版本、任务号和规则快照；工单只回写查询得到的脱敏聚合数值。读取完成后删除本地导出副本。正式 APK 若不允许 `run-as`，停止排查并确认安全的只读诊断出口，不通过放宽应用安全配置或上传完整数据库绕过。
+
+## Android 采购规格入口本地诊断（#249）
+
+实现绑定 `99faf5a`，Agent `0.9.67`（versionCode 80）。单元测试与 Debug 构建已通过，新增版本真机留存/读取尚待验证；本节不属于上文既有实测结论。
+
+采购执行器启动后，在应用私有 `files/purchase_diagnostics/<taskId>_<attemptId>.jsonl` 保存白名单结构化入口诊断。元数据包含 taskId、attemptId、deviceId、agentVersion、phase、ruleHash（当前任务规则快照 SHA-256）、timestamp 和 elapsedMs。现有任务接口只有 attemptId，没有 attemptNumber；用 attemptId 对照服务端历史，不推算重试序号。
+
+证据仅包含入口来源枚举、候选数、点击结果/原因枚举、等待轮数、面板结构布尔值/计数，以及受控恢复是否执行及固定拒绝原因。没有商品标题、规格原文、地址、手机号、Cookie、Token、链接、原始控件树或截图。entryWaitMillis 是该等待循环累计的计划等待量；elapsedMs 才是自本次采购执行器诊断起点计量的实际耗时，timestamp 是后台写入时间。
+
+复用现有单线程诊断队列异步写入，写入/排队失败不改变采购结果；不新增点击、滑动、等待或采购门禁。最多保留最近 5 个 attempt 文件、每文件最后 128 条事件，超过 7 天的文件在服务启动或下次写入时清理。异常断电或存储故障仍可能丢失诊断，不能将日志缺失当成动作未执行；不上传 Admin，不增加服务端接口。
+
+仅对允许 run-as 的 Debug APK，在设备已连接且选定准确序列号后只读提取：
+
+```powershell
+adb -s <device-serial> shell run-as cn.ilapage.goauto.agent ls files/purchase_diagnostics
+adb -s <device-serial> exec-out run-as cn.ilapage.goauto.agent cat files/purchase_diagnostics/<taskId>_<attemptId>.jsonl
+```
+
+先列出文件，再读取本次任务/attempt 的准确文件名；不得扩大为导出所有应用数据或完整数据库。新版安装前的失败不会补生成日志；需要用户授权后重试才能产生新证据。Release 若禁止 run-as 则停止，不更改权限绕过；首版没有导出界面。该功能用于确定拒绝分支，并不代表已经修复对应采购故障。

docs/07-mvp-requirements.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Product-Requirements-Overview
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Product-Requirements-Overview.-
-wiki_revision: 0d9924b4566e567edf167ba678fedde28a41cfd3
-synchronized_at: 2026-08-28T02:27:12Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:00Z
 <!-- gitea-wiki-mirror:end -->
 
 # 产品需求总览与当前 MVP

docs/08-agent-api-contract.md

@@ -2,8 +2,16 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Android-Agent-API-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Android-Agent-API-Contract.-
-wiki_revision: 87219820eec3964ee5379f1edba6a62e94bddd2e
-synchronized_at: 2026-09-01T15:32:52Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:05Z
+<!-- gitea-wiki-mirror:end -->
+
+<!-- gitea-wiki-mirror:start -->
+generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
+wiki_page: Android-Agent-API-Contract
+wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Android-Agent-API-Contract.-
+wiki_revision: ba259178cf6514d5b48ea425005dfd366ba803a3
+synchronized_at: 2026-09-12T03:09:46Z
 <!-- gitea-wiki-mirror:end -->
 
 # MVP 共享 API 契约
@@ -49,18 +57,15 @@ DELETE /api/admin/v1/shopee-products/{productId}/specs/mapping
 POST /api/admin/v1/shopee-products/{productId}/specs/mapping/confirm
 POST /api/admin/v1/shopee-products/{productId}/specs/mapping/confirm-exact-matches
 POST /api/admin/v1/shopee-products/{productId}/specs/mapping/preview-auto-size
-POST /api/admin/v1/shopee-products/{productId}/specs/mapping/auto-match
 POST /api/admin/v1/shopee-products/batch-delete
 ```
 
 创建与关联/映射相关写操作均提交 `requestId` 做幂等重放；重放请求返回相同结果并标记 `replayed`。创建请求提交 `shopeeItemId`、`title`、`shopName`，可选 `pddProductId` 和 `specs`；`shopeeItemId` 重复时返回 `SHOPEE_ITEM_ID_EXISTS` 和已存在商品 ID。`link-pdd` 校验 PDD 商品存在且非 `disabled`，否则分别返回 `PDD_PRODUCT_NOT_FOUND` 或 `PDD_PRODUCT_DISABLED`；关联成功后返回值包含 `sharedByPddCount`，表示当前共用同一 PDD 商品的虾皮商品数。
 
-`specs` 结构同 PDD 商品的维度/规格值形状，但规格值额外携带 `source`（`import` / `manual`）与可选的 `mapping`（`pddValue`、`source`、`status`、`confidence`、`reason`）。新增规格值固定为 `manual` 来源；删除规格值仅允许 `manual` 来源，`import` 来源返回 `SPEC_VALUE_NOT_MANUAL`。设置映射时，`exact_match` 与 `ai_match` 来源一律写入 `pending` 状态，与请求体中的 `status` 无关；只有 `manual` 来源可以直接写入 `confirmed`。`confirm-exact-matches` 仅确认 `source=exact_match` 且状态为 `pending` 的映射，不影响 `ai_match`。该通用入口不因 #188 或 #194 改变；两者只能通过各自独立的服务端写入路径，将唯一确定性 `exact_match` 或通过高置信度门槛的 `ai_match` 写入 `confirmed`。
+`specs` 结构同 PDD 商品的维度/规格值形状，但规格值额外携带 `source`（`import` / `manual`）与可选的 `mapping`（`pddValue`、`source`、`status`、`confidence`、`reason`）。新增规格值固定为 `manual` 来源；删除规格值仅允许 `manual` 来源，`import` 来源返回 `SPEC_VALUE_NOT_MANUAL`。设置映射时，`exact_match` 与 `ai_match` 来源一律写入 `pending` 状态，与请求体中的 `status` 无关；只有 `manual` 来源可以直接写入 `confirmed`。`confirm-exact-matches` 仅确认 `source=exact_match` 且状态为 `pending` 的映射，不影响 `ai_match`。该通用入口不因 #188 改变；#188 仅通过下述采购批量规格匹配接口的独立写入路径，将唯一确定性 `exact_match` 或通过高置信度门槛的 `ai_match` 写入 `confirmed`。
 
 `preview-auto-size` 是只读计算接口（使用 `POST` 触发计算，不写数据库），无需 `requestId`。它读取当前蝦皮尺码与关联 PDD 的可选尺码，只返回格式统一后唯一确定的匹配；响应含 `items[]`（`valueName`、可选 `pddValue`、`status=preserved|matched|pending`、`reason`）、`pddValues`、`matchedCount` 和 `pendingCount`。已确认且目标仍存在的映射标为 `preserved`；无唯一结果标为 `pending`。Admin 的显式“保存修改”仍通过既有设置/确认接口落库。
 
-`auto-match` 是 Admin 蝦皮商品详情一键匹配颜色和尺码的独立写入接口。请求体必须提交 UUID `requestId` 和详情返回的 `specContextVersion`。服务端在事务外完成必要的 Provider 调用，入事务后重新锁定蝦皮商品与 PDD 商品，复核关联、完整规格上下文、当前可选候选、AI 开关和最新置信度阈值。保留有效的已确认映射；唯一确定结果直接保存为 `exact_match + confirmed`；置信度达标、理由非空且候选仍有效的 AI 结果保存为 `ai_match + confirmed`；其余项保持未匹配。响应含 `product`、`items[]`（`dimension`、`role`、`valueName`、可选 `pddValue`、`status=confirmed|preserved|unmatched`、可选 `source`、`confidence`、`reason`）、`confirmedCount`、`preservedCount`、`unmatchedCount` 和 `replayed`。同一 `requestId` 幂等重放；Provider 异常或 AI 未启用返回 `AI_MATCHING_UNAVAILABLE`，关联或规格变化返回 `SPEC_CONTEXT_VERSION_STALE`，两者都不写入本次结果。
-
 设置映射时，`pddValue` 必须是关联 PDD 商品同角色下当前可选的原始规格标签，否则返回 `INVALID_REQUEST`。PDD 重新采集后旧目标消失时，Admin 标记失效；采购预检与任务创建返回 `PURCHASE_SPEC_MAPPING_REQUIRED` 和“规格匹配已失效，请重新选择 PDD 规格”，不得把旧标签下发给 Agent。
 
 `batch-delete` 提交 `requestId` 和 `ids`（1～500 个），逐条校验引用后返回每条的 `status`（`deleted` / `skipped`）与 `reason`；引用检查覆盖 SYB 明细（#41）与采购任务（#33/#34），两张表落地前恒不阻塞删除。`restore` 恢复一条已软删除商品，恢复后原有 PDD 关联与规格映射保持不变。列表接口 `status=deleted` 筛选已删除商品，默认只返回存活商品。
@@ -78,9 +83,9 @@ POST /api/admin/v1/syb-products/reparse-batch
 PATCH /api/admin/v1/syb-products/{productId}/correction
 ```
 
-`import` 仅允许管理员调用。请求体提交 `dateFrom`、`dateTo` 后创建持久化后台任务并立即以 `202` 返回 `runId` 和 `status=running`；关闭弹窗、刷新或离开页面不影响任务。没有启用店铺时必须在读取凭据、登录、验证码 OCR 和任意 SYB 网络请求之前返回 `422`。任意时刻只能有一条 `running` 记录，内存锁与数据库唯一执行槽共同阻止单进程和跨进程重复导入；冲突时返回正在执行任务的日期范围。
+`import` 允许已认证的管理员（admin）和采购员（purchaser）调用（#236），仍须通过 Casbin 权限校验；其他角色返回 403。采购员的 POST 权限由既有启动权限对账写入，不需要新增数据库迁移。操作人取已认证 claims，不接受客户端冒名。请求体提交 `dateFrom`、`dateTo` 后创建持久化后台任务并立即以 `202` 返回 `runId` 和 `status=running`；关闭弹窗、刷新或离开页面不影响任务。没有启用店铺时必须在读取凭据、登录、验证码 OCR 和任意 SYB 网络请求之前返回 `422`。任意时刻只能有一条 `running` 记录，内存锁与数据库唯一执行槽共同阻止单进程和跨进程重复导入；冲突时返回正在执行任务的日期范围。
 
-`sync-runs` 列表支持 `page`、`pageSize`、`status`、`dateFrom`、`dateTo`，详情返回日期范围、状态（`running` / `succeeded` / `failed` / `interrupted`）、处理天数、货运单/明细/新增/覆盖数量、店铺准入与跳过数量、店铺筛选快照哈希、按店铺的 `accepted` / `skipped` 统计、操作人和起止时间。列表和详情对已登录角色只读开放。服务启动时遗留的 `running` 任务改为 `interrupted`；中途失败或中断已经写入的数据保留，重新导入仍按唯一键覆盖。
+`sync-runs` 列表支持 `page`、`pageSize`、`status`、`dateFrom`、`dateTo`，详情返回日期范围、状态（`running` / `succeeded` / `partial_success` / `failed` / `interrupted`）、处理天数、货运单/明细/新增/覆盖数量、店铺准入与跳过数量、店铺筛选快照哈希、按店铺的 `accepted` / `skipped` 统计、操作人和起止时间。列表和详情对已登录角色只读开放。服务启动时遗留的 `running` 任务改为 `interrupted`；中途失败或中断已经写入的数据保留，重新导入仍按唯一键覆盖。
 
 列表返回结构化字段（`orderCode`、`shopeeItemId`、`productTitle`、`targetColor`、`targetSize`、`quantity`、`unitPriceCent`、`imageUrl`、`parseStatus`、`parseNote`、`manuallyConfirmed`），不含原始 JSON；`keyword` 匹配订单号、虾皮商品ID 或商品标题，`parseStatus` 筛选 `success`/`uncertain`/`failed`。详情额外返回 `rawJson`（原始 `details[]` 元素，未做任何改写）。
 
@@ -103,6 +108,33 @@ POST   /api/admin/v1/syb-shops/discover
 
 `discover` 提交日期范围，从 SYB 真实货运单列表发现店铺，返回 `shopName` 和 `status`（`new` / `exists`）；发现只读，不自动新增。店铺比较固定执行首尾去空白、全角/半角统一和忽略大小写。同步先完成原始列表完整性校验，再按一次性启用店铺快照过滤；明细响应中的店铺名为空或不在快照内时不得写入。
 
+## 管理端：SYB 商品过滤（#269）
+
+```http
+GET    /api/admin/v1/syb-product-filters
+POST   /api/admin/v1/syb-product-filters
+PATCH  /api/admin/v1/syb-product-filters/{id}/enabled
+DELETE /api/admin/v1/syb-product-filters/{id}
+```
+
+同步时按 `variationSku` 决定明细是否入库。规则分两类，由 `kind` 区分：`char` 是结构判据
+（`-`、`#`），`keyword` 是关键词清单。列表支持 `kind`、`keyword` 和分页，返回 `keyword`、
+`normalizedKeyword`、`enabled`、`lastHitCount`、`lastHitAt`、`note`，`char` 另有
+`lastChangedBy`、`lastChangedAt`。
+
+`[必须]` 服务端必须拒绝对 `kind=char` 行的 `POST` 新增与 `DELETE` 删除，分别返回
+`FORBIDDEN`（`结构过滤不可新增` / `结构过滤不可删除`），不得只依赖前端隐藏按钮。
+`kind=char` 的 `PATCH enabled` 允许，并记录操作人与时间。
+
+`[必须]` `lastHitCount` 是每条规则各自的命中数，由同步结束时回写；未命中的规则写 0，
+从未同步过为 `null`。停用 `kind=char` 的二次确认提示条数必须取该行实时的 `lastHitCount`，
+不得写死——写死的数字在数据变化后会给出错误警告。
+
+关键词归一化与店铺一致：去首尾空白、全角/半角统一、忽略大小写；**不做简繁转换**，SYB 数据
+为繁体。唯一性按 (`kind`, `normalizedKeyword`) 判定，重复添加返回
+`SYB_PRODUCT_FILTER_DUPLICATE`。写操作由 go-admin/Casbin 仅授权管理员，其他角色只读。
+删除为软删除，不清理已经入库的商品明细。
+
 ## 管理端：采集规则
 
 ```http
@@ -408,7 +440,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 
 - `executionMode` 只能是 `rehearsal` 或 `live`，创建后不可修改。
 - 正式 `live` 任务必须引用一条 `syb_product`；无副作用的 `rehearsal` 可以不引用 SYB。
-- 创建时固化 SYB、蝦皮订单号、虾皮商品、PDD 商品、目标规格、映射规格、数量、价格区间、币种、URL、`goods_id`、规则和可选 PDD 账号引用。正式任务的 `shopeeOrderNoSnapshot` 来自创建时的 `syb_product.order_code`；同一订单号可对应多条任务，之后来源商品修改不会改写任务快照。
+- 创建时固化 SYB、蝦皮订单号、虾皮商品、PDD 商品、目标规格、数量、价格区间、币种、URL、`goods_id`、规则和可选 PDD 账号引用。新建 SYB 任务的执行映射初始为空，首趟当次 PDD 规格探测决策成功后才固化 `mappedColor` / `mappedSize`；正式任务的 `shopeeOrderNoSnapshot` 来自创建时的 `syb_product.order_code`，之后来源商品修改不会改写任务快照。
 - Android 无法可靠读取当前 PDD 账号，因此 `pddAccountId` 和 `pddAccountRefSnapshot` 均可空。已知账号时参与账号级串行，未知时不阻止任务。
 - 地址后缀由任务 ID 唯一确定为 `_cg{taskId}`；#34 创建任务时必须在同一事务内回写快照。
 - 一个任务最多对应一个 PDD 订单；重新采购必须新建任务，旧任务和旧订单保留。
@@ -418,7 +450,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 | 状态 | 含义 | 是否占用 SYB 活动槽 |
 |---|---|---|
 | `pending` | 待执行 | 是 |
-| `spec_probe_pending` | 第一趟探测结束，待服务端固化规格并重新派发 | 是 |
+| `spec_probe_pending` | 第一趟探测结束，服务端规格匹配中；当前设备保留同任务连续流程且不得领取其他任务 | 是 |
 | `running` | Agent 执行中 | 是 |
 | `rehearsal_completed` | 演练安全结束，未改地址、未创建订单 | 否 |
 | `order_submit_started` | 不可逆标记已落库，只能核单，禁止再次点击 | 是 |
@@ -475,7 +507,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 |---|---:|---:|---:|---:|
 | `openProduct` | 是 | 是 | 是 | 否 |
 | `verifyProduct` | 是 | 是 | 否 | 否 |
-| `openSpecPanel` | 是 | 是 | 是 | 否 |
+| `openSpecPanel` | 是 | 是 | 兼容读取、不执行（0.9.60+，见 #238） | 否 |
 | `selectSpec` | 是 | 是 | 是 | 否 |
 | `setQuantity` | 是 | 是 | 否 | 否 |
 | `verifyUnitPrice` | 是 | 是 | 否 | 否 |
@@ -489,13 +521,23 @@ POST /api/agent/v1/tasks/{taskId}/fail
 - 文字候选按控件文字或内容描述**精确匹配**；候选合并后必须唯一命中。点击动作只允许点击唯一文字节点或其最近的可点击父容器，不允许模糊匹配、猜测相近候选、改点兄弟节点。
 - 动作 `textAliases` 不能包含地址修改、创建/提交订单、订单号或支付相关文字，防止用安全 action 绕过危险动作类型和能力门禁。只读识别字段使用独立校验：允许订单和支付证据，仍拒绝修改地址、收货地址，并沿用各字段声明的数量、长度、去重和空白限制。
 - `waitAfterMs` 表示动作成功后的等待时间，范围为 0～30000 毫秒；省略时为 0。
-- `swipeAfter` 表示动作成功后执行一个有限滑动计划。`direction` 只能为 `up` / `down` / `left` / `right`，`count` 为 1～10，`durationMs` 为 100～2000，`intervalMs` 为 0～5000 且省略时为 0。
+- `swipeAfter` 通常表示动作成功后执行一个有限滑动计划；Android 0.9.60+ 的 `openSpecPanel` 例外，只兼容读取而不执行预滑动（见 #238）。`direction` 只能为 `up` / `down` / `left` / `right`，`count` 为 1～10，`durationMs` 为 100～2000，`intervalMs` 为 0～5000 且省略时为 0。
 - 未在矩阵中授权的 action/参数组合、未知字段、空候选和越界值一律拒绝。`updateShippingAddress`、`createOrder`、`readOrderResult` 等正式动作在其独立高风险契约完成前不接受上述参数。
 - 旧的仅含 `actions[].type` 的规则继续有效：候选使用 Agent 内置语义，等待为 0，不执行动作后滑动。
 - 服务端保存创建任务时收到的完整原始规则快照；规则后来更新为规则 B，不会改变已有任务中的规则 A 快照。
 
 演练规则必须包含 `purchase.rehearsal.v1`，并且不能包含 `updateShippingAddress`、`createOrder`、`readOrderResult`。正式规则必须包含 `purchase.live.v1`；改地址和创建订单还分别要求 `purchase.address-update.v1`、`purchase.order-create.v1`。`probeSpecs` 要求 `purchase.spec-probe.v1`。任意模式下，尚未实现的 `pay`、名称包含 `payment` 的动作以及未知动作一律拒绝；服务端不下发任意脚本。
 
+### Android 规格动作执行边界（#214）
+
+本工单不改变采购规则 schema、Agent HTTP 字段或能力标识，只收紧 Android 对 `openSpecPanel` 与 `selectSpec` 的执行语义：
+
+- 每次操作从最新 `rootInActiveWindow` 重新定位；规格入口必须是解析器已接受的唯一安全候选，规格值必须逐字等于任务固化的服务端映射值且在当前维度唯一、可用。
+- 动作前先检查后置条件；规格已精确选中时直接成功，不重复点击。否则最多分发一次 `ACTION_CLICK`，再从新快照验证规格面板强证据或精确选中证据。
+- `ACTION_CLICK` 后页面结构完全无变化时，Android 可以重新定位同一唯一目标，并在目标可见、启用、中心点位于屏幕内且边界有效时执行一次中心手势。手势后仍未取得后置证据时明确失败，不继续点击。
+- 点击后页面已变化但面板分类仍为未知时返回 `PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED`；两种点击后页面均无变化时返回 `PURCHASE_SPEC_ENTRY_CLICK_NO_EFFECT`。诊断只携带面板类型、滚动容器数、标题数、选项数及证据布尔值，不携带节点文字或完整控件树。
+- 有界查找规格时只使用当前解析结果中的唯一 `specPanelContainer`；每次滚动前重新定位该容器，优先使用节点滚动动作，失败后才在容器边界内使用手势。缺少唯一容器时停止，不回退到全页面最大滚动区域。
+- 受控中心手势接口固定拒绝地址、保存地址、创建/提交/确认订单、确认购买和支付/付款语义；`updateShippingAddress`、`createOrder`、`readOrderResult` 不使用该兜底。创建订单的一次性不可逆状态机与禁止支付契约不变。
 ### 管理端接口
 
 | 方法 | 路径 | 幂等键 / 说明 |
@@ -504,7 +546,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 | `GET` | `/api/admin/v1/purchase-tasks/{taskId}` | 只读任务详情与 attempt 历史；不返回规则原文、Token、凭据、完整地址、控件树或截图 |
 | `POST` | `/api/admin/v1/purchase-tasks` | `requestId`；单条创建 |
 | `POST` | `/api/admin/v1/purchase-tasks/stock` | 创建备货采购；`requestId`、`executionMode`、`pddProductId`、可选 `deviceId` / `pddAccountId`、`color`、可选 `size`、`quantity`、`minUnitPriceCent`、`maxUnitPriceCent`。服务端使用内置规则并从所选颜色归档派生参考价；相同 `requestId` 幂等返回原任务 |
-| `POST` | `/api/admin/v1/purchase-tasks/batch-preview` | `sybProductIds`（1～100）和可选 `deviceId`；逐条返回采购是否可创建、价格区间、原因和下一步，并独立返回 PDD 采集资格 `collectionEligible` / `collectionDisabledReason` 与规格匹配资格 `aiMatchEligible` / `aiMatchDisabledReason`，不创建任务。只有目标颜色和尺码已保存为确认映射，且共同命中最近一次成功或部分成功采集中的完整可售 SKU 组合时，`eligible` 才为 `true`；只在内存中得到的确定性结果不算采购就绪 |
+| `POST` | `/api/admin/v1/purchase-tasks/batch-preview` | `sybProductIds`（1～100）和可选 `deviceId`；逐条返回采购是否可创建、价格区间、原因和下一步，并独立返回 PDD 采集资格 `collectionEligible` / `collectionDisabledReason` 与长期规格匹配资格 `aiMatchEligible` / `aiMatchDisabledReason`，不创建任务且不调用 AI Provider。自 #215 起，长期映射缺失或失效不再单独使 `eligible=false`；新任务会在首趟当次 PDD 页面探测中决定执行规格 |
 | `POST` | `/api/admin/v1/purchase-tasks/batch-spec-match` | `sybProductIds`（1～100）；仅处理服务端预检 `aiMatchEligible=true` 的明细，其他明细按具体禁用原因返回 `skipped`，并逐条返回 `auto_confirmed` / `pending` / `failed` / `skipped`。资格要求 SYB 采购规格解析成功、蝦皮与 PDD 关联完整、PDD 当前规格可用，且最近一次成功或部分成功采集存在完整可售 SKU 组合证据；未人工确认的 `parse_status=uncertain` 不进入自动确认，`manuallyConfirmed=true` 与 `parse_status=success` 同等视为可信规格。唯一确定性 `exact_match` 不调用 Provider，直接通过独立路径保存为 `confirmed`；其余结果只有 `ai_match` 置信度达到 `autoConfirmMinConfidence`、理由非空、返回值属于当前候选且颜色+尺码命中同一个可售 SKU 组合时才保存为 `confirmed`。低置信度、无效组合和 Provider 异常不改写现有映射 |
 | `POST` | `/api/admin/v1/purchase-tasks/batch` | 批次 `requestId`、`sybProductIds`（1～100）和可选 `deviceId`；每条派生稳定幂等键并独立创建，部分失败不回滚成功项 |
 | `POST` | `/api/admin/v1/purchase-tasks/{taskId}/authorize-repurchase` | 一次性授权；创建新任务后自动消耗 |
@@ -522,17 +564,17 @@ Admin 列表与详情由 #35 实现；#67 增加 `shopeeOrderNoSnapshot` 的列
 
 | 方法 | 路径 | 说明 |
 |---|---|---|
-| `GET` | `/api/agent/v1/purchase-tasks/next` | 返回与设备能力兼容的指定任务或空闲任务 |
+| `GET` | `/api/agent/v1/purchase-tasks/next` | 优先返回当前设备的运行任务；存在 `spec_probe_pending` 时返回同一等待任务以阻止其他任务插队，否则返回能力兼容的指定任务或空闲任务 |
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/claim` | `requestId` 原子领取，并建立设备/可选账号租约 |
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/start` | 创建不可变 `taskAttemptId` |
-| `POST` | `/api/agent/v1/purchase-tasks/{taskId}/order-submit-started` | 创建订单前先落不可逆标记；演练任务永远拒绝 |
+| `POST` | `/api/agent/v1/purchase-tasks/{taskId}/order-submit-started` | 创建订单前先落不可逆标记；演练任务和 `spec_probe` attempt 永远拒绝 |
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/result` | 请求体携带 `taskAttemptId` 和 `requestId`；幂等提交演练、规格探测、订单或失败结果 |
 
-创建阶段需要外部 AI 的任务会先以 `pending` 与持久匹配工作项同事务创建并立即返回 Admin。工作项处于 `pending`、`running`、`retry_wait` 或 `manual_required` 时，`next` 不返回该任务，直接调用 `claim` 或 `start` 也会返回状态冲突。匹配完成后 Agent 仍只接收服务端固化的精确 PDD 原始标签；Android 接口和请求体不新增 AI、候选或人工决策字段。
+自 #215 起，新建 SYB 采购任务不再从 PDD 档案创建持久匹配工作项，也不在首次派发前调用外部 AI；部署前已存在的 `purchase_spec_match_work_item` 继续按原状态兼容处理。新任务首次 `start` 固定得到 `phase=spec_probe`，Android 通过浏览器打开任务链接一次并经既有结果字段回传当次候选；匹配成功后的第二次 `start` 才得到 `phase=purchase` 和服务端固化的精确 PDD 原始标签。连续第二阶段仅在当前 PDD 页面仍有商品页或规格面板强证据时复用首趟页面、不再次打开浏览器链接；手动同任务重试，或当前为 Agent、其他应用及缺少上述强证据时，Android 重新打开任务 `urlSnapshot`。两种路径都不以标题、goodsId 或页面指纹做严格同页校验，仍必须通过 PDD 包名和商品/规格/订单页面结构安全证据。Android 不接收 AI 配置或自由决策权限。
 
-结果提交至少关联 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和结构化结果。相同 attempt 的相同结果重复提交返回同一事实；不同内容拒绝覆盖。慢路径第一趟提交规格后释放设备与已知账号租约，任务进入 `spec_probe_pending`；服务端先使用已确认人工映射，否则对实时/档案可选规格做繁简、空白/全半角/大小写及公斤/斤的唯一确定性匹配，仍无唯一结果才调用 AI。第二趟只会收到服务端已固化的精确 PDD 原始标签；Agent 只在已打开的规格面板内做有限纵向滑动，每次重新读取节点并按完整规范化文字精确点击，连续没有新证据或达到上限即停止。尺码的任务目标与页面值在选择边界使用同一安全尾价规范化；不改写任务快照，规范化为空、仍含货币符号或多个原始候选折叠为同一值时安全失败。
+结果提交至少关联 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和结构化结果。相同 attempt 的相同结果重复提交返回同一事实；不同内容拒绝覆盖。每个新 SYB 采购任务的第一趟只读遍历当次 PDD 规格面板并提交颜色、尺码原始候选，随后释放数据库租约和已知账号运行守卫并进入 `spec_probe_pending`，但服务端调度与 Agent 必须把当前设备保留给同一采购流程：`next` 返回该等待任务，Agent 只轮询等待，不领取其他采购或采集任务。服务端只以任务冻结的 SYB 目标和当次候选先做繁简、空白/全半角/大小写及公斤/斤的唯一确定性匹配，仍无唯一结果才调用 AI。AI 的颜色和尺码必须逐字属于当次对应候选，否则按无匹配失败。第二趟只会收到服务端固化的精确 PDD 原始标签；Agent 复用首趟仍打开的页面，只在已打开的规格面板内做有限纵向滑动，每次重新读取节点并按完整规范化文字精确点击，连续没有新证据或达到上限即停止。尺码的任务目标与页面值在选择边界使用同一安全尾价规范化；不改写任务快照，规范化为空、仍含货币符号或多个原始候选折叠为同一值时安全失败。
 
-任务 payload 新增必传布尔字段 `specResolutionAllowed`，它是 Android 是否可以把一次 `PURCHASE_SPEC_TARGET_NOT_VISIBLE` 转为 `spec_probe_completed` 的唯一资格事实。服务端仅在 `taskType=syb_order`、规则声明 `purchase.spec-probe.v1`、没有固化 `SpecDecisionRequestID` 且规格来源允许既有慢路径时返回 `true`；`stock`、`direct_select`、已固化规格决策、能力缺失及其他组合均返回 `false`。普通就地重试保留 `SpecDecisionRequestID`、目标规格、映射规格和规格决策快照，不能恢复探测资格。Android 不得根据映射是否非空、执行 phase、错误文字或本地判断扩大资格。
+任务 payload 的必传布尔字段 `specResolutionAllowed` 是 Android 是否可以提交规格探测的唯一资格事实。新建 `taskType=syb_order` 任务必须由声明 `purchase.spec-probe.v1` 的规则创建，初始 `SpecDecisionRequestID` 为空且 `specSource=unresolved`，首趟返回 `true`；当次决策固化后返回 `false`。`stock`、`direct_select`、已固化规格决策、能力缺失及其他组合均返回 `false`。普通 Agent 重试使用就地 `/reset`，保留 `SpecDecisionRequestID`、目标规格、映射规格和规格决策快照，不能恢复探测资格；映射不完整时必须拒绝，不能进入正式采购阶段。只有替代商品“继续采购”或 Admin 批量重试创建的新任务才按 #215 重新取得一次探测资格。Android 不得根据映射是否非空、错误文字或本地判断扩大资格。
 
 Android 规格失败使用五个稳定阶段：`PURCHASE_SPEC_TARGET_NOT_VISIBLE`、`PURCHASE_SPEC_TARGET_AMBIGUOUS`、`PURCHASE_SPEC_SAFE_TARGET_MISSING`、`PURCHASE_SPEC_CLICK_FAILED` 和 `PURCHASE_SPEC_SELECTION_UNCONFIRMED`。`PURCHASE_SPEC_CLICK_FAILED` 的 `errorMessage` 只允许稳定子原因 `root_unavailable`、`target_stale`、`no_clickable_ancestor`、`action_click_false` 或 `unknown`；其他阶段的消息不得包含规格原文、坐标、控件树或截图。只有 `PURCHASE_SPEC_TARGET_NOT_VISIBLE && specResolutionAllowed=true` 可以提交规格探测，其他四态直接提交真实失败，服务端原样保留稳定阶段/子原因。旧 Agent 在资格已用尽后再次提交 `spec_probe_completed` 时，服务端以 `PURCHASE_SPEC_REPROBE_REJECTED` fail-closed，释放租约并保留第一次规格决策，不再冒充新的选择根因或再次派发。无匹配、候选不完整、歧义或 Provider 异常同样使任务失败。`order_result_unknown` 只允许管理员或采购员人工解除，永不自动重派。
 
@@ -549,7 +591,17 @@ Android #42/#36 使用本地 SQLite 保存恢复与重传所需的任务、attem
 创建订单前先在本地事务保存 `order_submit_started`、不可逆时间、稳定的 `orderSubmitRequestId` 和脱敏最终确认快照，再调用服务端同名接口；只有两侧标记完成并重新校验商品、规格、数量、单价、地址后缀、PDD 包/Activity 与唯一创建订单按钮后，才点击一次。重启时重放同一标记请求并只读核单；无法取得唯一未付款订单号和 PDD 下单时间时提交 `order_result_unknown`。支付文字仅用于识别未付款/离开支付页，永不点击。服务端数据库仍是最终事实来源；双方均不保存原始控件树、截图、PDD 凭据或完整收货地址。
 
 创建订单后若出现 Android 多微信应用选择器，只读核单器必须同时确认前台包为 `android` / `com.android.intentresolver`、Activity 为白名单 `ChooserActivity` / `ResolverActivity`、页面出现已知系统选择器标题且至少一个候选以“微信”开头，才允许执行一次系统返回；不得点击任何微信候选。若前台已经是精确微信包 `com.tencent.mm`，只读核单器不得点击、输入、登录、支付或强制停止微信，只允许执行一次无参数 PDD 启动 Intent 并等待既有 PDD 任务栈回到前台；`startActivity()` 成功只表示恢复请求已发起。请求后在固定最多 15 次、每次 200ms 的宽限期内允许微信或空窗口短暂残留，不执行点击、返回、输入或滑动；观察到 PDD 后结束宽限，宽限超时、已经观察到 PDD 后再次进入微信或出现稳定未知应用时返回未知结果。随后若前台为 PDD `com.xunmeng.pinduoduo.app_pay.core.PayActivity` 或当前页面出现支付动作文字，最多再返回一次。返回后只读解析唯一订单号和下单时间；选择器或支付页重复出现、白名单不成立、恢复动作重复、无法到达订单详情、结果不唯一或超时均返回未知结果，禁止再次点击创建订单、取消订单或支付。
-`order_result_unknown` 保持订单号和下单时间为空，但允许携带创建订单前已经严格验证的 `actualUnitPriceCent`。Agent 同时提交脱敏稳定失败阶段，服务端只接受白名单并按错误码写入固定提示，不信任或保存页面原文；阶段覆盖空窗口超时、选择器返回失败、微信恢复失败/超时、未知应用、支付页返回失败/重复、订单上下文缺失、订单号缺失/歧义、下单时间缺失/无效和待付款证据缺失。任务与 attempt 保存同一错误阶段，Admin 和 Agent 历史读取数据库最终事实；旧 Agent 未提交阶段时归一为 `PURCHASE_ORDER_RESULT_UNKNOWN`。
+Agent 主动提交 `order_result_unknown` 时保持订单号和下单时间为空，但允许携带创建订单前已经严格验证的 `actualUnitPriceCent`。Agent 同时提交脱敏稳定失败阶段，服务端只接受白名单错误码，并按错误码写入固定提示作为面向人的主文案；不采信 Agent 文本作为权威描述，也不保存原始控件树或截图。阶段覆盖空窗口超时、选择器返回失败、微信恢复失败/超时、未知应用、支付页返回失败/重复、订单上下文缺失、订单号缺失/歧义、下单时间缺失/无效和待付款证据缺失。任务与 attempt 保存同一错误阶段，Admin 和 Agent 历史读取数据库最终事实；旧 Agent 未提交阶段时归一为 `PURCHASE_ORDER_RESULT_UNKNOWN`。
+
+#271 修订：`errorMessage` 的语义由「仅固定提示」改为「**固定提示 + Agent 诊断证据**」。固定提示仍由错误码唯一决定并排在最前，Agent 提交的脱敏诊断追加在其后。
+
+`[必须]` 追加前压平为单行：去除控制字符与零宽不换行空格、连续空白合并为一个空格；按 `error_message` 列宽 1000 截断，且**固定提示优先完整保留**，被截断的证据以 `…` 结尾。证据与固定提示相同时不重复拼接。Agent 文本为空或错误码不在白名单时行为不变，仍返回 `INVALID_REQUEST`。
+
+改动原因：原做法丢弃了 Agent 已经算出并上报的诊断。`#210` 为 `PURCHASE_ORDER_PAYMENT_REPEATED` 计算 `paymentBackAttempts` 与 `consecutivePaymentSamplesAfterBack`，但 2026-09-07 至 09-11 线上 61 次该错误的 `error_message` 无一携带这两个值，导致「返回动作未生效」「页面渲染慢于容忍窗口」「页面已是订单页但关键词未命中」三种情形无法区分。相邻的 `failed` 结果分支本就原样保存 Agent 文本，因此本修订不引入新的信任假设。
+
+`[必须]` `failed` 结果分支同样把错误码与消息写入 attempt，不再只写任务。此前该路径产生的 attempt 行 `error_code` 为 NULL，按 attempt 统计失败时这些记录是隐形的。
+
+#241 追加：全局订单号唯一性校验在人工处理结果未知、取消及 lifecycle 保存路径返回 `PURCHASE_ORDER_NUMBER_ALREADY_USED`（HTTP 409、`retryable=false`），提示“订单号已属于任务 CG-任务ID”；批量回填继续使用原有 `PURCHASE_BACKFILL_ORDER_ALREADY_USED`。不可逆边界后的 `order_created` 结果回传为例外：发现该号已属于其他任务时成功受理结果，将 `order_submit_started` 降级为 `order_result_unknown`，不回滚或自动重派。冲突订单号不写入 `pdd_order_no`，而以“读到订单号 X，但该号已属于任务 CG-yy”保存到任务和 attempt 的 `error_message`，两者 `error_code` 均为 `PURCHASE_ORDER_NUMBER_ALREADY_USED`；保留下单时间、不可逆时间及实际单价。attempt 以 failed 结束并保留原始 `order_created` 结果类型、请求 ID 和摘要，重复提交按原幂等协议返回；任务释放租约和运行槽，进入既有人工处理结果未知通道，权限不变。
 
 | 错误码 | 普通提示 |
 |---|---|
@@ -610,12 +662,12 @@ Content-Type: application/json
 - 响应返回 `taskId`、`attemptNumber`、`status` 和可选的 `replayed`，不返回规则快照、URL、Token、控件树或截图。
 - 设备离线、任务非终态、设备忙、规则不可用或同商品存在活动任务时返回明确冲突，不支持离线排队。
 
-## Agent 受控采购重试（#95、#157）
+## Agent 受控采购重试（#95、#157、#217、#225）
 
-普通失败任务的“重试采购”改为就地重跑：
+替代商品匹配完成后的“继续采购”调用新任务接口；普通失败任务的“重试采购”使用下方同任务重置接口：
 
 ```http
-POST /api/agent/v1/purchase-tasks/{taskId}/reset
+POST /api/agent/v1/purchase-tasks/{taskId}/retry
 Authorization: Bearer <device-token>
 Content-Type: application/json
 
@@ -627,37 +679,35 @@ Content-Type: application/json
 ```json
 {
   "data": {
-    "taskId": 12,
-    "taskNo": "CG-12",
-    "attemptNumber": 2,
-    "status": "pending",
+    "sourceTaskId": 12,
+    "sourceTaskNo": "CG-12",
+    "taskId": 13,
+    "taskNo": "CG-13",
     "replayed": false
   }
 }
 ```
 
-- 原任务必须属于当前 Device Token、在最近 30 天内、状态为 `failed`，且是分配给该设备的正式 SYB 采购任务；跨设备或超期按任务不存在处理。
-- 任务不得存在 `irreversibleAt`、`orderSubmitRequestId`、PDD 订单号或下单时间。已有任何不可逆证据时返回 `PURCHASE_RETRY_UNSAFE`，提示走“授权重新采购”，不得恢复为待执行。
-- 服务端在同一事务锁定任务和设备，确认同一 SYB 商品没有更新任务、设备在线且空闲，然后读取当前服务端采购规则，重新校验 schema、动作安全边界与设备能力。
-- 成功时复用原 `purchase_task.id`，只刷新 `ruleSnapshot`、`ruleType`、`ruleSchemaVersion`、`requiredCapabilities`，清除错误、租约和运行守卫并恢复 `pending`。商品、Target、Mapped、价格保护、数量、地址后缀及其他业务快照逐字段保持不变。
-- 每次受理创建该任务的新 `pending` attempt 并记录规则哈希；Start 复用该 attempt 转为 `running`，不会重复创建执行记录。相同 `requestId` 重放返回相同 attempt 且 `replayed=true`；不同请求可在任务再次失败后继续重试，不限制次数。
-- 采购详情新增 `attemptCount`、可选 `lastFailureCode` 和 `lastFailureMessage`，供 Agent 显示已尝试次数与上次失败原因；不返回规则快照、Token、地址、控件树或截图。
-- Android 仍只在服务端 `retryable=true` 且状态为 `failed` 时显示普通“重试采购”。确认文案必须说明任务号不变、使用最新规则重跑、可能产生待付款订单且系统不会支付。
-- 规则无效、设备离线/忙、能力不匹配、任务状态变化或同一 SYB 商品已有更新任务时，服务端明确拒绝且不得部分修改任务。
+- 来源任务必须属于当前 Device Token、在最近 30 天内、状态为 `failed`，且是分配给该设备的正式 SYB 采购任务；跨设备或超期按任务不存在处理。
+- 来源任务不得存在 `irreversibleAt`、`orderSubmitRequestId`、PDD 订单号或下单时间。已有任何不可逆证据时返回 `PURCHASE_RETRY_UNSAFE`，提示走“授权重新采购”，不得创建新任务。
+- `AgentRetry → BatchRetry → Create` 保留来源失败任务并创建不同 `purchase_task.id` 的新任务；新任务重新读取当前 SYB、虾皮/PDD 档案、当前采购规则、价格保护和设备能力，重新生成地址后缀，不继承来源任务的旧规格决策。
+- 新 SYB 任务按 #215 固定从 `spec_probe` 开始。相同 `requestId` 重放返回同一新任务且 `replayed=true`；不同 requestId 再次请求受同一 SYB 商品最新任务和设备并发门禁约束。
+- 本新任务接口只供替代商品“继续采购”；确认和成功反馈必须说明保留来源任务、按当前替代商品档案创建新任务、可能产生待付款订单且系统不会支付。
+- 规则无效、当前档案或价格不合格、设备离线/忙、能力不匹配、任务状态变化或同一 SYB 商品已有更新任务时，服务端明确拒绝且不得部分创建。
+- Admin 批量重试继续使用相同的新任务语义；替代商品“继续采购”仍在 AgentRetry 前额外验证替换分项与继续采购资格。
 
-既有新建任务接口保留原语义：
+普通失败任务的“重试采购”调用同任务重置接口：
 
 ```http
-POST /api/agent/v1/purchase-tasks/{taskId}/retry
+POST /api/agent/v1/purchase-tasks/{taskId}/reset
 Authorization: Bearer <device-token>
 Content-Type: application/json
 
 {"requestId":"<uuid>"}
 ```
 
-- `/retry` 的 `AgentRetry → BatchRetry → Create` 行为不变：保留来源失败任务并创建新任务，返回 `sourceTaskId`、`sourceTaskNo`、新 `taskId`、新 `taskNo` 和 `replayed`。
-- Android 普通“重试采购”不再调用 `/retry`；只有 #132 替代商品规格匹配完成后的“继续采购”继续调用它。Admin 批量重试行为也不变。
-- “继续采购”会重新解析替代商品、规格映射与价格并生成新地址后缀；这与普通失败任务保持快照的就地重跑不可互换。
+- `/reset` 只允许当前设备的安全失败任务且不得存在不可逆证据或更新任务；它复用原 `purchase_task.id`、新增 attempt、刷新当前有效规则，并保持商品、目标/执行规格、数量、价格、地址和规格决策等业务快照不变。
+- 目标颜色存在但映射颜色为空，或目标尺码存在但映射尺码为空时，必须返回 `PURCHASE_SPEC_MAPPING_REQUIRED`，不得创建 `purchase` attempt 或下发正式采购 payload。相同 `requestId` 重放返回同一 task ID 和 attempt，不重复递增；Android 必须明确提示复用原任务和新的 attempt 序号。
 - 两个入口都不执行支付。真机调用可能创建待付款订单，必须先取得人工授权。
 
 ## Agent 任务记录范围与同步（#99）
@@ -777,6 +827,158 @@ Content-Type: application/json
 - Admin 的 BatchRetry 接口和行为不变。相同 `requestId` 重放返回同一新任务；不同 requestId 再点由最新任务门禁拒绝。
 
 
+## SYB 商品 PDD 图搜采集（#275～#280）
+
+图搜任务**就是采集任务**：同一张 `collection_task` 表、`source = 'image_search'`、同一个
+`/api/agent/v1/tasks/*` 端点。与 `agent_current_page` 的唯一区别是**谁打开那个商品页**——
+后者由采购员手动打开，图搜由 Agent 用 PDD 的拍照搜索找到并打开。打开之后的链路
+（分享链接 → goods_id → 身份回填 → 采集 → 提交结果）完全复用，没有新的采集接口。
+
+### 管理端：批量创建
+
+```http
+POST /api/admin/v1/collection-tasks/image-search/batch
+Content-Type: application/json
+
+{"requestId":"<uuid>","sybProductIds":[1,2,3],"ruleId":3,"deviceId":null,"overwriteLinked":false}
+```
+
+- **按 `shopee_product` 去重**：多条共用同一张参考图的 SYB 明细合并为一个任务。请求最多
+  100 个 `sybProductIds`。
+- **批次上限作用于去重后的任务数**，不是入参明细数，上限 50（约 17～33 分钟设备占用，
+  按单次图搜 20～40 秒估算）。超限整批拒绝，不部分创建。该值是服务端常量，**不可由环境
+  变量覆盖**：确认对话框必须在提交前禁用按钮，前端持有同一个数字，可覆盖只会让两侧静默
+  不一致。改动时两侧必须同改。
+- `deviceId` 可空，为空由具备能力的空闲设备领取。`overwriteLinked` 为 false 时已关联 PDD
+  的蝦皮商品返回 `IMAGE_SEARCH_ALREADY_LINKED` 并跳过。
+- 响应逐条返回 `shopeeProductId` / `sybProductIds` / `taskId` 或 `code` + `message`。
+
+### 设备能力
+
+图搜任务要求设备声明 `pdd.image-search.v1`。不具备该能力的设备在领取阶段跳过图搜任务，
+不会失败。
+
+### 任务下发
+
+`GET /api/agent/v1/tasks/next` 与 `claim` 返回的载荷结构对所有来源一致，图搜任务额外携带
+`imageSearch`：
+
+```json
+{"imageUrl":"https://...","mediaType":"image/jpeg","sizeBytes":81234,"sha256":"<64 位小写 hex>"}
+```
+
+- **只下发这四个字段。** 关联关系、参考价、价格倍数、去重明细等快照留在服务端的
+  `image_search_snapshot`，不下发给 Agent。
+- 服务端不下发图片字节；Agent 自行下载 `imageUrl` 并按 `sizeBytes` 与 `sha256` 校验。
+  参考图上限 10MB。
+- 身份回填前 `pddProductId` 为 `null`，`urlSnapshot` 与 `goodsIdSnapshot` 为空字符串，
+  与 `agent_current_page` 相同。
+
+### 身份回填
+
+图搜复用 `POST /api/agent/v1/current-page-collection-tasks/{taskId}/identify`，该接口已同时
+接受 `agent_current_page` 与 `image_search` 两种来源。
+
+- `[已核对]` 该接口要求任务已绑定 `device_id`。批量创建允许 `deviceId` 为空，但
+  `Claim` 在事务中写入 `device_id = <领取设备>`，因此 Agent 调用 identify 时设备必定已绑定。
+- 回填之后的结果提交、失败上报、reset 重采与 `agent_current_page` 完全一致。
+  **`ruleSnapshot` 结构与普通采集任务同构**，图搜不引入第二种规则形态。
+
+### 结果自动关联与价格兜底
+
+任务完成后服务端尝试建立 shopee↔PDD 关联，条件全部满足才写入：
+
+- 任务 `source = 'image_search'`、状态 `completed`、已回填 `pddProductId`；
+- 目标蝦皮商品 `pdd_product_id IS NULL AND image_search_linked = false`（CAS 谓词：Agent
+  执行期间发生的人工改动胜出，不被覆盖）；
+- 蝦皮商品币种为 CNY。**非 CNY 一律不自动关联**，快照记 `priceGuardSkipped` 与
+  `CROSS_CURRENCY_TWD_PDD_CNY`，留给人工复核；
+- 候选价与 `syb_product.unit_price_cent` 的偏离在 `maxPriceRatio`（1～100 的整数）之内。
+
+自动建立的关联置 `shopee_product.image_search_linked = true`，含义是**「机器找的，没人核过」**。
+采购员在虾皮商品页手动关联（`LinkPDD`）时置回 false。该标记只读地出现在批量采购预览
+（`BatchPreviewItem.imageSearchLinked`）与采购任务列表，**不参与任何采购门禁、资格判定或
+下单条件**。
+
+### 调度：采集 > 图搜
+
+图搜任务在领取队列中垫底，由 `task.Service.Next` 的 `ORDER BY` 实现：
+
+```sql
+-- 共享候选池
+CASE WHEN device_id IS NULL THEN 1 ELSE 0 END,
+CASE WHEN source = 'image_search' THEN 1 ELSE 0 END,
+created_at ASC, id ASC
+```
+
+- `[必须]` 该排序只能落在服务端。图搜任务是同一端点下发的普通采集任务，Agent 调用
+  `next` 时服务端已经选好了行，客户端无从推翻。
+- `[必须]` 来源降级排在 `device_id` **之后**：指派设备是人的显式选择，必须继续优先于来源
+  降级，否则未指派的采集任务会抢在运营明确路由到本机的图搜任务前面。
+- 采购任务不需要此处排序：它们在独立表、独立端点，Agent 已在检查采集之前处理。
+
+### 错误码
+
+管理端（批量创建）：
+
+| 错误码 | 含义 |
+|---|---|
+| `IMAGE_SEARCH_BATCH_TOO_LARGE` | 去重后任务数超过单批上限 |
+| `IMAGE_SEARCH_ALREADY_LINKED` | 蝦皮商品已关联 PDD，逐条跳过 |
+| `IMAGE_SEARCH_TASK_ACTIVE` | 该蝦皮商品已有未结束的图搜任务 |
+| `IMAGE_SEARCH_IMAGE_INVALID` | 参考图下载失败、格式不支持或超过限制 |
+| `IMAGE_SEARCH_INPUT_CHANGED` | 关联、参考图、价格或币种在请求期间变化 |
+| `IMAGE_SEARCH_REQUEST_CONFLICT` | 同一 `requestId` 的参数已变化 |
+| `IMAGE_SEARCH_CONFIG_INVALID` | 价格倍数配置不是 1～100 的整数 |
+| `IMAGE_SEARCH_SNAPSHOT_INVALID` | 任务快照无效 |
+
+Agent 上报（`POST /api/agent/v1/tasks/{taskId}/fail`）：
+
+| 错误码 | 含义 |
+|---|---|
+| `IMAGE_SEARCH_PERMISSION_REQUIRED` | 未授予相册权限 |
+| `IMAGE_SEARCH_ASSET_INVALID` | 参考图下载、校验或写入相册失败 |
+| `IMAGE_SEARCH_ASSET_NOT_LATEST` | 相册中存在更新的图片或视频，无法确认会选中我们准备的图 |
+| `IMAGE_SEARCH_ENTRY_NOT_FOUND` | 找不到唯一可点的拍照搜索入口，或归位失败 |
+| `IMAGE_SEARCH_NO_CANDIDATES` | 结果页没有可用候选（含全部为广告） |
+| `IMAGE_SEARCH_AUTOMATION_UNAVAILABLE` | Agent 版本尚未接入图搜自动化 |
+
+### Agent 执行边界
+
+- 只使用无障碍树，**禁止 OCR / VLM**。
+- 相册权限：Android 13+ `READ_MEDIA_IMAGES`，10～12 `READ_EXTERNAL_STORAGE`
+  （`maxSdkVersion=32`）。这是本功能新增的权限，既有设备升级后需重新授权。
+- 参考图写入设备相册后，Agent 先确认它是相册中**最新的一项（图片与视频一起比较）**，
+  再点击网格第一格；不是最新一项时以 `IMAGE_SEARCH_ASSET_NOT_LATEST` 明确失败，
+  不往后找、不猜测。任务结束（成功或失败）都删除本次写入的图片。
+- 归位状态机可从商品详情、规格弹层、订单确认页、结果页、重试弹窗回到图搜入口，上限
+  50 次动作。**订单确认页只执行返回**；支付与下单文案仅作只读识别信号，任何情况下都不是
+  点击目标。
+- 结果页默认打开第一个候选，跳过带「广告」标记的卡片。
+- 「重新采集」对图搜任务的语义是**重采同一个商品**，不重新搜索；搜错了由采购员在管理端
+  手动改关联（该动作同时清除图搜标记）。
+
+### PDD 界面判据（2026-09-15 真机核对，设备 1080×2354）
+
+常量集中在 `PinduoduoImageSearchCriteria`。以下为核对结论，PDD 版本更新后需要重新 dump：
+
+| 位置 | 判据 | 状态 |
+|---|---|---|
+| 首页入口 | `content-desc='拍照搜索'` 且 **clickable** 的唯一节点，实测 `[941,161][1080,228]` | 命中 |
+| 图搜页 | `我的相册` + `最近搜索` + `历史浏览` + `点击拍照` | 命中 |
+| 选图网格 | `最近项目` 锚点下方 4 列等宽网格，每格 267px，屏宽 1080，容差 ±24 | 命中 |
+| 结果页 | `搜图片同款` 且排序控件 ≥ 3（实测 综合/销量/价格/品牌） | 命中 |
+| 重试弹窗 | `请对准商品或码，保持手机稳定` + `取消` + `再试一次` | **未验证** |
+
+`[必须]` 入口判定必须同时要求 clickable：个人中心 tab 的**根节点**也带
+`content-desc='拍照搜索'`，覆盖全屏且不可点，而 `visibleTexts()` 会把 `contentDescription`
+当文本收集。只按文案匹配会把个人中心判成首页，随后几何兜底会点到该页顶部最靠右的可点
+节点——实测那是「设置」按钮。
+
+已知偏差：取景提示真机为「对准商品/条形码/二维码，自动识别」，历史常量
+`即可进行自动识别` 不命中，靠 `点击拍照` 兜住。相册网格同时包含视频（实测见到带时长的
+格子），这是上面「最新一项须跨图片与视频比较」的由来。
+
 ## 采集颜色图片上传（#133）
 
 结构化采集结果成功提交后，Agent 可为任务已采集的颜色逐张调用：
@@ -849,16 +1051,351 @@ file=<JPEG 二进制>
 
 Agent 只比较整数 `versionCode`。设备有活动任务时禁止检查、下载和安装；下载到应用私有缓存并校验响应大小与 SHA-256，失败立即删除。安装使用 FileProvider 和 Android 系统安装确认页；未知来源权限必须由用户在系统设置授权，不静默安装。
 
-## Admin 蝦皮规格自动匹配批次（#195）
+## 设备身份恢复（#201）
 
-以下接口仅管理员可用，采购员与其他角色必须拒绝；两者不属于 Android Agent 接口，不改变任何 Agent 契约。
+```http
+POST /api/admin/v1/devices/{deviceId}/identity-reset
+POST /api/agent/v1/register
+X-GoAuto-Device-Recovery-Code: <one-time-code>
+```
 
-### `POST /api/admin/v1/shopee-spec-auto-match/runs`
+仅管理员可以对未停用的既有设备发起身份重置。服务端立即使旧 Device Token 无效，并生成 10 分钟内仅能使用一次的恢复码；恢复码只在该管理员操作的响应中返回一次，服务端仅保存不可逆摘要，管理端设备列表、日志、任务接口和 Android 本地持久化均不得保存或返回原文。管理员将恢复码经受控人工渠道输入同一安装实例的 Agent 设置页。
 
-请求：`{ "requestId": "UUID" }`。服务端以 `requestId` 幂等，异步受理默认最多 20 个商品的手动批次，并返回 HTTP 202、`data.run` 运行摘要。若已有活动批次，不再创建第二个批次，返回当前运行并标记 `alreadyRunning=true`；相同请求重放标记 `replayed=true`。
+Agent 携带既有 Token（可已失效）及恢复码重新调用注册接口。服务端必须同时校验同一 `installId`、未停用状态、恢复码摘要、未过期和未使用；成功后使用原 `deviceId` 写入新 Token 摘要并返回一次新 Token，清除恢复码摘要和有效期。旧 Token 与恢复码都立即失效，已分配的 pending 采集或采购任务保持原 `deviceId`，不创建替代设备记录。缺少或错误恢复码仍为 `DEVICE_INSTALL_ID_CONFLICT`；过期码为 `DEVICE_RECOVERY_EXPIRED`；停用设备为 `DEVICE_DISABLED`。
 
-### `GET /api/admin/v1/shopee-spec-auto-match/runs/latest`
+自 #223 起，新建 SYB 任务在保持 `mappedColor` / `mappedSize` 为空和首趟 `spec_probe` 不变的同时，把创建时与目标规格对应的 confirmed 商品映射冻结为仅供服务端决策的指导快照。服务端收到当次候选后按角色验证该快照：只有规范化后唯一对应当次候选时才复用，并固化当次候选原文；否则该角色继续执行确定性匹配，仍未解决才把该角色及其封闭候选交给 AI。已解决角色不得重复发送给 AI，最终颜色和尺码仍须逐字属于各自当次候选。任务决策快照通过 `roleSources` 记录每个角色的 `manual_mapping` / `exact_match` / `ai_match` 来源；任务级 `specSource` 使用现有枚举汇总，不新增 Agent 决策权限。
 
-返回 `data.run`；从未执行时为 `null`。运行摘要包含 `id/requestId/trigger/status/batchLimit/scannedCount/eligibleCount/processedCount/confirmedCount/unmatchedCount/failedCount/startedAt/finishedAt` 和可选脱敏 `errorSummary`，不得返回 API Key、Provider 原始响应或商品原始 JSON。
+## 客户端 API 与管理员密钥管理（#237）
 
-`status` 当前为 `running`、`completed`、`completed_partial` 或 `failed`。页面只轮询最近摘要；查询本身不调用 AI。批次只更新蝦皮商品规格映射，不创建采购任务、订单或付款动作。
+实现基线 `71f7751`；以下接口已通过隔离测试；2026-09-07 本机 MySQL 迁移及管理员通过 HTTP 读取列表、模块目录已验证，真实密钥创建/编辑/停用及业务访问仍未联调，线上尚未部署。Android 接口不变。
+
+### 管理接口
+
+前缀 `/api/admin/v1/client-keys`，要求 Admin JWT 和 admin 角色，默认接受 HTTP/HTTPS，响应 `Cache-Control: no-store`。
+
+| 方法与相对路径 | 输入 | 成功 data |
+|---|---|---|
+| GET 空路径 | page，固定每页 20 | items、total、page、pageSize |
+| GET /modules | 无 | 模块数组：key、title、group、writable、actions |
+| POST 空路径 | name（1～80 字符）、grants | key 元数据与仅本次返回的 secret |
+| PATCH /:keyId/grants | version、grants | 更新后的元数据 |
+| POST /:keyId/disable | version | 停用后的元数据 |
+
+授权示例：`{"module":"pdd_products","write":false,"actions":[]}`；grants 为非空数组。元数据包括 id、name、prefix、enabled、version、grants、createdBy、updatedBy、createdAt、updatedAt、lastUsedAt，不返回摘要或完整密钥。管理请求只接受单个 JSON 对象、拒绝未知字段、最大 64 KiB。成功 code=200；无效输入 422、不存在 404、授权版本冲突或已停用 409。
+
+### 客户端访问与错误语义
+
+- 前缀 `/api/client/v1`，只接受 `Authorization: Bearer <客户端密钥>`，不接受 Cookie 或 URL 凭据，不与 JWT、Device Token 通用。
+- 根据用户 2026-09-07 的明确确认，管理与客户端接口在所有环境默认接受 HTTP/HTTPS，不设置协议开关，也不依赖 X-Forwarded-Proto 或 GOAUTO_TRUST_FORWARDED_PROTO。HTTP 明文传输密钥及业务数据，优先使用 HTTPS；不影响其他接口各自的协议要求。
+- 不再因 HTTP 返回 426；401 为缺失、无效或停用密钥；403 为模块/动作未授权；400 为查询参数携带凭据；503 为认证或审计暂不可用。业务错误沿用各既有接口。
+- 一般请求体最大 16 MiB；响应只支持有限 JSON（32 MiB），递归过滤凭据与原始载荷字段。不支持直接流式/二进制文件接口。响应不可序列化或超限时返回 502；业务可能已执行，必须先核对结果，不要自动重试。
+- 通过密钥认证的请求由服务端生成 `X-Client-Request-Id` 关联审计；它不是业务幂等键，原业务接口要求的 requestId 等字段仍须提供。允许请求必须先落审计意图；完成状态更新失败可留下 status=0。无效密钥没有 key_id 关联审计；拒绝授权的 403 审计为尽力记录。
+- GET `/ai-matching-settings` 只返回 `data.enabled`。POST `/ai-matching-settings/resolve` 接受 targetColor、targetSize、colors、sizes；每组最多 200 项，每个值最多 255 字符，总请求最大 64 KiB；确定性优先，必要时使用当前 Provider，返回 mappedColor、mappedSize、source；不保存映射、不创建任务，无法可靠匹配返回 422 安全提示。
+
+### 明确开放的接口清单
+
+下表路径均相对 `/api/client/v1`；普通业务请求字段沿用本文对应 Admin 业务契约。read=选中模块，write=模块读写，其他值均需 actions 逐项授权。没有列出的 Admin 接口不能用客户端密钥调用；新增 Admin 路由不会自动开放。
+
+| 方法 | 路径 | 模块键 | 能力 |
+|---|---|---|---|
+| POST | `/ai-matching-settings/resolve` | ai_matching | match |
+| GET | `/devices` | devices | read |
+| GET | `/pdd-products` | pdd_products | read |
+| GET | `/pdd-products/:productId` | pdd_products | read |
+| POST | `/pdd-products` | pdd_products | write |
+| PATCH | `/pdd-products/:productId` | pdd_products | write |
+| GET | `/shopee-products` | shopee_products | read |
+| GET | `/shopee-products/:productId` | shopee_products | read |
+| POST | `/shopee-products` | shopee_products | write |
+| PATCH | `/shopee-products/:productId` | shopee_products | write |
+| POST | `/shopee-products/:productId/link-pdd` | shopee_products | write |
+| POST | `/shopee-products/:productId/specs/values` | shopee_products | write |
+| PUT | `/shopee-products/:productId/specs/mapping` | shopee_products | write |
+| DELETE | `/shopee-products/:productId/specs/values` | shopee_products | delete |
+| DELETE | `/shopee-products/:productId/specs/mapping` | shopee_products | delete |
+| POST | `/shopee-products/batch-delete` | shopee_products | delete |
+| POST | `/shopee-products/:productId/specs/mapping/auto-match` | shopee_products | match |
+| POST | `/shopee-products/:productId/specs/mapping/confirm` | shopee_products | match |
+| GET | `/syb-products` | syb_products | read |
+| GET | `/syb-products/:productId` | syb_products | read |
+| PATCH | `/syb-products/:productId/correction` | syb_products | write |
+| POST | `/syb-products/:productId/reparse` | syb_products | reparse |
+| POST | `/syb-products/reparse-batch` | syb_products | reparse |
+| GET | `/syb-products/sync-runs` | syb_sync_runs | read |
+| GET | `/syb-products/sync-runs/:runId` | syb_sync_runs | read |
+| POST | `/syb-products/import` | syb_sync_runs | sync |
+| GET | `/syb-inner-codes` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/:recordId` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/match-jobs/:jobId` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/apply-batches/:batchId` | syb_inner_codes | read |
+| POST | `/syb-inner-codes/rematch` | syb_inner_codes | match |
+| POST | `/syb-inner-codes/import` | syb_inner_codes | import |
+| POST | `/syb-inner-codes/batch-delete` | syb_inner_codes | delete |
+| POST | `/syb-inner-codes/apply-preview` | syb_inner_codes | writeback |
+| POST | `/syb-inner-codes/apply` | syb_inner_codes | writeback |
+| POST | `/syb-inner-codes/:recordId/recheck` | syb_inner_codes | match |
+| GET | `/syb-shops` | syb_shops | read |
+| POST | `/syb-shops` | syb_shops | write |
+| PATCH | `/syb-shops/:shopId/name` | syb_shops | write |
+| PATCH | `/syb-shops/:shopId/enabled` | syb_shops | write |
+| DELETE | `/syb-shops/:shopId` | syb_shops | delete |
+| GET | `/collection-rules` | collection_rules | read |
+| POST | `/collection-rules` | collection_rules | write |
+| PATCH | `/collection-rules/:ruleId` | collection_rules | write |
+| DELETE | `/collection-rules/:ruleId` | collection_rules | delete |
+| GET | `/purchase-rules` | purchase_rules | read |
+| GET | `/purchase-rules/current` | purchase_rules | read |
+| POST | `/purchase-rules` | purchase_rules | write |
+| PATCH | `/purchase-rules/:ruleId` | purchase_rules | write |
+| DELETE | `/purchase-rules/:ruleId` | purchase_rules | delete |
+| PUT | `/purchase-rules/current` | purchase_rules | activate |
+| GET | `/collection-tasks` | collection_tasks | read |
+| GET | `/collection-tasks/:taskId` | collection_tasks | read |
+| POST | `/collection-tasks` | collection_tasks | collect |
+| POST | `/collection-tasks/batch` | collection_tasks | collect |
+| POST | `/collection-tasks/:taskId/reset` | collection_tasks | collect |
+| DELETE | `/collection-tasks/:taskId` | collection_tasks | delete |
+| GET | `/purchase-tasks` | purchase_tasks | read |
+| GET | `/purchase-tasks/:taskId` | purchase_tasks | read |
+| POST | `/purchase-tasks/batch-preview` | purchase_tasks | purchase |
+| POST | `/purchase-tasks` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/batch` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/batch-retry` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/stock` | purchase_tasks | purchase |
+| GET | `/ai-matching-settings` | ai_matching | read |
+
+### openSpecPanel 后置滑动兼容与诊断（#238）
+
+版本边界：Android 0.9.60 / versionCode 73，代码 `58a6c1c`。不修改 JSON schema、能力标识、任务接口或已有快照哈希。`openSpecPanel.swipeAfter` 仍按 direction/count/durationMs/intervalMs 原约束校验；解析成功后不执行该准备性滑动，`waitAfterMs` 保留。其他动作后置滑动沿用旧执行语义。旧 Server 可继续下发原快照；旧 APK 仍按原策略执行，不能将本契约描述当作旧设备已获得兼容。
+
+规格探测与精确选择自行负责按需有界滚动，原始候选、精确点击和选中复核不变。跳过预滑动不作为规格探测成功或订单创建证据。
+
+本地 `GoAutoPurchasePanel` 脱敏结构日志关联 task、attempt、device、rule（规则 SHA-256），不上传原始页面。新增事件：`postSwipe=skipped;action=openSpecPanel;reason=spec_panel_on_demand;panel=<枚举>`；其他必需滑动失败为 `postSwipe=failed;action=<动作枚举>;direction=<方向枚举>;swipeIndex=<本动作内第几次滑动>;reason=<固定分类>`。
+固定失败分类：unknown、root_unavailable、no_scrollable、invalid_bounds、gesture_unsupported、gesture_rejected、gesture_cancelled、gesture_timeout。日志不含规格值、节点文本、坐标、地址、订单、凭据、原始树或截图；结果错误码仍为 RULE_ACTION_FAILED，现有结果提交字段不变。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；代码已实现不代表当前线上已部署。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+## Agent 采购订单批量回填（#241）
+
+本节为 #241 服务端实现契约，2026-09-08 按用户授权直接更新本地镜像；线上 Wiki 与其他长期文档由审核阶段同步。本节不表示已经部署或完成真机验收。
+
+`POST /api/agent/v1/purchase-tasks/order-backfill`
+
+使用 `Authorization: Bearer <Device Token>`，沿用 `RequireAgentHTTPS`、`GOAUTO_ALLOW_INSECURE_AGENT_HTTP` 与既有可信转发协议策略。无需 Admin JWT、claim、start 或 attempt。设备号只从认证读取，请求不得指定 deviceId、地址全文、收件人、手机号或原始控件树；未知 JSON 字段拒绝。此接口只记录已观察到的订单事实，不执行设备动作、创建订单或付款。
+
+请求示例（页面时间先按 Asia/Shanghai 理解，再以带时区 RFC3339/RFC3339Nano 发送）：
+
+```json
+{
+  "requestId": "5826cdda-dcd6-442e-90c3-9b75ba6fb8d8",
+  "items": [
+    {"addressSuffix": "_cg7", "pddOrderNo": "EXAMPLE-ORDER-7", "orderSubmittedAt": "2026-09-08T20:30:00+08:00"},
+    {"addressSuffix": "_cg72", "pddOrderNo": "EXAMPLE-ORDER-72"}
+  ]
+}
+```
+
+- requestId 必须为 UUID；items 为 1～50 条，保持输入顺序；请求体上限沿用 1 MiB。
+- addressSuffix 只接受 `AddressSuffix(id)` 生成的完整字符串。任务号为非零 uint64，拒绝前导零、正负号、空格、尾随文本、多个后缀与溢出；`_cg7` 与 `_cg72` 分别定位任务 7 和 72。
+- pddOrderNo 必填，最多 100 个 Unicode 字符，不接受首尾空白、换行或制表符，不自动裁剪后覆盖旧值。
+- orderSubmittedAt 缺失或 null 时回落任务 irreversible_at；空字符串、无时区文本及非法时间是条目错误，不触发回落。存储统一 UTC。页面值与 irreversible_at 都缺失时该条失败。
+
+有效批次返回 HTTP 200，包括全部条目失败的批次；每条独立事务，失败不撤销其他条目已提交的数据。响应包裹为 `data`，并设 `Cache-Control: no-store`：
+
+```json
+{
+  "data": {
+    "requestId": "5826cdda-dcd6-442e-90c3-9b75ba6fb8d8",
+    "items": [
+      {"index": 0, "taskId": 7, "result": "backfilled", "code": "BACKFILLED", "status": "order_created", "statusVersion": 5, "pddOrderNo": "EXAMPLE-ORDER-7", "orderSubmittedAt": "2026-09-08T12:30:00Z", "timeSource": "page", "retryable": false},
+      {"index": 1, "taskId": 72, "result": "backfilled", "code": "BACKFILLED", "status": "order_created", "statusVersion": 4, "pddOrderNo": "EXAMPLE-ORDER-72", "orderSubmittedAt": "2026-09-08T12:31:00Z", "timeSource": "irreversible_at", "retryable": false}
+    ]
+  }
+}
+```
+
+index 从 0 开始；后缀无法解析时不返回 taskId。result 为 `backfilled`、`already_backfilled`、`conflict` 或 `failed`。已认证设备所属任务可返回提交后的状态、版本、已保存订单号及时间；拒绝条目尽可能返回当前已提交事实。跨设备任务和不存在任务不返回这些业务字段，事务回滚后的内存值绝不作为最终事实返回。
+
+timeSource 说明已保存时间的来源：`page` 为页面值，`irreversible_at` 为估算回落，`existing_unknown` 为原先已创建的历史订单且没有可证明的来源。没有已保存时间时省略 timeSource。客户端必须保留估算标记，不得把回落值或 unknown 宣称为页面真实时间。重复回填不会用新页面时间自动校正旧时间。
+
+| 条目 code | result | 含义 |
+|---|---|---|
+| `BACKFILLED` | backfilled | 本条完成回填 |
+| `ALREADY_BACKFILLED` | already_backfilled | 正式任务已为 order_created 且订单号相同，无写入 |
+| `PURCHASE_BACKFILL_SUFFIX_INVALID` | failed | 非法、非规范、零、溢出或歧义后缀 |
+| `PURCHASE_TASK_NOT_FOUND` | failed | 任务不存在 |
+| `PURCHASE_BACKFILL_DEVICE_MISMATCH` | failed | 未绑定设备或不属于认证设备 |
+| `PURCHASE_STATE_CONFLICT` | failed | 非正式采购，或状态不允许回填 |
+| `PURCHASE_INVALID_REQUEST` | failed | 订单号非法 |
+| `PURCHASE_ORDER_TIME_INVALID` | failed | 提供的页面时间无效 |
+| `PURCHASE_ORDER_TIME_MISSING` | failed | 页面时间与 irreversible_at 均无有效值 |
+| `PURCHASE_BACKFILL_ORDER_CONFLICT` | conflict | 任务已有不同订单号 |
+| `PURCHASE_BACKFILL_BATCH_CONFLICT` | conflict | 同批同任务出现多个不同订单号，该任务所有条目均拒绝 |
+| `PURCHASE_BACKFILL_ORDER_ALREADY_USED` | conflict | 同一订单号已对应其他任务 |
+| `INTERNAL_ERROR` | failed | 数据库失败、死锁等，retryable=true，可安全重放 |
+
+批级 JSON/UUID/数量错误为 HTTP 422 `PURCHASE_INVALID_REQUEST`；鉴权、停用设备和 HTTPS 限制复用既有错误（401 `DEVICE_TOKEN_INVALID`、403 `DEVICE_DISABLED`、426 `HTTPS_REQUIRED`）。批级失败使用既有 `{code,message,retryable}` 包裹，未开始条目写入。
+
+### 状态、幂等与并发
+
+新服务在事务中锁定任务并检查来源状态，仅允许当前设备的 `live + order_result_unknown` 首次写入；`live + order_created` 只在订单号相同时返回已回填。其他状态（包括 running、failed、cancelled 与演练）均拒绝。复用 SetStatus 同步占用字段，同一事务递增 statusVersion、设置 statusChangedAt、清空主任务当前错误及租约；原始 attempt、规则快照、支付与物流、SYB 回写字段不变。
+
+requestId 沿用 UUID 约定，不增加批次表或全局幂等缓存。既有 unknown_resolve_request_id 槽存储 `backfill:<page|irreversible_at>:<由 requestId 和后缀派生的 UUID>`（最多 61 字符），用于任务级关联和保留本功能时间来源。相同任务和订单号即使更换 requestId 也无写入；同 requestId 改内容仍重新执行设备、状态和订单冲突检查，不凭 requestId 直接放行。批内不同任务提交同一订单号时，先成功提交者占用，其余条目返回订单已被使用；已存在的历史重复订单号不自动修复。
+
+订单号尚无唯一索引，本实现不迁移数据库。共享模型保存钩子复用 `purchase_rule_setting.id=1` 行作短事务互斥锁，再以锁定读检查订单号归属，覆盖回填、原人工解除和旧结果提交路径；单例缺失时拒绝写入，数据库死锁时回滚失败事务。原 ResolveUnknown 与 Admin 鉴权代码保持不变。禁止通过跳过模型钩子的直接 SQL 写入宣称具备此保证。
+
+新回填路径禁用包含绑定参数的 SQL 日志，不记录请求正文、订单号、地址或原始树；任务号和认证设备号沿既有任务关联不可变 ruleSnapshot。此接口未新增日志载荷或任务/attempt。
+
+本地测试覆盖事务回滚、并发服务调用和旧写入路径，使用 SQLite；MySQL 8.4 多连接/多进程的实际行锁、生产数据和真机端到端回填尚待环境验收，不以单元测试替代。
+
+
+## 蝦皮详情匹配等待与回读（#254）
+
+实现绑定 `9088e6b`（2026-09-10，分支 fix/254-match-loading）；已通过合成数据测试，尚未合并 main 或发布线上。
+
+本节是 Admin 蝦皮详情接口补充，不修改 Android 请求或采购协议。
+
+- `GET /api/admin/v1/shopee-products/:productId` 的 `data` 增加 `autoMatchTimeoutSeconds` 整数，为后端详情一键匹配整次预算 `2 × AI timeoutSeconds + 10`，配置范围3～600对应16～1210秒。它是非敏感派生预算，沿用商品详情读取权限；不是开放 AI 管理配置读取，响应不包含 Key、Provider、BaseURL 或 Model。现有客户端路由若复用本 Handler 同样仅获得这个数字。
+- `POST /api/admin/v1/shopee-products/:productId/specs/mapping/auto-match` 请求字段、业务权限、版本核对与响应映射语义不变。服务端按收到请求时的 AI 配置确定整次父预算，读取配置耗时扣除；Provider 请求仍受自身超时及父 context 剩余时间中更短者约束。
+- Admin 点击前先GET新详情取得预算，POST timeout=(autoMatchTimeoutSeconds+10)×1000毫秒；缺字段、非整数或超范围时明确拒绝开始匹配，不猜配置。前后端需配套升级。
+- 准备后配置可能变化，浏览器仍可能先超时；不要据超时响应断言事务是否提交。POST失败/断连/超时只执行有限GET回读，不自动重发POST；失败回读显示结果未知。回读结果表示当前已保存状态，不保证这次请求已经永久不再写入，也不保证全部项目都匹配成功。
+- 普通GET默认10秒；本轮未修改建议接口610秒、其他AI功能或后台批量匹配600秒预算。T=60时130/140秒、T=180时370/380秒。
+
+
+## SYB 行内一键关联最近采集（#253）
+
+实现绑定 `b1594dc`，2026-09-10；分支 feat/253-one-click-link，包含 #254 依赖。已完成合成数据测试及构建，未合并 main、未部署，不代表当前线上已具备此能力。
+
+本节仅补充 Admin API；Android 和客户端密钥旧请求不变。
+
+`POST /api/admin/v1/shopee-products/{productId}/link-pdd` 新增与非零 pddProductId 互斥的可选模式：
+
+```json
+{"requestId":"UUID","latestCollection":{"sybProductId":1,"deviceId":2,"specContextVersion":"详情返回的未关联版本"}}
+```
+
+- 校验当前 SYB→Shopee、未关联、规格版本和设备存在/未停用；离线可用。短事务选择最新已结束成功或部分成功的临时采集，排序 finished_at DESC、id DESC；部分成功不跳过回退旧记录。只接受 completed、存在 finishedAt/PDD、PDD active 且存在可选颜色或尺码。
+- 成功返回原 `product`，及 `collectionSource: {taskId, deviceId, pddProductId, requiresSpecConfirmation}`。product.specContextVersion 是此次事务写入后的冻结版本；requiresSpecConfirmation 对应 failed 且没有人工或AI确认，完整资格仍由现有 batch-preview 派生。不得把后续其他人的商品版本当作本次自动匹配上下文。
+- 409 `PDD_LINK_CONFLICT` 表示已有关联；409 `LATEST_COLLECTION_UNAVAILABLE` 表示设备/最近采集/候选不可用；409 `SPEC_CONTEXT_VERSION_STALE` 沿用现有语义。非法参数422。重复请求不会覆盖已有关联，成功响应丢失后重发也会冲突，客户端应回读而非自动重试。last_update_request_id 保留本次请求标识；不承诺额外持久化完整重放响应。
+- `/api/client/v1/.../link-pdd` 带 latestCollection 时返回403 FORBIDDEN，不扩大API Key授权模块；原手动 pddProductId 模式行为不变。
+- Web 先GET详情及 #254 autoMatchTimeoutSeconds，再提交关联；关联响应中的冻结版本交给现有 auto-match。其匹配仍自动保存，无额外“保存修改”写请求。普通请求/回读每次10秒，auto-match 单独使用派生前端预算2T+20秒；业务拒绝直接提示，网络/匹配失败至多一次详情回读，再刷新准备状态，禁止自动POST重试。
+- Server/Web 需配套更新并包含 #254；无需迁移/Android升级。现有人工关联、匹配阈值、规格/采购资格、任务与支付边界不变。
+
+## Admin 一键替换最近采集候选（#258）
+
+实现绑定 `2b01974`；仅补充 Admin，Android/API Key 不变。沿用 `POST /api/admin/v1/shopee-products/{productId}/link-pdd` 和原权限，不新增路由或迁移。
+
+先请求只读预览（仍需 UUID requestId）：
+
+```json
+{"requestId":"UUID","latestCollection":{"sybProductId":1,"deviceId":2,"specContextVersion":"当前详情版本","replacement":{"preview":true,"expectedPddProductId":3}}}
+```
+
+响应 `product` 保持原关联，`collectionSource` 返回 taskId、deviceId、pddProductId、requiresSpecConfirmation，并增加 targetVersion、title、goodsId、previousTitle、previousGoodsId、deviceName。预览没有关联写入。
+
+确认提交沿用同一 SYB/设备/详情版本与原商品ID，replacement 改为：
+
+```json
+{"preview":false,"expectedPddProductId":3,"taskId":4,"targetPddProductId":5,"targetVersion":"预览返回值"}
+```
+
+- 提交按指定 taskId 核对临时采集来源、设备、completed/finishedAt、目标ID、可用规格及 targetVersion；不重新选择最新任务。旧关联、旧/目标规格版本变更返回现有409上下文冲突；阶段不再允许返回409 PDD_LINK_CONFLICT；来源不可用409 LATEST_COLLECTION_UNAVAILABLE；缺字段422。
+- 不同商品条件更新旧关联，返回更新后的 product.specContextVersion；同商品不更新关联及 last_update_request_id，但仍返回用于后续匹配的当前版本。请求不是持久化重放协议；客户端超时只回读、不自动重发。
+- 预览与提交都校验当前允许阶段；采集中拒绝。复用现有人工更换关联的映射语义，后续 auto-match 自动保存及预算沿用 #254。部分匹配/AI故障不回滚已提交关联。
+- 不提供 replacement 时 #253 行为不变；`/api/client/v1` 携带 latestCollection（包括 replacement）仍403，不扩大客户端密钥授权。
+
+## 辅助信息缺失的采集关联（#259）
+
+实现绑定 `e467706`，仅 Server；部署/验收见 #259。替代 #253/#258 中“部分完成一律拒绝”的限制，不改变 completed 原有路径。
+
+- completed_partial 的 missing 必须是非空合法列表且仅包含 salesText、shopName、reviewCount，才进入辅助信息兼容检查；title、规格/价格缺失、遍历截断、SKU数量上限及未知原因仍拒绝。
+- `shopeeproduct/partial_collection.go` 核对本次 task 的维度和值、可售SKU的完整标记/规格引用/非负价格、本次颜色价格，以及当前档案可选值由本次有效SKU覆盖，不能借旧档案合并残留的规格或价格通过。真实单维度允许，不虚构另一维度；本次明确报告缺少规格仍拒绝。
+- 一键关联、替换预览及确认提交共用验证。失败沿用409 LATEST_COLLECTION_UNAVAILABLE及现有提示，不回退更早采集、不换手机。状态 completed_partial 和 missing 原样保留；辅助字段缺失仍可在任务详情查看。
+- 无接口字段、数据库迁移、Android/Web或权限变更；普通人工关联与采购/AI资格不变。不将“允许关联”视为“已匹配或已采购”。
+
+## 采购规格现场一次重新匹配（#263）
+
+2026-09-11 实现绑定 `c6ee6c0`，Server采购与Android Agent；未发布、未安装、未完成真实采购验收。
+
+- 正式采购阶段仅在服务端下发 `specRematchAllowed=true`、Android 返回稳定的 `PURCHASE_SPEC_TARGET_NOT_VISIBLE` 且尚未进入地址/下单阶段时触发；颜色/尺码选中复核失败、售罄、点击失败、歧义、价格、地址和订单错误不触发。
+- Agent 在当前PDD规格面板重新读取候选并提交同一采购任务的 `spec_rematch_completed` 结果；Server复用现有确定性优先/必要时AI匹配，结果必须属于当次候选。匹配成功后同task重新领取正式attempt，Agent沿用当前页面继续正式规格、数量、价格、地址和下单校验，不新建任务、不重新打开浏览器链接；页面证据失效时仍按原安全路径处理。
+- 每个采购任务最多一次；结果attempt和服务端状态原子记录，旧决策指针清除后只允许最新attempt固化新决策。重复请求、无资格、已有不可逆证据或旧attempt覆盖均拒绝；不新增数据库列，依赖现有attempt result_type审计。
+- 新共享字段 `specRematchAllowed` 和结果类型仅供现有Agent采购接口；旧Agent缺省false，旧 `spec_probe_completed` 重复探测拒绝规则不变。未改变设备租约、并发、支付禁止和任务重试语义。
+
+## 人工订单回填的可选实付金额（#306）
+
+实现绑定：8c01329（2026-09-18，feat/306-order-paid-amount，待验收，尚未合并/部署/执行业务库迁移）。本节补充并覆盖 #241 中“相同订单号一律无写入”的金额相关描述；订单号、时间、设备归属和状态校验保持原契约。
+
+POST /api/agent/v1/purchase-tasks/order-backfill 的 items 可增加 pddOrderAmountCent：可空/可省略的 int64，单位人民币分，表示订单详情明确“实付”标签的整单金额。缺失或 null 保留原值；负整数局部忽略，不影响订单号和时间回填。字符串、非整数或 int64 溢出属于 JSON 契约错误，仍按既有解码器返回批级 422；Agent 对识别异常只省略字段，不能发送异常值。
+
+- unknown 首次回填：可同时填充空金额；不会改变支付、物流或 SYB 回写字段。
+- order_created 且订单号相同：原金额为空时可补写，statusVersion 增加一次；订单号、下单时间不变。result/code 仍为 already_backfilled/ALREADY_BACKFILLED。
+- 同值或本次缺失金额：幂等，不增加版本；已有不同金额：保留原金额和正确订单事实，成功结果附 warningCode=PURCHASE_BACKFILL_AMOUNT_CONFLICT、warningMessage。不触发重新采购。
+- 条目响应可增加 pddOrderAmountCent（已提交数据库值）及上述 warning 字段。跨设备/不存在任务仍不返回业务字段。Android 缓存仅采纳服务端确认值，成功 warning 单独保存，不写为任务 errorCode。
+- Admin 采购任务查询/详情提供同名可选字段，详情按 CNY 展示，空值显示“尚未获取”。旧 Agent 省略字段仍可使用新 Server。
+
+Android 仅人工“回填”扫描识别单节点“实付”标签，兼容实付:,金额元,(免运费)及中英文冒号/逗号/空格，金额整数或最多两位小数，以十进制定点转换。不使用裸人民币数字、不跨节点拼金额；缺失、无效、溢出或多个不同金额时只省略金额。同一订单跨视口去重，切换订单清空。并不据此判断已付款。
+
+追加迁移：1789800100000_purchase_order_amount.go，仅扩展 purchase_task 的可空非负 pdd_order_amount_cent；旧行 NULL，不推算单价×数量。先授权迁移并发布新 Server，再升级 Agent；旧 Server 严格拒绝未知字段，不能先装新 Agent 后向旧 Server 发送金额。本单不扩展普通采购 readOrderResult，也不增加 SYB cost 数据流。
+
+## SYB 采购单号回填（#305）
+
+实现绑定 e89de1a（2026-09-18，feat/305-syb-order-writeback），已完成代码及隔离测试；未合并、未部署、未执行业务库迁移或真实 SYB 写入。
+
+- 普通 Agent order_created 结果和人工 order-backfill 首次成功/同单号 already_backfilled 共用事务内 ensureOrderWriteback。仅 live + syb_order + 有效 PDD 单号与 SYB stock/detail 关联时建立唯一 pending 记录（#326 起不限制任务状态）；网络写入由事务外 worker 执行。不改变 Agent 请求/响应字段；金额缺失/冲突不阻止单号入队，不依赖 paymentReviewStatus。
+- POST /api/admin/v1/purchase-tasks/syb-order-writeback：沿用管理员/采购员采购管理权限；body 为 {requestId: UUID, purchaseTaskIds: 正整数数组}，1～100条，不允许重复ID。单条补偿也使用本接口。
+- 返回 HTTP 200、{code:200,data:{items:[{taskId,result,reason?}]}}；result 为 pending/succeeded/skipped/conflict。pending 仅表示受理，不代表远端已写入。无资格或不存在的条目独立 skipped，其他条目继续；数据库事务故障整次命令回滚。服务端校验与冲突错误沿用采购错误信封。
+- requestId 持久幂等：对排序后的 ID 集合取摘要，相同 requestId/集合返回原接受结果，即使后台状态已推进；改变集合返回422。查询当前完成状态应重新GET，不能以重放响应判断最终成功。
+- Admin 列表/详情 task 新增 orderWriteback={status,reason?,completedAt?,canSubmit}。无队列时符合资格显示 not_started，否则 not_applicable；队列状态 pending/running/succeeded/failed/conflict/unknown。仅未发起、failed/unknown 且任务仍有资格、租约已过期时 canSubmit=true；running/pending/succeeded/conflict 不提供重复发起。
+- 回填只写 PDD 订单号；cost 固定0，created为空，绝不传 pddOrderAmountCent 或 actualUnitPriceCent。旧 writebackStatus/支付/物流字段不复用，旧物流 paid 规则不扩展到本接口。
+- 批量勾选取“可采购重试 OR 可单号回填”的并集，两个按钮各自过滤子集；不得把 order_created 任务送入采购重试。冲突只查看，不提供覆盖。unknown 人工补偿仍先回读，成功仅指回读确认相同单号与 pdd 平台。
+
+追加迁移 1789800200000_purchase_order_writeback.go 建立独立记录、命令和单例租约表。先授权迁移及权限对账后再运行新版 Server/Web；本实现基于 #306，发布时同时核验其金额列迁移依赖。历史记录不在迁移时自动入队。
+
+## Chrome 客户端采购订单回填（#316）
+
+`POST /api/client/v1/purchase-tasks/order-backfill`
+
+- 认证：`Authorization: Bearer <客户端密钥>`；模块 `purchase_tasks`，必须显式具有 action `writeback`。模块 read、通用 write 或 purchase action 均不隐含 writeback；不接受 Admin Cookie/JWT、Device Token、URL 凭据或客户端指定 deviceId。
+- 请求和逐项响应沿用本文“Agent 采购订单批量回填”契约，`requestId` 为 UUID、每批 1～50 条。客户端先扫描并按 CG 与订单号双向聚合全部冲突，再分批提交；金额缺失省略，不能发送 0 代替。
+- 客户端入口不要求任务归属某一 Android 设备，但仍复用任务状态、订单号唯一、同批冲突、金额和时间校验。Agent 入口继续要求认证设备归属，两个入口的错误回读范围不得互相扩大。
+- `order_created` 且订单号相同只补空金额和空下单时间；已有金额或时间不覆盖。补入页面时间时保存 `backfill:page:` 来源标记并返回 `timeSource=page`；历史已有时间且无来源仍返回 `existing_unknown`。
+- 扩展必须冻结启动时的 Origin、客户端身份和天数窗口；禁止 content script 接触密钥。网络超时或服务端逐项 `retryable=true` 时使用原稳定批次 UUID 重试，只有通过数量、索引和字段完整性校验的响应才确认批次。
+
+## 下单结果可选应付总额（#325）
+
+实现分支 fix/325-order-result，2026-09-19；未部署、未真机下单验收。POST /api/agent/v1/purchase-tasks/:taskId/result 的 resultType=order_created 新增可省略/可空 int64 字段 pddOrderAmountCent，人民币分，语义为本次待付款页明确“应付”的订单总额。actualUnitPriceCent 仍为商品单价。仅在唯一订单号和下单时间完整时随成功结果发送，金额缺失/冲突/无效/溢出时 Agent 省略金额，不影响订单事实。服务端拒绝负数或其他 resultType 携带非空金额，字符串/小数/溢出按现有严格 JSON 解码失败。
+
+服务端只为已成功确认且无订单号占用冲突的任务补写空 pdd_order_amount_cent；省略、null 或已有非空值均不清空/覆盖。字段纳入现有结果哈希，相同 requestId/attempt/载荷幂等，不同载荷拒绝。不改支付状态，不传金额到 SYB。原列已存在，无追加迁移；新 Agent 上报前须先发布此 Server，旧 Server 不接受新结果字段。
+
+本单不修改 #306 人工订单回填、#316 Chrome 回填、Web“实付价格”显示或历史值：这些路径仍沿用原语义，不能据此宣称全局金额已统一为应付。此节仅定义新增采购结果入口。
+
+## Admin 订单资料补全与字段型 SYB 入队（#326）
+
+实现提交 3a2472d，2026-09-19，feat/326-order-information；隔离测试及构建通过，未合并 main、未发布、未执行真实 SYB 写入。
+
+复用 POST /api/admin/v1/purchase-tasks/:id/resolve-unknown 及其原有管理员/采购员权限：live 的 order_result_unknown 可人工确认订单或取消；live 的 order_created 可补全订单信息，但不能通过此接口改成 cancelled。status=order_created 时沿用 pddOrderNo、orderSubmittedAt，增加可选非负整数分 pddOrderAmountCent，复用原数据库列。订单号非空、无首尾空白/换行且不超过100字符，时间须为有效非零时间；旧客户端省略金额仍接受并保留已有值。新 Admin 补录表单要求金额，0元合法，最多两位小数，转换为整数分后提交。
+
+已保存非空字段只补缺，不覆盖不同单号、时间或金额；订单号唯一归属仍由原模型保护。相同 requestId/已保存内容重放不重复保存，改变处理结果或已保存字段返回原采购冲突错误。前端网络失败保留输入及相同载荷的 requestId；修改载荷使用新 requestId。复用原审计字段 UnknownResolveRequestID，无新增表或持久化状态。
+
+资料完整性由订单号、有效下单时间和非空非负订单金额推导，页面显示“信息完整”或“订单信息待补全”。order_created 仍表示已创建订单，缺金额不转 failed，不代表已付款，不重新采购。
+
+人工确认/补录订单在同一事务中 ensureOrderWriteback；原 Agent order_created 与插件/Agent order-backfill 保持兼容。SYB 回填仅要求 live + syb_order + 非空订单号 + 有效关联 stock/detail；不检查任务状态、时间、金额、支付复核或地址后缀。列表批量读取有效关联，提交与 worker 校验相同目标范围。既有 pending/running/succeeded 不重复入队，conflict 不覆盖，unknown 保留原回读及租约规则。字段补全不恢复已失败队列，失败队列仍通过原“回填 SYB 单号”补偿操作处理。
+
+仅回填单号，cost=0/created为空；金额、时间只存 Admin。旧物流 paid 候选流程不改，Android 与 Chrome 上传定位契约未改；今后停用插件和 Agent 回填须另行实施。本次无需数据库迁移；先发布新 Server 再发布发送金额字段的新 Web。
+
+## Admin 采购列表已回填单号筛选（#327）
+
+实现368f2c2（2026-09-19），feat/327-syb-writeback-filter；测试和构建通过，未合并发布。
+
+GET /api/admin/v1/purchase-tasks 的既有 status 参数新增查询专用值 syb_writeback_succeeded。该值按独立 purchase_order_writeback.status=succeeded 且 purchase_task_id 对应当前采购任务过滤，不查询旧物流 writeback_status，不新增或改写任务状态。原 status 合法值及其他参数行为保持不变。
+
+匹配成功回填的历史任务，不额外要求当前采购状态为 order_created；返回的 task.status 仍为真实采购状态。无单号队列及 pending/running/failed/unknown/conflict 不命中。count及分页共用子查询过滤，可与 taskId、executionMode、taskType、sybProductId、shopeeOrderNo、pddOrderNo 组合；status为空恢复不限制状态。权限与返回信封不变，不写入数据、不触发采购或SYB请求。先发布Server再发布新增筛选值的Web，无数据库迁移或Android变更。

docs/09-delivery-issues.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Delivery-Issues
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Delivery-Issues.-
-wiki_revision: 0eed28dd5dc629ce66071833d5fefbdf24d567d3
-synchronized_at: 2026-08-24T02:35:58Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:09Z
 <!-- gitea-wiki-mirror:end -->
 
 # 当前 MVP 交付工单索引

docs/10-real-device-acceptance.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: OnePlus-Real-Device-Acceptance
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/OnePlus-Real-Device-Acceptance.-
-wiki_revision: 5b74a3b915cda6307cd59087bf9ce295f4c5e806
-synchronized_at: 2026-08-21T08:08:57Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:13Z
 <!-- gitea-wiki-mirror:end -->
 
 # 一加真机验收记录

docs/11-pdd-detail-rule-migration-analysis.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: PDD-Detail-Rule-Migration-Analysis
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/PDD-Detail-Rule-Migration-Analysis.-
-wiki_revision: 1fe9ed083c4fc565a50b4186571233d1dfab58a7
-synchronized_at: 2026-08-17T03:28:38Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:17Z
 <!-- gitea-wiki-mirror:end -->
 
 # PDD 商品详情采集规则迁移分析

docs/12-syb-erp-interface.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: SYB-ERP-Interface-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/SYB-ERP-Interface-Contract.-
-wiki_revision: f596931468caf524cbd9d90b3c299b32a8cf8228
-synchronized_at: 2026-08-28T02:29:07Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:30Z
 <!-- gitea-wiki-mirror:end -->
 
 # 12 顺云宝（SYB）ERP 接口契约
@@ -220,17 +220,19 @@ Admin 默认 `max_matches = 10000`，可以在配置中调整；上限针对整
 有限重试：单次 HTTP 总超时 60 秒，最多执行 3 次，重试前分别等待 1 秒、2 秒，等待须
 响应 context 取消。HTTP 401/403、明确会话失效、业务失败、接口数据完整性错误和本地
 校验失败不得重试；登录、验证码、单件码写入和任何回填请求也不得使用该机制。重试
-耗尽后返回最后一次错误，外层继续保留日期、页码和已获取数量上下文并将同步标为失败。
+耗尽后返回最后一次错误，外层保留日期、页码和已获取数量上下文，按最终已保存成果将同步标为失败或部分成功。
 
-今天的货运单会在同步期间持续新增。只有 UTC+8 下的今天发生上述快照漂移时，
-允许只重试今天的列表分页，最多 3 次；已经完成的历史日期不得重复拉取，每次尝试
-也必须使用独立 ID 集合。第三次仍不稳定时，可以对最后一次取得的合法唯一 ID
-读取完整明细并按既有 upsert 保存，但本次同步仍记为失败、明确提示当天未形成
-稳定快照且不推进游标，下一次继续覆盖今天。任何尝试都不得突破 `max_matches`；
-网络/业务错误、非法 ID 或不完整明细不属于可放宽的快照漂移。
+自 #239（实现提交 c6a962d，已于 2026-09-08 随 d403f3b 部署线上）起，改为按页验证和保存：每页先验证条数、合法 ID、页内/跨页重复，再按冻结店铺快照获取并验证全部明细；外部请求完成后才开启页事务。页内任一入库失败回滚整页，已提交的前页保留，计数在事务提交后累计。
+
+当天和历史日期统一处理：分页/明细失败或最终总数漂移时停止该日期并继续后续日期，不在同次运行中重新扫描当天，以避免重复写入和计数。数据库故障、进度持久化失败、明确会话失效、上下文取消或总任务超时停止整个范围。下一次人工或定时同步重新扫描日期，按 (order_code, detail_id) 幂等覆盖并保留人工确认。跨页重复不去重后冒充完整数据；最终日期完整性校验仍覆盖所有店铺。此流程替代此前 #235 的当天三次整日快照重扫。
+
+重复诊断只记录日期、首次/当前页码和行号、start、pageSize、expectedTotal、已获取唯一数量，不记录真实重复 ID、原始响应或个人数据。
 
 ### 4.4 统一日期范围同步与覆盖游标
 
+GoAuto 同步记录页的立即同步允许管理员和采购员（purchaser）使用（#236），固定覆盖昨天和今天；其他已登录角色仅可查看记录。复用既有同步互斥、日期校验、启用店铺筛选及操作人审计，不授予店铺配置、凭据或定时任务管理权限。权限代码发布并完成启动对账后生效。
+
+
 页面只有一个同步入口，操作员确认工具条上的开始日和结束日后发起。首次打开页面
 固定默认昨天到今天，不因 `last_synced_at` 更早而自动扩大范围；需要补历史缺口时
 由操作员明确选择日期，单次仍不得超过 31 天。
@@ -247,7 +249,7 @@ Admin 默认 `max_matches = 10000`，可以在配置中调整；上限针对整
 或超过 `max_matches` 时不推进游标。
 
 `[必须]` 每批明细响应必须与请求的货运单 ID 一一对应。缺失、重复、出现未请求
-ID，或某张货运单返回空商品明细，都视为不完整并停止同步；已经写入的幂等数据
+ID，或某张货运单返回空商品明细，都视为不完整并停止当前日期，继续后续日期；已经写入的幂等数据
 可以保留，但只有所有日期全部成功才推进游标。
 
 `[必须]` 登录和验证码只是同步前置步骤。日期范围经过自动 OCR 降级、手工
@@ -393,19 +395,32 @@ POST /am/stock/detail/listByStock?hist=0
 
 顺运宝给的是**商品级 ID + 规格原文**，没有規格 ID。
 
-### 6.3 `productSpec` 的格式和蝦皮报表完全一致
+### 6.3 `productSpec` 的角色顺序不是固定的
 
 ```text
 蝦皮目录 `spec_raw`       黑色,M【建議40-50公斤】
 顺运宝 productSpec       白色,L【建議50-60公斤】
-                         黑色+白色【純棉兩件裝】 簡約親膚,L【建議52.5-60公斤】
+                         均碼,黑色
 ```
 
-`[必须]` 规格身份统一复用 `spec.SpecKey()`：只折叠空白，不猜颜色、尺码或建议。
-第三方目录脚本提交 `spec_raw` 和明确的解析结果；顺运宝匹配不到时交给人工确认。
+2026-09-04 的真实数据确认：`productSpec` 至少存在 `颜色,尺码` 与
+`尺码,颜色` 两种顺序，不能再固定把逗号前当颜色、逗号后当尺码。
+
+`[必须]` 先按最后一个 ASCII 逗号拆成两段并剥离 `【...】` 备注。只有两侧
+恰好一侧带有明确尺码信号（如均码、字母尺码或明确尺码单位）时，才把该侧判为
+尺码、另一侧判为颜色。两侧都像尺码时标记存疑；不得使用模糊颜色词库、AI 或
+跨维度候选猜测角色。两侧都没有明确尺码信号时，暂按既有 `颜色,尺码` 契约兼容，
+并继续执行原有复杂分隔符和空值校验。
+
+`[必须]` 修正规格角色时保留原始 `raw_json`，不得覆盖人工确认值。已错误写入
+虾皮档案的导入规格只能在确认无其他 SYB 明细引用且没有规格映射时移除；人工规格、
+映射及历史采购任务保持不变。
+
+`[必须]` 规格身份继续复用 `spec.SpecKey()`：只折叠空白，不改写用于 PDD
+精确点击的原始候选标签。第三方目录脚本提交 `spec_raw` 和明确解析结果；角色或
+规格比对不明确时保持存疑，不得跨颜色/尺码猜测。
 
 ### 6.4 由此推导出的匹配路径
-
 ```text
 productId    ──→ shopee_products.goods_id            商品级，直接相等
 productSpec  ──→ SpecKey() ──→ 稳定规格身份键
@@ -476,9 +491,30 @@ POST /am/stock/detail/updateDetailCode?t=0&id={stockID}&detailId={detailID}&code
 > 以下「店铺准入」已由 GoAuto #49 采纳并实现；店铺规范化还包括全角/半角统一和忽略大小写。
 
 `[必须]` **同步先校验原始全量，再做店铺准入。** 顺序固定为：按日期查询原始总数
-并执行单次容量熔断 → 拉完当天原始列表并核对分页前后总数、页长和唯一 ID → 按
+并执行单次容量熔断 → 逐页核对页长和唯一 ID，整日结束复核总数 → 按
 `shopName` 去除首尾空白后与启用店铺精确匹配 → 只为接受的货运单请求明细和入库。
-不能先过滤再做完整性校验，否则非目标店铺的分页漂移会被掩盖。
+店铺过滤只决定明细获取和入库，不能减少原始列表完整性校验范围；已保存不代表整日完整。
+
+`[必须]` **店铺准入之后再按 `variationSku` 过滤商品（#269）。** 顺序固定为：店铺准入 →
+结构过滤 → 关键词过滤 → 入库。两类规则都存在 `syb_product_filter`，由 `kind` 区分：
+
+- `kind=char`：`-` 和 `#` 两条，命中任意一条即跳过（**OR，不是 AND**）。这两个字符是
+  「档口-供应商#货号」编码格式的判据。2026-09-11 核验线上 13010 行明细：含 `#` 8498 行、
+  含 `-` 6392 行、两者都含 6386 行、任一 8504 行（65%）。用 AND 只命中 6386 行，会漏掉
+  `DD#004`、`300斤牛奶絲圓領#A057` 这类只含 `#` 的 2118 行。
+- `kind=keyword`：关键词清单，匹配 `variationSku`，**不匹配 `productTitle`**。同一次核验
+  中六条初始关键词在 `productTitle` 上命中为 0，且全部已被结构过滤覆盖，净增为 0；保留它
+  是为档口改用不含 `#` 的编码时兜底。
+
+`[必须]` 空 `variationSku` **不过滤**。核验时 2724 行（21%）为空，分布在正常启用店铺且持续
+产生，属于尚未填写供应商编码的正常商品，不是档口货。
+
+`[必须]` 两类命中数分别统计并分别回写到每条规则自己的 `last_hit_count`，不得合并成单一
+「过滤总数」，也不得按 `kind` 写同一个汇总值。前者会使结构判据失效不可观测（关键词净增为 0
+时无法区分「没漏网」和「规则没生效」）；后者会让停用确认对 `#` 和 `-` 提示同一个数字。
+
+`[必须]` `kind=char` 不可新增、不可删除，只能停用，且停用需要二次确认并记录操作人与时间。
+判据本身需要变更（例如档口改用 `/` 或 `@`）属于范围变化，应另建工单评估。
 
 `[必须]` 同步开始时只读取一次启用店铺，整次运行使用同一个快照。列表允许但明细
 响应中的 `shopName` 变为空或非允许店铺时再次拦截。没有启用店铺时在会话/OCR/
@@ -633,3 +669,25 @@ settings:
 - 客户端实现：`server/app/goauto/sybclient/`
 - 落库与解析：`server/app/goauto/sybimport/`
 - 相关工单：[#48 客户端移植](https://git.ilapage.cn/OPC/goauto/issues/48)、[#41 SYB 货运单商品导入](https://git.ilapage.cn/OPC/goauto/issues/41)、[#37 物流调度与货运宝回填](https://git.ilapage.cn/OPC/goauto/issues/37)
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；2026-09-08 已随 d403f3b 部署线上，未手动触发真实同步验收；#240 上游尾页超时尚未修复。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+## PDD 采购单号写入（#305）
+
+实现绑定 e89de1a（2026-09-18，未部署）。协议依据用户本地 update_syb_pdd_order_number.har 单次样本；HAR/真实标识/Cookie不进入源码、Wiki或工单。本节不宣称远端幂等或原子比较写入。
+
+POST /am/stock/detail/updateDetailPurchaseCode，无JSON body；query：id=<stock.id>、detailId=<details[].id>、code=<PDD单号>、type=pdd、created=""、cost=0。ID必须为正整数，单号非空、无首尾空白/控制换行、最多100字符。cost是抓包确认的固定参数，不是实际金额；不得传Agent实付价格。
+
+样本成功信封 HTTP200、status=true；随后 listByStock?hist=0 对应明细 purchaseCode 等于提交单号、purchasePlatform=pdd、purchaseStatus=1，purchaseTime由SYB生成。更新存在采购状态/时间副作用。
+
+客户端每次处理最多一次写请求，并拒绝HTTP重定向重发；超时/连接中断/5xx/损坏响应作为结果未知。无论写响应成功或未知，都须按 stockId + detailId 唯一回读目标；相同单号+pdd才确认为成功，不同已有单号或其他非空平台记冲突且不覆盖。写前为空才写；目标缺失/重复/字段类型异常不得猜测选择。未知且未回读确认时持久化unknown，人工补偿前再次回读，不使用自动写重试。
+
+GoAuto自身通过持久租约串行，但SYB没有CAS证据，无法原子隔离系统外客户端；不能保证任意迟到请求已终止。真实接口写入需另行明确授权；当前验证仅fake/httptest。

docs/13-deployment-and-operations.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-and-Operations
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-and-Operations.-
-wiki_revision: 929a9496d2e4aa25769351e08075dce6bd993b2d
-synchronized_at: 2026-09-02T09:40:46Z
+wiki_revision: cc642ebfa65f429100779e40560a59174ab877a0
+synchronized_at: 2026-09-22T02:56:36Z
 <!-- gitea-wiki-mirror:end -->
 
 # 部署与运维
@@ -41,7 +41,7 @@ GOAUTO_ALLOW_INSECURE_AGENT_HTTP=true
 
 ### API 长请求超时约束
 
-Admin 蝦皮规格 AI 匹配会同步等待外部 Provider：Provider 配置允许 3～600 秒，复合的一键匹配共享 600 秒总预算，Admin 客户端等待 610 秒。因此服务端 `settings.application.writetimeout` 必须至少为 620 秒，受版本管理的标准配置固定为 `620`；启动时低于该值必须明确失败，禁止以 2 秒等短写超时运行，否则连接会在领域错误返回前被截断并表现为代理 502。反向代理的读/发送超时也必须大于服务端窗口。
+Admin 蝦皮规格 AI 匹配会同步等待外部 Provider：Provider 配置允许 3～600 秒，旧版详情复合一键匹配共享600秒总预算，旧Admin客户端等待610秒；#254未部署前仍适用，部署后详情入口改用下节动态预算。因此服务端 `settings.application.writetimeout` 必须至少为 620 秒，受版本管理的标准配置固定为 `620`；启动时低于该值必须明确失败，禁止以 2 秒等短写超时运行，否则连接会在领域错误返回前被截断并表现为代理 502。反向代理的读/发送超时也必须大于服务端窗口。
 
 Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、上游 HTTP 状态码或网络错误分类；不得记录 API Key、Authorization、Provider URL、模型输入、候选规格、商品原始内容或响应正文。Provider 失败时接口返回 HTTP 503 与 `AI_MATCHING_UNAVAILABLE`，供 Admin 显示安全中文提示。
 
@@ -56,3 +56,100 @@ Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、
 - 定时和手动触发共享数据库唯一活动槽。看到“已有自动匹配正在运行”属于正常互斥结果；运行租约超过 30 分钟会在下次触发时安全释放并把旧运行标记失败。处理每个商品前会续租。
 - Provider 临时失败的商品至少 60 分钟后重试，最多 3 次；低置信度或无结果在输入指纹不变时不会重复调用。排错优先查看 `shopee_spec_auto_match_run` 的结构化计数与脱敏错误，以及 `shopee_spec_auto_match_work_item` 的状态、尝试次数、下次尝试时间和租约；不得输出或复制 API Key、Provider 原始响应、商品原始 JSON 或个人数据。
 - 紧急回退只需关闭系统任务并停止使用 Admin 手动入口；保留运行记录和既有已确认映射用于审计，不删除数据，也不回滚 #194。
+
+## SYB 异常规格 AI 定时任务（#198）
+
+- 追加迁移 `1788354164329_syb_spec_ai_parse.go` 创建 AI 确认字段、`syb_spec_ai_parse_run`、`syb_spec_ai_parse_work_item`，并幂等写入 `sys_job.invoke_target=GoAutoSYBSpecAIParse`。
+- 系统任务默认关闭，默认 Cron 为每小时第 5 分钟、参数 `{"batchLimit":20}`；迁移重跑不得覆盖管理员后续修改的 Cron、参数或启停状态。建议先运行该任务，再由默认第 15 分钟的 #195 完成蝦皮到 PDD 的规格匹配。
+- 多实例通过可空唯一活动槽和租约保证全局单批运行；逐行工作项按输入指纹去重。Provider 临时失败至少 60 分钟后重试且最多 3 次，低置信度/无结果在输入不变时不重复调用。
+- 上线顺序为：备份数据库、执行追加迁移、发布服务并保持任务关闭、核验表/字段/任务种子，再由管理员决定是否启用。排错只查看运行计数、工作状态和脱敏错误，不输出 API Key、Provider 原始响应、完整 RawJSON 或订单数据。
+
+## 定时任务执行历史运维（#199）
+
+- 发布 #199 时先备份数据库，再执行追加迁移 `1788357000000_sys_job_execution_log.go`，随后发布服务与 Web。迁移创建 `sys_job_execution_log`、登记 `GET /api/v1/sysjob/:id/execution-logs`，并只为原本绑定隐藏菜单 `JobLog` 的角色写入精确读取权限；菜单缺失时迁移明确失败，不扩大角色授权。
+- 服务启动会将上次进程遗留的 `running` 执行记录标记为 `interrupted`。该恢复依赖当前线上每个数据库只运行一个调度器实例；扩展为多调度器前必须另建工单引入实例租约，不能直接复用此判断。
+- 排错从 Admin 定时任务页单选任务后进入“日志”，按状态和开始时间查询。记录只含稳定错误码和脱敏摘要；需要定位细节时查看受控服务日志，不得把任务参数、Provider 配置/响应、密钥或业务原始数据复制进执行历史。
+- 当前没有执行历史删除接口和自动保留策略；删除定时任务不删除历史。数据库容量治理需要另建工单评估。#198 的 `GoAutoSYBSpecAIParse` 在 #199 发布和迁移后仍保持关闭，启用必须由管理员另行确认。
+
+## 客户端密钥部署与验证（#237）
+
+实现基线 `71f7751`；2026-09-07 已按用户授权完成本机 MySQL 迁移、管理员菜单写入和 Server/Web 构建重启；管理页面 HTTP 列表与模块加载已验证。2026-09-08 经用户授权，线上已发布 Server/Web 基线 `d403f3b`，执行迁移 `1788798000000` 并重启 GoAuto/Nginx；迁移记录、两张密钥表、仅管理员菜单关联已回读。HTTP 页面与健康检查通过；未登录管理请求 HTTP 200、业务码 401。真实密钥创建及客户端业务读写闭环尚未验证。
+
+- 发布前须单独授权追加迁移 `server/cmd/migrate/migration/version-local/1788798000000_client_api_key.go`，按既有迁移流程创建 client_api_key、client_api_key_audit 和“采采管理/客户端密钥”管理员菜单。前置父菜单必须存在；不应以赋予普通用户管理员角色代替迁移或权限核验。
+- 用户于 2026-09-07 明确确认默认兼容 HTTP/HTTPS、不设开关并接受明文风险；部署本版本并执行迁移后，现有 `http://185.216.248.75:9527` 可以使用客户端密钥管理及客户端 API。2026-09-08 线上部署及未登录拒绝检查已通过，真实密钥读写验收仍待进行。HTTP 会明文传输密钥和业务数据，仍建议使用 HTTPS。
+- 客户端密钥功能不依赖 GOAUTO_TRUST_FORWARDED_PROTO、X-Forwarded-Proto 或 Agent HTTP 例外。既有其他路由的协议和代理配置保持不变；不伪造协议头，不新增明文放行开关。
+- 代理、APM、应用日志均不得记录 Authorization、创建响应 secret 或原始业务载荷。应用对两类客户端密钥路由跳过旧请求/响应正文日志，使用专用元数据审计；实际代理日志脱敏仍须部署验收。
+- 请求审计 status=0 可能表示在途、进程中断或结果审计更新失败；先按请求关联号核对业务结果，不自动重试采购、采集、同步等操作。停用阻止后续认证，不保证取消已开始的业务操作。
+- 隔离验证：Server `go test ./app/goauto/clientkey ./app/goauto/clientapi ./cmd/migrate/migration/version-local`；Web `pnpm exec jest tests/unit/client-keys.spec.js --runInBand` 与 `pnpm run build:prod`。浏览器模拟入口 `/tests/fixtures/client-keys.html` 仅由本地 Vite 开发服务承载，使用内存模拟请求和无效示例密钥，不连接真实数据库，不证明线上鉴权已验收。
+- 真实部署验收须另行验证实际 HTTP/HTTPS 入口、管理员创建/编辑/停用、普通用户拒绝、读写/独立动作隔离、停用后的后续请求拒绝及日志无密钥；任何真实业务执行继续按独立授权范围进行。
+
+
+## Windows 本机运行目录与 #237 迁移验证（2026-09-07）
+
+- Supervisor 实际配置 `D:/supervisor/programs/goauto.conf`；程序仅 `goauto-admin-api` 和 `goauto-admin-ui`。从已有干净工作区 `D:/OPC/goauto-worktrees/main-runtime` 的 main 分支运行；源码运行基线 `ac3c63e`，版本化启动模板更新提交 `9a10d82`。
+- 原目录 `D:/OPC/goauto` 的用户改动保持原样；本机敏感配置继续读取 `D:/OPC/goauto/config.yaml`，不复制凭据到运行工作区或版本库。数据库 `127.0.0.1:3307/goauto`，API `http://127.0.0.1:8010`，Web `http://127.0.0.1:9527`。
+- API 命令：`pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml" -SkipMigration`；Web 同目录 `scripts/start-web.ps1` 与相同 ConfigPath。已验证无需 ExecutionPolicy Bypass。
+- 真实迁移必须单独授权并先确认唯一待执行版本；常驻 API 加 `-SkipMigration`，日常重启不自动执行未来待审核迁移。#237 迁移 `1788798000000_client_api_key.go` 已执行，sys_migration 记录 `1788798000000`、两张密钥表及管理员菜单已回读；其他角色未新增菜单关联。任务启停状态未改。
+- 范围明确的服务控制：`D:/supervisor/supervisord.exe -c D:/supervisor/supervisord.conf ctl status goauto-admin-api goauto-admin-ui`，启动/停止/重启将 status 分别替换为 start/stop/restart。不得为了 GoAuto 重启整个 Supervisor 或其他项目。配置内容变化后需重新读取配置；本次调用 `supervisor.reloadConfig`，再对上述两个程序定向 start，已通过进程命令行核对新目录。
+- 日志：`D:/supervisor/logs/goauto-admin-api.log`、`D:/supervisor/logs/goauto-admin-ui.log`；对外分享只能保留脱敏结构摘要。迁移输出不得暴露凭据或业务原文。
+- 管理员刷新页面后可进入 `http://127.0.0.1:9527/#/client-keys/index`；菜单缓存未更新时重新登录。已验证列表空态、创建弹窗加载 12 模块及 HTTP 风险提示；未实际创建密钥，真实客户端读写及停用闭环仍待范围明确的验证。本节为 2026-09-07 本机验证记录；线上已于 2026-09-08 另行授权发布，见上节。
+
+
+## 蝦皮详情匹配等待与回读（#254）
+
+实现绑定 `9088e6b`（2026-09-10，分支 fix/254-match-loading）；已通过合成数据测试，尚未合并 main 或发布线上。
+
+- 本次只完成代码构建与合成测试，未改线上配置、AI设置、常驻服务或Nginx；部署与重启需另行授权。
+- 详情匹配新窗口是后端 2T+10 秒、Web POST 2T+20 秒。当前默认API最低写超时校验仍为620秒，这是历史最低值，不保证容纳所有动态预算；发布前读取实际 AI timeoutSeconds、application.writetimeout 和生效代理配置核对。
+- 建议API写超时至少为 2T+30 秒，且仍满足原最低620秒；代理读/发送超时需留足对应窗口。T=60/180时原620秒足够容纳应用预算；T=600时至少需要1230秒API写超时及适当更长的代理窗口。不得仅设置较大的AI超时却忽略传输层更早截断。
+- 上述是发布核对要求，不是本单已修改/验证线上代理的结论。超大T带来长连接占用，不能用关闭超时来代替正确预算。新增失败回读不代表必须延长任何线上请求。
+- 必须配套发布 Server/Web；仅上新版Web连接旧Server时，因缺失派生预算会提示等待时间不可用并停止匹配。原Android不需升级。
+
+## 本地 Supervisor 与局域网访问
+
+本机开发/联调环境由 `D:\supervisor\programs\goauto.conf` 分别启动 GoAuto API 与 Admin Web；实例配置只负责调用项目脚本，端口读取 `D:\OPC\goauto\config.yaml`。
+
+- API 由 `scripts/start-server.ps1` 启动并监听所有网卡的 `ports.server`。
+- Admin Web 由 `scripts/start-web.ps1` 启动，监听 `0.0.0.0` 的 `ports.web`，因此同一局域网设备可通过 `http://<本机局域网IP>:<web端口>/` 访问。
+- 浏览器使用同源相对 API；Vite 将 `/api` 与 `/static` 代理到本机 `127.0.0.1:<server端口>`，避免局域网客户端错误访问自身的 `127.0.0.1`。
+- 修改脚本或配置后，只需重启 Supervisor 的 `goauto-admin-ui`；API 未变化时无需重启 `goauto-admin-api`。若局域网仍无法连接，检查 Windows 防火墙是否允许 `ports.web` 的 TCP 入站。
+
+## SYB 订单号回填 worker 部署与排错（#305）
+
+代码绑定 e89de1a（2026-09-18），基于 #306 的07a3817；本节是部署要求，不表示已发布或业务库已迁移。
+
+1. 另行取得明确目标环境的数据库迁移、权限对账和发布授权。核对 #306 的1789800100000金额列前置；本单追加1789800200000_purchase_order_writeback.go，建立purchase_order_writeback、purchase_order_writeback_command、purchase_order_writeback_lease三表和单例行，不改任务/付款事实，不排入历史回填、不修改定时任务开关。
+2. 配套构建并发布Server/Web，沿用现有启动权限对账为管理员/采购员登记POST /api/admin/v1/purchase-tasks/syb-order-writeback。不新增角色、菜单或支付门槛。旧常驻实例使用SkipMigration时，仅重启并不能替代授权迁移。
+3. API启动后每数据库恢复一个3秒轮询的持久队列worker，独立于Admin定时任务列表；只处理已排入pending及租约过期running。正式采购结果、人工订单回填成功/同号回放会排队；历史补偿仅用户勾选发起。部署重启后已有pending会执行真实SYB写入，必须包含在发布授权范围内。
+4. 全局租约2分钟；会话恢复预算25秒，每次外部读/写20秒（只读客户端重试亦受该context限制），写前再次核验租约。崩溃恢复只回读，不盲目重写；unknown不自动重试，等租约到期再人工核对/补偿。同目标其他未确认写入先解决，不能删除记录规避保护。
+5. 排错先看采购管理的“SYB 单号回填”状态、脱敏原因、完成时间；需要结构诊断时查询记录的taskId/status/attempt_count/error_code/lease_expires_at，不输出单号、Cookie或完整原始响应。SYB会话失败应先恢复既有登录，再勾选失败任务补偿；按钮受理不等于SYB成功。conflict只核对，不强制覆盖。
+6. 不执行真实支付；实付金额只存Admin，SYB请求cost固定0。停止新版API可停止新轮询，但不保证已发送远端请求取消；回滚保留追加表和未知状态，不删除记录、不回退采购事实。迁移/多实例MySQL/真实SYB端到端仍需授权验收。
+
+### #305/#306 线上发布验证（2026-09-18）
+
+用户授权合并main、迁移并发布线上；main已快进至7e257ca（包含#306及#305），Server/Web从该提交重新构建。此前线上RELEASE记录60c7526；新发布目录为/home/goauto/releases/20260918-7e257ca-305，current已原子切换，goauto.service重启、Nginx校验及reload成功。先前各节“未部署”是对应提交阶段记录，本节为后续发布事实。
+
+- 迁移前51个版本已应用，唯一缺失为1789800100000和1789800200000；服务器内受限备份/home/goauto/backups/20260918-305/database.sql（目录0700、文件0600），不下载生产数据。执行后53版本齐全，purchase_task.pdd_order_amount_cent为nullable BIGINT，独立三表和单例租约行已建立，历史回填队列0条。
+- 启动对账已登记新POST接口及purchaser权限，管理员沿用原授权；已登录采购列表返回orderWriteback，空批次请求返回422且不入队。未执行真实订单回填或付款，不将空队列健康验证宣称为SYB端到端验收。
+- 保持sys_job原启停值不变（任务1/2为1，3/4/5为2），没有更改Cron或主动触发同步。发布前采集/采购运行数均0。
+- 原20260916目录的static/var与20260914目录互相循环，不能继续通过旧current间接链接。新release分别直接引用已确认真实存在的/home/goauto/releases/20260907-29ba16e-236/static和/home/goauto/releases/20260903-2d6d244-r1/var；不删除或改写历史资源，不修改其他站点Nginx配置。后续清理旧release前必须检查这些被引用的数据目录。
+- 公网入口http://185.216.248.75:9527首页和10项JS/CSS资源HTTP200，/api/v1/health HTTP200；未认证采购接口业务码401。二进制SHA256=4833d779843f0613455ea2b56cadff6efd88d2b96c13e00cb4423cac02e72cb7；发布后结构日志检查无panic/fatal/1146/1054。
+- 回滚代码目标保留/home/goauto/releases/20260916-03647dd，追加数据库表/列保留；该旧目录原有static/var循环是已知问题，回退不能宣称资源链自动恢复。不要删除新队列记录或恢复旧数据覆盖后续业务；停止服务亦不保证已发送远端请求取消。
+
+## Chrome 订单回填扩展交付与运行（#316）
+
+- 扩展以 `chrome-extension/manifest.json` 为入口，不随 Server 自动部署。解压安装、授予 Admin Origin、创建或修改客户端密钥授权、真实 PDD 遍历及订单回填都必须按目标环境另行授权；发布 Server 不等于安装或启用扩展。
+- 管理员为密钥显式勾选“采购管理 → 回填（writeback）”。建议 HTTPS；若使用项目既有客户端密钥 HTTP 例外，密钥和订单事实会明文传输，风险边界不扩大到 Cookie、JWT 或 Device Token。
+- popup 关闭不停止运行；重新打开可查看持久状态。设置在运行时只读。停止会保留已确认批次并阻止后续请求；重启或超时仅以原批次 UUID 重放未确认批次。
+- 排错只查看阶段、已读、可提交、已写入、冲突、未完整扫描原因、脱敏错误码和批次状态；不得记录客户端密钥、地址全文、订单号、Cookie、原始 HTML 或真实订单载荷。没有明确列表末尾证据时只能报告未完整扫描。
+
+## 采购手机准备清单（#331）
+
+采购员配置或更换采购用 Android 手机时逐项确认：
+1. 拼多多 App 已登录；
+2. 微信已登录；
+3. 拼多多已设置默认收货地址；
+4. 拼多多默认支付方式为微信支付；
+5. GoAuto Agent 已启动，无障碍服务已开启，Admin 设备列表显示在线并已归属对应采购员账号。
+
+任一项不满足时采购会明确失败并提示缺失项（如“未找到支付入口：请确认 PDD 默认支付方式为微信支付”）；Agent 不代为登录、切换支付方式或填写地址。安装新版 Agent 后需手动启动一次 App，心跳恢复后设备才显示在线。

docs/README.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Home
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Home
-wiki_revision: d5a46210da9dffa27247d80b20ab31b40790e48a
-synchronized_at: 2026-08-31T16:06:14Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:14:18Z
 <!-- gitea-wiki-mirror:end -->
 
 # GoAuto 文档中心

docs/evidence/pdd-home-35727-summary.md

@@ -0,0 +1,8 @@
+# PDD 首页控件摘要（设备 192.168.0.9:35727）
+
+- 采集时间：2026-09-15
+- 包名：`com.xunmeng.pinduoduo`
+- 发现语义入口：`content-desc=拍照搜索`
+- 发现搜索入口：`content-desc=搜索`
+- 结论：PDD 首页存在稳定的“拍照搜索”无障碍语义入口，可作为 #277 的第一步入口探测。
+- 未保存坐标、完整控件树、截图、账号或个人数据。

docs/templates/deployment.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-Template
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-Template.-
-wiki_revision: 389f09d292b0aa408f26f1967e33eec82d37cedf
-synchronized_at: 2026-08-27T09:39:50Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:22Z
 <!-- gitea-wiki-mirror:end -->
 
 # 部署文档模板

docs/templates/task-archive.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Task-Archive-Template
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Task-Archive-Template.-
-wiki_revision: 53927b3b69fa26943f323f9be53153f80ed54530
-synchronized_at: 2026-08-24T08:23:07Z
+wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
+synchronized_at: 2026-09-21T08:15:26Z
 <!-- gitea-wiki-mirror:end -->
 
 > 本模板只用于用户明确要求的专项历史快照或读取既有归档，不属于标准任务闭环。单次任务的唯一事实来源是 Gitea 工单；不要为了完成普通任务创建本页面，也不要自动导出到 `docs/task/`。

scripts/reparse-syb-failed.ps1

@@ -0,0 +1,38 @@
+param(
+    [string]$BaseUrl = $env:GOAUTO_ADMIN_BASE_URL,
+    [int]$BatchSize = 100,
+    [int]$PageSize = 500,
+    [int]$SleepSeconds = 1,
+    [switch]$Force,
+    [switch]$DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+if ([string]::IsNullOrWhiteSpace($BaseUrl) -or [string]::IsNullOrWhiteSpace($env:GOAUTO_ADMIN_TOKEN)) {
+    throw '请设置 GOAUTO_ADMIN_BASE_URL 与 GOAUTO_ADMIN_TOKEN 环境变量'
+}
+if ($BatchSize -lt 1 -or $BatchSize -gt 500) { throw 'BatchSize 必须在 1 到 500 之间' }
+$headers = @{ Authorization = "Bearer $($env:GOAUTO_ADMIN_TOKEN)" }
+$ids = [System.Collections.Generic.List[UInt64]]::new()
+for ($page = 1; ; $page++) {
+    $uri = "$($BaseUrl.TrimEnd('/'))/api/admin/v1/syb-products?parseStatus=failed&page=$page&pageSize=$PageSize"
+    $response = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get
+    $items = if ($response.data.items) { $response.data.items } elseif ($response.data.list) { $response.data.list } else { @() }
+    foreach ($item in $items) { if ($item.id) { [void]$ids.Add([UInt64]$item.id) } }
+    if ($items.Count -lt $PageSize) { break }
+}
+Write-Host "发现失败记录 $($ids.Count) 条"
+if ($DryRun -or $ids.Count -eq 0) { exit 0 }
+$ok = 0; $failed = 0
+for ($i = 0; $i -lt $ids.Count; $i += $BatchSize) {
+    $end = [Math]::Min($i + $BatchSize, $ids.Count)
+    $body = @{ ids = @($ids[$i..($end - 1)]); force = [bool]$Force } | ConvertTo-Json -Compress
+    try {
+        $result = Invoke-RestMethod -Uri "$($BaseUrl.TrimEnd('/'))/api/admin/v1/syb-products/reparse-batch" -Headers ($headers + @{ 'Content-Type' = 'application/json' }) -Method Post -Body $body
+        $rows = @($result.data.results)
+        $ok += @($rows | Where-Object { $_.newStatus -eq 'success' }).Count
+        $failed += @($rows | Where-Object { $_.newStatus -ne 'success' }).Count
+        Write-Host "已处理 $end/$($ids.Count)，成功 $ok，仍失败 $failed"
+    } catch { Write-Warning "批次 $($i + 1)-$end 请求失败：$($_.Exception.Message)" }
+    if ($SleepSeconds -gt 0 -and $end -lt $ids.Count) { Start-Sleep -Seconds $SleepSeconds }
+}

scripts/start-server.ps1

@@ -97,6 +97,31 @@ function Read-DatabaseConfig {
     }
 }
 
+function Read-ErpGoConfig {
+    param([string]$Path)
+
+    # Optional section. Absent or incomplete means the Shopee spec sync stays
+    # off; the server treats that as "skip", not as an error (#290).
+    $values = @{}
+    $insideSection = $false
+    foreach ($line in Get-Content -LiteralPath $Path) {
+        if ($line -match '^\s*(#.*)?$') {
+            continue
+        }
+        if ($line -match '^erpgo\s*:\s*$') {
+            $insideSection = $true
+            continue
+        }
+        if ($insideSection -and $line -match '^\S') {
+            break
+        }
+        if ($insideSection -and $line -match '^\s+(baseUrl|apikey)\s*:\s*(.*?)\s*$') {
+            $values[$Matches[1]] = ConvertFrom-YamlScalar $Matches[2]
+        }
+    }
+    return $values
+}
+
 function Read-PortConfig {
     param([string]$Path)
 
@@ -169,6 +194,7 @@ try {
     $ConfigPath = [IO.Path]::GetFullPath($ConfigPath)
     $databaseConfig = Read-DatabaseConfig $ConfigPath
     $portConfig = Read-PortConfig $ConfigPath
+    $erpgoConfig = Read-ErpGoConfig $ConfigPath
 
     if (-not $PSBoundParameters.ContainsKey('DatabaseHost')) {
         $DatabaseHost = $databaseConfig.Host
@@ -219,6 +245,14 @@ try {
     $env:GOAUTO_DB_DRIVER = "mysql"
     $env:GOAUTO_DB_DSN = "${DatabaseUser}:${plainPassword}@tcp(${DatabaseHost}:${DatabasePort})/${DatabaseName}?charset=utf8mb4&parseTime=True&loc=Local&timeout=5s"
     $env:GOAUTO_SERVER_PORT = [string]$portConfig.Server
+    # Shopee spec service. The key never reaches the repo: config.yaml is
+    # gitignored and the server only ever reads the environment (#290).
+    if ($erpgoConfig.ContainsKey('baseUrl') -and -not [string]::IsNullOrWhiteSpace([string]$erpgoConfig.baseUrl)) {
+        $env:GOAUTO_ERPGO_BASE_URL = [string]$erpgoConfig.baseUrl
+    }
+    if ($erpgoConfig.ContainsKey('apikey') -and -not [string]::IsNullOrWhiteSpace([string]$erpgoConfig.apikey)) {
+        $env:GOAUTO_ERPGO_APIKEY = [string]$erpgoConfig.apikey
+    }
 
     Push-Location $serverDirectory
     try {
@@ -272,5 +306,7 @@ finally {
     Remove-Item Env:GOAUTO_DB_DRIVER -ErrorAction SilentlyContinue
     Remove-Item Env:GOAUTO_SERVER_PORT -ErrorAction SilentlyContinue
     Remove-Item Env:GOAUTO_CONFIG -ErrorAction SilentlyContinue
+    Remove-Item Env:GOAUTO_ERPGO_BASE_URL -ErrorAction SilentlyContinue
+    Remove-Item Env:GOAUTO_ERPGO_APIKEY -ErrorAction SilentlyContinue
     $plainPassword = $null
 }

scripts/start-web.ps1

@@ -168,18 +168,22 @@ try {
         }
     }
 
-    $env:VUE_APP_BASE_API = "http://127.0.0.1:$($ports.Server)"
-    Write-Host "Starting GoAuto web UI at http://127.0.0.1:$($ports.Web)" -ForegroundColor Green
+    # Keep browser requests same-origin. Vite proxies API/static requests to the
+    # local backend, so a LAN client never tries to call its own 127.0.0.1.
+    $env:VUE_APP_BASE_API = ""
+    $env:VITE_DEV_PROXY_TARGET = "http://127.0.0.1:$($ports.Server)"
+    Write-Host "Starting GoAuto web UI at http://0.0.0.0:$($ports.Web)" -ForegroundColor Green
     $viteCli = Join-Path $webDirectory "node_modules\vite\bin\vite.js"
     if (-not (Test-Path -LiteralPath $viteCli -PathType Leaf)) {
         throw "Vite was not found after dependency installation: $viteCli"
     }
-    & $nodePath $viteCli --host 127.0.0.1 --port $ports.Web --strictPort
+    & $nodePath $viteCli --host 0.0.0.0 --port $ports.Web --strictPort
     if ($LASTEXITCODE -ne 0) {
         throw "Frontend exited with code $LASTEXITCODE."
     }
 }
 finally {
     Remove-Item Env:VUE_APP_BASE_API -ErrorAction SilentlyContinue
+    Remove-Item Env:VITE_DEV_PROXY_TARGET -ErrorAction SilentlyContinue
     Pop-Location
 }

scripts/supervisor/goauto.conf

@@ -1,6 +1,6 @@
 [program:goauto-admin-api]
-command=pwsh.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "D:/OPC/goauto/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
-directory=D:/OPC/goauto
+command=pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml" -SkipMigration
+directory=D:/OPC/goauto-worktrees/main-runtime
 autostart=true
 autorestart=true
 startsecs=3
@@ -14,8 +14,8 @@ stdout_logfile_maxbytes=50MB
 stdout_logfile_backups=5
 
 [program:goauto-admin-ui]
-command=pwsh.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "D:/OPC/goauto/scripts/start-web.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
-directory=D:/OPC/goauto
+command=pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-web.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
+directory=D:/OPC/goauto-worktrees/main-runtime
 autostart=true
 autorestart=true
 startsecs=3

server/app/admin/router/init_router.go

@@ -1,6 +1,7 @@
 package router
 
 import (
+	goautoclientapi "go-admin/app/goauto/clientapi"
 	"os"
 
 	"github.com/gin-gonic/gin"
@@ -13,12 +14,15 @@ import (
 	goautopurchase "go-admin/app/goauto/purchase"
 	goautopurchaserule "go-admin/app/goauto/purchaserule"
 	goautoreplacement "go-admin/app/goauto/replacement"
+	goautoreturnmatch "go-admin/app/goauto/returnmatch"
 	goautorule "go-admin/app/goauto/rule"
 	goautoshopeeproduct "go-admin/app/goauto/shopeeproduct"
 	goautosybimport "go-admin/app/goauto/sybimport"
 	goautosybinnercode "go-admin/app/goauto/sybinnercode"
+	goautosybproductfilter "go-admin/app/goauto/sybproductfilter"
 	goautosybshop "go-admin/app/goauto/sybshop"
 	goautotask "go-admin/app/goauto/task"
+	goautoyeeke "go-admin/app/goauto/yeeke"
 	common "go-admin/common/middleware"
 )
 
@@ -53,6 +57,7 @@ func InitRouter() {
 
 	// 注册 GoAuto Agent 与设备管理路由。
 	goautodevice.InitRouter(r, authMiddleware)
+	goautoclientapi.InitRouter(r, authMiddleware)
 	goautoapprelease.InitRouter(r, authMiddleware)
 	goautoaimatching.InitRouter(r, authMiddleware)
 	goautotask.InitRouter(r, authMiddleware)
@@ -61,8 +66,11 @@ func InitRouter() {
 	goautoproduct.InitRouter(r, authMiddleware)
 	goautoreplacement.InitRouter(r, authMiddleware)
 	goautorule.InitRouter(r, authMiddleware)
-	goautoshopeeproduct.InitRouter(r, authMiddleware)
+	goautoshopeeproduct.InitRouter(r, authMiddleware, goautopurchase.ValidateQuickReplacement)
 	goautosybimport.InitRouter(r, authMiddleware)
 	goautosybinnercode.InitRouter(r, authMiddleware)
 	goautosybshop.InitRouter(r, authMiddleware)
+	goautosybproductfilter.InitRouter(r, authMiddleware)
+	goautoyeeke.InitRouter(r, authMiddleware)
+	goautoreturnmatch.InitRouter(r, authMiddleware)
 }

server/app/goauto/access/modules.go

@@ -3,18 +3,21 @@ package access
 import "strings"
 
 const (
-	ModuleDevices         = "devices"
-	ModulePDDProducts     = "pdd_products"
-	ModuleShopeeProducts  = "shopee_products"
-	ModuleSYBProducts     = "syb_products"
-	ModuleSYBShops        = "syb_shops"
-	ModuleSYBSyncRuns     = "syb_sync_runs"
-	ModuleSYBInnerCodes   = "syb_inner_codes"
-	ModuleCollectionRules = "collection_rules"
-	ModulePurchaseRules   = "purchase_rules"
-	ModuleCollectionTasks = "collection_tasks"
-	ModulePurchaseTasks   = "purchase_tasks"
-	ModuleAIMatching      = "ai_matching"
+	ModuleDevices           = "devices"
+	ModulePDDProducts       = "pdd_products"
+	ModuleShopeeProducts    = "shopee_products"
+	ModuleSYBProducts       = "syb_products"
+	ModuleSYBShops          = "syb_shops"
+	ModuleSYBProductFilters = "syb_product_filters"
+	ModuleSYBSyncRuns       = "syb_sync_runs"
+	ModuleSYBInnerCodes     = "syb_inner_codes"
+	ModuleCollectionRules   = "collection_rules"
+	ModulePurchaseRules     = "purchase_rules"
+	ModuleCollectionTasks   = "collection_tasks"
+	ModulePurchaseTasks     = "purchase_tasks"
+	ModuleAIMatching        = "ai_matching"
+	ModuleYeekeReturns      = "yeeke_returns"
+	ModuleYeekeSyncRuns     = "yeeke_sync_runs"
 )
 
 // ModuleDefinition is the single source of truth shared by menu migration,
@@ -66,6 +69,8 @@ var goAutoMenuGroupMetadata = []MenuGroupDefinition{
 			ModulePDDProducts,
 			ModuleCollectionTasks,
 			ModulePurchaseTasks,
+			ModuleYeekeReturns,
+			ModuleYeekeSyncRuns,
 		},
 	},
 	{
@@ -77,6 +82,7 @@ var goAutoMenuGroupMetadata = []MenuGroupDefinition{
 		Sort:     51,
 		ModuleKeys: []string{
 			ModuleSYBShops,
+			ModuleSYBProductFilters,
 			ModuleCollectionRules,
 			ModulePurchaseRules,
 			ModuleDevices,
@@ -91,13 +97,16 @@ var goAutoModuleMetadata = []ModuleDefinition{
 	{Key: ModuleShopeeProducts, Title: "虾皮商品", Path: "/shopee-products", RouteName: "GoAutoShopeeProducts", Component: "/goauto/shopee-products/index", Icon: "goods", Sort: 52, PurchaserDefault: true},
 	{Key: ModuleSYBProducts, Title: "SYB 商品", Path: "/syb-products", RouteName: "GoAutoSybProducts", Component: "/goauto/syb-products/index", Icon: "tickets", Sort: 53, PurchaserDefault: true},
 	{Key: ModuleSYBShops, Title: "SYB 店铺", Path: "/syb-shops", RouteName: "GoAutoSybShops", Component: "/goauto/syb-shops/index", Icon: "shopping", Sort: 54, PurchaserDefault: true},
-	{Key: ModuleSYBSyncRuns, Title: "SYB 同步记录", Path: "/syb-sync-runs", RouteName: "GoAutoSybSyncRuns", Component: "/goauto/syb-sync-runs/index", Icon: "time", Sort: 55, PurchaserDefault: true},
-	{Key: ModuleSYBInnerCodes, Title: "档口入库码", Path: "/syb-inner-codes", RouteName: "GoAutoSybInnerCodes", Component: "/goauto/syb-inner-codes/index", Icon: "list", Sort: 56, PurchaserDefault: true},
-	{Key: ModuleCollectionRules, Title: "采集规则", Path: "/collection-rules", RouteName: "GoAutoCollectionRules", Component: "/goauto/collection-rules/index", Icon: "code", Sort: 57, PurchaserDefault: true},
-	{Key: ModulePurchaseRules, Title: "采购规则", Path: "/purchase-rules", RouteName: "GoAutoPurchaseRules", Component: "/goauto/purchase-rules/index", Icon: "setting", Sort: 58, PurchaserHardHidden: true},
-	{Key: ModuleCollectionTasks, Title: "采集任务", Path: "/collection-tasks", RouteName: "GoAutoCollectionTasks", Component: "/goauto/collection-tasks/index", Icon: "list", Sort: 59, PurchaserDefault: true},
-	{Key: ModulePurchaseTasks, Title: "采购管理", Path: "/purchase-tasks", RouteName: "GoAutoPurchaseTasks", Component: "/goauto/purchase-tasks/index", Icon: "shopping", Sort: 60, PurchaserDefault: true},
-	{Key: ModuleAIMatching, Title: "AI 规格匹配", Path: "/ai-matching-settings", RouteName: "GoAutoAiMatchingSettings", Component: "/goauto/ai-matching-settings/index", Icon: "setting", Sort: 61, PurchaserHardHidden: true},
+	{Key: ModuleSYBProductFilters, Title: "SYB 商品过滤", Path: "/syb-product-filters", RouteName: "GoAutoSybProductFilters", Component: "/goauto/syb-product-filters/index", Icon: "filter", Sort: 55, PurchaserDefault: true},
+	{Key: ModuleSYBSyncRuns, Title: "SYB 同步记录", Path: "/syb-sync-runs", RouteName: "GoAutoSybSyncRuns", Component: "/goauto/syb-sync-runs/index", Icon: "time", Sort: 56, PurchaserDefault: true},
+	{Key: ModuleSYBInnerCodes, Title: "档口入库码", Path: "/syb-inner-codes", RouteName: "GoAutoSybInnerCodes", Component: "/goauto/syb-inner-codes/index", Icon: "list", Sort: 57, PurchaserDefault: true},
+	{Key: ModuleCollectionRules, Title: "采集规则", Path: "/collection-rules", RouteName: "GoAutoCollectionRules", Component: "/goauto/collection-rules/index", Icon: "code", Sort: 58, PurchaserDefault: true},
+	{Key: ModulePurchaseRules, Title: "采购规则", Path: "/purchase-rules", RouteName: "GoAutoPurchaseRules", Component: "/goauto/purchase-rules/index", Icon: "setting", Sort: 59, PurchaserHardHidden: true},
+	{Key: ModuleCollectionTasks, Title: "采集任务", Path: "/collection-tasks", RouteName: "GoAutoCollectionTasks", Component: "/goauto/collection-tasks/index", Icon: "list", Sort: 60, PurchaserDefault: true},
+	{Key: ModulePurchaseTasks, Title: "采购管理", Path: "/purchase-tasks", RouteName: "GoAutoPurchaseTasks", Component: "/goauto/purchase-tasks/index", Icon: "shopping", Sort: 61, PurchaserDefault: true},
+	{Key: ModuleAIMatching, Title: "AI 规格匹配", Path: "/ai-matching-settings", RouteName: "GoAutoAiMatchingSettings", Component: "/goauto/ai-matching-settings/index", Icon: "setting", Sort: 62, PurchaserHardHidden: true},
+	{Key: ModuleYeekeReturns, Title: "yeeke 退货包裹", Path: "/yeeke-returns", RouteName: "GoAutoYeekeReturns", Component: "/goauto/yeeke-returns/index", Icon: "goods", Sort: 63, PurchaserDefault: true},
+	{Key: ModuleYeekeSyncRuns, Title: "yeeke 同步记录", Path: "/yeeke-sync-runs", RouteName: "GoAutoYeekeSyncRuns", Component: "/goauto/yeeke-sync-runs/index", Icon: "time", Sort: 64, PurchaserDefault: true},
 }
 
 // GoAutoModules returns independent copies so callers cannot mutate the
@@ -144,6 +153,8 @@ func moduleKeyForAPI(path string) string {
 		return ModuleSYBProducts
 	case strings.HasPrefix(path, "/api/admin/v1/syb-shops"):
 		return ModuleSYBShops
+	case strings.HasPrefix(path, "/api/admin/v1/syb-product-filters"):
+		return ModuleSYBProductFilters
 	case strings.HasPrefix(path, "/api/admin/v1/syb-inner-codes"):
 		return ModuleSYBInnerCodes
 	case strings.HasPrefix(path, "/api/admin/v1/collection-rules"):
@@ -156,6 +167,12 @@ func moduleKeyForAPI(path string) string {
 		return ModulePurchaseTasks
 	case strings.HasPrefix(path, "/api/admin/v1/ai-matching-settings"):
 		return ModuleAIMatching
+	case strings.HasPrefix(path, "/api/admin/v1/yeeke-returns/sync-runs"):
+		return ModuleYeekeSyncRuns
+	case strings.HasPrefix(path, "/api/admin/v1/yeeke-returns/sync"):
+		return ModuleYeekeSyncRuns
+	case strings.HasPrefix(path, "/api/admin/v1/yeeke-returns"):
+		return ModuleYeekeReturns
 	default:
 		return ""
 	}

server/app/goauto/access/modules_test.go

@@ -10,8 +10,8 @@ import (
 
 func TestGoAutoModulesOwnEveryAdminAPIExactlyOnce(t *testing.T) {
 	modules := GoAutoModules()
-	if len(modules) != 12 {
-		t.Fatalf("got %d modules, want 12", len(modules))
+	if len(modules) != 15 {
+		t.Fatalf("got %d modules, want 15", len(modules))
 	}
 
 	owners := make(map[string]int)
@@ -31,6 +31,30 @@ func TestGoAutoModulesOwnEveryAdminAPIExactlyOnce(t *testing.T) {
 	}
 }
 
+func TestYeekeSyncRunsModuleIsRegisteredAndPurchaserVisible(t *testing.T) {
+	module, ok := ModuleByRouteName("GoAutoYeekeSyncRuns")
+	if !ok {
+		t.Fatal("yeeke sync-runs module not found")
+	}
+	if module.Key != ModuleYeekeSyncRuns {
+		t.Fatalf("unexpected key: %s", module.Key)
+	}
+	if module.Path != "/yeeke-sync-runs" || module.Component != "/goauto/yeeke-sync-runs/index" {
+		t.Fatalf("unexpected route wiring: %#v", module)
+	}
+	if !module.PurchaserDefault {
+		t.Fatal("yeeke sync-runs module must be purchaser-visible per #337")
+	}
+	if len(module.APIs) == 0 {
+		t.Fatal("yeeke sync-runs module must own its APIs")
+	}
+	for _, permission := range module.APIs {
+		if permission.Path == "/api/admin/v1/yeeke-returns" && permission.Method == "GET" {
+			t.Fatal("the return-package list API belongs to yeeke_returns, not yeeke_sync_runs")
+		}
+	}
+}
+
 func TestAIMatchingIsHardHiddenFromPurchaser(t *testing.T) {
 	module, ok := ModuleByRouteName("GoAutoAiMatchingSettings")
 	if !ok {
@@ -56,8 +80,8 @@ func TestGoAutoMenuSortsFitMySQLSignedTinyInt(t *testing.T) {
 		}
 		previous = module.Sort
 	}
-	if modules[0].Sort != 50 || modules[len(modules)-1].Sort != 61 {
-		t.Fatalf("GoAuto menu sort range = %d..%d, want 50..61", modules[0].Sort, modules[len(modules)-1].Sort)
+	if modules[0].Sort != 50 || modules[len(modules)-1].Sort != 64 {
+		t.Fatalf("GoAuto menu sort range = %d..%d, want 50..64", modules[0].Sort, modules[len(modules)-1].Sort)
 	}
 }
 
@@ -71,8 +95,8 @@ func TestGoAutoMenuGroupsCoverModulesExactlyOnce(t *testing.T) {
 	}
 
 	wantOrder := [][]string{
-		{ModuleSYBProducts, ModuleSYBSyncRuns, ModuleSYBInnerCodes, ModuleShopeeProducts, ModulePDDProducts, ModuleCollectionTasks, ModulePurchaseTasks},
-		{ModuleSYBShops, ModuleCollectionRules, ModulePurchaseRules, ModuleDevices, ModuleAIMatching},
+		{ModuleSYBProducts, ModuleSYBSyncRuns, ModuleSYBInnerCodes, ModuleShopeeProducts, ModulePDDProducts, ModuleCollectionTasks, ModulePurchaseTasks, ModuleYeekeReturns, ModuleYeekeSyncRuns},
+		{ModuleSYBShops, ModuleSYBProductFilters, ModuleCollectionRules, ModulePurchaseRules, ModuleDevices, ModuleAIMatching},
 	}
 	seen := make(map[string]int)
 	for groupIndex, group := range groups {

server/app/goauto/access/purchaser.go

@@ -56,7 +56,7 @@ var AdminAPIs = []APIPermission{
 	{"重新解析 SYB 商品", "/api/admin/v1/syb-products/:productId/reparse", "POST", true},
 	{"批量重新解析 SYB 商品", "/api/admin/v1/syb-products/reparse-batch", "POST", true},
 	{"人工修正 SYB 商品", "/api/admin/v1/syb-products/:productId/correction", "PATCH", true},
-	{"手动同步 SYB 商品", "/api/admin/v1/syb-products/import", "POST", false},
+	{"手动同步 SYB 商品", "/api/admin/v1/syb-products/import", "POST", true},
 	{"查看 SYB 同步记录", "/api/admin/v1/syb-products/sync-runs", "GET", true},
 	{"查看 SYB 同步详情", "/api/admin/v1/syb-products/sync-runs/:runId", "GET", true},
 
@@ -77,6 +77,10 @@ var AdminAPIs = []APIPermission{
 	{"启停 SYB 店铺", "/api/admin/v1/syb-shops/:shopId/enabled", "PATCH", false},
 	{"删除 SYB 店铺", "/api/admin/v1/syb-shops/:shopId", "DELETE", false},
 	{"从 SYB 发现店铺", "/api/admin/v1/syb-shops/discover", "POST", false},
+	{"查看 SYB 商品过滤", "/api/admin/v1/syb-product-filters", "GET", true},
+	{"新增 SYB 商品过滤", "/api/admin/v1/syb-product-filters", "POST", false},
+	{"启停 SYB 商品过滤", "/api/admin/v1/syb-product-filters/:filterId/enabled", "PATCH", false},
+	{"删除 SYB 商品过滤", "/api/admin/v1/syb-product-filters/:filterId", "DELETE", false},
 
 	{"查看采集规则模板", "/api/admin/v1/collection-rules/templates/:templateId", "GET", true},
 	{"查看采集规则", "/api/admin/v1/collection-rules", "GET", true},
@@ -94,8 +98,11 @@ var AdminAPIs = []APIPermission{
 	{"查看采集任务", "/api/admin/v1/collection-tasks", "GET", true},
 	{"创建采集任务", "/api/admin/v1/collection-tasks", "POST", true},
 	{"批量创建采集任务", "/api/admin/v1/collection-tasks/batch", "POST", true},
+	{"批量创建图搜采集任务", "/api/admin/v1/collection-tasks/image-search/batch", "POST", true},
 	{"查看采集任务详情", "/api/admin/v1/collection-tasks/:taskId", "GET", true},
 	{"重置采集任务", "/api/admin/v1/collection-tasks/:taskId/reset", "POST", true},
+	{"取消采集任务", "/api/admin/v1/collection-tasks/:taskId/cancel", "POST", true},
+	{"批量取消采集任务", "/api/admin/v1/collection-tasks/batch-cancel", "POST", true},
 	{"删除采集任务", "/api/admin/v1/collection-tasks/:taskId", "DELETE", true},
 
 	{"查看采购任务", "/api/admin/v1/purchase-tasks", "GET", true},
@@ -103,6 +110,7 @@ var AdminAPIs = []APIPermission{
 	{"批量 AI 匹配采购规格", "/api/admin/v1/purchase-tasks/batch-spec-match", "POST", true},
 	{"批量创建采购任务", "/api/admin/v1/purchase-tasks/batch", "POST", true},
 	{"批量重试采购任务", "/api/admin/v1/purchase-tasks/batch-retry", "POST", true},
+	{"回填SYB采购单号", "/api/admin/v1/purchase-tasks/syb-order-writeback", "POST", true},
 	{"创建备货采购任务", "/api/admin/v1/purchase-tasks/stock", "POST", true},
 	{"查看采购任务详情", "/api/admin/v1/purchase-tasks/:taskId", "GET", true},
 	{"创建采购任务", "/api/admin/v1/purchase-tasks", "POST", true},
@@ -116,6 +124,14 @@ var AdminAPIs = []APIPermission{
 	{"取消采购任务", "/api/admin/v1/purchase-tasks/:taskId/cancel", "POST", true},
 	{"处理结果不明确任务", "/api/admin/v1/purchase-tasks/:taskId/resolve-unknown", "POST", true},
 
+	{"查看 yeeke 退货包裹列表", "/api/admin/v1/yeeke-returns", "GET", true},
+	{"查看 yeeke 退货店铺列表", "/api/admin/v1/yeeke-returns/shops", "GET", true},
+	{"查看 yeeke 退货商品详情", "/api/admin/v1/yeeke-returns/items/:itemId", "GET", true},
+	{"查看 yeeke 退货包裹详情", "/api/admin/v1/yeeke-returns/:packageId", "GET", true},
+	{"查看 yeeke 同步记录", "/api/admin/v1/yeeke-returns/sync-runs", "GET", true},
+	{"查看 yeeke 同步详情", "/api/admin/v1/yeeke-returns/sync-runs/:runId", "GET", true},
+	{"手动触发 yeeke 同步", "/api/admin/v1/yeeke-returns/sync", "POST", true},
+
 	{"查看 AI 匹配状态", "/api/admin/v1/ai-matching-settings", "GET", true},
 	{"保存 AI 匹配设置", "/api/admin/v1/ai-matching-settings", "PUT", false},
 	{"测试 AI 服务连接", "/api/admin/v1/ai-matching-settings/test", "POST", false},

server/app/goauto/access/purchaser_test.go

@@ -2,6 +2,15 @@ package access
 
 import "testing"
 
+func TestPurchaserMayWritebackOrderNumber(t *testing.T) {
+	for _, permission := range PurchaserAPIs() {
+		if permission.Method == "POST" && permission.Path == "/api/admin/v1/purchase-tasks/syb-order-writeback" {
+			return
+		}
+	}
+	t.Fatal("missing purchaser order number writeback permission")
+}
+
 func TestPurchaserPermissionMatrixHasNoDuplicates(t *testing.T) {
 	seen := map[string]bool{}
 	for _, permission := range AdminAPIs {
@@ -15,12 +24,14 @@ func TestPurchaserPermissionMatrixHasNoDuplicates(t *testing.T) {
 
 func TestPurchaserExcludesAdministratorOperations(t *testing.T) {
 	denied := map[string]bool{
-		"POST /api/admin/v1/devices/:deviceId/disable":         true,
-		"POST /api/admin/v1/syb-products/import":               true,
-		"POST /api/admin/v1/collection-rules":                  true,
-		"PUT /api/admin/v1/ai-matching-settings":               true,
-		"POST /api/admin/v1/shopee-spec-auto-match/runs":       true,
-		"GET /api/admin/v1/shopee-spec-auto-match/runs/latest": true,
+		"POST /api/admin/v1/devices/:deviceId/disable":              true,
+		"POST /api/admin/v1/syb-shops/discover":                     true,
+		"POST /api/admin/v1/syb-product-filters":                    true,
+		"PATCH /api/admin/v1/syb-product-filters/:filterId/enabled": true,
+		"POST /api/admin/v1/collection-rules":                       true,
+		"PUT /api/admin/v1/ai-matching-settings":                    true,
+		"POST /api/admin/v1/shopee-spec-auto-match/runs":            true,
+		"GET /api/admin/v1/shopee-spec-auto-match/runs/latest":      true,
 	}
 	for _, permission := range PurchaserAPIs() {
 		if denied[permission.Method+" "+permission.Path] {

server/app/goauto/access/reconcile_test.go

@@ -55,7 +55,9 @@ func TestReconcilePurchaserPermissions(t *testing.T) {
 	}
 
 	assertPolicyCount(t, db, "custom-role", "/custom", "GET", 1)
-	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-products/import", "POST", 0)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-products/import", "POST", 1)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-shops/discover", "POST", 0)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-shops", "POST", 0)
 }
 
 func TestReconcilePurchaserPermissionsRemovesOnlyStalePurchaserGrant(t *testing.T) {

server/app/goauto/aimatching/normalizer.go

@@ -15,6 +15,7 @@ var (
 	traditionalToSimplified *gocc.OpenCC
 	traditionalErr          error
 	weightPattern           = regexp.MustCompile(`(?i)(\d+(?:\.\d+)?)\s*(?:[-~～至到]\s*(\d+(?:\.\d+)?))?\s*(公斤|千克|kg|斤)`)
+	sizeTokenPattern        = regexp.MustCompile(`(?i)^(?:xxxs|xxl|xxxl|xxxxl|[2-9]xl|xs|s|m|l|xl|\d+xl)\b`)
 )
 
 // Normalize makes a deterministic comparison key. It intentionally removes
@@ -80,7 +81,7 @@ func normalizeWeight(raw string) string {
 // deliberately treated as no match instead of picking the first label.
 func DeterministicMatch(request MatchRequest) (MatchResult, bool) {
 	color, colorOK := exactCandidate(request.TargetColor, request.Colors)
-	size, sizeOK := exactCandidate(request.TargetSize, request.Sizes)
+	size, sizeOK := exactSizeCandidate(request.TargetSize, request.Sizes)
 	if !colorOK || !sizeOK {
 		return MatchResult{}, false
 	}
@@ -88,6 +89,27 @@ func DeterministicMatch(request MatchRequest) (MatchResult, bool) {
 	return result, true
 }
 
+func exactSizeCandidate(target string, candidates []string) (string, bool) {
+	key := sizeTokenPattern.FindString(strings.ToLower(Normalize(target)))
+	if key == "" {
+		return exactCandidate(target, candidates)
+	}
+	matches := make([]string, 0, 1)
+	seen := map[string]bool{}
+	for _, candidate := range candidates {
+		candidate = strings.TrimSpace(candidate)
+		if candidate == "" || sizeTokenPattern.FindString(strings.ToLower(Normalize(candidate))) != key || seen[candidate] {
+			continue
+		}
+		seen[candidate] = true
+		matches = append(matches, candidate)
+	}
+	if len(matches) == 1 {
+		return matches[0], true
+	}
+	return "", false
+}
+
 // ManualMatch records an already-confirmed mapping without reinterpreting it.
 // The caller owns the human-confirmation check; this helper only creates the
 // same bounded task snapshot shape used by automatic decisions.