docs: sync agent backfill scanning rules for #242

线上 Wiki Business-Rules-and-Glossary 已更新并回读，revision
1eb380d07183157a8430c7ced868479e72fbdfe3。镜像由 harness.py sync
从线上重建，sync --check 通过，未反向覆盖 Wiki。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTDbDcwbDw1TSAcE6wfh2F

android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "cn.ilapage.goauto.agent"
         minSdk = 23
         targetSdk = 34
-        versionCode = 52
-        versionName = "0.9.39"
+        versionCode = 72
+        versionName = "0.9.59"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

android/app/src/main/java/cn/ilapage/goauto/agent/MainActivity.kt

@@ -49,6 +49,7 @@ class MainActivity : AppCompatActivity() {
 
     override fun onResume() {
         super.onResume()
+        cn.ilapage.goauto.agent.automation.GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         screenPolicyHandler.removeCallbacks(screenPolicyRefresh)
         screenPolicyHandler.post(screenPolicyRefresh)
     }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/GoAutoAccessibilityService.kt

@@ -18,6 +18,8 @@ import android.util.Log
 import android.view.Display
 import android.view.accessibility.AccessibilityEvent
 import android.view.accessibility.AccessibilityNodeInfo
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubbleController
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePresentation
 import java.util.concurrent.CountDownLatch
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicBoolean
@@ -32,6 +34,9 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         ActivityEvidenceTracker { packageName, className -> isDeclaredActivity(packageName, className) }
     }
     private var accessibilityButtonCallback: AccessibilityButtonController.AccessibilityButtonCallback? = null
+    private val purchaseResultBubble by lazy {
+        PurchaseResultBubbleController(this) { currentPackage() == PDD_PACKAGE }
+    }
 
     override fun onServiceConnected() {
         serviceInfo = serviceInfo.apply {
@@ -48,18 +53,19 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
 
     override fun onAccessibilityEvent(event: AccessibilityEvent?) {
         if (event?.eventType == AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED) {
-            val packageName = event.packageName?.toString()
-            if (packageName != null && packageName != lastForegroundPackage) {
-                lastForegroundPackage = packageName
+            val foregroundPackage = event.packageName?.toString()
+            if (foregroundPackage != null && foregroundPackage != lastForegroundPackage) {
+                lastForegroundPackage = foregroundPackage
                 foregroundRevision.incrementAndGet()
             }
-            if (packageName == PDD_PACKAGE) lastPddForegroundAt.set(SystemClock.elapsedRealtime())
-            activityTracker.observe(packageName, event.className?.toString())
+            if (foregroundPackage == PDD_PACKAGE) lastPddForegroundAt.set(SystemClock.elapsedRealtime())
+            activityTracker.observe(foregroundPackage, event.className?.toString())
         }
     }
     override fun onInterrupt() = Unit
 
     override fun onDestroy() {
+        dismissPurchaseResultBubble()
         unregisterAccessibilityButton()
         if (instance === this) instance = null
         super.onDestroy()
@@ -71,6 +77,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         runCatching {
             val callback = object : AccessibilityButtonController.AccessibilityButtonCallback() {
                 override fun onClicked(controller: AccessibilityButtonController) {
+                    dismissPurchaseResultBubble()
                     AccessibilityButtonPolicy.handleClick(::openAgentPreservingTab)
                 }
             }
@@ -115,6 +122,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
     ).restore(packageName, timeoutMillis)
 
     fun openAgentPreservingTab(): Boolean = runCatching {
+        dismissPurchaseResultBubble()
         startActivity(
             android.content.Intent(this, cn.ilapage.goauto.agent.MainActivity::class.java).apply {
                 addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK or android.content.Intent.FLAG_ACTIVITY_CLEAR_TOP or android.content.Intent.FLAG_ACTIVITY_SINGLE_TOP)
@@ -123,6 +131,14 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         true
     }.getOrDefault(false)
 
+    fun showPurchaseResultBubble(presentation: PurchaseResultBubblePresentation) {
+        purchaseResultBubble.show(presentation)
+    }
+
+    fun dismissPurchaseResultBubble() {
+        purchaseResultBubble.dismiss()
+    }
+
     override fun visibleTexts(): List<String> {
         val root = rootInActiveWindow ?: return emptyList()
         val texts = mutableListOf<String>()
@@ -178,6 +194,39 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         return swipeNode(node, direction)
     }
 
+    /** Backfill never uses ancestor clicks or coordinate/gesture fallbacks. */
+    fun clickBackfill(target: SnapshotNode): Boolean {
+        val page = capture()
+        BackfillPagePolicy.validate(page)
+        val fresh = page.nodes.singleOrNull { it.path == target.path && it.label == target.label &&
+            it.bounds == target.bounds && it.className == target.className } ?: return false
+        val allowed = BackfillPagePolicy.cards(page).any { it.path == fresh.path } ||
+            BackfillPagePolicy.expansion(page)?.path == fresh.path ||
+            (fresh.label == "全部" && page.nodes.any { it.label in setOf("我的订单", "全部订单") })
+        if (!allowed || !BackfillPagePolicy.safe(page, fresh)) return false
+        val root = rootInActiveWindow ?: return false
+        if (root.packageName?.toString() != BackfillPagePolicy.PDD) return false
+        var node = root
+        for (index in fresh.path.split('/').drop(1)) node = node.getChild(index.toInt()) ?: return false
+        val bounds = Rect().also(node::getBoundsInScreen)
+        if (!node.isClickable || !node.isEnabled || !node.isVisibleToUser ||
+            NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom) != fresh.bounds ||
+            (node.text?.toString()?.trim().takeUnless { it.isNullOrEmpty() } ?: node.contentDescription?.toString()?.trim().orEmpty()) != fresh.label) return false
+        return node.performAction(AccessibilityNodeInfo.ACTION_CLICK)
+    }
+
+    fun scrollBackfill(): Boolean {
+        BackfillPagePolicy.validate(capture())
+        val root = rootInActiveWindow ?: return false
+        val candidates = mutableListOf<AccessibilityNodeInfo>()
+        walk(root) { if (it.isScrollable && it.isVisibleToUser && it.isEnabled) candidates += it }
+        // Prefer the unique largest vertical viewport. Ambiguous panes fail closed.
+        val areas = candidates.map { it to Rect().also(it::getBoundsInScreen) }
+        val maxArea = areas.maxOfOrNull { it.second.width().toLong() * it.second.height() } ?: return false
+        val target = areas.filter { it.second.width().toLong() * it.second.height() == maxArea }.singleOrNull() ?: return false
+        return target.first.performAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD)
+    }
+
     override fun capture(): UiSnapshot {
         val root = rootInActiveWindow ?: return UiSnapshot(null, null, emptyList())
         val rootPackage = root.packageName?.toString()
@@ -314,6 +363,42 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }
     }
 
+    override fun clickAddressEntryFresh(target: SnapshotNode): FreshClickOutcome {
+        val root = rootInActiveWindow ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.ROOT_UNAVAILABLE)
+        val indexes = target.path.split('/').mapNotNull(String::toIntOrNull)
+        if (indexes.isEmpty() || indexes.first() != 0 || indexes.size != target.path.split('/').size) {
+            return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        var node = root
+        for (index in indexes.drop(1)) {
+            node = node.getChild(index)
+                ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        val bounds = Rect().also(node::getBoundsInScreen)
+        if (!node.isVisibleToUser || !node.isEnabled ||
+            node.preferredOrDescendantLabel() != target.label ||
+            node.className?.toString() != target.className ||
+            kotlin.math.abs(bounds.centerX() - target.bounds.centerX) > 32 ||
+            kotlin.math.abs(bounds.centerY() - target.bounds.centerY) > 32
+        ) {
+            return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+        }
+        var ancestorDepth = 0
+        while (!node.isClickable) {
+            node = node.parent ?: return FreshClickOutcome(
+                FreshActionResult.FAILED,
+                FreshClickReason.NO_CLICKABLE_ANCESTOR,
+                clickableAncestorDepth = ancestorDepth,
+            )
+            ancestorDepth++
+        }
+        return if (node.performAction(AccessibilityNodeInfo.ACTION_CLICK)) {
+            FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS, 1, ancestorDepth)
+        } else {
+            FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.ACTION_CLICK_FALSE, 1, ancestorDepth)
+        }
+    }
+
     override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult {
         val root = rootInActiveWindow ?: return FreshActionResult.NOT_FOUND
         val candidates = mutableListOf<AccessibilityNodeInfo>()
@@ -333,31 +418,32 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (bounds.width() < 2 || bounds.height() < 2 || Build.VERSION.SDK_INT < Build.VERSION_CODES.N) {
             return FreshActionResult.FAILED
         }
-        val path = Path().apply {
-            moveTo(bounds.centerX().toFloat(), bounds.centerY().toFloat())
-        }
-        val completed = AtomicBoolean(false)
-        val latch = CountDownLatch(1)
-        val queued = dispatchGesture(
-            GestureDescription.Builder().addStroke(GestureDescription.StrokeDescription(path, 0, 80)).build(),
-            object : GestureResultCallback() {
-                override fun onCompleted(gestureDescription: GestureDescription?) {
-                    completed.set(true)
-                    latch.countDown()
-                }
+        return if (dispatchCenterTap(bounds)) FreshActionResult.SUCCESS else FreshActionResult.FAILED
+    }
 
-                override fun onCancelled(gestureDescription: GestureDescription?) {
-                    latch.countDown()
-                }
-            },
-            null,
-        )
-        if (!queued) return FreshActionResult.FAILED
-        return if (latch.await(1_500, TimeUnit.MILLISECONDS) && completed.get()) {
-            FreshActionResult.SUCCESS
-        } else {
-            FreshActionResult.FAILED
+    override fun tapSpecFresh(target: SnapshotNode): FreshActionResult {
+        val width = resources.displayMetrics.widthPixels
+        val height = resources.displayMetrics.heightPixels
+        if (!PurchaseSpecGesturePolicy.isAllowed(target, width, height)) return FreshActionResult.FAILED
+        val root = rootInActiveWindow ?: return FreshActionResult.NOT_FOUND
+        val candidates = mutableListOf<AccessibilityNodeInfo>()
+        walk(root) { node ->
+            val bounds = Rect().also(node::getBoundsInScreen)
+            if (node.isVisibleToUser && node.isEnabled &&
+                node.preferredOrDescendantLabel() == target.label &&
+                node.className?.toString() == target.className &&
+                kotlin.math.abs(bounds.centerX() - target.bounds.centerX) <= 32 &&
+                kotlin.math.abs(bounds.centerY() - target.bounds.centerY) <= 32
+            ) candidates += node
         }
+        if (candidates.isEmpty()) return FreshActionResult.NOT_FOUND
+        if (candidates.size != 1) return FreshActionResult.AMBIGUOUS
+        val bounds = Rect().also(candidates.single()::getBoundsInScreen)
+        val freshTarget = target.copy(bounds = NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom))
+        if (!PurchaseSpecGesturePolicy.isAllowed(freshTarget, width, height)) {
+            return FreshActionResult.FAILED
+        }
+        return if (dispatchCenterTap(bounds)) FreshActionResult.SUCCESS else FreshActionResult.FAILED
     }
 
     override fun inputFresh(target: SnapshotNode, value: String): FreshActionResult {
@@ -397,17 +483,27 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
 
     override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
         val root = rootInActiveWindow ?: return false
-        val matches = mutableListOf<AccessibilityNodeInfo>()
-        walk(root) { node ->
-            val bounds = Rect().also(node::getBoundsInScreen)
-            if (node.isVisibleToUser && node.isEnabled && node.isScrollable &&
-                node.className?.toString() == target.className &&
-                kotlin.math.abs(bounds.centerX() - target.bounds.centerX) <= 32 &&
-                kotlin.math.abs(bounds.centerY() - target.bounds.centerY) <= 32
-            ) matches += node
+        val candidates = mutableListOf<PurchaseScrollCandidate>()
+        val liveNodes = mutableMapOf<String, AccessibilityNodeInfo>()
+        fun visit(node: AccessibilityNodeInfo, path: String) {
+            if (node.isVisibleToUser && node.isEnabled && node.isScrollable) {
+                val bounds = Rect().also(node::getBoundsInScreen)
+                candidates += PurchaseScrollCandidate(
+                    path, node.className?.toString(),
+                    NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom),
+                )
+                liveNodes[path] = node
+            }
+            for (index in 0 until node.childCount) {
+                node.getChild(index)?.let { visit(it, "$path/$index") }
+            }
         }
-        if (matches.size != 1) return false
-        return swipeNode(matches.single(), direction, durationMs, preferScrollAction = false)
+        visit(root, "0")
+        val resolved = PurchaseScrollLocator.locate(
+            PurchaseScrollCandidate(target.path, target.className, target.bounds), candidates,
+        ) ?: return false
+        val current = liveNodes[resolved.path] ?: return false
+        return swipeNode(current, direction, durationMs, preferScrollAction = true)
     }
 
     override fun backPurchase(): Boolean = performGlobalAction(GLOBAL_ACTION_BACK)
@@ -421,9 +517,17 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }.getOrDefault(false)
     }
 
+    private var lastSpecRowSwipeFailure = "none"
+
+    override fun specRowSwipeFailureReason(): String = lastSpecRowSwipeFailure
+
     override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean {
+        lastSpecRowSwipeFailure = "none"
         if (anchor == null) return swipe(SemanticTarget.SPEC_PANEL, direction)
-        val root = rootInActiveWindow ?: return false
+        val root = rootInActiveWindow ?: run {
+            lastSpecRowSwipeFailure = "windowMissing"
+            return false
+        }
         val matches = mutableListOf<AccessibilityNodeInfo>()
         walk(root) { node ->
             val bounds = Rect().also(node::getBoundsInScreen)
@@ -441,6 +545,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         val horizontal = direction == SwipeDirection.LEFT || direction == SwipeDirection.RIGHT
         if (matches.size != 1) {
             if (!SpecSwipeSafety.allowGlobalFallback(direction)) {
+                lastSpecRowSwipeFailure = if (matches.isEmpty()) "anchorMissing" else "anchorAmbiguous"
                 Log.i("GoAutoCollector", "swipe direction=$direction result=blocked reason=anchor-not-unique matches=${matches.size}")
                 return false
             }
@@ -464,19 +569,27 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (anchoredTarget != null) {
             val bounds = Rect().also(anchoredTarget::getBoundsInScreen)
             Log.i("GoAutoCollector", "swipe direction=$direction anchored=true bounds=$bounds class=${anchoredTarget.className}")
-            return swipeNode(
+            val success = swipeNode(
                 anchoredTarget,
                 direction,
                 preferScrollAction = SpecSwipeSafety.preferAccessibilityScrollAction(direction),
             )
+            if (!success) lastSpecRowSwipeFailure = "gestureFailed"
+            return success
         }
         if (!SpecSwipeSafety.allowGlobalFallback(direction)) {
+            lastSpecRowSwipeFailure = "horizontalContainerMissing"
             Log.i("GoAutoCollector", "swipe direction=$direction result=blocked reason=no-anchored-horizontal-container")
             return false
         }
         return swipe(SemanticTarget.SPEC_PANEL, direction)
     }
 
+    override fun swipeSpecRow(target: SnapshotNode, direction: SwipeDirection): Boolean {
+        if (direction != SwipeDirection.LEFT && direction != SwipeDirection.RIGHT) return false
+        return swipeSpec(direction, target)
+    }
+
     override fun pullDownSpecPanel(anchor: SnapshotNode): Boolean {
         if (!anchor.scrollable) return false
         val root = rootInActiveWindow ?: return false
@@ -617,6 +730,28 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         return latch.await(1500, TimeUnit.MILLISECONDS) && completed.get()
     }
 
+    private fun dispatchCenterTap(bounds: Rect): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N || bounds.width() < 2 || bounds.height() < 2) return false
+        val path = Path().apply { moveTo(bounds.centerX().toFloat(), bounds.centerY().toFloat()) }
+        val completed = AtomicBoolean(false)
+        val latch = CountDownLatch(1)
+        val queued = dispatchGesture(
+            GestureDescription.Builder().addStroke(GestureDescription.StrokeDescription(path, 0, 80)).build(),
+            object : GestureResultCallback() {
+                override fun onCompleted(gestureDescription: GestureDescription?) {
+                    completed.set(true)
+                    latch.countDown()
+                }
+
+                override fun onCancelled(gestureDescription: GestureDescription?) {
+                    latch.countDown()
+                }
+            },
+            null,
+        )
+        return queued && latch.await(1_500, TimeUnit.MILLISECONDS) && completed.get()
+    }
+
     private fun walk(node: AccessibilityNodeInfo, visit: (AccessibilityNodeInfo) -> Unit) {
         visit(node)
         for (index in 0 until node.childCount) node.getChild(index)?.let { walk(it, visit) }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/OrderBackfillPolicy.kt

@@ -0,0 +1,87 @@
+package cn.ilapage.goauto.agent.automation
+
+import java.math.BigInteger
+import java.text.SimpleDateFormat
+import java.util.Locale
+import java.util.TimeZone
+
+/** Runtime evidence only: a sorted prefix cannot prove the unvisited tail is sorted. */
+class OrderBackfillWindow(days: String, val confirmedAt: Long) {
+    val cutoff: Long
+    var checked = 0
+        private set
+    var nonDescending = false
+        private set
+    private var previous: Long? = null
+    private var missingTime = false
+    private var timed = 0
+
+    init {
+        require(days.matches(Regex("[0-9]+")) && BigInteger(days) > BigInteger.ZERO)
+        cutoff = BigInteger.valueOf(confirmedAt).subtract(BigInteger(days).multiply(BigInteger.valueOf(86_400_000)))
+            .max(BigInteger.valueOf(Long.MIN_VALUE)).toLong()
+    }
+
+    fun observe(time: Long?): Boolean {
+        checked++
+        if (time == null) missingTime = true else {
+            if (previous != null && time > previous!!) nonDescending = true
+            previous = time
+            timed++
+        }
+        // Check at least five details before using a sampled ordering assumption.
+        return !nonDescending && !missingTime && timed >= ORDERING_SAMPLE && time != null && time < cutoff
+    }
+
+    fun includes(time: Long?): Boolean = time == null || time in cutoff..confirmedAt
+
+    companion object {
+        const val ORDERING_SAMPLE = 5
+        const val MAX_ORDERS = 200
+        const val MAX_DURATION_MS = 10 * 60_000L
+        const val UNORDERED = "列表非严格倒序，已改为有界扫描，可能未覆盖全部"
+    }
+}
+
+data class BackfillItem(val addressSuffix: String, val pddOrderNo: String, val orderSubmittedAt: String?)
+data class BackfillDetail(val item: BackfillItem?, val timeMillis: Long?)
+
+/** Per-detail accumulator. Never retains raw text, addresses, names or phone numbers. */
+class BackfillDetailReader(private val zone: TimeZone = TimeZone.getDefault()) {
+    private val suffixes = mutableSetOf<String>()
+    private val orders = mutableSetOf<String>()
+    private val times = mutableSetOf<Long>()
+
+    fun accept(text: String) {
+        SUFFIX.findAll(text).forEach { suffixes += it.value }
+        ORDER_NO.findAll(text).forEach { orders += it.groupValues[1] }
+        ORDER_TIME.findAll(text).forEach { match -> parseTime(match.groupValues[1])?.let(times::add) }
+    }
+
+    fun finish(): BackfillDetail {
+        val time = times.singleOrNull()
+        val item = if (suffixes.size == 1 && orders.size == 1 && times.size <= 1) {
+            BackfillItem(suffixes.single(), orders.single(), time?.let {
+                SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssXXX", Locale.ROOT).apply { timeZone = zone }.format(it)
+            })
+        } else null
+        suffixes.clear()
+        orders.clear()
+        times.clear()
+        return BackfillDetail(item, time)
+    }
+
+    private fun parseTime(raw: String): Long? {
+        val normalized = raw.replace('年', '-').replace('月', '-').replace("日", "").replace('/', '-').replace('.', '-')
+        val pattern = if (normalized.count { it == ':' } == 2) "yyyy-M-d H:mm:ss" else "yyyy-M-d H:mm"
+        val position = java.text.ParsePosition(0)
+        val date = SimpleDateFormat(pattern, Locale.ROOT).apply { isLenient = false; timeZone = zone }.parse(normalized, position)
+        return date?.time?.takeIf { position.index == normalized.length }
+    }
+
+    companion object {
+        val ORDER_NO = Regex("(?:订单编号|订单号)\\s*[:：]?\\s*([A-Za-z0-9-]{6,64})")
+        val ORDER_TIME = Regex("(?:下单时间|创建时间)\\s*[:：]?\\s*(20\\d{2}[-/.年]\\d{1,2}[-/.月]\\d{1,2}日?\\s+\\d{1,2}:\\d{2}(?::\\d{2})?)")
+        private val SUFFIX = Regex("_cg[1-9][0-9]*(?![0-9A-Za-z_０-９])")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/OrderBackfillScanner.kt

@@ -0,0 +1,140 @@
+package cn.ilapage.goauto.agent.automation
+
+import java.security.MessageDigest
+
+object BackfillPagePolicy {
+    const val PDD = "com.xunmeng.pinduoduo"
+    val forbidden = listOf("确认收货", "申请退款", "催发货", "去支付", "立即支付", "提交订单", "付款", "退款", "取消订单", "再次购买", "删除订单")
+    private val risk = listOf("验证码", "安全验证", "人机验证", "登录", "账号异常", "风险验证", "拖动滑块")
+    fun validate(page: UiSnapshot) {
+        require(page.packageName == PDD && page.activityName?.startsWith(PDD) == true) { "PDD 页面身份不符" }
+        require(page.nodes.none { it.visible && risk.any { word -> it.label.contains(word) } }) { "遇到登录或安全验证，已停止" }
+    }
+    private fun subtree(page: UiSnapshot, node: SnapshotNode) = page.nodes.filter { it.path == node.path || it.path.startsWith(node.path + "/") }
+    fun safe(page: UiSnapshot, node: SnapshotNode): Boolean = node.visible && node.enabled && node.clickable &&
+        node.bounds.width > 0 && node.bounds.height > 0 &&
+        subtree(page, node).none { child -> forbidden.any { child.label.contains(it) } } &&
+        page.nodes.none { other -> other.visible && forbidden.any { other.label.contains(it) } &&
+            other.bounds.left < node.bounds.right && other.bounds.right > node.bounds.left &&
+            other.bounds.top < node.bounds.bottom && other.bounds.bottom > node.bounds.top }
+
+    fun list(page: UiSnapshot): Boolean = page.nodes.any { it.visible && it.label == "全部" && it.selected } &&
+        page.nodes.any { it.visible && it.label in setOf("我的订单", "全部订单") }
+    fun detail(page: UiSnapshot): Boolean = page.nodes.any { it.visible && (it.label == "订单详情" || it.label.contains("订单编号")) }
+    fun expansion(page: UiSnapshot): SnapshotNode? {
+        if (!detail(page) || page.nodes.none { it.visible && it.label.contains("订单编号") }) return null
+        val order = page.nodes.first { it.visible && it.label.contains("订单编号") }
+        val snapshot = page.nodes.filter { it.visible && it.label == "商品快照" }.singleOrNull() ?: return null
+        return page.nodes.filter { it.label == "展开" && safe(page, it) && it.bounds.top >= order.bounds.top &&
+            it.bounds.top < snapshot.bounds.bottom && it.bounds.bottom > snapshot.bounds.top }.singleOrNull()
+    }
+    fun cards(page: UiSnapshot): List<SnapshotNode> {
+        if (!list(page)) return emptyList()
+        return page.nodes.filter { node ->
+            if (!safe(page, node)) return@filter false
+            if (node.label in setOf("订单详情", "查看详情")) return@filter true
+            val children = subtree(page, node)
+            val product = children.any { it.className?.endsWith("ImageView") == true } && children.any { it.label.length >= 4 }
+            val parent = page.nodes.firstOrNull { it.path == node.parentPath } ?: return@filter false
+            val context = subtree(page, parent)
+            product && context.any { it.label in setOf("查看物流", "确认收货", "去支付", "待发货", "待收货", "交易成功", "再次购买") }
+        }.sortedBy { it.bounds.top }.let { candidates ->
+            candidates.filter { node -> candidates.none { it !== node && it.path.startsWith(node.path + "/") } }
+        }
+    }
+    fun fingerprint(page: UiSnapshot, card: SnapshotNode): String {
+        val labels = subtree(page, card).joinToString("|") { it.label }
+        return MessageDigest.getInstance("SHA-256").digest(labels.toByteArray()).joinToString("") { "%02x".format(it) }
+    }
+}
+
+interface BackfillDriver {
+    fun openOrders()
+    fun capture(): UiSnapshot
+    fun click(node: SnapshotNode): Boolean
+    fun scroll(): Boolean
+    fun back(): Boolean
+    fun pause()
+}
+
+class OrderBackfillScanner(
+    private val driver: BackfillDriver,
+    private val window: OrderBackfillWindow,
+    private val checkActive: () -> Unit,
+    private val submit: (BackfillItem) -> Unit,
+    private val progress: (Int) -> Unit,
+) {
+    fun scan(): String {
+        checkActive()
+        driver.openOrders()
+        driver.pause()
+        var page = read()
+        if (!BackfillPagePolicy.list(page)) {
+            val tab = page.nodes.filter { it.label == "全部" && BackfillPagePolicy.safe(page, it) }.singleOrNull()
+            check(page.nodes.any { it.label in setOf("我的订单", "全部订单") } && tab != null) { "未识别我的订单-全部" }
+            act { driver.click(tab) }
+            page = read()
+            check(BackfillPagePolicy.list(page)) { "无法确认全部订单标签" }
+        }
+        if (page.nodes.any { it.visible && it.label == "暂无订单" }) return "扫描完成，未发现订单"
+        val seenCards = mutableSetOf<String>()
+        val seenOrders = mutableSetOf<String>()
+        var noProgress = 0
+        while (window.checked < OrderBackfillWindow.MAX_ORDERS) {
+            checkActive()
+            check(BackfillPagePolicy.list(page)) { "返回后未识别全部订单列表" }
+            val card = BackfillPagePolicy.cards(page).firstOrNull { BackfillPagePolicy.fingerprint(page, it) !in seenCards }
+            if (card == null) {
+                if (++noProgress >= 3) return finish("列表无进展或卡片无法安全识别，未完整扫描")
+                checkActive()
+                if (!driver.scroll()) return finish("列表滚动结束或不可滚动，未完整扫描")
+                driver.pause()
+                page = read()
+                continue
+            }
+            noProgress = 0
+            seenCards += BackfillPagePolicy.fingerprint(page, card)
+            act { driver.click(card) }
+            var detail = read()
+            check(BackfillPagePolicy.detail(detail)) { "点击后未识别订单详情" }
+            val reader = BackfillDetailReader()
+            var expanded = false
+            // Limited detail scrolling; only this accumulator associates fields across these frames.
+            for (step in 0 until 6) {
+                reader.accept(detail.nodes.filter { it.visible }.joinToString("\n") { it.label })
+                val expand = if (expanded) null else BackfillPagePolicy.expansion(detail)
+                if (expand != null) {
+                    act { driver.click(expand) }
+                    expanded = true
+                } else {
+                    checkActive()
+                    if (!driver.scroll()) break
+                    driver.pause()
+                }
+                detail = read()
+                check(BackfillPagePolicy.detail(detail)) { "滚动后无法确认订单详情，未完整扫描" }
+            }
+            reader.accept(detail.nodes.filter { it.visible }.joinToString("\n") { it.label })
+            val found = reader.finish()
+            val stopForTime = window.observe(found.timeMillis)
+            progress(window.checked)
+            found.item?.takeIf { window.includes(found.timeMillis) && seenOrders.add(it.pddOrderNo) }?.let(submit)
+            if (stopForTime) return "已达指定天数（已读序列倒序）；未完整扫描，后续列表时序未经验证"
+            act { driver.back() }
+            page = read()
+        }
+        return finish("达到 200 单内部上限，未完整扫描")
+    }
+
+    private fun finish(reason: String): String = reason + if (window.nonDescending) "\n${OrderBackfillWindow.UNORDERED}" else ""
+
+    private fun read(): UiSnapshot {
+        checkActive()
+        return driver.capture().also(BackfillPagePolicy::validate)
+    }
+    private fun act(action: () -> Boolean) {
+        checkActive()
+        check(action()) { "安全页面操作失败，未完整扫描" }
+        driver.pause()
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddLaunchFallback.kt

@@ -0,0 +1,8 @@
+package cn.ilapage.goauto.agent.automation
+
+internal object PddLaunchFallback {
+    fun open(preferDirect: Boolean, direct: () -> Boolean, browser: () -> Boolean): Boolean {
+        if (preferDirect && runCatching(direct).getOrDefault(false)) return true
+        return runCatching(browser).getOrDefault(false)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddNavigation.kt

@@ -31,11 +31,21 @@ object PddPageClassifier {
 }
 
 class PddLinkLauncher(private val context: Context) {
-    fun open(url: String): Boolean {
+    fun open(url: String, preferDirect: Boolean = false): Boolean {
         val uri = runCatching { Uri.parse(url) }.getOrNull() ?: return false
         if (uri.scheme !in setOf("http", "https") || !isPddHost(uri.host) || uri.getQueryParameter("goods_id").isNullOrBlank()) {
             return false
         }
+        return PddLaunchFallback.open(preferDirect, direct = {
+            val direct = Intent(Intent.ACTION_VIEW, uri)
+                .setPackage("com.xunmeng.pinduoduo")
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK)
+            context.startActivity(direct)
+            true
+        }, browser = { openBrowser(uri) })
+    }
+
+    private fun openBrowser(uri: Uri): Boolean {
         val base = Intent(Intent.ACTION_VIEW, uri).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
         val browser = BROWSER_PACKAGES.firstOrNull { packageName ->
             runCatching { context.packageManager.getPackageInfo(packageName, 0) }.isSuccess

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddProductDetailCollector.kt

@@ -99,6 +99,8 @@ object PddSoldOutRecoveryDefaults {
     const val SETTLE_MILLIS = 2_000L
 }
 
+data class PurchasePanelContext(val container: SnapshotNode, val exactColor: String)
+
 data class ParsedPddScreen(
     val summary: ProductSummary,
     val dimensions: List<VisibleDimension>,
@@ -128,6 +130,10 @@ data class ParsedPddScreen(
     val bottomPurchaseEntryCount: Int,
     val problem: PageProblem?,
     val sourceNodes: List<SnapshotNode>,
+    val isPddPackage: Boolean,
+    val hasCloseControl: Boolean = false,
+    val hasPaymentArea: Boolean = false,
+    val purchaseContextMatched: Boolean = false,
 ) {
     fun isTransientSoldOut(
         exactText: String,
@@ -162,6 +168,7 @@ data class ParsedPddScreen(
 }
 
 object PddScreenParser {
+    private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
     private data class SafeSpecEntry(val anchor: SnapshotNode, val clickTarget: SnapshotNode)
     private val pricePattern = Regex("[¥￥]\\s*([0-9]+(?:\\.[0-9]{1,2})?)")
     private val salesPattern = Regex("已拼\\s*[0-9]+(?:\\.[0-9]+)?\\s*(?:万|亿)?\\s*\\+?\\s*(?:件|人)?")
@@ -179,7 +186,7 @@ object PddScreenParser {
     // purchase/order/payment controls must never become collection click targets.
     private val nonConfigurableClickDenylist = listOf("提交订单", "确认订单", "支付", "付款")
 
-    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?): ParsedPddScreen {
+    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?, purchaseContext: PurchasePanelContext? = null): ParsedPddScreen {
         val visibleNodes = snapshot.nodes.filter { it.visible }
         val visible = visibleNodes.mapNotNull { node ->
             val descendants = descendants(node, visibleNodes)
@@ -304,9 +311,24 @@ object PddScreenParser {
         // Opening evidence is intentionally independent from whether the current
         // viewport still exposes a clickable spec value. PDD may hide the only
         // selected value or restore a previously scrolled confirmation panel.
+        val continuedPurchasePanel = snapshot.packageName == PDD_PACKAGE && problem == null &&
+            purchaseContext != null && headedPanelScrollable != null &&
+            headedPanelScrollable.path == purchaseContext.container.path &&
+            headedPanelScrollable.className == purchaseContext.container.className &&
+            kotlin.math.abs(headedPanelScrollable.bounds.left - purchaseContext.container.bounds.left) <= 32 &&
+            kotlin.math.abs(headedPanelScrollable.bounds.right - purchaseContext.container.bounds.right) <= 32 &&
+            minOf(headedPanelScrollable.bounds.bottom, purchaseContext.container.bounds.bottom) >
+                maxOf(headedPanelScrollable.bounds.top, purchaseContext.container.bounds.top)
+        val structuredSelectionPanel = headedPanelScrollable != null &&
+            (headings.size >= 2 || (continuedPurchasePanel && headings.isNotEmpty())) &&
+            dimensions.any { it.values.isNotEmpty() } && hasClose &&
+            hasQuantityControls && hasPaymentArea && hasOrderSubmitAction
+        // Some selected-spec panels omit both the "已选" prefix and a confirm
+        // button. Keep the same structural evidence required for checkout.
         val specPanelType = when {
             quickConfirmationEvidence -> SpecPanelType.QUICK_CONFIRMATION
             orderConfirmationEvidence -> SpecPanelType.ORDER_CONFIRMATION
+            structuredSelectionPanel -> SpecPanelType.NORMAL_SCROLLABLE
             panelScrollable != null && (hasSelectionSummary || hasSubmitHint || (hasPanelTitle && hasPanelAction)) -> SpecPanelType.NORMAL_SCROLLABLE
             hasSelectionSummary && hasPanelTitle && hasPanelAction -> SpecPanelType.NON_SCROLLABLE_CONFIRMATION
             // Some PDD builds expose the complete selector as non-scrollable
@@ -320,6 +342,28 @@ object PddScreenParser {
             else -> SpecPanelType.UNKNOWN
         }
         val panelOpen = specPanelType != SpecPanelType.UNKNOWN
+        val unprefixedSummary = if (structuredSelectionPanel) {
+            val quantity = quantityInputs.single()
+            val knownColors = (dimensions.filter { it.key == "color" }.flatMap { it.values }.map { it.text } +
+                listOfNotNull(purchaseContext?.exactColor?.takeIf { continuedPurchasePanel && it.isNotBlank() })).distinct()
+            val byPath = visibleNodes.associateBy { it.path }
+            var region = quantity.parentPath?.let(byPath::get)
+            var summary: String? = null
+            while (region != null && region.bounds.bottom <= headedPanelScrollable!!.bounds.top) {
+                val candidates = visible.filter { node ->
+                    node.path.startsWith("${region!!.path}/") && !node.clickable &&
+                        node.className?.endsWith("TextView") == true &&
+                        node.bounds.bottom <= quantity.bounds.top && node.label.length <= 160 &&
+                        knownColors.any { SpecValueNormalizer.summaryHasExactToken(node.label, it) }
+                }.map { it.label }.distinct()
+                if (candidates.isNotEmpty()) {
+                    summary = candidates.singleOrNull()
+                    break
+                }
+                region = region.parentPath?.let(byPath::get)
+            }
+            summary
+        } else null
         val firstHeadingTop = headings.firstOrNull()?.bounds?.top ?: Int.MAX_VALUE
         val price = visible.asSequence()
             .filter { it.bounds.top < firstHeadingTop }
@@ -337,7 +381,7 @@ object PddScreenParser {
         val nestedSpecEntry = nestedSpecEntries.singleOrNull()
         val bottomSpecEntries = if (panelOpen || explicitSpecEntry != null || nestedSpecEntry != null) emptyList() else
             safeBottomSpecEntries(visibleNodes, visible, config)
-        val bottomSpecEntry = bottomSpecEntries.singleOrNull()
+        val bottomSpecEntry = bottomSpecEntries.firstOrNull()
         val candidateSpecEntry = explicitSpecEntry ?: nestedSpecEntry?.anchor ?: bottomSpecEntry?.anchor
         val candidateClickTarget = explicitSpecEntry ?: nestedSpecEntry?.clickTarget ?: bottomSpecEntry?.clickTarget
         val reviewPageOpen = isReviewPage(visibleNodes, visible, screenHeight, candidateSpecEntry, config)
@@ -347,7 +391,8 @@ object PddScreenParser {
             reviewPageOpen -> null
             explicitSpecEntry != null -> "explicit_selection"
             nestedSpecEntry != null -> "nested_selection"
-            bottomSpecEntry != null -> "bottom_purchase"
+            bottomSpecEntries.size == 1 -> "bottom_purchase"
+            bottomSpecEntry != null -> "bottom_purchase_rightmost"
             else -> null
         }
         val quickConfirmationEntry = if (quickConfirmationEvidence) quickConfirmationSpecEntry(visibleNodes, visible, config) else null
@@ -370,7 +415,7 @@ object PddScreenParser {
             selectedSummary = labels.firstOrNull {
                 val compact = it.replace(" ", "")
                 textAliases.selection.selectedPrefixes.any(compact::startsWith)
-            },
+            } ?: unprefixedSummary,
             priceCent = price,
             specPanelOpen = panelOpen,
             specPanelType = specPanelType,
@@ -389,6 +434,9 @@ object PddScreenParser {
             panelHeadingCount = headings.size,
             panelOptionCount = dimensions.sumOf { it.values.size },
             hasSelectionSummary = hasSelectionSummary,
+            hasCloseControl = hasClose,
+            hasPaymentArea = hasPaymentArea,
+            purchaseContextMatched = continuedPurchasePanel,
             hasQuantityControls = hasQuantityControls,
             hasOrderSubmitAction = hasOrderSubmitAction,
             explicitSpecEntryCount = explicitSpecEntries.size,
@@ -396,6 +444,7 @@ object PddScreenParser {
             bottomPurchaseEntryCount = bottomSpecEntries.size,
             problem = problem,
             sourceNodes = visibleNodes,
+            isPddPackage = snapshot.packageName == PDD_PACKAGE,
         )
     }
 
@@ -539,7 +588,7 @@ object PddScreenParser {
                 val normalizedTarget = normalizedByPath[clickTarget.path] ?: return@mapNotNull null
                 SafeSpecEntry(normalizedAnchor, normalizedTarget) to clickTarget.bounds.width.toLong() * clickTarget.bounds.height
             }
-            .sortedWith(compareBy<Pair<SafeSpecEntry, Long>> { it.second }.thenByDescending { it.first.clickTarget.bounds.centerX })
+            .sortedWith(compareByDescending<Pair<SafeSpecEntry, Long>> { it.first.clickTarget.bounds.centerX }.thenBy { it.second })
             .map { it.first }
             .distinctBy { it.clickTarget.path }
             .toList()

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseLiveAutomation.kt

@@ -36,6 +36,58 @@ class PurchaseLiveAutomation(
     private var submitAttempted = false
     var lastOrderReadFailure: PurchaseOrderReadFailure? = null
         private set
+
+    /**
+     * Advances an already verified spec selector to the order confirmation
+     * page. Only the selector's unique exact confirm button is clickable; an
+     * order-submit or payment control can never satisfy this transition.
+     */
+    fun advanceToOrderConfirmation(allowUnclassifiedPanelWithSelectionProof: Boolean = false) {
+        var snapshot = driver.capture()
+        pageProblem(snapshot)
+        if (orderConfirmationReady(snapshot)) return
+        if (snapshot.packageName != PDD_PACKAGE) {
+            fail("PURCHASE_SPEC_CONFIRMATION_NOT_READY", "当前不是拼多多规格页面，未创建订单")
+        }
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        val unclassifiedSelectionPanelWithProof = allowUnclassifiedPanelWithSelectionProof &&
+            screen.specPanelType == SpecPanelType.UNKNOWN &&
+            screen.priceCent != null &&
+            snapshot.nodes.count {
+                it.visible && it.enabled && it.className?.endsWith("EditText") == true && it.label.toLongOrNull() != null
+            } == 1
+        if (
+            screen.specPanelType !in setOf(SpecPanelType.NORMAL_SCROLLABLE, SpecPanelType.NON_SCROLLABLE_CONFIRMATION) &&
+            !unclassifiedSelectionPanelWithProof
+        ) {
+            fail("PURCHASE_SPEC_CONFIRMATION_NOT_READY", "当前规格面板不能安全确认，未创建订单")
+        }
+        val aliases = PurchaseRehearsalExecutor.DEFAULT_COLLECTOR.textAliases.specPanel.confirmAliases
+            .map { it.replace(" ", "") }
+            .toSet()
+        val targets = snapshot.nodes.filter { node ->
+            node.visible && node.enabled && node.clickable && node.label.replace(" ", "") in aliases
+        }.distinctBy { it.path }
+        if (targets.isEmpty()) {
+            fail("PURCHASE_SPEC_CONFIRM_TARGET_MISSING", "没有找到唯一的规格确认按钮，未创建订单")
+        }
+        if (targets.size > 1) {
+            fail("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", "规格确认按钮不唯一，未创建订单")
+        }
+        when (driver.clickFresh(targets.single())) {
+            FreshActionResult.SUCCESS -> Unit
+            FreshActionResult.AMBIGUOUS -> fail("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", "规格确认按钮不唯一，未创建订单")
+            else -> fail("PURCHASE_SPEC_CONFIRM_CLICK_FAILED", "规格确认按钮点击失败，未创建订单")
+        }
+        repeat(SPEC_CONFIRMATION_MAX_SAMPLES) {
+            pause(SPEC_CONFIRMATION_SAMPLE_INTERVAL_MS)
+            snapshot = driver.capture()
+            pageProblem(snapshot)
+            if (orderConfirmationReady(snapshot)) return
+        }
+        fail("PURCHASE_SPEC_CONFIRMATION_UNCONFIRMED", "规格确认后没有进入订单确认页，未创建订单")
+    }
+
     fun updateShippingAddress(addressSuffix: String): ShippingAddressProof {
         if (!addressSuffix.matches(Regex("^_cg[1-9][0-9]*$"))) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "采购任务的地址标记无效")
         var snapshot = driver.capture()
@@ -43,12 +95,31 @@ class PurchaseLiveAutomation(
         var unchangedCount = 0
         for (attempt in 0 until 5) {
             pageProblem(snapshot)
-            val entries = mergedDirect(snapshot.nodes.filter { it.visible && it.enabled && MASKED_PHONE.containsMatchIn(it.label) })
-            if (entries.size == 1) {
-                when (driver.tapPurchaseFresh(entries.single())) {
+            val resolution = resolveAddressEntries(snapshot)
+            if (resolution.addressCardCount > 1 || resolution.tapTargetCount > 1) {
+                fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${resolution.diagnostic()}]")
+            }
+            if (resolution.target != null) {
+                pause(ADDRESS_ENTRY_STABLE_INTERVAL_MS)
+                val stableSnapshot = driver.capture()
+                pageProblem(stableSnapshot)
+                val stableResolution = resolveAddressEntries(stableSnapshot)
+                if (stableResolution.addressCardCount > 1 || stableResolution.tapTargetCount > 1) {
+                    fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${stableResolution.diagnostic()}]")
+                }
+                if (stableResolution.target == null || stableResolution.fingerprint() != resolution.fingerprint()) {
+                    snapshot = stableSnapshot
+                    continue
+                }
+                val target = stableResolution.target
+                val result = when (target.activation) {
+                    AddressEntryActivation.CLICK -> driver.clickAddressEntryFresh(target.node).result
+                    AddressEntryActivation.TAP -> driver.tapPurchaseFresh(target.node)
+                }
+                when (result) {
                     FreshActionResult.SUCCESS -> Unit
-                    FreshActionResult.AMBIGUOUS -> fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单")
-                    else -> fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口点击失败，未创建订单")
+                    FreshActionResult.AMBIGUOUS -> fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单 [${stableResolution.diagnostic()}]")
+                    else -> fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口点击失败，未创建订单 [${stableResolution.diagnostic()}]")
                 }
                 pause(1_000)
                 snapshot = waitFor("PURCHASE_ADDRESS_PANEL_TIMEOUT", "收货地址页面打开超时，未创建订单") {
@@ -56,7 +127,9 @@ class PurchaseLiveAutomation(
                 }
                 return editAndVerifyAddress(snapshot, addressSuffix)
             }
-            if (entries.size > 1) fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "收货地址入口不唯一，未创建订单")
+            if (resolution.phoneNodeCount > 0) {
+                fail("PURCHASE_ADDRESS_ENTRY_NOT_READY", "收货地址入口无法安全定位，未创建订单 [${resolution.diagnostic()}]")
+            }
             val panel = purchasePanelScrollTargets(snapshot)
             if (panel.size != 1) fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "没有找到唯一的规格面板滚动区域，未创建订单")
             val signature = viewportSignature(snapshot, panel.single())
@@ -72,6 +145,161 @@ class PurchaseLiveAutomation(
         fail("PURCHASE_ADDRESS_PANEL_TIMEOUT", "规格面板下拉后仍未找到收货地址，未创建订单")
     }
 
+    private enum class AddressEntryActivation { CLICK, TAP }
+
+    private data class AddressEntryTarget(
+        val node: SnapshotNode,
+        val activation: AddressEntryActivation,
+        val cardKey: String,
+    )
+
+    private data class AddressCardCandidate(
+        val phone: SnapshotNode,
+        val clickableCard: SnapshotNode?,
+        val semanticKey: String?,
+    )
+
+    private data class AddressEntryResolution(
+        val phoneNodeCount: Int,
+        val addressCardCount: Int,
+        val tapTargetCount: Int,
+        val target: AddressEntryTarget?,
+    ) {
+        fun diagnostic(): String =
+            "phoneNodes=$phoneNodeCount;addressCards=$addressCardCount;tapTargets=$tapTargetCount"
+
+        fun fingerprint(): String? = target?.let {
+            listOf(
+                it.activation.name,
+                it.cardKey,
+                it.node.label,
+                it.node.className.orEmpty(),
+                it.node.bounds.left,
+                it.node.bounds.top,
+                it.node.bounds.right,
+                it.node.bounds.bottom,
+            ).joinToString(":")
+        }
+    }
+
+    private fun resolveAddressEntries(snapshot: UiSnapshot): AddressEntryResolution {
+        val phones = snapshot.nodes.filter {
+            it.visible && it.enabled && maskedPhone(it.label) != null
+        }.distinctBy { it.path }
+        if (phones.isEmpty()) return AddressEntryResolution(0, 0, 0, null)
+
+        val byPath = snapshot.nodes.associateBy(SnapshotNode::path)
+        val candidates = phones.map { phone ->
+            val card = nearestClickableAncestor(phone, byPath)
+            AddressCardCandidate(phone, card, card?.let { addressCardSemanticKey(it, snapshot) })
+        }
+        val groups = mutableListOf<MutableList<AddressCardCandidate>>()
+        candidates.forEach { candidate ->
+            val matching = groups.filter { group -> group.any { sameLogicalAddress(it, candidate) } }
+            if (matching.isEmpty()) {
+                groups += mutableListOf(candidate)
+            } else {
+                val primary = matching.first()
+                primary += candidate
+                matching.drop(1).forEach { duplicate ->
+                    primary += duplicate
+                    groups.remove(duplicate)
+                }
+            }
+        }
+
+        val targets = groups.mapIndexed { index, group ->
+            val clickable = group.filter { it.clickableCard != null }
+                .minWithOrNull(compareBy<AddressCardCandidate>({ nodeArea(requireNotNull(it.clickableCard)) }, { it.phone.path }))
+            if (clickable != null) {
+                AddressEntryTarget(clickable.phone, AddressEntryActivation.CLICK, logicalAddressKey(group, index))
+            } else {
+                AddressEntryTarget(group.minBy { nodeArea(it.phone) }.phone, AddressEntryActivation.TAP, logicalAddressKey(group, index))
+            }
+        }
+
+        val actionable = targets.filter { it.node.bounds.width >= 2 && it.node.bounds.height >= 2 }
+        return AddressEntryResolution(
+            phoneNodeCount = phones.size,
+            addressCardCount = targets.size,
+            tapTargetCount = actionable.size,
+            target = actionable.singleOrNull(),
+        )
+    }
+
+    private fun nearestClickableAncestor(
+        source: SnapshotNode,
+        byPath: Map<String, SnapshotNode>,
+    ): SnapshotNode? {
+        var current: SnapshotNode? = source
+        while (current != null) {
+            if (current.clickable && current.visible && current.enabled) return current
+            current = current.parentPath?.let(byPath::get)
+        }
+        return null
+    }
+
+    private fun addressCardSemanticKey(card: SnapshotNode, snapshot: UiSnapshot): String? {
+        val labels = snapshot.nodes.asSequence()
+            .filter { it.visible && (it.path == card.path || it.path.startsWith("${card.path}/")) }
+            .map { normalizeAddressSemantic(it.label) }
+            .filter { it.isNotBlank() && maskedPhone(it) == null && it !in ADDRESS_CARD_GENERIC_LABELS }
+            .distinct()
+            .sorted()
+            .toList()
+        if (labels.none { it.length >= ADDRESS_SEMANTIC_MIN_LENGTH }) return null
+        return labels.joinToString("|")
+    }
+
+    private fun normalizeAddressSemantic(value: String): String = value
+        .replace(Regex("\\s+"), "")
+        .replace("，", ",")
+        .replace("：", ":")
+        .lowercase()
+
+    private fun sameLogicalAddress(first: AddressCardCandidate, second: AddressCardCandidate): Boolean {
+        if (maskedPhone(first.phone.label) != maskedPhone(second.phone.label)) return false
+        if (first.clickableCard?.path != null && first.clickableCard.path == second.clickableCard?.path) return true
+        if (sameAddressRegion(first.phone, second.phone)) return true
+        val firstCard = first.clickableCard
+        val secondCard = second.clickableCard
+        if (firstCard != null && secondCard != null && boundsRepresentSameRegion(firstCard.bounds, secondCard.bounds)) return true
+        return first.semanticKey != null && first.semanticKey == second.semanticKey
+    }
+
+    private fun boundsRepresentSameRegion(first: NodeBounds, second: NodeBounds): Boolean {
+        val overlapWidth = (minOf(first.right, second.right) - maxOf(first.left, second.left)).coerceAtLeast(0)
+        val overlapHeight = (minOf(first.bottom, second.bottom) - maxOf(first.top, second.top)).coerceAtLeast(0)
+        val overlap = overlapWidth.toLong() * overlapHeight
+        val smaller = minOf(first.width.toLong() * first.height, second.width.toLong() * second.height)
+        return smaller > 0 && overlap * 100 >= smaller * ADDRESS_CARD_OVERLAP_PERCENT
+    }
+
+    private fun logicalAddressKey(group: List<AddressCardCandidate>, index: Int): String {
+        val semantic = group.mapNotNull(AddressCardCandidate::semanticKey).distinct().singleOrNull()
+        return semantic?.let { "semantic:$it" } ?: "geometry:$index:${group.minOf { it.phone.bounds.top }}"
+    }
+
+    private fun sameAddressRegion(first: SnapshotNode, second: SnapshotNode): Boolean {
+        if (maskedPhone(first.label) != maskedPhone(second.label)) return false
+        val overlapWidth = (minOf(first.bounds.right, second.bounds.right) - maxOf(first.bounds.left, second.bounds.left)).coerceAtLeast(0)
+        val overlapHeight = (minOf(first.bounds.bottom, second.bounds.bottom) - maxOf(first.bounds.top, second.bounds.top)).coerceAtLeast(0)
+        val overlap = overlapWidth.toLong() * overlapHeight
+        val smaller = minOf(nodeArea(first), nodeArea(second))
+        val containsCenter = (
+            first.bounds.centerX in second.bounds.left..second.bounds.right &&
+                first.bounds.centerY in second.bounds.top..second.bounds.bottom
+            ) || (
+            second.bounds.centerX in first.bounds.left..first.bounds.right &&
+                second.bounds.centerY in first.bounds.top..first.bounds.bottom
+            )
+        return (smaller > 0 && overlap * 100 >= smaller * 50) || containsCenter
+    }
+
+    private fun maskedPhone(value: String): String? = MASKED_PHONE.find(value)?.value
+
+    private fun nodeArea(node: SnapshotNode): Long = node.bounds.width.toLong() * node.bounds.height
+
     fun finalConfirmation(input: PurchaseExecutionInput, address: ShippingAddressProof): FinalConfirmationEvidence {
         val snapshot = driver.capture()
         pageProblem(snapshot)
@@ -117,7 +345,8 @@ class PurchaseLiveAutomation(
             return null
         }
         val labels = linkedSetOf<String>()
-        var backedOutOfPayment = false
+        var paymentBackAttempts = 0
+        var consecutivePaymentSamplesAfterBack = 0
         var backedOutOfChooser = false
         var restoredFromWechat = false
         var pddObservedAfterWechatRestore = false
@@ -170,17 +399,27 @@ class PurchaseLiveAutomation(
             // it permits only bounded reading gestures below, never a payment click.
             val paymentVisible = isKnownPddPaymentActivity(snapshot) && !orderContextVisible && !unpaidContextVisible
             if (paymentVisible) {
-                if (!backedOutOfPayment) {
-                    backedOutOfPayment = true
+                if (paymentBackAttempts == 0) {
+                    paymentBackAttempts++
                     if (!driver.backPurchase()) {
                         return unknown("PURCHASE_ORDER_PAYMENT_BACK_FAILED", "支付页无法安全返回订单详情")
                     }
                     pause(500)
                 } else {
-                    return unknown("PURCHASE_ORDER_PAYMENT_REPEATED", "支付页重复出现，已停止自动核单")
+                    consecutivePaymentSamplesAfterBack++
+                    if (consecutivePaymentSamplesAfterBack >= ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES) {
+                        return unknown(
+                            "PURCHASE_ORDER_PAYMENT_REPEATED",
+                            "支付页安全返回后持续无订单证据，已停止自动核单" +
+                                "[paymentBackAttempts=$paymentBackAttempts;" +
+                                "consecutivePaymentSamplesAfterBack=$consecutivePaymentSamplesAfterBack]",
+                        )
+                    }
+                    pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
                 }
                 return@repeat
             }
+            consecutivePaymentSamplesAfterBack = 0
             if (!orderContextVisible && !unpaidContextVisible) {
                 val entries = orderDetailEntryTargets(snapshot)
                 if (entries.size > 1) {
@@ -248,14 +487,62 @@ class PurchaseLiveAutomation(
         click(save.single(), "保存地址")
         val savedEvidence = waitForStableAddressEditorExit()
         if (!hasFinalSavedAddressEvidence(savedEvidence, expected, suffix)) {
-            if (!driver.backPurchase()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存后无法返回订单页面，未创建订单")
-            waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
-                hasFinalSavedAddressEvidence(it, expected, suffix)
+            if (isPurchaseConfirmationPanel(savedEvidence)) {
+                restoreFinalEvidenceInCurrentPanel(savedEvidence, expected, suffix)
+            } else {
+                if (!driver.backPurchase()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存后无法返回订单页面，未创建订单")
+                waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
+                    hasFinalSavedAddressEvidence(it, expected, suffix)
+                }
             }
         }
         return ShippingAddressProof(expected, suffix)
     }
 
+    private fun isPurchaseConfirmationPanel(snapshot: UiSnapshot): Boolean {
+        if (snapshot.packageName != PDD_PACKAGE || shippingAddressEditors(snapshot).isNotEmpty()) return false
+        val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        return screen.specPanelType in setOf(
+            SpecPanelType.NORMAL_SCROLLABLE,
+            SpecPanelType.NON_SCROLLABLE_CONFIRMATION,
+            SpecPanelType.ORDER_CONFIRMATION,
+        )
+    }
+
+    private fun restoreFinalEvidenceInCurrentPanel(
+        initial: UiSnapshot,
+        expected: String,
+        suffix: String,
+    ) {
+        var snapshot = initial
+        var previousSignature: String? = null
+        repeat(ADDRESS_CONFIRMATION_SCROLL_LIMIT) { attempt ->
+            if (hasFinalSavedAddressEvidence(snapshot, expected, suffix)) return
+            if (!isPurchaseConfirmationPanel(snapshot)) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后采购面板发生变化，未创建订单")
+            }
+            val panels = purchasePanelScrollTargets(snapshot)
+            if (panels.size != 1) {
+                fail("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", "地址保存后没有找到唯一的规格面板滚动区域，未创建订单")
+            }
+            val panel = panels.single()
+            val signature = viewportSignature(snapshot, panel)
+            if (signature == previousSignature) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板未找到完整订单确认信息，未创建订单")
+            }
+            previousSignature = signature
+            if (!driver.swipePurchaseIn(panel, SwipeDirection.DOWN, 350)) {
+                fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板无法定位订单确认信息，未创建订单")
+            }
+            if (attempt < ADDRESS_CONFIRMATION_SCROLL_LIMIT - 1) pause(ADDRESS_CONFIRMATION_SCROLL_INTERVAL_MS)
+            snapshot = driver.capture()
+            pageProblem(snapshot)
+        }
+        if (!hasFinalSavedAddressEvidence(snapshot, expected, suffix)) {
+            fail("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后规格面板未找到完整订单确认信息，未创建订单")
+        }
+    }
+
     private fun hasSavedAddressEvidence(snapshot: UiSnapshot, expected: String, suffix: String): Boolean {
         if (snapshot.packageName != PDD_PACKAGE || shippingAddressEditors(snapshot).isNotEmpty()) return false
         val visible = snapshot.nodes.filter { it.visible }
@@ -318,7 +605,7 @@ class PurchaseLiveAutomation(
     private fun viewportSignature(snapshot: UiSnapshot, panel: SnapshotNode): String = snapshot.nodes
         .filter { node -> node.visible && inside(node.bounds, panel.bounds) }
         .joinToString("|") { node ->
-            listOf(node.className.orEmpty(), node.bounds.left, node.bounds.top, node.bounds.right, node.bounds.bottom, node.clickable, node.scrollable).joinToString(":")
+            listOf(node.path, node.className.orEmpty(), node.bounds.left, node.bounds.top, node.bounds.right, node.bounds.bottom, node.clickable, node.scrollable).joinToString(":")
         }
 
     private fun inside(child: NodeBounds, parent: NodeBounds): Boolean =
@@ -396,6 +683,13 @@ class PurchaseLiveAutomation(
         snapshot.nodes.filter { node -> node.visible && node.enabled && FINAL_SUBMIT_MARKERS.any { node.label == it || node.label.startsWith(it) } },
     )
 
+    private fun orderConfirmationReady(snapshot: UiSnapshot): Boolean {
+        if (snapshot.packageName != PDD_PACKAGE) return false
+        if (snapshot.nodes.any { it.visible && it.enabled && MASKED_PHONE.containsMatchIn(it.label) }) return true
+        return PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null).specPanelType ==
+            SpecPanelType.ORDER_CONFIRMATION
+    }
+
     /** A post-submit navigation target is allowed only when it is one exact, non-payment PDD order-detail entry. */
     private fun orderDetailEntryTargets(snapshot: UiSnapshot): List<SnapshotNode> = uniqueClickable(
         snapshot,
@@ -469,7 +763,16 @@ class PurchaseLiveAutomation(
         const val ORDER_RESULT_MAX_SAMPLES = 60
         const val ORDER_RESULT_MAX_EMPTY_SAMPLES = 15
         const val ORDER_RESULT_WECHAT_RESTORE_MAX_SAMPLES = 15
+        const val ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES = 3
         const val ORDER_RESULT_SCROLL_SAMPLE_INTERVAL = 15
         const val ORDER_RESULT_SAMPLE_INTERVAL_MS = 200L
+        const val SPEC_CONFIRMATION_MAX_SAMPLES = 20
+        const val SPEC_CONFIRMATION_SAMPLE_INTERVAL_MS = 100L
+        const val ADDRESS_ENTRY_STABLE_INTERVAL_MS = 200L
+        const val ADDRESS_CARD_OVERLAP_PERCENT = 70
+        const val ADDRESS_SEMANTIC_MIN_LENGTH = 4
+        val ADDRESS_CARD_GENERIC_LABELS = setOf("收货地址", "修改", "默认地址", "默认")
+        const val ADDRESS_CONFIRMATION_SCROLL_LIMIT = 5
+        const val ADDRESS_CONFIRMATION_SCROLL_INTERVAL_MS = 500L
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseRehearsalExecutor.kt

@@ -10,7 +10,26 @@ interface PurchaseUiDriver {
         result = clickFresh(target),
         reason = FreshClickReason.UNKNOWN,
     )
+    /**
+     * Reacquires one address-entry node by its accessibility path and validates
+     * its immutable snapshot traits before clicking its nearest clickable
+     * ancestor. This is intentionally limited to the reversible transition
+     * from order confirmation into address management.
+     */
+    fun clickAddressEntryFresh(target: SnapshotNode): FreshClickOutcome = clickFreshDetailed(target)
     fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult
+    /**
+     * Reacquires and center-taps a target that the purchase parser has already
+     * accepted as either a safe spec entry or one exact spec value. Callers
+     * must still verify the semantic postcondition from a fresh snapshot.
+     */
+    fun tapSpecFresh(target: SnapshotNode): FreshActionResult = FreshActionResult.FAILED
+    /**
+     * Reacquires a parsed spec option and swipes only its nearest horizontal
+     * scrollable ancestor. There is deliberately no global fallback.
+     */
+    fun swipeSpecRow(target: SnapshotNode, direction: SwipeDirection): Boolean = false
+    fun specRowSwipeFailureReason(): String = "gestureFailed"
     fun inputFresh(target: SnapshotNode, value: String): FreshActionResult
     fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean
     fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean
@@ -20,6 +39,21 @@ interface PurchaseUiDriver {
     fun bringPddToForeground(): Boolean = false
 }
 
+internal object PurchaseSpecGesturePolicy {
+    private val forbiddenLabels = listOf(
+        "提交订单", "创建订单", "确认订单", "确认购买", "支付", "付款",
+        "收货地址", "修改地址", "保存地址",
+    )
+
+    fun isAllowed(target: SnapshotNode, screenWidth: Int, screenHeight: Int): Boolean {
+        val label = target.label.replace(" ", "")
+        return target.visible && target.enabled && label.isNotBlank() &&
+            forbiddenLabels.none(label::contains) &&
+            target.bounds.width >= 2 && target.bounds.height >= 2 &&
+            target.bounds.centerX in 0 until screenWidth && target.bounds.centerY in 0 until screenHeight
+    }
+}
+
 data class PurchaseExecutionInput(
     val taskId: Long,
     val executionMode: String,
@@ -54,7 +88,10 @@ class PurchaseRehearsalExecutor(
     private val panelDiagnostic: (String) -> Unit = {},
     private val beforeOrderSubmit: (FinalConfirmationEvidence) -> Unit = { throw PurchaseLiveException("PURCHASE_MODE_NOT_ALLOWED", "当前执行器没有正式采购授权") },
 ) {
+    private var purchasePanelContext: PurchasePanelContext? = null
+
     fun execute(input: PurchaseExecutionInput, rule: PurchaseRule, supportedCapabilities: Set<String>): PurchaseExecutionOutcome {
+        purchasePanelContext = null
         validateBeforeDeviceAction(input, rule, supportedCapabilities)?.let { return it }
         var observedPrice: Long? = null
         var addressProof: ShippingAddressProof? = null
@@ -62,6 +99,15 @@ class PurchaseRehearsalExecutor(
         val specSelectionProofs = mutableMapOf<String, ExactSpecSelectionProof>()
         val live = PurchaseLiveAutomation(driver, pause)
         for (action in rule.actions) {
+            // The immediate phase-two handoff can reuse the PDD page retained by
+            // spec_probe. A later manual retry may start from Agent (or another
+            // unrelated screen), so only skip navigation when a fresh snapshot
+            // still carries safe PDD product/spec evidence.
+            if (
+                input.phase == "purchase" &&
+                action.type == PurchaseActionType.OPEN_PRODUCT &&
+                canReuseCurrentProduct(input)
+            ) continue
             stepChanged(action.type.wireName)
             val failure = when (action.type) {
                 PurchaseActionType.OPEN_PRODUCT -> openProduct(input, action)
@@ -80,6 +126,7 @@ class PurchaseRehearsalExecutor(
                     null
                 }
                 PurchaseActionType.UPDATE_SHIPPING_ADDRESS -> try {
+                    live.advanceToOrderConfirmation(hasAllRecordedSelectionProofs(input, specSelectionProofs))
                     addressProof = live.updateShippingAddress(input.addressSuffix)
                     null
                 } catch (error: PurchaseLiveException) {
@@ -131,6 +178,11 @@ class PurchaseRehearsalExecutor(
         else failure("PURCHASE_RULE_INVALID", "正式采购规则缺少核单动作")
     }
 
+    private fun canReuseCurrentProduct(input: PurchaseExecutionInput): Boolean =
+        currentScreen(input).let { screen ->
+            screen.problem == null && screen.hasPurchaseProductEvidence()
+        }
+
     private fun validateBeforeDeviceAction(
         input: PurchaseExecutionInput,
         rule: PurchaseRule,
@@ -182,15 +234,26 @@ class PurchaseRehearsalExecutor(
     }
 
     private fun openProduct(input: PurchaseExecutionInput, action: PurchaseAction): PurchaseExecutionOutcome? {
+        purchasePanelContext = null
         if (!openLink(input.url)) return failure("PDD_LINK_INVALID", "任务中的 PDD 链接无法打开")
         val aliases = action.textAliases ?: listOf("打开拼多多APP", "打开拼多多 App", "打开")
         var clickAttempted = false
         var nextClickPoll = 0
         var lastClickReason = FreshClickReason.UNKNOWN
+        var stableEvidenceReads = 0
+        var pddForegroundObserved = false
         repeat(OPEN_PRODUCT_POLL_LIMIT) { poll ->
             val snapshot = driver.capture()
             pageProblem(snapshot)?.let { return it }
-            if (snapshot.packageName == PDD_PACKAGE) return null
+            if (snapshot.packageName == PDD_PACKAGE) {
+                pddForegroundObserved = true
+                val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null)
+                stableEvidenceReads = if (screen.hasPurchaseProductEvidence()) stableEvidenceReads + 1 else 0
+                if (stableEvidenceReads >= PRODUCT_PAGE_STABLE_READS) return null
+                pause(OPEN_PRODUCT_POLL_MILLIS)
+                return@repeat
+            }
+            stableEvidenceReads = 0
             val candidates = snapshot.nodes.filter { it.visible && it.enabled && it.label in aliases }
             if (candidates.size > 1) return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
             if (candidates.size == 1 && poll >= nextClickPoll) {
@@ -208,6 +271,9 @@ class PurchaseRehearsalExecutor(
             }
             pause(OPEN_PRODUCT_POLL_MILLIS)
         }
+        if (pddForegroundObserved) {
+            return failure("PDD_DETAIL_ENTRY_FAILED", "打开拼多多后未识别到稳定商品页面")
+        }
         if (clickAttempted) {
             val message = when (lastClickReason) {
                 FreshClickReason.ROOT_UNAVAILABLE, FreshClickReason.TARGET_NOT_FOUND -> "打开拼多多入口发生变化"
@@ -221,13 +287,20 @@ class PurchaseRehearsalExecutor(
     }
 
     private fun verifyProduct(input: PurchaseExecutionInput): PurchaseExecutionOutcome? {
-        repeat(50) {
+        var stableEvidenceReads = 0
+        repeat(PRODUCT_PAGE_POLL_LIMIT) {
             val snapshot = driver.capture()
             pageProblem(snapshot)?.let { return it }
-            if (snapshot.packageName == PDD_PACKAGE && snapshot.nodes.any { it.visible }) {
-                return recoverSoldOut(input, PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null))
+            val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null)
+            if (screen.hasPurchaseProductEvidence()) {
+                stableEvidenceReads++
+                if (stableEvidenceReads >= PRODUCT_PAGE_STABLE_READS) {
+                    return recoverSoldOut(input, screen)
+                }
+            } else {
+                stableEvidenceReads = 0
             }
-            pause(100)
+            pause(OPEN_PRODUCT_POLL_MILLIS)
         }
         return failure("PDD_DETAIL_ENTRY_FAILED", "没有进入拼多多商品页面")
     }
@@ -266,42 +339,134 @@ class PurchaseRehearsalExecutor(
 
     private fun openSpecPanel(input: PurchaseExecutionInput, action: PurchaseAction): PurchaseExecutionOutcome? {
         var screen = currentScreen(input)
-        if (screen.reviewPageOpen) return leaveUnexpectedReviewPage(input)
-        screen.problem?.let { return failure(it.code, it.message) }
-        if (screen.specPanelOpen) return null
-        val safeCandidates = listOfNotNull(
-            screen.specEntry?.let { anchor -> anchor to (screen.specEntryClickTarget ?: anchor) },
-            screen.quickConfirmationEntry?.let { it to it },
-        ).distinctBy { it.second.path }
-        // A rule alias may only narrow the semantic candidates already accepted
-        // by PddScreenParser. It must never turn into a raw-page text lookup:
-        // review cards and unrelated controls can share arbitrary labels.
-        val candidates = action.textAliases?.let { aliases ->
-            safeCandidates.filter { (anchor, _) -> specEntryMatchesAliases(screen, anchor, aliases) }
-        } ?: safeCandidates
-        if (candidates.size > 1) {
-            panelDiagnostic(specEntryEvidence(screen, candidates.size))
-            return failure(SPEC_ENTRY_TARGET_AMBIGUOUS, "规格入口候选不唯一")
-        }
-        val target = candidates.singleOrNull()?.second ?: run {
-            panelDiagnostic(specEntryEvidence(screen, 0))
-            return failure(SPEC_ENTRY_NOT_FOUND, "没有找到安全的商品规格入口")
-        }
-        val click = driver.clickFreshDetailed(target)
-        when (click.result) {
-            FreshActionResult.AMBIGUOUS -> return failure(SPEC_ENTRY_TARGET_AMBIGUOUS, "规格入口候选不唯一")
-            FreshActionResult.SUCCESS -> Unit
-            else -> return failure(SPEC_ENTRY_CLICK_FAILED, click.reason.specEntrySubreason())
-        }
-        repeat(30) {
-            screen = currentScreen(input)
-            panelDiagnostic(panelEvidence(screen))
+        var entryReadyWaitPolls = 0
+        var target: SnapshotNode? = null
+        while (target == null) {
             if (screen.reviewPageOpen) return leaveUnexpectedReviewPage(input)
             screen.problem?.let { return failure(it.code, it.message) }
             if (screen.specPanelOpen) return null
-            pause(100)
+            val safeCandidates = listOfNotNull(
+                screen.specEntry?.let { anchor -> anchor to (screen.specEntryClickTarget ?: anchor) },
+                screen.quickConfirmationEntry?.let { it to it },
+            ).distinctBy { it.second.path }
+            // A rule alias may only narrow the semantic candidates already accepted
+            // by PddScreenParser. It must never turn into a raw-page text lookup:
+            // review cards and unrelated controls can share arbitrary labels.
+            val candidates = action.textAliases?.let { aliases ->
+                safeCandidates.filter { (anchor, _) -> specEntryMatchesAliases(screen, anchor, aliases) }
+            } ?: safeCandidates
+            if (candidates.size > 1) {
+                panelDiagnostic(specEntryEvidence(screen, candidates.size, entryReadyWaitPolls))
+                return failure(SPEC_ENTRY_TARGET_AMBIGUOUS, "规格入口候选不唯一 [${specEntryEvidence(screen, candidates.size, entryReadyWaitPolls)}]")
+            }
+            target = candidates.singleOrNull()?.second
+            if (target != null) continue
+            if (entryReadyWaitPolls >= SPEC_ENTRY_READY_WAIT_POLLS) {
+                panelDiagnostic(specEntryEvidence(screen, 0, entryReadyWaitPolls))
+                return failure(SPEC_ENTRY_NOT_FOUND, "没有找到安全的商品规格入口 [${specEntryEvidence(screen, 0, entryReadyWaitPolls)}]")
+            }
+            pause(SPEC_ENTRY_READY_POLL_MILLIS)
+            entryReadyWaitPolls++
+            screen = currentScreen(input)
         }
-        return failure(SPEC_PANEL_NOT_OPENED, "点击后未识别到商品规格面板 [${panelEvidence(screen)}]")
+        val beforeSignature = specActionSignature(screen)
+        val click = driver.clickFreshDetailed(requireNotNull(target))
+        when (click.result) {
+            // The parser already narrowed to a single semantic candidate; the
+            // ambiguity here comes from the live tree matching that target more
+            // than once at click time, so the wording must not claim otherwise.
+            FreshActionResult.AMBIGUOUS -> return failure(
+                SPEC_ENTRY_TARGET_AMBIGUOUS,
+                "规格入口点击目标不唯一 [${specEntryEvidence(screen, 1, entryReadyWaitPolls)}]",
+            )
+            else -> Unit
+        }
+
+        var wait = waitForSpecPanel(input, beforeSignature)
+        wait.failure?.let { return it }
+        if (wait.opened) return null
+        if (wait.changed) {
+            return failure(
+                SPEC_PANEL_EVIDENCE_NOT_MATCHED,
+                "规格入口点击后页面已变化，但规格面板强证据不足 [${panelEvidence(wait.screen)}]",
+            )
+        }
+
+        when (driver.tapSpecFresh(requireNotNull(target))) {
+            FreshActionResult.AMBIGUOUS -> return failure(
+                SPEC_ENTRY_TARGET_AMBIGUOUS,
+                "规格入口手势目标不唯一 [${specEntryEvidence(screen, 1, entryReadyWaitPolls)}]",
+            )
+            FreshActionResult.SUCCESS -> Unit
+            else -> return failure(
+                SPEC_ENTRY_CLICK_FAILED,
+                click.reason.specEntrySubreasonAfterGestureFailure(),
+            )
+        }
+        wait = waitForSpecPanel(input, specActionSignature(wait.screen))
+        wait.failure?.let { return it }
+        if (wait.opened) return null
+        if (wait.changed) {
+            return failure(
+                SPEC_PANEL_EVIDENCE_NOT_MATCHED,
+                "规格入口手势后页面已变化，但规格面板强证据不足 [${panelEvidence(wait.screen)}]",
+            )
+        }
+        return failure(
+            SPEC_ENTRY_CLICK_NO_EFFECT,
+            "规格入口无障碍点击和受控手势后页面均无变化 [${panelEvidence(wait.screen)}]",
+        )
+    }
+
+    private data class SpecPanelWait(
+        val screen: ParsedPddScreen,
+        val opened: Boolean,
+        val changed: Boolean,
+        val failure: PurchaseExecutionOutcome? = null,
+    )
+
+    private data class SpecActionNodeSignature(
+        val path: String,
+        val className: String?,
+        val bounds: NodeBounds,
+        val clickable: Boolean,
+        val scrollable: Boolean,
+        val selected: Boolean,
+        val checked: Boolean,
+        val enabled: Boolean,
+        val visible: Boolean,
+    )
+
+    private fun waitForSpecPanel(input: PurchaseExecutionInput, beforeSignature: List<SpecActionNodeSignature>): SpecPanelWait {
+        var last = currentScreen(input)
+        var changed = false
+        repeat(SPEC_POST_CLICK_VERIFY_POLLS) {
+            last = currentScreen(input)
+            panelDiagnostic(panelEvidence(last))
+            if (last.reviewPageOpen) {
+                return SpecPanelWait(last, false, true, leaveUnexpectedReviewPage(input))
+            }
+            last.problem?.let { return SpecPanelWait(last, false, true, failure(it.code, it.message)) }
+            if (last.specPanelOpen) return SpecPanelWait(last, true, true)
+            changed = changed || specActionSignature(last) != beforeSignature
+            pause(SPEC_SELECTION_POLL_MILLIS)
+        }
+        return SpecPanelWait(last, false, changed)
+    }
+
+    /** In-memory only; the signature is never logged, persisted, or uploaded. */
+    private fun specActionSignature(screen: ParsedPddScreen): List<SpecActionNodeSignature> = screen.sourceNodes.map { node ->
+        SpecActionNodeSignature(
+            node.path,
+            node.className,
+            node.bounds,
+            node.clickable,
+            node.scrollable,
+            node.selected,
+            node.checked,
+            node.enabled,
+            node.visible,
+        )
     }
 
     private fun panelEvidence(screen: ParsedPddScreen): String =
@@ -309,11 +474,12 @@ class PurchaseRehearsalExecutor(
             "options=${screen.panelOptionCount};summary=${screen.hasSelectionSummary};quantity=${screen.hasQuantityControls};" +
             "orderAction=${screen.hasOrderSubmitAction};pageEvidence=${screen.pageEvidenceMatched}"
 
-    private fun specEntryEvidence(screen: ParsedPddScreen, candidateCount: Int): String =
+    private fun specEntryEvidence(screen: ParsedPddScreen, candidateCount: Int, entryReadyWaitPolls: Int = 0): String =
         "specEntryCandidates=$candidateCount;explicit=${screen.explicitSpecEntryCount};" +
             "nested=${screen.nestedSpecEntryCount};bottomPurchase=${screen.bottomPurchaseEntryCount};" +
             "panelAlreadyOpen=${screen.specPanelOpen};reviewPage=${screen.reviewPageOpen};" +
-            "pageEvidence=${screen.pageEvidenceMatched}"
+            "pageEvidence=${screen.pageEvidenceMatched};entryReadyWaitPolls=$entryReadyWaitPolls;" +
+            "entryReadyWaitMillis=${entryReadyWaitPolls * SPEC_ENTRY_READY_POLL_MILLIS}"
 
     private fun specEntryMatchesAliases(screen: ParsedPddScreen, candidate: SnapshotNode, aliases: List<String>): Boolean {
         val prefix = "${candidate.path}/"
@@ -342,6 +508,12 @@ class PurchaseRehearsalExecutor(
         else -> "unknown"
     }
 
+    private fun FreshClickReason.specEntrySubreasonAfterGestureFailure(): String = when (this) {
+        FreshClickReason.SUCCESS -> "gesture_failed_after_action_click_no_effect"
+        FreshClickReason.UNKNOWN -> "gesture_failed_after_unclassified_action_result"
+        else -> specEntrySubreason()
+    }
+
     private fun selectSpecs(
         input: PurchaseExecutionInput,
         rule: PurchaseRule,
@@ -369,44 +541,39 @@ class PurchaseRehearsalExecutor(
         target: String,
         selectionProofs: MutableMap<String, ExactSpecSelectionProof>,
     ): PurchaseExecutionOutcome? {
-        var lastClickReason = FreshClickReason.UNKNOWN
-        var clickSucceeded = false
-        repeat(SPEC_SELECTION_CLICK_ATTEMPTS) {
-            val lookup = locateExactSpec(input, dimension, target)
-            lookup.failure?.let { return it }
-            val outcome = driver.clickFreshDetailed(requireNotNull(lookup.node))
-            lastClickReason = outcome.reason
-            if (outcome.result == FreshActionResult.AMBIGUOUS) {
-                return failure(SPEC_TARGET_AMBIGUOUS, "精确规格匹配到多个控件")
-            }
-            clickSucceeded = clickSucceeded || outcome.result == FreshActionResult.SUCCESS
+        val initial = currentScreen(input)
+        initial.problem?.let { return failure(it.code, it.message) }
+        if (rememberExactSelection(initial, dimension, target, selectionProofs)) return null
 
-            // PDD rerenders the remaining options after a color selection. A
-            // stale node can report NOT_FOUND/FAILED even when the exact option
-            // was selected. Always verify the observable selected state before
-            // deciding whether to refind and retry the same exact target.
-            val verifyPolls = if (outcome.result == FreshActionResult.SUCCESS) {
-                SPEC_SELECTION_SUCCESS_VERIFY_POLLS
-            } else {
-                SPEC_SELECTION_FAILED_VERIFY_POLLS
-            }
-            repeat(verifyPolls) {
-                val refreshed = currentScreen(input)
-                refreshed.problem?.let { return failure(it.code, it.message) }
-                if (isExactSpecSelected(refreshed, dimension, target)) {
-                    exactSpecSelectionProof(refreshed, dimension, target)?.let { proof ->
-                        selectionProofs[dimension] = proof
-                    }
-                    return null
-                }
-                pause(SPEC_SELECTION_POLL_MILLIS)
-            }
+        val lookup = locateExactSpec(input, dimension, target)
+        lookup.failure?.let { return it }
+        val outcome = driver.clickFreshDetailed(requireNotNull(lookup.node))
+        if (outcome.result == FreshActionResult.AMBIGUOUS) {
+            return failure(SPEC_TARGET_AMBIGUOUS, "精确规格匹配到多个控件")
         }
+        var verification = waitForExactSelection(input, dimension, target, selectionProofs, SPEC_SELECTION_SUCCESS_VERIFY_POLLS)
+        verification.failure?.let { return it }
+        if (verification.confirmed) return null
 
-        if (clickSucceeded) {
+        // Reacquire the exact option after PDD has had a chance to rerender.
+        // The fallback is still bounded to one center gesture and the same
+        // unique, server-provided exact value.
+        val refreshedLookup = locateExactSpec(input, dimension, target)
+        refreshedLookup.failure?.let { return it }
+        val gesture = driver.tapSpecFresh(requireNotNull(refreshedLookup.node))
+        if (gesture == FreshActionResult.AMBIGUOUS) {
+            return failure(SPEC_TARGET_AMBIGUOUS, "精确规格手势目标不唯一")
+        }
+        if (gesture == FreshActionResult.SUCCESS) {
+            verification = waitForExactSelection(input, dimension, target, selectionProofs, SPEC_SELECTION_SUCCESS_VERIFY_POLLS)
+            verification.failure?.let { return it }
+            if (verification.confirmed) return null
+            return failure(SPEC_SELECTION_UNCONFIRMED, "无障碍点击和受控手势后未能确认精确选中状态")
+        }
+        if (outcome.result == FreshActionResult.SUCCESS) {
             return failure(SPEC_SELECTION_UNCONFIRMED, "点击规格后未能确认精确选中状态")
         }
-        val subreason = when (lastClickReason) {
+        val subreason = when (outcome.reason) {
             FreshClickReason.ROOT_UNAVAILABLE -> SPEC_CLICK_ROOT_UNAVAILABLE
             FreshClickReason.TARGET_NOT_FOUND -> SPEC_CLICK_TARGET_STALE
             FreshClickReason.NO_CLICKABLE_ANCESTOR -> SPEC_CLICK_NO_CLICKABLE_ANCESTOR
@@ -416,12 +583,50 @@ class PurchaseRehearsalExecutor(
         return failure(SPEC_CLICK_FAILED, subreason)
     }
 
+    private data class ExactSelectionWait(
+        val confirmed: Boolean,
+        val failure: PurchaseExecutionOutcome? = null,
+    )
+
+    private fun waitForExactSelection(
+        input: PurchaseExecutionInput,
+        dimension: String,
+        target: String,
+        selectionProofs: MutableMap<String, ExactSpecSelectionProof>,
+        polls: Int,
+    ): ExactSelectionWait {
+        repeat(polls) {
+            val refreshed = currentScreen(input)
+            refreshed.problem?.let { return ExactSelectionWait(false, failure(it.code, it.message)) }
+            if (rememberExactSelection(refreshed, dimension, target, selectionProofs)) return ExactSelectionWait(true)
+            pause(SPEC_SELECTION_POLL_MILLIS)
+        }
+        return ExactSelectionWait(false)
+    }
+
+    private fun rememberExactSelection(
+        screen: ParsedPddScreen,
+        dimension: String,
+        target: String,
+        selectionProofs: MutableMap<String, ExactSpecSelectionProof>,
+    ): Boolean {
+        if (!isExactSpecSelected(screen, dimension, target)) return false
+        exactSpecSelectionProof(screen, dimension, target)?.let { proof -> selectionProofs[dimension] = proof }
+        return true
+    }
+
     private fun isExactSpecSelected(screen: ParsedPddScreen, dimension: String, target: String): Boolean {
         val candidates = screen.dimensions.filter { it.key == dimension }.flatMap { it.values }
+        if (candidates.any { it.text != target && (it.node.selected || it.node.checked) }) return false
         if (candidates.any { it.text == target && (it.node.selected || it.node.checked) }) return true
+        if (screen.specPanelOpen && fullSummaryTargetMatches(screen.selectedSummary, target)) return true
         return summarySelectionMatches(screen.selectedSummary, dimension, target, candidates)
     }
 
+    private fun fullSummaryTargetMatches(summary: String?, target: String): Boolean =
+        summary != null && Regex("(^|[\\s,，、/|;；:：])" + Regex.escape(target) + "($|[\\s,，、/|;；:：])")
+            .containsMatchIn(summary)
+
     private fun summarySelectionMatches(
         summary: String?,
         dimension: String,
@@ -436,7 +641,11 @@ class PurchaseRehearsalExecutor(
         return matchingCandidates.size == 1 && matchingCandidates.single() == target
     }
 
-    private data class ExactSpecSelectionProof(val dimension: String, val target: String)
+    private data class ExactSpecSelectionProof(
+        val dimension: String,
+        val target: String,
+        val panelType: SpecPanelType,
+    )
 
     private fun exactSpecSelectionProof(
         screen: ParsedPddScreen,
@@ -448,8 +657,9 @@ class PurchaseRehearsalExecutor(
         val tokenCandidates = screen.dimensions.filter { it.key == dimension }.flatMap { it.values }.filter { candidate ->
             if (dimension == "size") SpecValueNormalizer.primarySizeToken(candidate.text) == token else candidate.text == token
         }
-        return ExactSpecSelectionProof(dimension, target).takeIf {
-            tokenCandidates.size == 1 && tokenCandidates.single().text == target
+        return ExactSpecSelectionProof(dimension, target, screen.specPanelType).takeIf {
+            (tokenCandidates.size == 1 && tokenCandidates.single().text == target) ||
+                (tokenCandidates.isEmpty() && screen.specPanelOpen && fullSummaryTargetMatches(screen.selectedSummary, target))
         }
     }
 
@@ -458,7 +668,11 @@ class PurchaseRehearsalExecutor(
         val reason: String,
         val summaryTokenMatched: Boolean,
         val candidateCount: Int,
-        val proofPresent: Boolean,
+        val proofRecorded: Boolean,
+        val proofUsable: Boolean,
+        val targetMatchCount: Int = 0,
+        val relocationAttempted: Boolean = false,
+        val relocationSwipes: Int = 0,
     )
 
     private fun verifyExactSpecSelection(
@@ -469,15 +683,25 @@ class PurchaseRehearsalExecutor(
     ): FinalSpecVerification {
         val candidates = screen.dimensions.filter { it.key == dimension }.flatMap { it.values }
         val matchingNodes = candidates.filter { it.text == target }
-        val proofPresent = proof?.dimension == dimension && proof.target == target
+        val proofRecorded = proof?.dimension == dimension && proof.target == target
+        val proofUsable = proofRecorded && (
+            proof?.panelType == screen.specPanelType ||
+                (screen.specPanelType == SpecPanelType.UNKNOWN && screen.isPddPackage && screen.rootAvailable)
+            )
         if (matchingNodes.size == 1 && (matchingNodes.single().node.selected || matchingNodes.single().node.checked)) {
-            return FinalSpecVerification(true, "selected_node", false, candidates.size, proofPresent)
+            return FinalSpecVerification(true, "selected_node", false, candidates.size, proofRecorded, proofUsable, matchingNodes.size)
+        }
+        if (candidates.any { it.text != target && (it.node.selected || it.node.checked) }) {
+            return FinalSpecVerification(false, "visible_selected_conflict", false, candidates.size, proofRecorded, proofUsable, matchingNodes.size)
         }
 
         val token = if (dimension == "size") SpecValueNormalizer.primarySizeToken(target) else target.trim()
         val summaryTokenMatched = !token.isNullOrBlank() && SpecValueNormalizer.summaryHasExactToken(screen.selectedSummary, token)
         if (!summaryTokenMatched) {
-            return FinalSpecVerification(false, "summary_token_missing", false, candidates.size, proofPresent)
+            if (screen.selectedSummary == null && proofUsable) {
+                return FinalSpecVerification(true, "attempt_selection_state", false, candidates.size, true, true, matchingNodes.size)
+            }
+            return FinalSpecVerification(false, "summary_token_missing", false, candidates.size, proofRecorded, proofUsable, matchingNodes.size)
         }
         // PDD can rerender or scroll the previously selected dimension out of
         // the current viewport while the selected summary remains visible. A
@@ -488,18 +712,83 @@ class PurchaseRehearsalExecutor(
             if (dimension == "size") SpecValueNormalizer.primarySizeToken(candidate.text) == token else candidate.text == token
         }
         if (visibleTokenMatches.size == 1 && visibleTokenMatches.single().text == target) {
-            return FinalSpecVerification(true, "visible_candidate", true, candidates.size, proofPresent)
+            return FinalSpecVerification(true, "visible_candidate", true, candidates.size, proofRecorded, proofUsable, matchingNodes.size)
         }
         if (visibleTokenMatches.isNotEmpty()) {
-            return FinalSpecVerification(false, "visible_candidate_conflict", true, candidates.size, proofPresent)
+            return FinalSpecVerification(false, "visible_candidate_conflict", true, candidates.size, proofRecorded, proofUsable, matchingNodes.size)
         }
-        return if (proofPresent) {
-            FinalSpecVerification(true, "attempt_selection_proof", true, candidates.size, true)
+        return if (proofUsable) {
+            FinalSpecVerification(true, "attempt_selection_proof", true, candidates.size, true, true, matchingNodes.size)
         } else {
-            FinalSpecVerification(false, "selection_proof_missing", true, candidates.size, false)
+            FinalSpecVerification(false, "selection_proof_missing", true, candidates.size, proofRecorded, false, matchingNodes.size)
         }
     }
 
+    private fun verifyExactSpecSelectionWithRelocation(
+        input: PurchaseExecutionInput,
+        dimension: String,
+        target: String,
+        proof: ExactSpecSelectionProof?,
+    ): FinalSpecVerification {
+        var screen = currentScreen(input)
+        screen.problem?.let {
+            return FinalSpecVerification(false, it.code, false, 0, proof != null, false)
+        }
+        var verification = verifyExactSpecSelection(screen, dimension, target, proof)
+        if (verification.confirmed || verification.targetMatchCount > 0 || verification.reason == "visible_selected_conflict") return verification
+        if (!screen.specPanelOpen) return verification.copy(reason = "relocation_panel_closed", relocationAttempted = true)
+
+        var signature = screen.dimensions.joinToString("|") { item ->
+            "${item.key}:${item.values.joinToString(",") { value -> "${value.text}:${value.available}" }}"
+        }
+        var swipes = 0
+        for ((direction, limit) in listOf(SwipeDirection.DOWN to 3, SwipeDirection.UP to 6)) {
+            for (attempt in 0 until limit) {
+                val container = screen.specPanelContainer
+                    ?: return verification.copy(
+                        reason = "relocation_container_missing",
+                        relocationAttempted = true,
+                        relocationSwipes = swipes,
+                    )
+                if (!driver.swipePurchaseIn(container, direction, 350)) {
+                    return verification.copy(
+                        reason = "relocation_swipe_failed",
+                        relocationAttempted = true,
+                        relocationSwipes = swipes,
+                    )
+                }
+                swipes++
+                pause(300)
+                screen = currentScreen(input)
+                screen.problem?.let {
+                    return verification.copy(
+                        reason = it.code,
+                        relocationAttempted = true,
+                        relocationSwipes = swipes,
+                    )
+                }
+                if (!screen.specPanelOpen) {
+                    return verification.copy(
+                        reason = "relocation_panel_closed",
+                        relocationAttempted = true,
+                        relocationSwipes = swipes,
+                    )
+                }
+                verification = verifyExactSpecSelection(screen, dimension, target, proof).copy(
+                    relocationAttempted = true,
+                    relocationSwipes = swipes,
+                )
+                if (verification.confirmed || verification.targetMatchCount > 0 || verification.reason == "visible_selected_conflict") return verification
+                val refreshedSignature = screen.dimensions.joinToString("|") { item ->
+                    "${item.key}:${item.values.joinToString(",") { value -> "${value.text}:${value.available}" }}"
+                }
+                if (refreshedSignature == signature) break
+                signature = refreshedSignature
+            }
+        }
+        return verification.copy(relocationAttempted = true, relocationSwipes = swipes)
+    }
+
     private data class SpecLookup(val node: SnapshotNode? = null, val failure: PurchaseExecutionOutcome? = null)
 
     /**
@@ -509,44 +798,222 @@ class PurchaseRehearsalExecutor(
      * Every gesture is followed by a fresh parse, and unchanged evidence ends
      * that direction early.
      */
+    private fun panelRecognitionFailure(screen: ParsedPddScreen, dimension: String): PurchaseExecutionOutcome =
+        failure("RULE_NOT_MATCHED",
+            "未能识别当前商品规格面板 [dimension=$dimension;panel=${screen.specPanelType};headings=${screen.panelHeadingCount};options=${screen.panelOptionCount};summary=${screen.hasSelectionSummary};quantity=${screen.hasQuantityControls};orderAction=${screen.hasOrderSubmitAction};close=${screen.hasCloseControl};payment=${screen.hasPaymentArea};contextMatched=${screen.purchaseContextMatched}]")
+
+    private fun stableSelectionScreen(input: PurchaseExecutionInput): ParsedPddScreen {
+        var screen = currentScreen(input)
+        repeat(2) {
+            if (screen.specPanelOpen || screen.problem != null) return screen
+            pause(SPEC_SELECTION_POLL_MILLIS)
+            screen = currentScreen(input)
+        }
+        return screen
+    }
+
     private fun locateExactSpec(input: PurchaseExecutionInput, dimension: String, target: String): SpecLookup {
-        fun inspect(): Pair<SpecLookup?, String> {
-            val screen = currentScreen(input)
-            screen.problem?.let { return SpecLookup(failure = failure(it.code, it.message)) to "" }
+        data class Inspection(val lookup: SpecLookup?, val signature: String, val container: SnapshotNode?)
+        fun inspect(): Inspection {
+            val screen = stableSelectionScreen(input)
+            screen.problem?.let { return Inspection(SpecLookup(failure = failure(it.code, it.message)), "", null) }
             if (!screen.specPanelOpen) {
-                return SpecLookup(failure = failure("RULE_NOT_MATCHED", "商品规格面板已经关闭")) to ""
+                return Inspection(SpecLookup(failure = panelRecognitionFailure(screen, dimension)), "", null)
             }
             val dimensionValues = screen.dimensions.filter { it.key == dimension }.flatMap { it.values }
             val exact = dimensionValues.filter { it.text == target }
             if (exact.size > 1) {
-                return SpecLookup(failure = failure(SPEC_TARGET_AMBIGUOUS, "精确规格匹配到多个控件")) to ""
+                return Inspection(SpecLookup(failure = failure(SPEC_TARGET_AMBIGUOUS, "精确规格匹配到多个控件")), "", screen.specPanelContainer)
             }
-            if (exact.size == 1 && exact.single().available) return SpecLookup(node = exact.single().node) to ""
+            if (exact.size == 1 && exact.single().available) return Inspection(SpecLookup(node = exact.single().node), "", screen.specPanelContainer)
             if (exact.size == 1) {
-                return SpecLookup(failure = failure(SPEC_SAFE_TARGET_MISSING, "精确规格当前不可安全点击")) to ""
+                return Inspection(SpecLookup(failure = failure(SPEC_SAFE_TARGET_MISSING, "精确规格当前不可安全点击")), "", screen.specPanelContainer)
             }
             val signature = screen.dimensions.joinToString("|") { item ->
                 "${item.key}:${item.values.joinToString(",") { value -> "${value.text}:${value.available}" }}"
             }
-            return null to signature
+            return Inspection(null, signature, screen.specPanelContainer)
         }
 
         var inspected = inspect()
-        inspected.first?.let { return it }
-        var currentSignature = inspected.second
+        inspected.lookup?.let { return it }
+        var currentSignature = inspected.signature
         for ((direction, limit) in listOf(SwipeDirection.DOWN to 3, SwipeDirection.UP to 6)) {
             for (attempt in 0 until limit) {
-                if (!driver.swipePurchase(direction, 350)) break
+                val container = inspected.container ?: break
+                if (!driver.swipePurchaseIn(container, direction, 350)) break
                 pause(300)
                 inspected = inspect()
-                inspected.first?.let { return it }
-                if (inspected.second == currentSignature) break
-                currentSignature = inspected.second
+                inspected.lookup?.let { return it }
+                if (inspected.signature == currentSignature) break
+                currentSignature = inspected.signature
             }
         }
+        if (dimension == "color" || dimension == "size") {
+            locateExactDimensionHorizontally(input, dimension, target)?.let { return it }
+        }
         return SpecLookup(failure = failure(SPEC_TARGET_NOT_VISIBLE, "有界搜索后未找到精确规格"))
     }
 
+    /**
+     * Compatibility fallback for horizontally paged PDD color or size rows. The
+     * established visible/vertical lookup above remains the primary path, so
+     * already successful purchases never enter this branch.
+     */
+    private fun locateExactDimensionHorizontally(
+        input: PurchaseExecutionInput,
+        dimension: String,
+        target: String,
+    ): SpecLookup? {
+        val swipeLimit = DEFAULT_COLLECTOR.limits.getValue("specHorizontalSwipes")
+        val stableReadLimit = DEFAULT_COLLECTOR.limits.getValue("stableEdgeReads")
+        data class ColorInspection(
+            val lookup: SpecLookup?,
+            val screen: ParsedPddScreen,
+            val rows: List<List<VisibleSpecValue>>,
+            val signature: String,
+        )
+
+        fun inspect(): ColorInspection {
+            val screen = stableSelectionScreen(input)
+            screen.problem?.let {
+                return ColorInspection(SpecLookup(failure = failure(it.code, it.message)), screen, emptyList(), "")
+            }
+            if (!screen.specPanelOpen) {
+                return ColorInspection(
+                    SpecLookup(failure = panelRecognitionFailure(screen, dimension)),
+                    screen,
+                    emptyList(),
+                    "",
+                )
+            }
+            val values = screen.dimensions.filter { it.key == dimension }.flatMap { it.values }
+            val exact = values.filter { it.text == target }
+            val lookup = when {
+                exact.size > 1 -> SpecLookup(failure = failure(SPEC_TARGET_AMBIGUOUS, "精确规格匹配到多个控件"))
+                exact.size == 1 && exact.single().available -> SpecLookup(node = exact.single().node)
+                exact.size == 1 -> SpecLookup(failure = failure(SPEC_SAFE_TARGET_MISSING, "精确规格当前不可安全点击"))
+                else -> null
+            }
+            val rows = specValueRows(values)
+            val signature = screen.dimensions.flatMap { it.values }.joinToString("|") { value ->
+                val bounds = value.node.bounds
+                "${value.text}:${bounds.left},${bounds.top},${bounds.right},${bounds.bottom}:${value.available}"
+            }
+            return ColorInspection(lookup, screen, rows, signature)
+        }
+
+        var inspected = inspect()
+        inspected.lookup?.let { return it }
+        var verticalSwipes = 0
+        var horizontalSwipes = 0
+        var lastHorizontalFailure = "none"
+        var termination = "budgetExhausted"
+        val horizontalBudget = mutableMapOf(SwipeDirection.RIGHT to swipeLimit, SwipeDirection.LEFT to swipeLimit)
+
+        fun searchVisibleRows(): SpecLookup? {
+            for (direction in listOf(SwipeDirection.RIGHT, SwipeDirection.LEFT)) {
+                var stableReads = 0
+                var previousSignature = inspected.signature
+                while (horizontalBudget.getValue(direction) > 0) {
+                    // Always reacquire a supported row; never fall back to a stale node.
+                    val anchor = horizontalSpecRow(inspected.screen, inspected.rows)?.firstOrNull()?.node ?: break
+                    horizontalBudget[direction] = horizontalBudget.getValue(direction) - 1
+                    if (!driver.swipeSpecRow(anchor, direction)) {
+                        lastHorizontalFailure = driver.specRowSwipeFailureReason()
+                        // A failed gesture is not evidence that the target is absent.
+                        inspected = inspect()
+                        inspected.lookup?.let { return it }
+                        break
+                    }
+                    horizontalSwipes++
+                    pause(300)
+                    inspected = inspect()
+                    inspected.lookup?.let { return it }
+                    stableReads = if (previousSignature == inspected.signature) stableReads + 1 else 0
+                    previousSignature = inspected.signature
+                    if (stableReads >= stableReadLimit) break
+                }
+            }
+            return null
+        }
+
+        // The original fast path remains first. Recover both ends of a vertical
+        // grid, inspecting each viewport for the exact target and supported rows.
+        val verticalLimit = DEFAULT_COLLECTOR.limits.getValue("specVerticalSwipes")
+        for (direction in listOf(SwipeDirection.DOWN, SwipeDirection.UP)) {
+            var stableReads = 0
+            var previousSignature = inspected.signature
+            for (attempt in 0..verticalLimit) {
+                searchVisibleRows()?.let { return it }
+                if (attempt == verticalLimit) {
+                    termination = "budgetExhausted"
+                    break
+                }
+                val container = inspected.screen.specPanelContainer
+                if (container == null) {
+                    termination = "verticalContainerMissing"
+                    break
+                }
+                if (!driver.swipePurchaseIn(container, direction, 350)) {
+                    termination = "verticalSwipeFailed"
+                    break
+                }
+                verticalSwipes++
+                pause(300)
+                inspected = inspect()
+                inspected.lookup?.let { return it }
+                stableReads = if (previousSignature == inspected.signature) stableReads + 1 else 0
+                previousSignature = inspected.signature
+                if (stableReads >= stableReadLimit) {
+                    searchVisibleRows()?.let { return it }
+                    termination = "stableViewport"
+                    break
+                }
+            }
+        }
+        return SpecLookup(failure = failure(
+            SPEC_TARGET_NOT_VISIBLE,
+            "有界搜索后未找到精确规格 [dimension=$dimension;horizontalSwipes=$horizontalSwipes;verticalRecoverySwipes=$verticalSwipes;visibleCandidates=${inspected.rows.flatten().size};reason=$termination;horizontalFailure=$lastHorizontalFailure]",
+        ))
+    }
+
+    private fun horizontalSpecRow(
+        screen: ParsedPddScreen,
+        rows: List<List<VisibleSpecValue>>,
+    ): List<VisibleSpecValue>? = rows.firstOrNull { row ->
+        row.isNotEmpty() && row.all { value -> hasDedicatedHorizontalAncestor(screen, value.node) }
+    }
+
+    private fun hasDedicatedHorizontalAncestor(screen: ParsedPddScreen, source: SnapshotNode): Boolean {
+        val byPath = screen.sourceNodes.associateBy(SnapshotNode::path)
+        var current: SnapshotNode? = source
+        while (current != null) {
+            if (current.path == screen.specPanelContainer?.path) return false
+            if (current.scrollable && current.bounds.width > current.bounds.height) return true
+            current = current.parentPath?.let(byPath::get)
+        }
+        return false
+    }
+
+    private fun specValueRows(values: List<VisibleSpecValue>): List<List<VisibleSpecValue>> {
+        val sorted = values.sortedWith(compareBy({ it.node.bounds.centerY }, { it.node.bounds.left }))
+        val rows = mutableListOf<MutableList<VisibleSpecValue>>()
+        val centers = mutableListOf<Int>()
+        sorted.forEach { value ->
+            val tolerance = (value.node.bounds.height / 2).coerceIn(24, 80)
+            val index = centers.indexOfFirst { kotlin.math.abs(value.node.bounds.centerY - it) <= tolerance }
+            if (index < 0) {
+                rows += mutableListOf(value)
+                centers += value.node.bounds.centerY
+            } else {
+                rows[index] += value
+                centers[index] = rows[index].map { it.node.bounds.centerY }.average().toInt()
+            }
+        }
+        return rows.onEach { row -> row.sortBy { it.node.bounds.left } }
+    }
+
     private fun setQuantity(quantity: Long): PurchaseExecutionOutcome? {
         val snapshot = driver.capture()
         pageProblem(snapshot)?.let { return it }
@@ -585,23 +1052,26 @@ class PurchaseRehearsalExecutor(
         observedPrice: Long?,
         selectionProofs: Map<String, ExactSpecSelectionProof>,
     ): PurchaseExecutionOutcome? {
-        val screen = currentScreen(input)
-        screen.problem?.let { return failure(it.code, it.message) }
         val selected = listOf("color" to input.mappedColor, "size" to input.mappedSize).filter { it.second.isNotBlank() }.map { (dimension, rawTarget) ->
             dimension to (normalizedTarget(dimension, rawTarget)
                 ?: return failure(SPEC_SAFE_TARGET_MISSING, "下发规格无法安全规范化"))
         }
         selected.forEach { (dimension, target) ->
-            val verification = verifyExactSpecSelection(screen, dimension, target, selectionProofs[dimension])
+            val verification = verifyExactSpecSelectionWithRelocation(input, dimension, target, selectionProofs[dimension])
             if (!verification.confirmed) {
+                val screen = currentScreen(input)
                 val panel = screen.specPanelType.name.lowercase()
                 val diagnostic = "dimension=$dimension,reason=${verification.reason},panel=$panel," +
                     "summary=${screen.selectedSummary != null},tokenMatched=${verification.summaryTokenMatched}," +
-                    "candidates=${verification.candidateCount},proof=${verification.proofPresent}"
+                    "candidates=${verification.candidateCount},targetMatches=${verification.targetMatchCount}," +
+                    "proofRecorded=${verification.proofRecorded},proofUsable=${verification.proofUsable}," +
+                    "relocated=${verification.relocationAttempted},relocationSwipes=${verification.relocationSwipes}"
                 return failure(SPEC_SELECTION_UNCONFIRMED, "最终规格复核未能确认精确选中状态 [$diagnostic]")
             }
         }
         if (readQuantity() != input.quantity) return failure("PURCHASE_QUANTITY_MISMATCH", "最终数量复核失败")
+        val screen = currentScreen(input)
+        screen.problem?.let { return failure(it.code, it.message) }
         val price = screen.priceCent ?: observedPrice ?: return failure("RULE_NOT_MATCHED", "最终价格复核失败")
         if (price !in input.minUnitPriceCent..input.maxUnitPriceCent) {
             return failure("PURCHASE_PRICE_OUT_OF_RANGE", "当前商品单价超出允许范围", price)
@@ -609,6 +1079,18 @@ class PurchaseRehearsalExecutor(
         return null
     }
 
+    private fun hasAllRecordedSelectionProofs(
+        input: PurchaseExecutionInput,
+        proofs: Map<String, ExactSpecSelectionProof>,
+    ): Boolean {
+        val required = listOf("color" to input.mappedColor, "size" to input.mappedSize)
+            .filter { it.second.isNotBlank() }
+            .map { (dimension, rawTarget) -> dimension to normalizedTarget(dimension, rawTarget) }
+        return required.isNotEmpty() && required.all { (dimension, target) ->
+            target != null && proofs[dimension]?.let { it.dimension == dimension && it.target == target } == true
+        }
+    }
+
     private fun applyPostAction(input: PurchaseExecutionInput, action: PurchaseAction): PurchaseExecutionOutcome? {
         if (action.waitAfterMs > 0) pause(action.waitAfterMs)
         action.swipeAfter?.let { swipe ->
@@ -643,8 +1125,16 @@ class PurchaseRehearsalExecutor(
         return normalized.takeIf(SpecValueNormalizer::isSafeSize)
     }
 
-    private fun currentScreen(input: PurchaseExecutionInput): ParsedPddScreen =
-        PddScreenParser.parse(driver.capture(), DEFAULT_COLLECTOR, input.goodsId, null)
+    private fun currentScreen(input: PurchaseExecutionInput): ParsedPddScreen {
+        val snapshot = driver.capture()
+        val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null, purchasePanelContext)
+        purchasePanelContext = if (screen.isPddPackage && screen.problem == null && screen.specPanelOpen) {
+            screen.specPanelContainer?.let {
+                PurchasePanelContext(it, normalizedTarget("color", input.mappedColor).orEmpty())
+            }
+        } else null
+        return screen
+    }
 
     private fun pageProblem(snapshot: UiSnapshot): PurchaseExecutionOutcome? =
         PddPageClassifier.classify(snapshot.packageName, snapshot.activityName, snapshot.nodes.filter { it.visible }.map { it.label })
@@ -668,10 +1158,14 @@ class PurchaseRehearsalExecutor(
 
     companion object {
         private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
-        private const val OPEN_PRODUCT_POLL_LIMIT = 50
+        private const val OPEN_PRODUCT_POLL_LIMIT = 150
+        private const val PRODUCT_PAGE_POLL_LIMIT = 150
+        private const val PRODUCT_PAGE_STABLE_READS = 2
         private const val OPEN_PRODUCT_RETRY_POLLS = 10
         private const val OPEN_PRODUCT_POLL_MILLIS = 100L
-        private const val SPEC_SELECTION_CLICK_ATTEMPTS = 3
+        private const val SPEC_ENTRY_READY_WAIT_POLLS = 20
+        private const val SPEC_ENTRY_READY_POLL_MILLIS = 100L
+        private const val SPEC_POST_CLICK_VERIFY_POLLS = 30
         private const val SPEC_SELECTION_SUCCESS_VERIFY_POLLS = 20
         private const val SPEC_SELECTION_FAILED_VERIFY_POLLS = 5
         private const val SPEC_SELECTION_POLL_MILLIS = 100L
@@ -680,7 +1174,8 @@ class PurchaseRehearsalExecutor(
         private const val SPEC_ENTRY_TARGET_AMBIGUOUS = "PURCHASE_SPEC_ENTRY_TARGET_AMBIGUOUS"
         private const val SPEC_ENTRY_CLICK_FAILED = "PURCHASE_SPEC_ENTRY_CLICK_FAILED"
         private const val SPEC_ENTRY_OPENED_REVIEW = "PURCHASE_SPEC_ENTRY_OPENED_REVIEW"
-        private const val SPEC_PANEL_NOT_OPENED = "PURCHASE_SPEC_PANEL_NOT_OPENED"
+        private const val SPEC_ENTRY_CLICK_NO_EFFECT = "PURCHASE_SPEC_ENTRY_CLICK_NO_EFFECT"
+        private const val SPEC_PANEL_EVIDENCE_NOT_MATCHED = "PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED"
         private const val SPEC_TARGET_NOT_VISIBLE = "PURCHASE_SPEC_TARGET_NOT_VISIBLE"
         private const val SPEC_TARGET_AMBIGUOUS = "PURCHASE_SPEC_TARGET_AMBIGUOUS"
         private const val SPEC_SAFE_TARGET_MISSING = "PURCHASE_SPEC_SAFE_TARGET_MISSING"

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseScrollLocator.kt

@@ -0,0 +1,24 @@
+package cn.ilapage.goauto.agent.automation
+
+internal data class PurchaseScrollCandidate(
+    val path: String,
+    val className: String?,
+    val bounds: NodeBounds,
+)
+
+internal object PurchaseScrollLocator {
+    fun locate(target: PurchaseScrollCandidate, candidates: List<PurchaseScrollCandidate>): PurchaseScrollCandidate? {
+        val compatible = candidates.filter {
+            it.className == target.className && boundsMatch(it.bounds, target.bounds)
+        }
+        val samePath = compatible.filter { it.path == target.path }
+        if (samePath.isNotEmpty()) return samePath.singleOrNull()
+        return compatible.singleOrNull()
+    }
+
+    private fun boundsMatch(a: NodeBounds, b: NodeBounds): Boolean =
+        kotlin.math.abs(a.left - b.left) <= 32 &&
+            kotlin.math.abs(a.top - b.top) <= 32 &&
+            kotlin.math.abs(a.right - b.right) <= 32 &&
+            kotlin.math.abs(a.bottom - b.bottom) <= 32
+}

android/app/src/main/java/cn/ilapage/goauto/agent/network/AgentApiClient.kt

@@ -203,6 +203,9 @@ class AgentApiException(
 ) : Exception(message)
 
 class AgentApiClient(private val serverUrl: String) {
+    fun backfillOrders(requestId: String, items: List<cn.ilapage.goauto.agent.automation.BackfillItem>, token: String): List<BackfillResult> =
+        parseBackfillResults(post("/api/agent/v1/purchase-tasks/order-backfill", backfillPayload(requestId, items), token))
+
     fun testConnection() {
         requireNotNull(request("GET", "/api/v1/health", null, null))
     }

android/app/src/main/java/cn/ilapage/goauto/agent/network/OrderBackfillUpload.kt

@@ -0,0 +1,92 @@
+package cn.ilapage.goauto.agent.network
+
+import cn.ilapage.goauto.agent.automation.BackfillItem
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.IOException
+import java.util.UUID
+
+data class BackfillResult(
+    val index: Int, val taskId: Long, val result: String, val code: String,
+    val status: String, val statusVersion: Long, val pddOrderNo: String?,
+    val orderSubmittedAt: String?, val timeSource: String,
+) {
+    val success get() = result in setOf("backfilled", "already_backfilled")
+    val needsReview get() = !success && code != "INTERNAL_ERROR" && code != "NETWORK_ERROR"
+    fun display(): String = if (success) {
+        val source = when (timeSource) {
+            "page" -> "页面下单时间"
+            "irreversible_at" -> "估算时间（提交订单时刻）"
+            else -> "已有时间（来源未知）"
+        }
+        "CG-$taskId：${if (result == "already_backfilled") "已回填" else "成功"}；$source ${orderSubmittedAt.orEmpty()}"
+    } else "${if (taskId > 0) "CG-$taskId" else "条目 ${index + 1}"}：${if (needsReview) "需人工检查" else "重试耗尽，未确认"}（$code）"
+}
+
+internal fun backfillPayload(requestId: String, items: List<BackfillItem>): JSONObject {
+    require(items.size in 1..50)
+    return JSONObject().put("requestId", requestId).put("items", JSONArray().apply {
+        items.forEach { item -> put(JSONObject().put("addressSuffix", item.addressSuffix).put("pddOrderNo", item.pddOrderNo).apply {
+            item.orderSubmittedAt?.let { put("orderSubmittedAt", it) }
+        }) }
+    })
+}
+
+internal fun parseBackfillResults(data: JSONObject): List<BackfillResult> {
+    val items = data.getJSONArray("items")
+    return (0 until items.length()).map { index -> items.getJSONObject(index).let {
+        BackfillResult(it.getInt("index"), it.optLong("taskId"), it.getString("result"), it.getString("code"),
+            it.optString("status"), it.optLong("statusVersion"),
+            if (it.isNull("pddOrderNo")) null else it.optString("pddOrderNo"),
+            if (it.isNull("orderSubmittedAt")) null else it.optString("orderSubmittedAt"), it.optString("timeSource"))
+    } }
+}
+
+/** Separate from the purchase outbox: only transport failures / INTERNAL_ERROR retry, three attempts total. */
+class OrderBackfillUpload(
+    private val submit: (String, List<BackfillItem>) -> List<BackfillResult>,
+    private val checkActive: () -> Unit,
+    private val pause: (Long) -> Unit = Thread::sleep,
+) {
+    fun upload(items: List<BackfillItem>, confirmed: (BackfillResult) -> Unit) {
+        var pending = items.mapIndexed { index, item -> index to item }
+        var requestId = UUID.randomUUID().toString()
+        repeat(3) { attempt ->
+            checkActive()
+            val results = try {
+                submit(requestId, pending.map { it.second }).also { values ->
+                    check(values.size == pending.size && values.map { it.index }.toSet() == pending.indices.toSet())
+                    values.filter { it.success }.forEach { value ->
+                        val input = pending[value.index].second
+                        check(value.taskId.toString() == input.addressSuffix.removePrefix("_cg") && value.pddOrderNo == input.pddOrderNo)
+                        check(value.status.isNotBlank())
+                    }
+                }
+            } catch (error: Exception) {
+                val code = when (error) {
+                    is AgentApiException -> error.code
+                    is IOException -> "NETWORK_ERROR"
+                    else -> throw error
+                }
+                if (code in setOf("INTERNAL_ERROR", "NETWORK_ERROR") && attempt < 2) {
+                    pause((attempt + 1) * 1_000L)
+                    return@repeat // same request ID for an unknown transport result
+                }
+                pending.forEach { (index, _) -> confirmed(BackfillResult(index, 0, "failed", code, "", 0, null, null, "")) }
+                return
+            }
+            // A completed HTTP response is evidence, even when cancellation arrived while waiting.
+            val retry = mutableListOf<Pair<Int, BackfillItem>>()
+            results.forEach { result ->
+                val original = pending[result.index]
+                if (!result.success && result.code == "INTERNAL_ERROR" && attempt < 2) retry += original
+                else confirmed(result.copy(index = original.first))
+            }
+            if (retry.isEmpty()) return
+            pending = retry
+            requestId = UUID.randomUUID().toString() // payload changed after partial acknowledgement
+            checkActive()
+            pause((attempt + 1) * 1_000L)
+        }
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/TaskHistoryCache.kt

@@ -11,6 +11,32 @@ import org.json.JSONObject
 class TaskHistoryCache(context: Context) {
     private val preferences = context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE)
 
+    /** Only acknowledged server facts may overwrite cached task facts. Never store scanned candidates. */
+    fun applyBackfill(result: cn.ilapage.goauto.agent.network.BackfillResult, environment: String) = synchronized(BACKFILL_LOCK) {
+        if (!result.success) {
+            if (result.needsReview) check(preferences.edit().putString("backfill_review_${result.taskId}_${result.code}",
+                JSONObject().put("taskId", result.taskId).put("code", result.code).put("environment", environment).toString()).commit())
+            return@synchronized
+        }
+        val values = JSONArray(preferences.getString(PURCHASE, "[]"))
+        for (index in 0 until values.length()) {
+            applyBackfillFacts(values.getJSONObject(index), result)
+        }
+        // Also retain the small acknowledged summary when this task is absent from downloaded history.
+        val confirmed = JSONObject().put("taskId", result.taskId).put("status", result.status)
+            .put("statusVersion", result.statusVersion).putNullable("pddOrderNo", result.pddOrderNo)
+            .putNullable("orderSubmittedAt", result.orderSubmittedAt).put("timeSource", result.timeSource)
+            .put("environment", environment)
+        check(preferences.edit().putString(PURCHASE, values.toString())
+            .putString("backfill_confirmed_${result.taskId}", confirmed.toString()).commit())
+    }
+
+    fun backfillTimeSource(taskId: Long, environment: String): String? {
+        val raw = preferences.getString("backfill_confirmed_$taskId", null) ?: return null
+        val confirmed = runCatching { JSONObject(raw) }.getOrNull() ?: return null
+        return confirmed.optString("timeSource").takeIf { confirmed.optString("environment") == environment }
+    }
+
     fun saveCollection(days: Int, items: List<CollectionHistoryItem>) = save(COLLECTION, days, JSONArray().apply {
         items.forEach { item -> put(JSONObject()
             .put("taskId", item.taskId).put("attemptNumber", item.attemptNumber).put("status", item.status).put("source", item.source).put("goodsId", item.goodsId)
@@ -90,9 +116,18 @@ class TaskHistoryCache(context: Context) {
     private fun JSONObject.nullableLong(key: String): Long? = if (isNull(key)) null else optLong(key)
 
     private companion object {
+        val BACKFILL_LOCK = Any()
         const val PREFERENCES = "goauto_task_history_cache"
         const val COLLECTION = "collection"
         const val PURCHASE = "purchase"
         const val PAGE_SIZE = 20
     }
 }
+
+internal fun applyBackfillFacts(task: JSONObject, result: cn.ilapage.goauto.agent.network.BackfillResult) {
+    if (!result.success || task.optLong("taskId") != result.taskId) return
+    task.put("status", result.status).put("pddOrderNo", result.pddOrderNo ?: JSONObject.NULL)
+        .put("orderSubmittedAt", result.orderSubmittedAt ?: JSONObject.NULL)
+        .put("errorCode", JSONObject.NULL).put("errorMessage", JSONObject.NULL)
+        .put("retryable", false).put("retryDisabledReason", JSONObject.NULL)
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentForegroundService.kt

@@ -57,6 +57,7 @@ import cn.ilapage.goauto.agent.persistence.AgentDiagnosticEvent
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticReason
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticStage
 import cn.ilapage.goauto.agent.persistence.SafeAgentDiagnosticRecorder
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePolicy
 import org.json.JSONArray
 import org.json.JSONObject
 import java.util.concurrent.Executors
@@ -74,6 +75,7 @@ class AgentForegroundService : Service() {
     private val taskExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val diagnosticExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val taskMutex = TaskExecutionMutex()
+    private val backfillGuard = OrderBackfillGuard(taskMutex)
     private val runningTaskId = AtomicReference<Long?>(null)
     private val working = AtomicBoolean(false)
     private val manualCheckRequested = AtomicBoolean(false)
@@ -131,6 +133,14 @@ class AgentForegroundService : Service() {
     }
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent?.action == ACTION_BACKFILL_STOP) {
+            backfillGuard.cancelled.set(true)
+            return START_STICKY
+        }
+        if (intent?.action == ACTION_BACKFILL_START) {
+            requestOrderBackfill(intent.getStringExtra("days").orEmpty(), intent.getLongExtra("confirmedAt", 0))
+            return START_STICKY
+        }
         if (intent?.action == ACTION_RECONNECT) registeredThisProcess.set(false)
         if (intent?.action == ACTION_CHECK_NOW) manualCheckRequested.set(true)
         if (intent?.action == ACTION_CURRENT_PAGE_COLLECTION) {
@@ -146,6 +156,7 @@ class AgentForegroundService : Service() {
     }
 
     override fun onDestroy() {
+        backfillGuard.cancelled.set(true)
         runCatching { connectivityManager.unregisterNetworkCallback(networkCallback) }
         cancelIdleReturn("服务已停止")
         collectionCooldownFuture.getAndSet(null)?.cancel(false)
@@ -164,7 +175,7 @@ class AgentForegroundService : Service() {
     override fun onBind(intent: Intent?): IBinder? = null
 
     private fun triggerSync() {
-        if (!working.compareAndSet(false, true)) return
+        if (!synchronized(taskMutex) { working.compareAndSet(false, true) }) return
         executor.execute {
             val manualCheck = manualCheckRequested.getAndSet(false)
             try {
@@ -255,13 +266,20 @@ class AgentForegroundService : Service() {
         flushPurchaseOutbox(api, token)
         val collectionCooldown = activeCollectionCooldown()
         val purchaseTask = api.nextPurchaseTask(token)
-        when (TaskDispatchPolicy.decide(purchaseTask != null, collectionCooldown != null)) {
+        when (TaskDispatchPolicy.decide(purchaseTask?.status, collectionCooldown != null)) {
             TaskDispatchDecision.RUN_PURCHASE -> {
                 cancelIdleReturn("收到新的采购任务")
                 releaseCollectionCooldownWakeLock()
                 schedulePurchaseTask(api, requireNotNull(purchaseTask), token)
                 return MANUAL_PURCHASE_TASK
             }
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH -> {
+                val waitingTask = requireNotNull(purchaseTask)
+                cancelIdleReturn("等待采购规格匹配")
+                stateStore.update("ONLINE", "采购任务 #${waitingTask.taskId} 正在匹配规格", tokenStored = true)
+                updateNotification("采购任务 #${waitingTask.taskId} 等待规格匹配")
+                return MANUAL_PURCHASE_MATCH_PENDING
+            }
             TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN -> {
                 val ticket = requireNotNull(collectionCooldown)
                 showCollectionCooldown(ticket)
@@ -299,6 +317,98 @@ class AgentForegroundService : Service() {
         })
     }
 
+    private fun publishBackfill(state: OrderBackfillState) {
+        backfillState = state
+        sendBroadcast(Intent(ACTION_BACKFILL_STATE).setPackage(packageName))
+        updateNotification(if (state.running) "订单回填 · 已检查 ${state.checked}" else "订单回填已停止，请查看采购页结果")
+    }
+
+    private fun requestOrderBackfill(days: String, confirmedAt: Long) {
+        // Refuse while polling/dispatch is in flight too: never queue behind another PDD operation.
+        val acquired = synchronized(taskMutex) {
+            !working.get() && purchaseStore.activeTaskId() == null && backfillGuard.tryAcquire()
+        }
+        if (!acquired) {
+            android.widget.Toast.makeText(this, "设备忙碌，请稍后操作", android.widget.Toast.LENGTH_SHORT).show()
+            return
+        }
+        try {
+            val window = cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, confirmedAt)
+            val server = settingsStore.serverUrl()
+            val credentials = identityStore.credentials() ?: error("设备尚未注册")
+            val accessibility = GoAutoAccessibilityService.instance ?: error("请先启用无障碍服务")
+            val started = SystemClock.elapsedRealtime()
+            cancelIdleReturn("人工订单回填")
+            publishBackfill(OrderBackfillState(running = true, message = "正在检查订单列表时序…"))
+            taskExecutor.execute {
+                var state = backfillState
+                fun checkActive() {
+                    check(!backfillGuard.cancelled.get() && !Thread.currentThread().isInterrupted) { "用户停止，未完整扫描" }
+                    check(SystemClock.elapsedRealtime() - started < cn.ilapage.goauto.agent.automation.OrderBackfillWindow.MAX_DURATION_MS) { "达到 10 分钟内部上限，未完整扫描" }
+                    check(settingsStore.serverUrl() == server && identityStore.credentials() == credentials) { "服务器或设备身份已变化，未完整扫描" }
+                }
+                try {
+                    acquireTaskWakeLock()
+                    val api = AgentApiClient(server)
+                    val uploader = cn.ilapage.goauto.agent.network.OrderBackfillUpload(
+                        submit = { id, items -> api.backfillOrders(id, items, credentials.token) },
+                        checkActive = ::checkActive,
+                    )
+                    val driver = object : cn.ilapage.goauto.agent.automation.BackfillDriver {
+                        override fun openOrders() {
+                            checkActive()
+                            startActivity(Intent(Intent.ACTION_VIEW, android.net.Uri.parse("https://mobile.yangkeduo.com/orders.html"))
+                                .setPackage(cn.ilapage.goauto.agent.automation.BackfillPagePolicy.PDD).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+                        }
+                        override fun capture() = accessibility.capture()
+                        override fun click(node: cn.ilapage.goauto.agent.automation.SnapshotNode): Boolean { checkActive(); return accessibility.clickBackfill(node) }
+                        override fun scroll(): Boolean { checkActive(); return accessibility.scrollBackfill() }
+                        override fun back(): Boolean {
+                            checkActive()
+                            cn.ilapage.goauto.agent.automation.BackfillPagePolicy.validate(capture())
+                            return accessibility.back()
+                        }
+                        override fun pause() { repeat(10) { checkActive(); Thread.sleep(100) } }
+                    }
+                    val reason = cn.ilapage.goauto.agent.automation.OrderBackfillScanner(driver, window, ::checkActive,
+                        submit = { item -> uploader.upload(listOf(item)) { result ->
+                            state = state.copy(success = state.success + if (result.result == "backfilled") 1 else 0,
+                                already = state.already + if (result.result == "already_backfilled") 1 else 0,
+                                failed = state.failed + if (!result.success) 1 else 0,
+                                evidence = state.evidence + result.display())
+                            // The frozen API receives all submissions. Never write an old environment's response into a new cache.
+                            if (settingsStore.serverUrl() == server && identityStore.credentials() == credentials) {
+                                cn.ilapage.goauto.agent.persistence.TaskHistoryCache(this).applyBackfill(result, "$server|${credentials.deviceId}")
+                            }
+                            publishBackfill(state)
+                            check(result.success || result.needsReview) { "网络或服务端瞬时错误重试耗尽，未完整扫描" }
+                        } },
+                        progress = { checked ->
+                            state = state.copy(checked = checked, message = if (window.nonDescending) cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED else "正在扫描（已读 $checked 单）…")
+                            publishBackfill(state)
+                        }).scan()
+                    state = state.copy(message = reason)
+                } catch (error: Exception) {
+                    // Never echo raw page text, HTTP bodies or credentials in UI/logs.
+                    val reason = if (error is IllegalStateException || error is IllegalArgumentException) error.message else null
+                    val message = reason?.takeIf { it.length < 100 } ?: "网络或页面异常"
+                    state = state.copy(message = message + if (message.contains("未完整扫描")) "" else "，未完整扫描")
+                } finally {
+                    val warning = if (window.nonDescending && !state.message.contains(cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED))
+                        "\n${cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED}" else ""
+                    try {
+                        publishBackfill(state.copy(running = false, message = state.message + warning))
+                    } finally {
+                        try { releaseTaskWakeLock() } finally { backfillGuard.release() }
+                    }
+                }
+            }
+        } catch (error: Exception) {
+            backfillGuard.release()
+            publishBackfill(OrderBackfillState(message = "回填未启动，请检查天数、设备连接与无障碍服务"))
+        }
+    }
+
     private fun requestCurrentPageCollection(
         requestId: String,
         replacementOriginType: String?,
@@ -434,8 +544,10 @@ class AgentForegroundService : Service() {
     }
 
     private fun executePurchaseTask(api: AgentApiClient, initial: PurchaseAgentTask, token: String) {
+        GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         var resultSafelyStored = false
+        val lastStep = AtomicReference("started")
         try {
             val claimed = if (initial.status == "pending") {
                 api.claimPurchaseTask(initial.taskId, UUID.randomUUID().toString(), token)
@@ -470,9 +582,12 @@ class AgentForegroundService : Service() {
                     } else {
                         PurchaseRehearsalExecutor(
                             driver = accessibility,
-                            openLink = { PddLinkLauncher(this).open(it) },
+                            openLink = { PddLinkLauncher(this).open(it, preferDirect = true) },
                             probeSpecs = { collectPurchaseProbe(accessibility, task, parsedRule) },
-                            stepChanged = { step -> purchaseStore.updateStep(task.taskId, task.taskAttemptId, step) },
+                            stepChanged = { step ->
+                                lastStep.set(step)
+                                purchaseStore.updateStep(task.taskId, task.taskAttemptId, step)
+                            },
                             panelDiagnostic = { evidence -> Log.i("GoAutoPurchasePanel", "task=${task.taskId};$evidence") },
                             beforeOrderSubmit = { evidence ->
                                 val boundaryRequestId = UUID.randomUUID().toString()
@@ -513,6 +628,14 @@ class AgentForegroundService : Service() {
             val payload = purchaseResultPayload(requestId, task.taskAttemptId, outcome)
             purchaseStore.completeAndEnqueue(task.taskId, task.taskAttemptId, requestId, payload)
             resultSafelyStored = true
+            PurchaseResultBubblePolicy.create(
+                taskId = task.taskId,
+                resultType = outcome.resultType,
+                lastStep = lastStep.get(),
+                resultMessage = outcome.message,
+            )?.let { presentation ->
+                GoAutoAccessibilityService.instance?.showPurchaseResultBubble(presentation)
+            }
             beginIdleReturnCooldown()
             flushPurchaseOutbox(api, token)
             val message = if (outcome.resultType == "failed") "${outcome.errorCode}：${outcome.message}" else outcome.message
@@ -611,6 +734,7 @@ class AgentForegroundService : Service() {
         initialTask: cn.ilapage.goauto.agent.network.AgentTask,
         token: String,
     ): TaskExecutionSummary {
+        GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         return try {
             executeTaskWhileAwake(api, initialTask, token)
@@ -1016,10 +1140,15 @@ class AgentForegroundService : Service() {
             @Suppress("DEPRECATION")
             Notification.Builder(this)
         }
+        if (backfillState.running) {
+            val stop = PendingIntent.getService(this, 242, Intent(this, AgentForegroundService::class.java).setAction(ACTION_BACKFILL_STOP),
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+            builder.addAction(Notification.Action.Builder(null, "停止回填", stop).build())
+        }
         return builder
             .setSmallIcon(android.R.drawable.stat_notify_sync)
             .setContentTitle(getString(R.string.app_name))
-            .setContentText(content)
+            .setContentText(if (backfillState.running) "订单回填 · 已检查 ${backfillState.checked}" else content)
             .setContentIntent(pendingIntent)
             .setOngoing(true)
             .build()
@@ -1045,6 +1174,11 @@ class AgentForegroundService : Service() {
     }
 
     companion object {
+        const val ACTION_BACKFILL_START = "cn.ilapage.goauto.agent.BACKFILL_START"
+        const val ACTION_BACKFILL_STOP = "cn.ilapage.goauto.agent.BACKFILL_STOP"
+        const val ACTION_BACKFILL_STATE = "cn.ilapage.goauto.agent.BACKFILL_STATE"
+        @Volatile var backfillState = OrderBackfillState()
+            private set
         const val ACTION_RECONNECT = "cn.ilapage.goauto.agent.RECONNECT"
         const val ACTION_CHECK_NOW = "cn.ilapage.goauto.agent.CHECK_NOW"
         const val ACTION_CHECK_RESULT = "cn.ilapage.goauto.agent.CHECK_RESULT"
@@ -1059,6 +1193,7 @@ class AgentForegroundService : Service() {
         const val MANUAL_EMPTY = "empty"
         const val MANUAL_COLLECTION_TASK = "collection_task"
         const val MANUAL_PURCHASE_TASK = "purchase_task"
+        const val MANUAL_PURCHASE_MATCH_PENDING = "purchase_match_pending"
         const val MANUAL_BUSY = "busy"
         const val MANUAL_CONFIG_REQUIRED = "config_required"
         const val MANUAL_AUTH_ERROR = "auth_error"

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentStateStore.kt

@@ -99,13 +99,15 @@ internal object CollectionCooldownPolicy {
 
 internal enum class TaskDispatchDecision {
     RUN_PURCHASE,
+    WAIT_FOR_PURCHASE_MATCH,
     WAIT_FOR_COLLECTION_COOLDOWN,
     CHECK_COLLECTION,
 }
 
 internal object TaskDispatchPolicy {
-    fun decide(purchaseAvailable: Boolean, collectionCooldownActive: Boolean): TaskDispatchDecision = when {
-        purchaseAvailable -> TaskDispatchDecision.RUN_PURCHASE
+    fun decide(purchaseStatus: String?, collectionCooldownActive: Boolean): TaskDispatchDecision = when {
+        purchaseStatus == "spec_probe_pending" -> TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH
+        purchaseStatus != null -> TaskDispatchDecision.RUN_PURCHASE
         collectionCooldownActive -> TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN
         else -> TaskDispatchDecision.CHECK_COLLECTION
     }

android/app/src/main/java/cn/ilapage/goauto/agent/service/OrderBackfillGuard.kt

@@ -0,0 +1,22 @@
+package cn.ilapage.goauto.agent.service
+
+import java.util.concurrent.atomic.AtomicBoolean
+
+class OrderBackfillGuard(private val mutex: TaskExecutionMutex) {
+    private val active = AtomicBoolean(false)
+    val cancelled = AtomicBoolean(false)
+    fun tryAcquire(): Boolean {
+        if (!active.compareAndSet(false, true)) return false
+        if (!mutex.tryAcquire(RESERVATION)) {
+            active.set(false)
+            return false
+        }
+        cancelled.set(false)
+        return true
+    }
+    fun release() {
+        mutex.release(RESERVATION)
+        active.set(false)
+    }
+    companion object { const val RESERVATION = Long.MAX_VALUE - 1 }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/OrderBackfillState.kt

@@ -0,0 +1,14 @@
+package cn.ilapage.goauto.agent.service
+
+data class OrderBackfillState(
+    val running: Boolean = false,
+    val checked: Int = 0,
+    val success: Int = 0,
+    val already: Int = 0,
+    val failed: Int = 0,
+    val message: String = "",
+    val evidence: List<String> = emptyList(),
+) {
+    fun text(): String = "已检查 $checked · 成功 $success · 已回填 $already · 冲突/失败 $failed\n$message" +
+        if (evidence.isEmpty()) "" else "\n" + evidence.joinToString("\n")
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/PurchaseResultBubbleController.kt

@@ -0,0 +1,114 @@
+package cn.ilapage.goauto.agent.ui
+
+import android.content.Context
+import android.graphics.PixelFormat
+import android.graphics.drawable.GradientDrawable
+import android.os.Handler
+import android.os.Looper
+import android.view.Gravity
+import android.view.View
+import android.view.ViewGroup
+import android.view.WindowManager
+import android.widget.LinearLayout
+import android.widget.TextView
+import cn.ilapage.goauto.agent.R
+
+class PurchaseResultBubbleController(
+    private val context: Context,
+    private val canShow: () -> Boolean,
+) {
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private val windowManager = context.getSystemService(WindowManager::class.java)
+    private val session = PurchaseResultBubbleSession()
+    private var bubbleView: View? = null
+
+    fun show(presentation: PurchaseResultBubblePresentation) {
+        val revision = session.replace()
+        mainHandler.post {
+            if (!session.isCurrent(revision)) return@post
+            removeCurrentView()
+            if (!canShow()) return@post
+            val view = buildView(presentation)
+            runCatching { windowManager.addView(view, layoutParams()) }
+                .onSuccess {
+                    bubbleView = view
+                    mainHandler.postDelayed({
+                        if (session.isCurrent(revision)) {
+                            session.dismiss()
+                            removeCurrentView()
+                        }
+                    }, presentation.durationMillis)
+                }
+        }
+    }
+
+    fun dismiss() {
+        session.dismiss()
+        mainHandler.post(::removeCurrentView)
+    }
+
+    private fun buildView(presentation: PurchaseResultBubblePresentation): View {
+        val horizontalPadding = context.dp(16)
+        val verticalPadding = context.dp(12)
+        return LinearLayout(context).apply {
+            orientation = LinearLayout.VERTICAL
+            setPadding(horizontalPadding, verticalPadding, horizontalPadding, verticalPadding)
+            elevation = context.dp(8).toFloat()
+            background = GradientDrawable().apply {
+                cornerRadius = context.dp(16).toFloat()
+                setColor(context.getColor(if (presentation.isFailure) R.color.purchase_result_failure_background else R.color.purchase_result_success_background))
+            }
+            contentDescription = "${presentation.title}。${presentation.message}"
+            importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_YES
+            descendantFocusability = ViewGroup.FOCUS_BLOCK_DESCENDANTS
+            addView(TextView(context).apply {
+                text = presentation.title
+                setTextColor(context.getColor(R.color.purchase_result_text))
+                textSize = 14f
+                setTypeface(typeface, android.graphics.Typeface.BOLD)
+                maxLines = 2
+                importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_NO
+            }, LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.WRAP_CONTENT))
+            addView(TextView(context).apply {
+                text = presentation.message
+                setTextColor(context.getColor(R.color.purchase_result_text_secondary))
+                textSize = 13f
+                maxLines = 3
+                importantForAccessibility = View.IMPORTANT_FOR_ACCESSIBILITY_NO
+            }, LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.WRAP_CONTENT).apply {
+                topMargin = context.dp(4)
+            })
+        }
+    }
+
+    private fun layoutParams(): WindowManager.LayoutParams {
+        val availableWidth = context.resources.displayMetrics.widthPixels - context.dp(32)
+        return WindowManager.LayoutParams(
+            availableWidth.coerceAtMost(context.dp(360)),
+            WindowManager.LayoutParams.WRAP_CONTENT,
+            WindowManager.LayoutParams.TYPE_ACCESSIBILITY_OVERLAY,
+            WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE or
+                WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE or
+                WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL,
+            PixelFormat.TRANSLUCENT,
+        ).apply {
+            gravity = Gravity.TOP or Gravity.CENTER_HORIZONTAL
+            y = context.statusBarHeight() + context.dp(8)
+            windowAnimations = android.R.style.Animation_Toast
+        }
+    }
+
+    private fun removeCurrentView() {
+        val view = bubbleView ?: return
+        bubbleView = null
+        runCatching { windowManager.removeViewImmediate(view) }
+    }
+
+    private fun Context.dp(value: Int): Int = (value * resources.displayMetrics.density).toInt()
+
+    @Suppress("DiscouragedApi")
+    private fun Context.statusBarHeight(): Int {
+        val resourceId = resources.getIdentifier("status_bar_height", "dimen", "android")
+        return if (resourceId > 0) resources.getDimensionPixelSize(resourceId) else dp(24)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/PurchaseResultBubblePolicy.kt

@@ -0,0 +1,86 @@
+package cn.ilapage.goauto.agent.ui
+
+data class PurchaseResultBubblePresentation(
+    val title: String,
+    val message: String,
+    val isFailure: Boolean,
+    val durationMillis: Long,
+)
+
+object PurchaseResultBubblePolicy {
+    const val SUCCESS_DURATION_MILLIS = 3_000L
+    const val FAILURE_DURATION_MILLIS = 8_000L
+    private const val MAX_MESSAGE_LENGTH = 96
+
+    private val stepLabels = mapOf(
+        "started" to "准备采购",
+        "openProduct" to "打开商品",
+        "verifyProduct" to "核对商品",
+        "openSpecPanel" to "打开规格面板",
+        "selectSpec" to "选择颜色与尺码",
+        "setQuantity" to "设置数量",
+        "verifyUnitPrice" to "核对价格",
+        "verifyOrderSummary" to "核对订单",
+        "probeSpecs" to "采集规格",
+        "updateShippingAddress" to "更新收货地址",
+        "createOrder" to "创建待付款订单",
+        "order_submit_started" to "创建待付款订单",
+        "readOrderResult" to "读取订单编号和下单时间",
+    )
+
+    fun create(
+        taskId: Long,
+        resultType: String,
+        lastStep: String?,
+        resultMessage: String?,
+    ): PurchaseResultBubblePresentation? {
+        if (resultType == "spec_probe_completed") return null
+        val failure = resultType == "failed" || resultType == "order_result_unknown"
+        if (failure) {
+            val label = stepLabels[lastStep] ?: "处理采购任务"
+            return PurchaseResultBubblePresentation(
+                title = if (resultType == "order_result_unknown") "CG-$taskId 待人工核对｜$label" else "CG-$taskId 失败于：$label",
+                message = sanitize(resultMessage, "采购失败，请返回 Agent 查看详情"),
+                isFailure = true,
+                durationMillis = FAILURE_DURATION_MILLIS,
+            )
+        }
+        val successMessage = when (resultType) {
+            "order_created" -> "已获取订单编号和下单时间"
+            "rehearsal_completed" -> "商品、规格、数量和价格复核完成"
+            else -> sanitize(resultMessage, "采购结果已安全保存")
+        }
+        return PurchaseResultBubblePresentation(
+            title = "CG-$taskId 采购完成",
+            message = successMessage,
+            isFailure = false,
+            durationMillis = SUCCESS_DURATION_MILLIS,
+        )
+    }
+
+    private fun sanitize(value: String?, fallback: String): String {
+        val normalized = value.orEmpty()
+            .replace(Regex("https?://\\S+", RegexOption.IGNORE_CASE), "[链接已隐藏]")
+            .replace(Regex("(?i)(token|authorization|cookie)\\s*[:=]\\s*\\S+")) { match ->
+                "${match.groupValues[1]}=[已隐藏]"
+            }
+            .replace(Regex("[\\r\\n\\t]+"), " ")
+            .replace(Regex("\\s{2,}"), " ")
+            .trim()
+            .ifBlank { fallback }
+        return normalized.take(MAX_MESSAGE_LENGTH)
+    }
+}
+
+class PurchaseResultBubbleSession {
+    private var revision = 0L
+
+    @Synchronized
+    fun replace(): Long = ++revision
+
+    @Synchronized
+    fun dismiss(): Long = ++revision
+
+    @Synchronized
+    fun isCurrent(candidate: Long): Boolean = candidate == revision
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/TaskHistoryFragment.kt

@@ -36,8 +36,6 @@ import cn.ilapage.goauto.agent.network.HistoryPage
 import cn.ilapage.goauto.agent.network.HistoryColorImage
 import cn.ilapage.goauto.agent.network.PurchaseHistoryDetail
 import cn.ilapage.goauto.agent.network.PurchaseHistoryItem
-import cn.ilapage.goauto.agent.network.PurchaseResetResult
-import cn.ilapage.goauto.agent.network.PurchaseRetryResult
 import cn.ilapage.goauto.agent.persistence.TaskHistoryCache
 import cn.ilapage.goauto.agent.service.AgentForegroundService
 import cn.ilapage.goauto.agent.service.AgentSettingsStore
@@ -85,10 +83,12 @@ internal object CollectionResetPolicy {
 internal object PurchaseRetryPolicy {
     fun showsAction(status: String, retryable: Boolean): Boolean = status == "failed" && retryable
 
+    fun usesInPlaceReset(continuing: Boolean): Boolean = !continuing
+
     fun confirmationMessage(continuing: Boolean = false): String = if (continuing) {
         "替代商品已完成匹配。系统会保留原任务并创建一笔新采购任务；可能创建拼多多待付款订单，但不会支付。"
     } else {
-        "将使用服务端最新采购规则重跑当前任务，任务号和商品、规格、价格快照不变；可能创建拼多多待付款订单，但不会支付。"
+        "系统会复用原采购任务并开始新一次执行，使用当前有效采购规则，商品和规格等任务快照保持不变；可能创建拼多多待付款订单，但不会支付。"
     }
 }
 
@@ -141,8 +141,16 @@ class TaskHistoryFragment : Fragment() {
     private val imageLoader = HistoryImageLoader()
     private val imageRequests = mutableListOf<HistoryImageRequest>()
     private var currentPageReceiverRegistered = false
+    private var backfillPanel: LinearLayout? = null
     private val currentPageReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
+            if (intent?.action == AgentForegroundService.ACTION_BACKFILL_STATE) {
+                renderBackfill()
+                if (!collection && isResumed && !AgentForegroundService.backfillState.running) {
+                    detailState.taskId?.let(::loadPurchaseDetail) ?: load()
+                }
+                return
+            }
             if (intent?.action != AgentForegroundService.ACTION_CURRENT_PAGE_RESULT) return
             val message = intent.getStringExtra(AgentForegroundService.EXTRA_CURRENT_PAGE_MESSAGE).orEmpty()
             val taskId = intent.getLongExtra(AgentForegroundService.EXTRA_CURRENT_PAGE_TASK_ID, 0L)
@@ -182,6 +190,11 @@ class TaskHistoryFragment : Fragment() {
         pageColumn = context.column()
         pageColumn.addView(context.screenTitle(if (collection) "采集记录" else "采购记录"))
         pageColumn.addView(buildSearch())
+        if (!collection) {
+            backfillPanel = context.column(0)
+            pageColumn.addView(backfillPanel)
+            renderBackfill()
+        }
         pageColumn.addView(buildFilters())
         resultColumn = context.column(0).apply { setPadding(0, context.dp(12), 0, 0) }
         pageColumn.addView(resultColumn, resultColumn.fullWidth())
@@ -207,6 +220,7 @@ class TaskHistoryFragment : Fragment() {
     }
 
     override fun onDestroyView() {
+        backfillPanel = null
         requestGeneration++
         cancelImageRequests()
         super.onDestroyView()
@@ -273,6 +287,14 @@ class TaskHistoryFragment : Fragment() {
                     contentDescription = "采集当前拼多多商品"
                     setOnClickListener { confirmCurrentPageCollection() }
                 }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
+            } else {
+                row.addView(MaterialButton(context).apply {
+                    text = "回填"
+                    textSize = 14f
+                    minimumHeight = context.dp(48)
+                    contentDescription = "回填拼多多订单号和下单时间"
+                    setOnClickListener { showBackfillInput() }
+                }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
             }
             addView(row, row.fullWidth())
         }).apply {
@@ -280,6 +302,75 @@ class TaskHistoryFragment : Fragment() {
         }
     }
 
+    private fun showBackfillInput() {
+        if (AgentForegroundService.backfillState.running) {
+            toast("设备忙碌，请稍后操作")
+            return
+        }
+        val context = requireContext()
+        val input = TextInputEditText(context).apply {
+            setText("2")
+            inputType = android.text.InputType.TYPE_CLASS_NUMBER
+            minimumHeight = context.dp(48)
+            contentDescription = "回填天数"
+            selectAll()
+        }
+        val field = TextInputLayout(context).apply {
+            hint = "天数"
+            helperText = "从确认时刻往前 N×24 小时"
+            addView(input)
+        }
+        val dialog = MaterialAlertDialogBuilder(context).setTitle("回填订单")
+            .setView(context.cardColumn().apply { addView(field) })
+            .setNegativeButton("取消", null).setPositiveButton("确认", null).create()
+        dialog.setOnShowListener {
+            dialog.getButton(androidx.appcompat.app.AlertDialog.BUTTON_POSITIVE).setOnClickListener {
+                val days = input.text.toString().trim()
+                val now = System.currentTimeMillis()
+                if (runCatching { cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, now) }.isFailure) {
+                    field.error = "请输入正整数天数"
+                    return@setOnClickListener
+                }
+                val intent = Intent(context, AgentForegroundService::class.java)
+                    .setAction(AgentForegroundService.ACTION_BACKFILL_START).putExtra("days", days).putExtra("confirmedAt", now)
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) context.startForegroundService(intent) else context.startService(intent)
+                dialog.dismiss()
+            }
+        }
+        dialog.show()
+    }
+
+    private fun renderBackfill() {
+        val panel = backfillPanel ?: return
+        val context = context ?: return
+        val state = AgentForegroundService.backfillState
+        panel.removeAllViews()
+        if (state.message.isBlank()) return
+        panel.addView(context.card(context.cardColumn().apply {
+            addView(context.label(if (state.running) "正在回填订单" else "回填结果", 16f))
+            addView(context.label(state.copy(evidence = emptyList()).text(), 14f))
+            if (state.running) {
+                addView(MaterialButton(context).apply {
+                    text = "停止"
+                    minimumHeight = context.dp(48)
+                    setOnClickListener {
+                        context.startService(Intent(context, AgentForegroundService::class.java).setAction(AgentForegroundService.ACTION_BACKFILL_STOP))
+                        isEnabled = false
+                        text = "正在停止…"
+                    }
+                })
+            }
+            if (state.evidence.isNotEmpty()) addView(MaterialButton(context).apply {
+                text = "查看逐条结果"
+                minimumHeight = context.dp(48)
+                setOnClickListener {
+                    MaterialAlertDialogBuilder(context).setTitle("回填明细")
+                        .setMessage(state.evidence.joinToString("\n")).setPositiveButton("关闭", null).show()
+                }
+            })
+        }))
+    }
+
     private fun buildFilters(): View {
         val context = requireContext()
         val statuses = if (collection) {
@@ -632,6 +723,7 @@ class TaskHistoryFragment : Fragment() {
     private fun registerCurrentPageReceiver() {
         if (currentPageReceiverRegistered) return
         val filter = IntentFilter(AgentForegroundService.ACTION_CURRENT_PAGE_RESULT)
+        filter.addAction(AgentForegroundService.ACTION_BACKFILL_STATE)
         if (Build.VERSION.SDK_INT >= 33) {
             requireContext().registerReceiver(currentPageReceiver, filter, Context.RECEIVER_NOT_EXPORTED)
         } else {
@@ -724,6 +816,12 @@ class TaskHistoryFragment : Fragment() {
             append("实际单价：${money(task.actualUnitPriceCent, task.currency)}\n")
             append("PDD 订单号：${task.pddOrderNo ?: "—"}\n")
             append("下单时间：${task.orderSubmittedAt?.let(::formatTime) ?: "—"}")
+            val environment = "${AgentSettingsStore(context).serverUrl()}|${runCatching { SecureDeviceStore(context).credentials()?.deviceId }.getOrNull()}"
+            when (TaskHistoryCache(context).backfillTimeSource(task.taskId, environment)) {
+                "page" -> append("（页面读取）")
+                "irreversible_at" -> append("（估算：提交订单时刻）")
+                "existing_unknown" -> append("（已有值，来源未知）")
+            }
         }
         resultColumn.addView(context.card(context.cardColumn().apply {
             addView(context.label("CG-${task.taskId}", 20f, context.getColor(R.color.agent_text), true))
@@ -748,7 +846,7 @@ class TaskHistoryFragment : Fragment() {
                 contentDescription = "重试采购任务 CG-${task.taskId}"
                 setOnClickListener { confirmPurchaseRetry(task) }
             }, collectionCardParams())
-            resultColumn.addView(context.centeredMessage("重试边界", "复用当前任务并刷新采购规则；不会执行支付。"))
+            resultColumn.addView(context.centeredMessage("重试边界", "复用当前任务并新增一次执行；使用当前有效采购规则，商品和规格快照不变，不会执行支付。"))
         } else if (!replacementInProgress && task.status == "failed") {
             val reason = task.retryDisabledReason?.takeIf(String::isNotBlank) ?: "请在管理端核对任务状态。"
             resultColumn.addView(context.centeredMessage("不可重试", reason))
@@ -866,22 +964,25 @@ class TaskHistoryFragment : Fragment() {
         val generation = ++requestGeneration
         showLoading(if (continuing) "正在提交继续采购请求…" else "正在提交重试请求…")
         Thread {
-            runCatching {
+            runCatching<Unit> {
                 val client = AgentApiClient(serverUrl)
                 val requestId = UUID.randomUUID().toString()
-                if (continuing) client.retryPurchaseTask(taskId, requestId, credentials.token)
-                else client.resetPurchaseTask(taskId, requestId, credentials.token)
-            }
-                .onSuccess { result ->
+                if (PurchaseRetryPolicy.usesInPlaceReset(continuing)) {
+                    val result = client.resetPurchaseTask(taskId, requestId, credentials.token)
                     resultColumn.post {
                         if (!isAdded || generation != requestGeneration) return@post
                         AgentForegroundService.start(requireContext())
-                        when (result) {
-                            is PurchaseRetryResult -> showPurchaseRetrySuccess(result.sourceTaskNo, result.taskNo, result.taskId)
-                            is PurchaseResetResult -> showPurchaseResetSuccess(result.taskNo, result.taskId, result.attemptNumber)
-                        }
+                        showPurchaseResetSuccess(result.taskNo, result.taskId, result.attemptNumber)
+                    }
+                } else {
+                    val result = client.retryPurchaseTask(taskId, requestId, credentials.token)
+                    resultColumn.post {
+                        if (!isAdded || generation != requestGeneration) return@post
+                        AgentForegroundService.start(requireContext())
+                        showPurchaseRetrySuccess(result.sourceTaskNo, result.taskNo, result.taskId)
                     }
                 }
+            }
                 .onFailure { error ->
                     resultColumn.post {
                         if (isAdded && generation == requestGeneration) {
@@ -892,14 +993,14 @@ class TaskHistoryFragment : Fragment() {
         }.start()
     }
 
-    private fun showPurchaseRetrySuccess(sourceTaskNo: String, taskNo: String, taskId: Long) {
+    private fun showPurchaseResetSuccess(taskNo: String, taskId: Long, attemptNumber: Int) {
         resultColumn.removeAllViews()
         resultColumn.addView(requireContext().centeredMessage(
-            "已创建新任务 $taskNo",
-            "旧任务 $sourceTaskNo 已保留。新任务将由当前设备按正常队列执行；系统不会支付。",
+            "$taskNo 已进入第 $attemptNumber 次执行",
+            "原采购任务已复用，并将由当前设备按正常队列执行；系统不会支付。",
         ))
         resultColumn.addView(MaterialButton(requireContext()).apply {
-            text = "查看新任务"
+            text = "查看当前任务"
             minimumHeight = requireContext().dp(48)
             setOnClickListener { loadPurchaseDetail(taskId) }
         }, collectionCardParams())
@@ -910,14 +1011,14 @@ class TaskHistoryFragment : Fragment() {
         }, collectionCardParams())
     }
 
-    private fun showPurchaseResetSuccess(taskNo: String, taskId: Long, attemptNumber: Int) {
+    private fun showPurchaseRetrySuccess(sourceTaskNo: String, taskNo: String, taskId: Long) {
         resultColumn.removeAllViews()
         resultColumn.addView(requireContext().centeredMessage(
-            "已加入重试队列 $taskNo",
-            "任务号保持不变，将使用最新采购规则进行第 $attemptNumber 次尝试；系统不会支付。",
+            "已创建新任务 $taskNo",
+            "旧任务 $sourceTaskNo 已保留。新任务将由当前设备按正常队列执行；系统不会支付。",
         ))
         resultColumn.addView(MaterialButton(requireContext()).apply {
-            text = "查看当前任务"
+            text = "查看新任务"
             minimumHeight = requireContext().dp(48)
             setOnClickListener { loadPurchaseDetail(taskId) }
         }, collectionCardParams())

android/app/src/main/res/values/colors.xml

@@ -8,4 +8,8 @@
     <color name="agent_text_muted">#CBD5E1</color>
     <color name="agent_warning">#FBBF24</color>
     <color name="agent_error">#F87171</color>
+    <color name="purchase_result_success_background">#166534</color>
+    <color name="purchase_result_failure_background">#991B1B</color>
+    <color name="purchase_result_text">#FFFFFF</color>
+    <color name="purchase_result_text_secondary">#F1F5F9</color>
 </resources>

android/app/src/test/java/cn/ilapage/goauto/agent/CollectionCooldownPolicyTest.kt

@@ -86,15 +86,19 @@ class CollectionCooldownPolicyTest {
     fun `purchase keeps priority while collection waits for cooldown`() {
         assertEquals(
             TaskDispatchDecision.RUN_PURCHASE,
-            TaskDispatchPolicy.decide(purchaseAvailable = true, collectionCooldownActive = true),
+            TaskDispatchPolicy.decide(purchaseStatus = "pending", collectionCooldownActive = true),
+        )
+        assertEquals(
+            TaskDispatchDecision.WAIT_FOR_PURCHASE_MATCH,
+            TaskDispatchPolicy.decide(purchaseStatus = "spec_probe_pending", collectionCooldownActive = true),
         )
         assertEquals(
             TaskDispatchDecision.WAIT_FOR_COLLECTION_COOLDOWN,
-            TaskDispatchPolicy.decide(purchaseAvailable = false, collectionCooldownActive = true),
+            TaskDispatchPolicy.decide(purchaseStatus = null, collectionCooldownActive = true),
         )
         assertEquals(
             TaskDispatchDecision.CHECK_COLLECTION,
-            TaskDispatchPolicy.decide(purchaseAvailable = false, collectionCooldownActive = false),
+            TaskDispatchPolicy.decide(purchaseStatus = null, collectionCooldownActive = false),
         )
     }
 }

android/app/src/test/java/cn/ilapage/goauto/agent/OrderBackfillTest.kt

@@ -0,0 +1,245 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.network.*
+import cn.ilapage.goauto.agent.service.*
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+import java.io.IOException
+import java.util.TimeZone
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.Executors
+import java.util.concurrent.atomic.AtomicInteger
+
+class OrderBackfillTest {
+    private val zone = TimeZone.getTimeZone("Asia/Shanghai")
+    private fun time(raw: String): Long = BackfillDetailReader(zone).apply { accept("下单时间：$raw") }.finish().timeMillis!!
+    private val now = time("2026-09-08 12:00:00")
+
+    @Test fun `expanded detail reads order time not group time across frames`() {
+        val reader = BackfillDetailReader(zone)
+        reader.accept("测试地址_cg7\n订单编号：TEST-000007\n展开")
+        reader.accept("下单时间：2026-09-08 10:50:29\n拼单时间：2026-09-08 11:20:35")
+        val detail = reader.finish()
+        assertEquals("2026-09-08T10:50:29+08:00", detail.item!!.orderSubmittedAt)
+        assertEquals("_cg7", detail.item!!.addressSuffix)
+        assertNull(reader.finish().item)
+    }
+
+    @Test fun `untagged order never becomes retained or uploaded candidate`() {
+        val reader = BackfillDetailReader(zone)
+        reader.accept("个人订单\n订单编号：PERSONAL-1\n下单时间：2026-09-08 10:00:00")
+        assertNull(reader.finish().item)
+        reader.accept("测试地址_cg7")
+        assertNull(reader.finish().item) // previous order number has been cleared
+        val uploaded = mutableListOf<BackfillItem>()
+        scanner(FakeDriver(tagged = false), uploaded).scan()
+        assertTrue(uploaded.isEmpty())
+    }
+
+    @Test fun `ambiguous and noncanonical suffixes are skipped and missing time remains optional`() {
+        for (suffix in listOf("_cg07", "_cg+7", "_cg７", "_cg7abc", "_cg7 _cg8")) {
+            assertNull(BackfillDetailReader(zone).apply { accept("$suffix\n订单号：TEST-000007") }.finish().item)
+        }
+        assertNull(BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n订单号：TEST-000008") }.finish().item)
+        val missing = BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n拼单时间：2026-09-08 10:00:00") }.finish()
+        assertNotNull(missing.item)
+        assertNull(missing.item!!.orderSubmittedAt)
+    }
+
+    @Test fun `rolling hours boundary and sampled descending cutoff`() {
+        val window = OrderBackfillWindow("2", now)
+        assertEquals(now - 48 * 3_600_000L, window.cutoff)
+        assertTrue(window.includes(window.cutoff))
+        assertFalse(window.includes(window.cutoff - 1))
+        repeat(4) { assertFalse(window.observe(window.cutoff + 10 - it)) }
+        assertTrue(window.observe(window.cutoff - 1))
+        assertEquals(Long.MIN_VALUE, OrderBackfillWindow("99999999999999999999999999", now).cutoff)
+    }
+
+    @Test fun `time reversal and missing times disable early stop`() {
+        val window = OrderBackfillWindow("2", now)
+        assertFalse(window.observe(now - 100))
+        assertFalse(window.observe(now))
+        repeat(10) { assertFalse(window.observe(window.cutoff - it - 1)) }
+        assertTrue(window.nonDescending)
+        val unknown = OrderBackfillWindow("2", now)
+        unknown.observe(null)
+        repeat(10) { assertFalse(unknown.observe(unknown.cutoff - it - 1)) }
+    }
+
+    @Test fun `scanner expands and stops after validated prefix passes rolling cutoff`() {
+        val driver = FakeDriver()
+        val items = mutableListOf<BackfillItem>()
+        val result = scanner(driver, items).scan()
+        assertEquals(5, driver.opened)
+        assertEquals(5, driver.expansions)
+        assertTrue(result.contains("已达指定天数"))
+        assertTrue(result.contains("未完整扫描"))
+        assertTrue(items.all { !it.orderSubmittedAt.orEmpty().contains("11:20") })
+    }
+
+    @Test fun `unordered list scans to internal cap and reports incomplete`() {
+        val window = OrderBackfillWindow("2", now)
+        val driver = FakeDriver(unordered = true)
+        val result = OrderBackfillScanner(driver, window, {}, {}, {}).scan()
+        assertTrue(window.nonDescending)
+        assertEquals(200, driver.opened)
+        assertTrue(result.contains("未完整扫描"))
+        assertTrue(result.contains(OrderBackfillWindow.UNORDERED))
+    }
+
+    @Test fun `mutex occupied rejects and simultaneous double tap has one winner and finally releases`() {
+        val mutex = TaskExecutionMutex()
+        val guard = OrderBackfillGuard(mutex)
+        mutex.tryAcquire(7)
+        assertFalse(guard.tryAcquire())
+        mutex.release(7)
+        val start = CountDownLatch(1)
+        val complete = CountDownLatch(2)
+        val won = AtomicInteger()
+        val pool = Executors.newFixedThreadPool(2)
+        repeat(2) { pool.execute { start.await(); if (guard.tryAcquire()) won.incrementAndGet(); complete.countDown() } }
+        start.countDown()
+        complete.await()
+        pool.shutdownNow()
+        assertEquals(1, won.get())
+        assertFalse(mutex.tryAcquire(8))
+        try { guard.cancelled.set(true); throw IllegalStateException("cancelled") } catch (_: IllegalStateException) { } finally { guard.release() }
+        assertNull(mutex.currentTaskId())
+        assertTrue(guard.tryAcquire())
+        assertFalse(guard.cancelled.get())
+        guard.release()
+    }
+
+    @Test fun `permanent business errors never retry regardless of server retryable flag`() {
+        val codes = listOf("PURCHASE_BACKFILL_SUFFIX_INVALID", "PURCHASE_TASK_NOT_FOUND", "PURCHASE_BACKFILL_DEVICE_MISMATCH",
+            "PURCHASE_STATE_CONFLICT", "PURCHASE_INVALID_REQUEST", "PURCHASE_ORDER_TIME_INVALID", "PURCHASE_ORDER_TIME_MISSING",
+            "PURCHASE_BACKFILL_ORDER_CONFLICT", "PURCHASE_BACKFILL_BATCH_CONFLICT", "PURCHASE_BACKFILL_ORDER_ALREADY_USED")
+        codes.forEach { code ->
+            var calls = 0
+            val results = mutableListOf<BackfillResult>()
+            OrderBackfillUpload({ _, _ -> calls++; listOf(failure(code)) }, {}, {}).upload(listOf(item), results::add)
+            assertEquals(1, calls)
+            assertTrue(results.single().display().contains("需人工检查"))
+        }
+        var calls = 0
+        OrderBackfillUpload({ _, _ -> calls++; throw AgentApiException(409, codes.first(), "hidden", true) }, {}, {})
+            .upload(listOf(item)) { assertTrue(it.needsReview) }
+        assertEquals(1, calls)
+    }
+
+    @Test fun `network and internal errors retry bounded with stable transport request id`() {
+        val ids = mutableListOf<String>()
+        val results = mutableListOf<BackfillResult>()
+        OrderBackfillUpload({ id, _ -> ids += id; throw IOException("private body") }, {}, {})
+            .upload(listOf(item), results::add)
+        assertEquals(3, ids.size)
+        assertEquals(1, ids.toSet().size)
+        assertFalse(results.single().needsReview)
+        assertFalse(results.single().display().contains("private"))
+        var calls = 0
+        OrderBackfillUpload({ _, _ -> calls++; listOf(failure("INTERNAL_ERROR")) }, {}, {})
+            .upload(listOf(item)) { assertTrue(it.display().contains("重试耗尽")) }
+        assertEquals(3, calls)
+    }
+
+    @Test fun `partial response only retries transient items and preserves acknowledged success`() {
+        val sizes = mutableListOf<Int>()
+        val results = mutableListOf<BackfillResult>()
+        val second = item.copy(addressSuffix = "_cg8", pddOrderNo = "TEST-000008")
+        OrderBackfillUpload({ _, items ->
+            sizes += items.size
+            if (items.size == 2) listOf(success(), failure("INTERNAL_ERROR").copy(index = 1))
+            else listOf(failure("PURCHASE_STATE_CONFLICT"))
+        }, {}, {}).upload(listOf(item, second), results::add)
+        assertEquals(listOf(2, 1), sizes)
+        assertTrue(results.first().success)
+        assertEquals(1, results.last().index)
+    }
+
+    @Test fun `cancellation prevents upload and invalid response cannot confirm cache`() {
+        var calls = 0
+        try {
+            OrderBackfillUpload({ _, _ -> calls++; listOf(success()) }, { error("stopped") }, {}).upload(listOf(item)) { fail() }
+            fail()
+        } catch (_: IllegalStateException) { }
+        assertEquals(0, calls)
+        try {
+            OrderBackfillUpload({ _, _ -> listOf(success().copy(taskId = 99)) }, {}, {}).upload(listOf(item)) { fail() }
+            fail()
+        } catch (_: IllegalStateException) { }
+    }
+
+    @Test fun `payload contains only suffix order and optional RFC3339 time`() {
+        val payload = backfillPayload("test", listOf(item))
+        assertEquals(setOf("requestId", "items"), payload.keySet())
+        assertEquals(setOf("addressSuffix", "pddOrderNo"), payload.getJSONArray("items").getJSONObject(0).keySet())
+        val parsed = parseBackfillResults(JSONObject("""{"items":[{"index":0,"taskId":7,"result":"backfilled","code":"BACKFILLED","status":"order_created","statusVersion":3,"pddOrderNo":"TEST-000007","orderSubmittedAt":"2026-09-08T10:00:00+08:00","timeSource":"irreversible_at","retryable":false}]}"""))
+        assertTrue(parsed.single().display().contains("估算"))
+        assertTrue(parsed.single().copy(timeSource = "page").display().contains("页面下单时间"))
+    }
+
+    @Test fun `cache updates confirmed server facts only and clears old errors`() {
+        val task = JSONObject().put("taskId", 7).put("status", "order_result_unknown").put("errorCode", "OLD").put("errorMessage", "old")
+        cn.ilapage.goauto.agent.persistence.applyBackfillFacts(task, failure("PURCHASE_BACKFILL_ORDER_CONFLICT"))
+        assertEquals("order_result_unknown", task.getString("status"))
+        assertEquals("OLD", task.getString("errorCode"))
+        cn.ilapage.goauto.agent.persistence.applyBackfillFacts(task, success())
+        assertEquals("order_created", task.getString("status"))
+        assertEquals(item.pddOrderNo, task.getString("pddOrderNo"))
+        assertTrue(task.isNull("errorCode"))
+        assertTrue(task.isNull("errorMessage"))
+        assertFalse(task.getBoolean("retryable"))
+    }
+
+    @Test fun `expansion requires order information and product snapshot row`() {
+        val expand = node("0/1", "展开")
+        assertNull(BackfillPagePolicy.expansion(page(node("0/0", "订单编号：TEST-000007"), expand)))
+        assertEquals(expand, BackfillPagePolicy.expansion(page(node("0/0", "订单编号：TEST-000007"), expand, node("0/2", "商品快照"))))
+    }
+
+    @Test fun `dangerous nodes ancestors and overlapping actions never become click targets`() {
+        BackfillPagePolicy.forbidden.forEach { label ->
+            val dangerous = node("0/0", label)
+            assertFalse(BackfillPagePolicy.safe(page(dangerous), dangerous))
+            val parent = node("0", "查看详情")
+            assertFalse(BackfillPagePolicy.safe(page(parent, dangerous), parent))
+            val adjacent = node("0/1", "查看详情")
+            assertFalse(BackfillPagePolicy.safe(page(adjacent, dangerous), adjacent))
+        }
+    }
+
+    private val item = BackfillItem("_cg7", "TEST-000007", null)
+    private fun failure(code: String) = BackfillResult(0, 7, "failed", code, "", 0, null, null, "")
+    private fun success() = BackfillResult(0, 7, "backfilled", "BACKFILLED", "order_created", 3, item.pddOrderNo, null, "page")
+    private fun scanner(driver: FakeDriver, items: MutableList<BackfillItem>) = OrderBackfillScanner(driver, OrderBackfillWindow("2", now), {}, items::add, {})
+    private fun node(path: String, label: String, selected: Boolean = false) = SnapshotNode(path, path.substringBeforeLast('/'), label, null, null, "View",
+        NodeBounds(0, 0, 200, 60), true, false, selected, false, true, true)
+    private fun page(vararg nodes: SnapshotNode) = UiSnapshot(BackfillPagePolicy.PDD, "com.xunmeng.pinduoduo.activity.NewPageActivity", nodes.toList())
+
+    private inner class FakeDriver(val tagged: Boolean = true, val unordered: Boolean = false) : BackfillDriver {
+        var opened = 0
+        var expansions = 0
+        var index = 0
+        var inDetail = false
+        var expanded = false
+        override fun openOrders() = Unit
+        override fun pause() = Unit
+        override fun capture(): UiSnapshot {
+            if (!inDetail) return page(node("0/0", "我的订单"), node("0/1", "全部", true), node("0/2", "查看详情"), node("0/2/0", "合成卡片 $index"))
+            val date = if (unordered && index == 1) "2026-09-08 11:00:00" else if (index < 4) "2026-09-08 10:00:00" else "2026-09-05 10:00:00"
+            return page(node("0/0", "订单详情"), node("0/1", "订单编号：TEST-${100000 + index}"),
+                node("0/2", if (tagged) "合成地址_cg${index + 1}" else "无后缀合成地址"),
+                node("0/4", "商品快照"),
+                node("0/3", if (expanded) "下单时间：$date\n拼单时间：2026-09-08 11:20:00" else "展开"))
+        }
+        override fun click(node: SnapshotNode): Boolean {
+            if (node.label == "展开") { expanded = true; expansions++ } else { inDetail = true; opened++ }
+            return true
+        }
+        override fun scroll() = false
+        override fun back(): Boolean { inDetail = false; expanded = false; index++; return true }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PddLaunchFallbackTest.kt

@@ -0,0 +1,25 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.PddLaunchFallback
+import org.junit.Assert.*
+import org.junit.Test
+
+class PddLaunchFallbackTest {
+    @Test fun directSuccessDoesNotStartBrowser() {
+        assertTrue(PddLaunchFallback.open(true, { true }, { error("browser must not start") }))
+    }
+    @Test fun missingHandlerFallsBackOnce() {
+        var browserCalls = 0
+        assertTrue(PddLaunchFallback.open(true, { throw IllegalStateException("no handler") }, { browserCalls++; true }))
+        assertEquals(1, browserCalls)
+    }
+    @Test fun rejectedDirectLaunchFallsBack() {
+        assertTrue(PddLaunchFallback.open(true, { false }, { true }))
+        assertFalse(PddLaunchFallback.open(true, { false }, { false }))
+    }
+    @Test fun collectionKeepsBrowserEntry() {
+        var directCalls = 0
+        assertTrue(PddLaunchFallback.open(false, { directCalls++; true }, { true }))
+        assertEquals(0, directCalls)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PddProductDetailCollectorTest.kt

@@ -11,6 +11,7 @@ import cn.ilapage.goauto.agent.automation.PddCollectorConfig
 import cn.ilapage.goauto.agent.automation.PddCollectorDriver
 import cn.ilapage.goauto.agent.automation.PddProductDetailCollector
 import cn.ilapage.goauto.agent.automation.PddScreenParser
+import cn.ilapage.goauto.agent.automation.PurchasePanelContext
 import cn.ilapage.goauto.agent.automation.SnapshotNode
 import cn.ilapage.goauto.agent.automation.SpecPanelType
 import cn.ilapage.goauto.agent.automation.SwipeDirection
@@ -26,6 +27,62 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PddProductDetailCollectorTest {
+    private fun prefixlessPanel(): UiSnapshot = UiSnapshot(PDD_PACKAGE, ACTIVITY, listOf(
+        node("root", "", 0, 0, 1080, 2376),
+        node("close", "关闭", 970, 270, 1050, 350, clickable = true),
+        node("info", "", 0, 770, 1080, 1157),
+        node("info/summary", "米白色（有里布） 2XL 建议131到150斤", 396, 878, 1053, 992, parentPath = "info"),
+        node("info/quantity", "1", 480, 1046, 561, 1121, className = "android.widget.EditText", parentPath = "info"),
+        node("minus", "减少数量", 396, 1046, 470, 1121, clickable = true),
+        node("plus", "增加数量", 570, 1046, 645, 1121, clickable = true),
+        node("scroll", "", 0, 1294, 1080, 2079, scrollable = true),
+        node("scroll/color-title", "颜色分类", 36, 1319, 216, 1380, parentPath = "scroll"),
+        node("scroll/color", "米白色（有里布）", 36, 1405, 352, 1808, clickable = true, selected = true, parentPath = "scroll"),
+        node("scroll/size-title", "尺码", 36, 1858, 126, 1911, parentPath = "scroll"),
+        node("scroll/size", "XL 建议111到130斤", 36, 1930, 440, 2015, clickable = true, parentPath = "scroll"),
+        node("payment", "微信支付", 112, 2100, 929, 2157),
+        node("submit", "提交订单", 375, 2225, 705, 2284, clickable = true),
+    ))
+
+    @Test fun `prefixless selected panel retains structural recognition and product summary`() {
+        val parsed = PddScreenParser.parse(prefixlessPanel(), config(), GOODS_ID, evidence())
+        assertEquals(SpecPanelType.NORMAL_SCROLLABLE, parsed.specPanelType)
+        assertEquals("米白色（有里布） 2XL 建议131到150斤", parsed.selectedSummary)
+    }
+
+    @Test fun `prefixless panel requires quantity and order evidence`() {
+        for (missing in listOf("plus", "submit", "payment")) {
+            val snapshot = prefixlessPanel()
+            val parsed = PddScreenParser.parse(snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == missing }), config(), GOODS_ID, evidence())
+            assertFalse(parsed.specPanelOpen)
+            assertEquals(null, parsed.selectedSummary)
+        }
+    }
+
+    @Test fun `ambiguous product summaries are not used`() {
+        val snapshot = prefixlessPanel()
+        val extra = node("info/other", "米白色（有里布） XL 建议111到130斤", 396, 800, 1053, 870, parentPath = "info")
+        val parsed = PddScreenParser.parse(snapshot.copy(nodes = snapshot.nodes + extra), config(), GOODS_ID, evidence())
+        assertEquals(null, parsed.selectedSummary)
+    }
+
+    @Test fun `scrolling away color heading and options preserves known purchase panel and summary`() {
+        val initial = prefixlessPanel()
+        val opened = PddScreenParser.parse(initial, config(), GOODS_ID, evidence())
+        val context = PurchasePanelContext(requireNotNull(opened.specPanelContainer), "米白色（有里布）")
+        val scrolled = initial.copy(nodes = initial.nodes.filterNot { it.path.startsWith("scroll/color") })
+        val continued = PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence(), context)
+        assertEquals(1, continued.panelHeadingCount)
+        assertTrue(continued.specPanelOpen)
+        assertEquals("米白色（有里布） 2XL 建议131到150斤", continued.selectedSummary)
+        assertTrue(continued.dimensions.none { it.key == "color" })
+        assertFalse(PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence()).specPanelOpen)
+        assertFalse(PddScreenParser.parse(scrolled, config(), GOODS_ID, evidence(),
+            context.copy(container = context.container.copy(path = "other"))).specPanelOpen)
+        assertFalse(PddScreenParser.parse(scrolled.copy(nodes = scrolled.nodes.filterNot { it.path == "submit" }),
+            config(), GOODS_ID, evidence(), context).specPanelOpen)
+    }
+
     @Test
     fun `parser removes only trailing size price and keeps raw evidence`() {
         val snapshot = UiSnapshot(
@@ -367,6 +424,64 @@ class PddProductDetailCollectorTest {
         assertEquals("bottom_purchase", parsed.specEntrySource)
     }
 
+    @Test
+    fun bottomPurchaseEntriesPreferRightmostCandidate() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("buy-left", "单独购买", 446, 2000, 685, 2160, clickable = true),
+                node("buy-right", "发起拼单", 685, 2000, 1080, 2160, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("buy-right", parsed.specEntry?.path)
+        assertEquals("buy-right", parsed.specEntryClickTarget?.path)
+        assertEquals("bottom_purchase_rightmost", parsed.specEntrySource)
+        assertEquals(2, parsed.bottomPurchaseEntryCount)
+    }
+
+    @Test
+    fun equallyRightmostBottomPurchaseEntriesPreferSmallerArea() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("buy-large", "发起拼单", 685, 2000, 1080, 2160, clickable = true),
+                node("buy-small", "立即购买", 785, 2000, 980, 2140, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals("buy-small", parsed.specEntry?.path)
+        assertEquals("bottom_purchase_rightmost", parsed.specEntrySource)
+    }
+
+    @Test
+    fun bottomPurchaseCandidatesStillExcludeReviewOrderAndPaymentContexts() {
+        val snapshot = UiSnapshot(
+            PDD_PACKAGE,
+            ACTIVITY,
+            listOf(
+                node("content", "", 0, 0, 1080, 2200, resourceId = "android:id/content", className = "android.widget.FrameLayout"),
+                node("reviews", "商品评价", 446, 1900, 685, 2160, clickable = true),
+                node("reviews/buy", "购买", 480, 2000, 650, 2100, parentPath = "reviews"),
+                node("order", "购买并提交订单", 685, 2000, 880, 2160, clickable = true),
+                node("payment", "购买后立即支付", 880, 2000, 1080, 2160, clickable = true),
+            ),
+        )
+
+        val parsed = PddScreenParser.parse(snapshot, config(), GOODS_ID, evidence())
+
+        assertEquals(null, parsed.specEntry)
+        assertEquals(0, parsed.bottomPurchaseEntryCount)
+    }
+
     @Test
     fun bottomPurchaseInsideReviewCardIsNeverSpecEntry() {
         val snapshot = UiSnapshot(

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseLiveAutomationTest.kt

@@ -1,6 +1,8 @@
 package cn.ilapage.goauto.agent
 
 import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.FreshClickOutcome
+import cn.ilapage.goauto.agent.automation.FreshClickReason
 import cn.ilapage.goauto.agent.automation.NodeBounds
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
 import cn.ilapage.goauto.agent.automation.PurchaseLiveAutomation
@@ -16,6 +18,81 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PurchaseLiveAutomationTest {
+    @Test
+    fun `verified spec panel advances through one exact confirm target`() {
+        val driver = SpecConfirmationDriver()
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation()
+
+        assertEquals(listOf("确定"), driver.clicked)
+        assertEquals("order", driver.page)
+    }
+
+    @Test
+    fun `ambiguous missing and unchanged spec confirmation stop safely`() {
+        val ambiguous = SpecConfirmationDriver(confirmLabels = listOf("确定", "确认"))
+        val ambiguousError = runCatching { PurchaseLiveAutomation(ambiguous, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRM_TARGET_AMBIGUOUS", ambiguousError.code)
+        assertTrue(ambiguous.clicked.isEmpty())
+
+        val missing = SpecConfirmationDriver(confirmLabels = emptyList(), specPanelScrollable = true)
+        val missingError = runCatching { PurchaseLiveAutomation(missing, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRM_TARGET_MISSING", missingError.code)
+        assertTrue(missing.clicked.isEmpty())
+
+        val unchanged = SpecConfirmationDriver(advanceAfterClick = false)
+        val unchangedError = runCatching { PurchaseLiveAutomation(unchanged, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_UNCONFIRMED", unchangedError.code)
+        assertEquals(listOf("确定"), unchanged.clicked)
+    }
+
+    @Test
+    fun `existing order confirmation does not click submit or payment controls`() {
+        val driver = SpecConfirmationDriver(startOnOrderPage = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation()
+
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `recorded exact selections allow one unique confirm on an unclassified pdd panel`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation(
+            allowUnclassifiedPanelWithSelectionProof = true,
+        )
+
+        assertEquals(listOf("确定"), driver.clicked)
+        assertEquals("order", driver.page)
+    }
+
+    @Test
+    fun `unclassified pdd panel without recorded selections remains blocked`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation() }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `recorded selections never authorize a generic unclassified pdd dialog`() {
+        val driver = SpecConfirmationDriver(unclassifiedSpecPanel = true, unclassifiedHasPurchaseEvidence = false)
+        val error = runCatching {
+            PurchaseLiveAutomation(driver, pause = {}).advanceToOrderConfirmation(
+                allowUnclassifiedPanelWithSelectionProof = true,
+            )
+        }.exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_SPEC_CONFIRMATION_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
     @Test
     fun `address is retagged verified and final order button can only be clicked once`() {
         val driver = LiveDriver()
@@ -64,6 +141,31 @@ class PurchaseLiveAutomationTest {
         assertEquals(0, driver.submitClicks)
     }
 
+    @Test
+    fun `saved address returning to spec panel is recovered without pressing back`() {
+        val driver = LiveDriver(saveReturnsToSpecPanel = true)
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+
+        val address = automation.updateShippingAddress("_cg91")
+        val final = automation.finalConfirmation(input().copy(addressSuffix = "_cg91"), address)
+
+        assertEquals("_cg91", final.addressSuffix)
+        assertEquals(0, driver.backCount)
+        assertEquals(1, driver.scopedSwipes)
+        assertEquals(0, driver.submitClicks)
+    }
+
+    @Test
+    fun `saved address stuck on spec panel fails without backing out or submitting`() {
+        val driver = LiveDriver(saveReturnsToSpecPanel = true, savedSpecPanelRecoveryStuck = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg92") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
+        assertEquals(0, driver.backCount)
+        assertEquals(0, driver.submitClicks)
+    }
+
     @Test
     fun `edit field containing suffix cannot impersonate post save evidence`() {
         val driver = LiveDriver(saveStaysInEdit = true)
@@ -199,8 +301,25 @@ class PurchaseLiveAutomationTest {
     }
 
     @Test
-    fun `repeated known payment activity still stops without scrolling or payment clicks`() {
-        val driver = LiveDriver(postSubmitCaptureSequence = listOf("payment", "payment"))
+    fun `payment transition frame after safe back reaches unpaid order evidence without payment clicks`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = listOf("payment", "payment", "order"))
+        val automation = PurchaseLiveAutomation(driver, pause = {})
+        val address = automation.updateShippingAddress("_cg55")
+        automation.finalConfirmation(input().copy(addressSuffix = "_cg55"), address)
+        automation.submitOrderOnce()
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-202608210001", order?.orderNo)
+        assertEquals("2026-08-21T02:30:00Z", order?.submittedAt)
+        assertEquals(1, driver.postSubmitBackCount)
+        assertEquals(0, driver.genericSwipes)
+        assertFalse(driver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `continuous payment activity still stops at bounded post back samples without payment clicks`() {
+        val driver = LiveDriver(postSubmitCaptureSequence = List(4) { "payment" })
         val automation = PurchaseLiveAutomation(driver, pause = {})
         val address = automation.updateShippingAddress("_cg55")
         automation.finalConfirmation(input().copy(addressSuffix = "_cg55"), address)
@@ -208,6 +327,12 @@ class PurchaseLiveAutomationTest {
 
         assertEquals(null, automation.readOrderResult())
         assertEquals("PURCHASE_ORDER_PAYMENT_REPEATED", automation.lastOrderReadFailure?.code)
+        assertEquals(
+            "支付页安全返回后持续无订单证据，已停止自动核单" +
+                "[paymentBackAttempts=1;consecutivePaymentSamplesAfterBack=3]",
+            automation.lastOrderReadFailure?.message,
+        )
+        assertEquals(4, driver.postSubmitCaptureCount)
         assertEquals(1, driver.postSubmitBackCount)
         assertEquals(0, driver.genericSwipes)
         assertFalse(driver.clicked.any { it.contains("支付") })
@@ -376,6 +501,52 @@ class PurchaseLiveAutomationTest {
         assertTrue(driver.clicked.isEmpty())
     }
 
+    @Test
+    fun `duplicate masked phone nodes in one clickable address card are activated once`() {
+        val driver = LiveDriver(duplicatePhoneNodesSameCard = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94")
+
+        assertEquals(1, driver.clicked.count { it == "138****5678" })
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `duplicate semantic address cards in separate accessibility trees are activated once`() {
+        val driver = LiveDriver(duplicateSemanticAddressCards = true)
+
+        PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94")
+
+        assertEquals(1, driver.addressPathClicks)
+        assertEquals(1, driver.clicked.count { it == "138****5678" })
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `two independent address cards remain ambiguous without any click`() {
+        val driver = LiveDriver(duplicateAddressCards = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg95") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_ENTRY_AMBIGUOUS", error.code)
+        assertTrue(error.message.orEmpty().contains("phoneNodes=2;addressCards=2;tapTargets=2"))
+        assertFalse(error.message.orEmpty().contains("138"))
+        assertTrue(driver.clicked.isEmpty())
+        assertEquals(0, driver.addressTaps)
+    }
+
+    @Test
+    fun `address entry path drift fails without fallback tap`() {
+        val driver = LiveDriver(duplicatePhoneNodesSameCard = true, addressEntryPathUnavailable = true)
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg94") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_ADDRESS_ENTRY_NOT_READY", error.code)
+        assertTrue(driver.clicked.isEmpty())
+        assertEquals(1, driver.addressPathClicks)
+        assertEquals(0, driver.addressTaps)
+    }
+
     private fun input() = PurchaseExecutionInput(
         taskId = 11,
         executionMode = "live",
@@ -390,6 +561,78 @@ class PurchaseLiveAutomationTest {
         addressSuffix = "_cg11",
     )
 
+    private class SpecConfirmationDriver(
+        private val confirmLabels: List<String> = listOf("确定"),
+        private val advanceAfterClick: Boolean = true,
+        private val specPanelScrollable: Boolean = false,
+        private val unclassifiedSpecPanel: Boolean = false,
+        private val unclassifiedHasPurchaseEvidence: Boolean = true,
+        startOnOrderPage: Boolean = false,
+    ) : PurchaseUiDriver {
+        var page = if (startOnOrderPage) "order" else "spec"
+        val clicked = mutableListOf<String>()
+
+        override fun capture(): UiSnapshot = if (page == "order") {
+            snapshot(listOf(
+                node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)),
+                node("scroll", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 2100)),
+                node("summary", "已选 黑色 均码"),
+                node("quantity", "1", className = "android.widget.EditText"),
+                node("phone", "138****5678"),
+                node("submit", "提交订单", clickable = true),
+                node("payment", "微信支付"),
+            ))
+        } else {
+            snapshot(buildList {
+                add(node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)))
+                if (unclassifiedSpecPanel) {
+                    if (unclassifiedHasPurchaseEvidence) {
+                        add(node("price", "¥20.00"))
+                        add(node("quantity", "1", className = "android.widget.EditText"))
+                    }
+                    confirmLabels.forEachIndexed { index, label -> add(node("confirm-$index", label, clickable = true)) }
+                    return@buildList
+                }
+                if (specPanelScrollable) {
+                    add(node("scroll", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 1500)))
+                }
+                add(node("title", "确认款式"))
+                add(node("summary", "已选 黑色 均码"))
+                val parent = "scroll".takeIf { specPanelScrollable }
+                val prefix = if (specPanelScrollable) "scroll/" else ""
+                add(node("${prefix}color-heading", "颜色分类", parentPath = parent))
+                add(node("${prefix}color", "黑色", clickable = true, parentPath = parent))
+                add(node("${prefix}size-heading", "尺码", parentPath = parent))
+                add(node("${prefix}size", "均码", clickable = true, parentPath = parent))
+                add(node("quantity", "1", className = "android.widget.EditText"))
+                confirmLabels.forEachIndexed { index, label -> add(node("confirm-$index", label, clickable = true)) }
+            })
+        }
+
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicked += target.label
+            if (advanceAfterClick && target.label in confirmLabels) page = "order"
+            return FreshActionResult.SUCCESS
+        }
+
+        override fun tapPurchaseFresh(target: SnapshotNode) = FreshActionResult.FAILED
+        override fun inputFresh(target: SnapshotNode, value: String) = FreshActionResult.FAILED
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long) = false
+        override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long) = false
+        override fun backPurchase() = false
+
+        private fun snapshot(nodes: List<SnapshotNode>) = UiSnapshot(PDD, ACTIVITY, nodes)
+        private fun node(
+            path: String,
+            text: String,
+            clickable: Boolean = false,
+            scrollable: Boolean = false,
+            className: String = "android.widget.TextView",
+            bounds: NodeBounds = NodeBounds(20, 100, 900, 180),
+            parentPath: String? = null,
+        ) = SnapshotNode(path, parentPath, text, null, null, className, bounds, clickable, scrollable, false, false, true, true)
+    }
+
     private class LiveDriver(
         private val addressClipped: Boolean = false,
         private val duplicatePanels: Boolean = false,
@@ -401,6 +644,12 @@ class PurchaseLiveAutomationTest {
         private val saveStaysInEdit: Boolean = false,
         private val savedTransitionWithoutLegacyContext: Boolean = false,
         private val savedTransitionHidesSuffix: Boolean = false,
+        private val saveReturnsToSpecPanel: Boolean = false,
+        private val savedSpecPanelRecoveryStuck: Boolean = false,
+        private val duplicatePhoneNodesSameCard: Boolean = false,
+        private val duplicateSemanticAddressCards: Boolean = false,
+        private val duplicateAddressCards: Boolean = false,
+        private val addressEntryPathUnavailable: Boolean = false,
         private val wechatLoginAfterSubmit: Boolean = false,
         private val wechatRestoreStuck: Boolean = false,
         private val orderEvidenceBelowFold: Boolean = false,
@@ -419,6 +668,7 @@ class PurchaseLiveAutomationTest {
         var scopedSwipes = 0
         var genericSwipes = 0
         var addressTaps = 0
+        var addressPathClicks = 0
         var lastInputTargetPath: String? = null
         var backCount = 0
         var postSubmitBackCount = 0
@@ -456,6 +706,21 @@ class PurchaseLiveAutomationTest {
                 node("transition-title", "选择收货信息"),
                 node("address-summary", if (savedTransitionHidesSuffix) "已保存的收货信息" else address.substring(address.lastIndexOf("_cg"))),
             ))
+            "post-save-spec" -> snapshot(listOf(
+                node("root", "", bounds = NodeBounds(0, 0, 1080, 2200)),
+                node("panel", "", scrollable = true, bounds = NodeBounds(0, 400, 1080, 2100)),
+                node("panel-title", "确认款式", bounds = NodeBounds(20, 396, 300, 430)),
+                node("panel/price", "¥20.00", parentPath = "panel", bounds = NodeBounds(20, 460, 300, 520)),
+                node("panel/selected", "已选 黑色 XL", parentPath = "panel", bounds = NodeBounds(20, 540, 700, 600)),
+                node("panel/color-heading", "颜色分类", parentPath = "panel", bounds = NodeBounds(20, 650, 300, 700)),
+                node("panel/color", "黑色", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 720, 220, 790)),
+                node("panel/size-heading", "尺码", parentPath = "panel", bounds = NodeBounds(20, 850, 300, 900)),
+                node("panel/size", "XL", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 920, 220, 990)),
+                node("panel/quantity", "2", className = "android.widget.EditText", parentPath = "panel", bounds = NodeBounds(400, 1050, 600, 1120)),
+                node("panel/confirm", "确定", clickable = true, parentPath = "panel", bounds = NodeBounds(20, 1200, 500, 1280)),
+                node("submit-parent", "", clickable = true, bounds = NodeBounds(20, 1900, 1000, 2100)),
+                node("submit", "提交订单", parentPath = "submit-parent", bounds = NodeBounds(520, 1940, 980, 2040)),
+            ))
             "order" -> snapshot(listOf(node("status", "待付款"), node("order", "订单号：PDD-202608210001"), node("time", "下单时间：2026-08-21 10:30:00"), node("pay", "立即支付", clickable = true)))
             "order-folded" -> snapshot(listOf(node("status", "待付款"), node("pay", "立即支付", clickable = true)))
             "order-folded-payment-activity" -> UiSnapshot(PDD, "com.xunmeng.pinduoduo.app_pay.core.PayActivity", listOf(
@@ -489,7 +754,30 @@ class PurchaseLiveAutomationTest {
                 )
                 if (duplicatePanels) nodes += node("panel2", "", scrollable = true, bounds = NodeBounds(0, 500, 1080, 2000))
                 if (addressVisible) {
-                    nodes += node("phone", "138****5678")
+                    when {
+                        duplicateSemanticAddressCards -> {
+                            nodes += node("address-layer-a", "", clickable = true, bounds = NodeBounds(0, 620, 1080, 840))
+                            nodes += node("address-layer-a/phone", "138****5678", parentPath = "address-layer-a", bounds = NodeBounds(20, 650, 400, 710))
+                            nodes += node("address-layer-a/detail", "广东省广州市天园街道骏景花园", parentPath = "address-layer-a", bounds = NodeBounds(20, 720, 900, 790))
+                            nodes += node("address-layer-b", "", clickable = true, bounds = NodeBounds(0, 900, 1080, 1120))
+                            nodes += node("address-layer-b/phone", "138****5678", parentPath = "address-layer-b", bounds = NodeBounds(20, 930, 400, 990))
+                            nodes += node("address-layer-b/detail", "广东省广州市天园街道骏景花园", parentPath = "address-layer-b", bounds = NodeBounds(20, 1000, 900, 1070))
+                        }
+                        duplicateAddressCards -> {
+                            nodes += node("address-card-a", "", clickable = true, bounds = NodeBounds(0, 620, 1080, 820))
+                            nodes += node("address-card-a/phone", "138****5678", parentPath = "address-card-a", bounds = NodeBounds(20, 650, 400, 710))
+                            nodes += node("address-card-a/detail", "广东省广州市天园街道一号", parentPath = "address-card-a", bounds = NodeBounds(20, 720, 900, 780))
+                            nodes += node("address-card-b", "", clickable = true, bounds = NodeBounds(0, 840, 1080, 1040))
+                            nodes += node("address-card-b/phone", "138****5678", parentPath = "address-card-b", bounds = NodeBounds(20, 870, 400, 930))
+                            nodes += node("address-card-b/detail", "广东省广州市天园街道二号", parentPath = "address-card-b", bounds = NodeBounds(20, 940, 900, 1000))
+                        }
+                        duplicatePhoneNodesSameCard -> {
+                            nodes += node("address-card", "", clickable = true, bounds = NodeBounds(0, 620, 1080, 900))
+                            nodes += node("address-card/phone-a", "138****5678", parentPath = "address-card", bounds = NodeBounds(20, 650, 400, 710))
+                            nodes += node("address-card/phone-b", "138****5678", parentPath = "address-card", bounds = NodeBounds(20, 720, 440, 790))
+                        }
+                        else -> nodes += node("phone", "138****5678")
+                    }
                     val suffixStart = address.lastIndexOf("_cg")
                     val addressBody = if (suffixStart >= 0) address.substring(0, suffixStart) else address
                     val addressSuffix = if (suffixStart >= 0) address.substring(suffixStart) else ""
@@ -514,7 +802,13 @@ class PurchaseLiveAutomationTest {
             when (target.label) {
                 "138****5678" -> page = "panel"
                 "修改" -> page = "edit"
-                "保存" -> if (!saveStaysInEdit) page = if (savedTransitionWithoutLegacyContext) "saved-transition" else "panel"
+                "保存" -> if (!saveStaysInEdit) {
+                    page = when {
+                        saveReturnsToSpecPanel -> "post-save-spec"
+                        savedTransitionWithoutLegacyContext -> "saved-transition"
+                        else -> "panel"
+                    }
+                }
                 "提交订单" -> {
                     submitClicks++
                     page = when {
@@ -532,6 +826,14 @@ class PurchaseLiveAutomationTest {
             return FreshActionResult.SUCCESS
         }
 
+        override fun clickAddressEntryFresh(target: SnapshotNode): FreshClickOutcome {
+            addressPathClicks++
+            if (addressEntryPathUnavailable) {
+                return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.TARGET_NOT_FOUND)
+            }
+            return FreshClickOutcome(clickFresh(target), FreshClickReason.SUCCESS, 1, 1)
+        }
+
         override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult {
             addressTaps++
             clicked += target.label
@@ -552,6 +854,7 @@ class PurchaseLiveAutomationTest {
         override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
             scopedSwipes++
             if (target.path == "panel" && direction == SwipeDirection.DOWN) addressVisible = true
+            if (page == "post-save-spec" && direction == SwipeDirection.DOWN && !savedSpecPanelRecoveryStuck) page = "confirmation"
             return true
         }
         override fun backPurchase(): Boolean {

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseRehearsalExecutorTest.kt

@@ -8,6 +8,7 @@ import cn.ilapage.goauto.agent.automation.PurchaseAgentCapabilities
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
 import cn.ilapage.goauto.agent.automation.PurchaseRehearsalExecutor
 import cn.ilapage.goauto.agent.automation.PurchaseRuleParser
+import cn.ilapage.goauto.agent.automation.PurchaseSpecGesturePolicy
 import cn.ilapage.goauto.agent.automation.PurchaseUiDriver
 import cn.ilapage.goauto.agent.automation.RuleValidationException
 import cn.ilapage.goauto.agent.automation.SnapshotNode
@@ -21,6 +22,52 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PurchaseRehearsalExecutorTest {
+    @Test
+    fun `color selection then single size heading completes without selecting color again`() {
+        val driver = FakePurchaseDriver(prefixlessSingleHeadingAfterColor = true)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
+        assertEquals(1, driver.clicked.count { it == "黑色" })
+        assertEquals(1, driver.clicked.count { it == "XL" })
+    }
+    @Test
+    fun `full exact summary confirms size after option leaves viewport`() {
+        val target = "2XL 建议131到150斤"
+        val driver = FakePurchaseDriver(sizes = listOf(target), hideSizeAfterSelection = true)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
+        assertEquals(1, driver.clicked.count { it == target })
+    }
+
+    @Test
+    fun `same size token with different full range cannot establish selection`() {
+        val target = "2XL 建议131到150斤"
+        val driver = FakePurchaseDriver(
+            sizes = listOf(target), hideSizeAfterSelection = true,
+            selectedSizeSummaryOverride = "2XL 建议151到170斤",
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("failed", outcome.resultType)
+    }
+    @Test
+    fun `spec gesture policy excludes irreversible and out of bounds targets`() {
+        fun target(label: String, bounds: NodeBounds = NodeBounds(20, 100, 300, 180)) = SnapshotNode(
+            "target", null, label, null, null, "android.widget.TextView", bounds,
+            clickable = true, scrollable = false, selected = false, checked = false, enabled = true, visible = true,
+        )
+
+        assertTrue(PurchaseSpecGesturePolicy.isAllowed(target("选择规格"), 1080, 2200))
+        assertTrue(PurchaseSpecGesturePolicy.isAllowed(target("XL"), 1080, 2200))
+        assertFalse(PurchaseSpecGesturePolicy.isAllowed(target("提交订单"), 1080, 2200))
+        assertFalse(PurchaseSpecGesturePolicy.isAllowed(target("确认购买"), 1080, 2200))
+        assertFalse(PurchaseSpecGesturePolicy.isAllowed(target("立即支付"), 1080, 2200))
+        assertFalse(PurchaseSpecGesturePolicy.isAllowed(target("修改地址"), 1080, 2200))
+        assertFalse(PurchaseSpecGesturePolicy.isAllowed(target("XL", NodeBounds(-20, 100, -2, 180)), 1080, 2200))
+    }
+
     @Test
     fun `shared current live rule matches Android contract`() {
         val raw = requireNotNull(javaClass.classLoader?.getResource("purchase-rule-live-v1.json")) {
@@ -64,12 +111,63 @@ class PurchaseRehearsalExecutorTest {
 
         assertEquals("rehearsal_completed", outcome.resultType)
         assertEquals(2_000L, outcome.actualUnitPriceCent)
-        assertEquals(1, openCount)
+        assertEquals(0, openCount)
         assertEquals(2, driver.swipeCount)
         assertEquals(2L, driver.quantity)
-        assertTrue(driver.clicked.containsAll(listOf("打开", "选择规格", "黑色", "XL")))
+        assertTrue(driver.clicked.containsAll(listOf("选择规格", "黑色", "XL")))
         assertFalse(driver.clicked.any { it.contains("订单") || it.contains("支付") })
-        assertTrue(pauses.contains(700))
+        assertFalse(pauses.contains(700))
+    }
+
+    @Test
+    fun `manual purchase retry from agent reopens the task product url`() {
+        val driver = FakePurchaseDriver(initiallyInAgent = true)
+        var openCount = 0
+        val outcome = PurchaseRehearsalExecutor(
+            driver,
+            openLink = {
+                openCount++
+                driver.leaveAgentAndOpenBrowser()
+                true
+            },
+            probeSpecs = { null },
+            pause = {},
+        ).execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(1, openCount)
+        assertEquals(1, driver.openClickCount)
+    }
+
+    @Test
+    fun `purchase phase reopens when pdd foreground has no product evidence`() {
+        val driver = FakePurchaseDriver(loadingPddCaptures = 1)
+        var openCount = 0
+        val outcome = PurchaseRehearsalExecutor(
+            driver,
+            openLink = { openCount++; driver.browser = true; true },
+            probeSpecs = { null },
+            pause = {},
+        ).execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(1, openCount)
+        assertEquals(1, driver.openClickCount)
+    }
+
+    @Test
+    fun `purchase phase does not reuse a pdd login page`() {
+        val driver = FakePurchaseDriver(pddProblemLabels = listOf("手机号登录", "登录后继续"))
+        var openCount = 0
+        val outcome = PurchaseRehearsalExecutor(
+            driver,
+            openLink = { openCount++; driver.browser = true; true },
+            probeSpecs = { null },
+            pause = {},
+        ).execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PDD_LOGIN_REQUIRED", outcome.errorCode)
+        assertEquals(1, openCount)
     }
 
     @Test
@@ -130,6 +228,161 @@ class PurchaseRehearsalExecutorTest {
         assertEquals("rehearsal_completed", outcome.resultType)
         assertTrue(driver.clicked.contains("XL"))
         assertEquals(3, driver.upSwipeCount)
+        assertTrue(driver.swipeInPaths.isNotEmpty())
+        assertTrue(driver.swipeInPaths.all { it == "scroll" })
+    }
+
+    @Test
+    fun `exact color on later horizontal page is found by bounded fallback`() {
+        val driver = FakePurchaseDriver(
+            horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals("富贵粉", driver.color)
+        assertTrue(driver.horizontalSpecDirections.contains(SwipeDirection.LEFT))
+        assertEquals(1, driver.clicked.count { it == "富贵粉" })
+    }
+
+    @Test
+    fun `visible exact color keeps established path without horizontal fallback`() {
+        val driver = FakePurchaseDriver(colors = listOf("黑色", "白色"))
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertTrue(driver.horizontalSpecDirections.isEmpty())
+    }
+
+    @Test
+    fun `single column colors never trigger horizontal fallback`() {
+        val driver = FakePurchaseDriver(
+            horizontalColorPages = listOf(listOf("黑色"), listOf("富贵粉")),
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
+        assertTrue(outcome.message.contains("horizontalSwipes=0"))
+        assertTrue(driver.horizontalSpecDirections.isEmpty())
+        assertFalse(driver.clicked.contains("黑色"))
+    }
+
+    @Test
+    fun `failed horizontal color swipe remains safely failed`() {
+        val driver = FakePurchaseDriver(
+            horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
+            horizontalSpecSwipeSucceeds = false,
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
+        assertTrue(outcome.message.contains("horizontalFailure=gestureFailed"))
+        assertTrue(driver.clicked.none { it == "富贵粉" })
+    }
+
+    @Test
+    fun `long exact size on later horizontal page is found after color selection`() {
+        val targetSize = "3XL 推荐140-155斤"
+        val driver = FakePurchaseDriver(
+            horizontalSizePages = listOf(
+                listOf("S 推荐80-95斤", "M 推荐95-110斤"),
+                listOf("2XL 推荐125-140斤", targetSize),
+            ),
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedSize = targetSize), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(targetSize, driver.size)
+        assertTrue(driver.horizontalSpecDimensions.contains("size"))
+        assertEquals(1, driver.clicked.count { it == targetSize })
+    }
+
+    @Test
+    fun `single visible long size uses its dedicated horizontal container`() {
+        val targetSize = "3XL 推荐140-155斤"
+        val driver = FakePurchaseDriver(
+            horizontalSizePages = listOf(listOf("S 推荐80-95斤"), listOf(targetSize)),
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedSize = targetSize), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(targetSize, driver.size)
+        assertTrue(driver.horizontalSpecDimensions.contains("size"))
+    }
+
+    @Test
+    fun `color and size horizontal fallbacks reacquire their own row anchors`() {
+        val targetSize = "3XL 推荐140-155斤"
+        val driver = FakePurchaseDriver(
+            horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
+            horizontalSizePages = listOf(listOf("S 推荐80-95斤", "M 推荐95-110斤"), listOf("2XL 推荐125-140斤", targetSize)),
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(
+                input().copy(mappedColor = "富贵粉", mappedSize = targetSize),
+                PurchaseRuleParser.parse(rule()),
+                PurchaseAgentCapabilities.supported,
+            )
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertTrue(driver.horizontalSpecDimensions.containsAll(listOf("color", "size")))
+        assertTrue(driver.horizontalSpecAnchorPaths.filterIndexed { index, _ -> driver.horizontalSpecDimensions[index] == "size" }
+            .all { it.contains("size-row") })
+    }
+
+    @Test
+    fun `two column size grid continues vertically without horizontal container`() {
+        val target = "3XL 推荐140-155斤"
+        val driver = FakePurchaseDriver(sizes = listOf(target), revealGridSizeAfterUpSwipes = 7)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(target, driver.size)
+        assertTrue(driver.horizontalSpecDirections.isEmpty())
+        assertEquals(1, driver.clicked.count { it == target })
+    }
+
+    @Test
+    fun `failed horizontal gesture still permits vertical exact size recovery`() {
+        val target = "3XL 推荐140-155斤"
+        val driver = FakePurchaseDriver(
+            sizes = listOf(target),
+            horizontalSizePages = listOf(listOf("S", "M")),
+            horizontalSpecSwipeSucceeds = false,
+            revealGridSizeAfterUpSwipes = 7,
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
+        assertEquals(target, driver.size)
+        assertTrue(driver.horizontalSpecDirections.isNotEmpty())
+    }
+
+    @Test
+    fun `missing size terminates at stable viewport with bounded gestures`() {
+        val driver = FakePurchaseDriver(sizes = listOf("S", "M"))
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
+        assertTrue(outcome.message.contains("reason=stableViewport"))
+        assertTrue(driver.horizontalSpecDirections.isEmpty())
+        assertTrue(driver.swipeCount < 35)
+    }
+
+    @Test
+    fun `visible exact size does not enter horizontal fallback`() {
+        val driver = FakePurchaseDriver(sizes = listOf("L", "XL"))
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertFalse(driver.horizontalSpecDimensions.contains("size"))
     }
 
     @Test
@@ -147,18 +400,31 @@ class PurchaseRehearsalExecutorTest {
     }
 
     @Test
-    fun `rerendered exact size is refound and selected on the second attempt`() {
+    fun `rerendered exact size falls back to one verified center gesture`() {
         val driver = FakePurchaseDriver(
-            sizeClickResults = mutableListOf(FreshActionResult.NOT_FOUND, FreshActionResult.SUCCESS),
+            sizeClickResults = mutableListOf(FreshActionResult.NOT_FOUND),
+            specTapResult = FreshActionResult.SUCCESS,
         )
         val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
-        assertEquals(2, driver.sizeClickCount)
+        assertEquals(1, driver.sizeClickCount)
+        assertEquals(1, driver.specTapCount)
         assertEquals("XL", driver.size)
     }
 
+    @Test
+    fun `already selected exact size is not clicked again`() {
+        val driver = FakePurchaseDriver(initialSize = "XL")
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(0, driver.sizeClickCount)
+        assertEquals(0, driver.specTapCount)
+    }
+
     @Test
     fun `long exact size can be verified by one unambiguous short summary token`() {
         val target = "XL【建议121-140斤】"
@@ -201,7 +467,7 @@ class PurchaseRehearsalExecutorTest {
     }
 
     @Test
-    fun `final verification rejects prior proof when selected summary is no longer visible`() {
+    fun `final verification keeps exact attempt selection when summary is no longer visible`() {
         val driver = FakePurchaseDriver(
             hideColorAfterQuantitySet = true,
             hideSelectedSummaryAfterQuantitySet = true,
@@ -209,11 +475,53 @@ class PurchaseRehearsalExecutorTest {
         val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(1, driver.clicked.count { it == "黑色" })
+    }
+
+    @Test
+    fun `final verification keeps current attempt proof when selected panel becomes unclassified`() {
+        val driver = FakePurchaseDriver(panelBecomesUnknownAfterSizeProof = true)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input().copy(quantity = 1), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(1, driver.clicked.count { it == "黑色" })
+        assertEquals(1, driver.clicked.count { it == "XL" })
+    }
+
+    @Test
+    fun `final verification reuses exact attempt state without scrolling back`() {
+        val driver = FakePurchaseDriver(
+            hideColorAfterQuantitySet = true,
+            hideSelectedSummaryAfterQuantitySet = true,
+            restoreHiddenColorOnDownSwipe = true,
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertFalse(driver.swipeInPaths.contains("scroll"))
+        assertEquals(1, driver.clicked.count { it == "黑色" })
+        assertEquals(1, driver.clicked.count { it == "XL" })
+    }
+
+    @Test
+    fun `final verification rejects explicit conflicting selected color`() {
+        val driver = FakePurchaseDriver(
+            colors = listOf("黑色", "白色"),
+            hideSelectedSummaryAfterQuantitySet = true,
+            selectedColorOverrideAfterQuantitySet = "白色",
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
         assertEquals("failed", outcome.resultType)
         assertEquals("PURCHASE_SPEC_SELECTION_UNCONFIRMED", outcome.errorCode)
         assertTrue(outcome.message.contains("dimension=color"))
-        assertTrue(outcome.message.contains("reason=summary_token_missing"))
-        assertTrue(outcome.message.contains("proof=true"))
+        assertTrue(outcome.message.contains("reason=visible_selected_conflict"))
+        assertTrue(outcome.message.contains("targetMatches=1"))
+        assertEquals(1, driver.clicked.count { it == "黑色" })
     }
 
     @Test
@@ -247,7 +555,8 @@ class PurchaseRehearsalExecutorTest {
         assertEquals("PURCHASE_SPEC_SELECTION_UNCONFIRMED", outcome.errorCode)
         assertTrue(outcome.message.contains("dimension=size"))
         assertTrue(outcome.message.contains("reason=visible_candidate_conflict"))
-        assertTrue(outcome.message.contains("proof=true"))
+        assertTrue(outcome.message.contains("proofRecorded=true"))
+        assertTrue(outcome.message.contains("proofUsable=true"))
     }
 
     @Test
@@ -280,16 +589,17 @@ class PurchaseRehearsalExecutorTest {
     }
 
     @Test
-    fun `persistent exact size click failure stops after three attempts`() {
+    fun `persistent exact size click failure stops after one action and one bounded gesture`() {
         val driver = FakePurchaseDriver(
-            sizeClickResults = MutableList(3) { FreshActionResult.FAILED },
+            sizeClickResults = mutableListOf(FreshActionResult.FAILED),
         )
         val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_CLICK_FAILED", outcome.errorCode)
         assertEquals("action_click_false", outcome.message)
-        assertEquals(3, driver.sizeClickCount)
+        assertEquals(1, driver.sizeClickCount)
+        assertEquals(1, driver.specTapCount)
         assertEquals(null, driver.size)
     }
 
@@ -371,8 +681,8 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `ambiguous browser target stops safely`() {
         val driver = FakePurchaseDriver(duplicateOpen = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
-            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("RULE_AMBIGUOUS", outcome.errorCode)
         assertTrue(driver.clicked.isEmpty())
     }
@@ -383,10 +693,10 @@ class PurchaseRehearsalExecutorTest {
             openClickResults = mutableListOf(FreshActionResult.FAILED),
             openPddOnFailedClick = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
-            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
-        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals("spec_probe_completed", outcome.resultType)
         assertEquals(1, driver.openClickCount)
     }
 
@@ -396,10 +706,10 @@ class PurchaseRehearsalExecutorTest {
             openClickResults = mutableListOf(FreshActionResult.NOT_FOUND, FreshActionResult.SUCCESS),
         )
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = pauses::add)
-            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
-        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals("spec_probe_completed", outcome.resultType)
         assertEquals(2, driver.openClickCount)
         assertTrue(pauses.size <= 50)
     }
@@ -407,15 +717,50 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `persistent open click failure is bounded and remains safely failed`() {
         val driver = FakePurchaseDriver(
-            openClickResults = MutableList(10) { FreshActionResult.FAILED },
+            openClickResults = MutableList(20) { FreshActionResult.FAILED },
         )
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = pauses::add)
-            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
-        assertTrue(driver.openClickCount in 1..5)
-        assertEquals(50, pauses.size)
+        assertTrue(driver.openClickCount in 1..15)
+        assertEquals(150, pauses.size)
+    }
+
+    @Test
+    fun `five second browser interstitial can still reach a stable product page`() {
+        val pauses = mutableListOf<Long>()
+        val driver = FakePurchaseDriver(browserOpenVisibleAfterCaptures = 50)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("spec_probe_completed", outcome.resultType)
+        assertEquals(1, driver.openClickCount)
+        assertTrue(pauses.count { it == 100L } in 52..60)
+    }
+
+    @Test
+    fun `pdd foreground without stable product evidence times out at fifteen seconds`() {
+        val pauses = mutableListOf<Long>()
+        val driver = FakePurchaseDriver(loadingPddCaptures = 200)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals("打开拼多多后未识别到稳定商品页面", outcome.message)
+        assertEquals(150, pauses.count { it == 100L })
+    }
+
+    @Test
+    fun `explicit pdd login page fails before the product timeout`() {
+        val pauses = mutableListOf<Long>()
+        val driver = FakePurchaseDriver(pddProblemLabels = listOf("手机号登录", "登录后继续"))
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PDD_LOGIN_REQUIRED", outcome.errorCode)
+        assertTrue(pauses.count { it == 100L } < 5)
     }
 
     @Test
@@ -434,34 +779,107 @@ class PurchaseRehearsalExecutorTest {
         val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
-        assertEquals("PURCHASE_SPEC_PANEL_NOT_OPENED", outcome.errorCode)
+        assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
         assertEquals(
-            "点击后未识别到商品规格面板 [type=UNKNOWN;scrollables=0;headings=0;options=0;summary=false;quantity=false;orderAction=false;pageEvidence=true]",
+            "规格入口点击后页面已变化，但规格面板强证据不足 [type=UNKNOWN;scrollables=0;headings=0;options=0;summary=false;quantity=false;orderAction=false;pageEvidence=true]",
             outcome.message,
         )
+        assertEquals(0, driver.specTapCount)
         assertFalse(outcome.message.orEmpty().contains("确认款式"))
     }
 
+    @Test
+    fun `unchanged spec entry action uses one verified center gesture`() {
+        val driver = FakePurchaseDriver(
+            entryActionHasEffect = false,
+            specTapResult = FreshActionResult.SUCCESS,
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        assertEquals(1, driver.specTapCount)
+        assertTrue(driver.panel)
+    }
+
+    @Test
+    fun `unchanged spec entry after action and gesture returns no effect`() {
+        val driver = FakePurchaseDriver(
+            entryActionHasEffect = false,
+            specTapResult = FreshActionResult.SUCCESS,
+            specTapHasEffect = false,
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_ENTRY_CLICK_NO_EFFECT", outcome.errorCode)
+        assertEquals(1, driver.specTapCount)
+        assertFalse(driver.panel)
+    }
+
+    @Test
+    fun `failed spec entry gesture preserves the action click no effect reason`() {
+        val driver = FakePurchaseDriver(
+            entryActionHasEffect = false,
+            specTapResult = FreshActionResult.FAILED,
+        )
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_ENTRY_CLICK_FAILED", outcome.errorCode)
+        assertEquals("gesture_failed_after_action_click_no_effect", outcome.message)
+        assertFalse(outcome.message.contains("unknown"))
+    }
+
     @Test
     fun `missing spec entry emits scalar source counts without node text`() {
         val diagnostics = mutableListOf<String>()
+        val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(missingSpecEntry = true)
         val outcome = PurchaseRehearsalExecutor(
             driver,
             { driver.browser = true; true },
             { null },
-            pause = {},
+            pause = pauses::add,
             panelDiagnostic = diagnostics::add,
         ).execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_NOT_FOUND", outcome.errorCode)
         assertEquals(
-            "specEntryCandidates=0;explicit=0;nested=0;bottomPurchase=0;panelAlreadyOpen=false;reviewPage=false;pageEvidence=true",
+            "specEntryCandidates=0;explicit=0;nested=0;bottomPurchase=0;panelAlreadyOpen=false;reviewPage=false;pageEvidence=true;entryReadyWaitPolls=20;entryReadyWaitMillis=2000",
             diagnostics.single(),
         )
+        assertEquals(21, pauses.count { it == 100L })
         assertFalse(diagnostics.single().contains("选择规格"))
     }
 
+    @Test
+    fun `open spec panel waits for a late safe bottom purchase entry`() {
+        val pauses = mutableListOf<Long>()
+        val driver = FakePurchaseDriver(bottomPurchaseEntry = true, specEntryVisibleAfterPddCaptures = 4)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = pauses::add)
+            .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("spec_probe_completed", outcome.resultType)
+        assertTrue(driver.clickedPaths.contains("buy"))
+        // One 100ms pause belongs to the existing open-product foreground poll;
+        // two belong to the entry-ready wait before the bottom bar appears.
+        assertEquals(3, pauses.count { it == 100L })
+    }
+
+    @Test
+    fun `purchase reopens and waits for product evidence instead of a visible loading frame`() {
+        val pauses = mutableListOf<Long>()
+        val driver = FakePurchaseDriver(loadingPddCaptures = 1)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = pauses::add)
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("rehearsal_completed", outcome.resultType)
+        // Two stable reads belong to reopening the product; verifyProduct then
+        // independently requires its second stable read before continuing.
+        assertEquals(3, pauses.count { it == 100L })
+    }
+
     @Test
     fun `transient sold out page recovers before opening specs`() {
         val driver = FakePurchaseDriver(soldOut = true, recoverSoldOutAfterPull = true)
@@ -526,11 +944,22 @@ class PurchaseRehearsalExecutorTest {
     }
 
     @Test
-    fun `live rule spec probe returns before address or order actions`() {
+    fun `live rule spec probe ignores historical mapping and returns before address or order actions`() {
         val driver = FakePurchaseDriver()
         val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
-            .execute(input().copy(executionMode = "live", phase = "spec_probe", addressSuffix = "_cg42"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
+            .execute(
+                input().copy(
+                    executionMode = "live",
+                    phase = "spec_probe",
+                    mappedColor = "历史颜色",
+                    mappedSize = "历史尺码",
+                    addressSuffix = "_cg42",
+                ),
+                PurchaseRuleParser.parse(liveRule()),
+                PurchaseAgentCapabilities.supported,
+            )
         assertEquals("spec_probe_completed", outcome.resultType)
+        assertEquals("{\"dimensions\":[]}", outcome.probedSpecs)
         assertFalse(driver.clicked.any { it.contains("订单") || it.contains("地址") || it.contains("支付") })
     }
 
@@ -605,6 +1034,29 @@ class PurchaseRehearsalExecutorTest {
         assertFalse(driver.clicked.contains("商品评价"))
     }
 
+    @Test
+    fun `spec entry failures include scalar diagnostics only`() {
+        val driver = FakePurchaseDriver(missingSpecEntry = true)
+        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_ENTRY_NOT_FOUND", outcome.errorCode)
+        assertEquals(
+            "没有找到安全的商品规格入口 [specEntryCandidates=0;explicit=0;nested=0;bottomPurchase=0;panelAlreadyOpen=false;reviewPage=false;pageEvidence=true;entryReadyWaitPolls=20;entryReadyWaitMillis=2000]",
+            outcome.message,
+        )
+
+        val ambiguousDriver = FakePurchaseDriver(forcedEntryClickReason = FreshClickReason.TARGET_AMBIGUOUS)
+        val ambiguous = PurchaseRehearsalExecutor(ambiguousDriver, { ambiguousDriver.browser = true; true }, { null }, pause = {})
+            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+
+        assertEquals("PURCHASE_SPEC_ENTRY_TARGET_AMBIGUOUS", ambiguous.errorCode)
+        assertEquals(
+            "规格入口点击目标不唯一 [specEntryCandidates=1;explicit=1;nested=0;bottomPurchase=0;panelAlreadyOpen=false;reviewPage=false;pageEvidence=true;entryReadyWaitPolls=0;entryReadyWaitMillis=0]",
+            ambiguous.message,
+        )
+    }
+
     @Test
     fun `parser keeps type only compatibility and rejects dangerous or unknown fields`() {
         val legacy = """{"schemaVersion":1,"ruleType":"pddPurchase","requiredCapabilities":["purchase.rehearsal.v1"],"actions":[{"type":"openProduct"}]}"""
@@ -749,26 +1201,42 @@ class PurchaseRehearsalExecutorTest {
 
     private class FakePurchaseDriver(
         private val colors: List<String> = listOf("黑色"),
+        private val horizontalColorPages: List<List<String>>? = null,
+        private val horizontalSizePages: List<List<String>>? = null,
+        private val horizontalSpecSwipeSucceeds: Boolean = true,
         private val sizes: List<String> = listOf("XL"),
         private val priceCent: Long = 2_000,
         private val duplicateOpen: Boolean = false,
         private val bottomPurchaseEntry: Boolean = false,
         private val missingSpecEntry: Boolean = false,
+        private val specEntryVisibleAfterPddCaptures: Int = 0,
+        private val loadingPddCaptures: Int = 0,
+        private val browserOpenVisibleAfterCaptures: Int = 0,
+        private val pddProblemLabels: List<String> = emptyList(),
         private val includeReviewEntry: Boolean = false,
         private val openReviewOnBottomClick: Boolean = false,
         private val reviewBackSucceeds: Boolean = true,
         private val hiddenSizeUntilUpSwipes: Int = 0,
+        private val prefixlessSingleHeadingAfterColor: Boolean = false,
+        private val hideSizeAfterSelection: Boolean = false,
+        private val revealGridSizeAfterUpSwipes: Int? = null,
         private val openClickResults: MutableList<FreshActionResult> = mutableListOf(),
         private val openPddOnFailedClick: Boolean = false,
         private val sizeClickResults: MutableList<FreshActionResult> = mutableListOf(),
         private val forcedSizeClickReason: FreshClickReason? = null,
         private val forcedEntryClickReason: FreshClickReason? = null,
+        private val initialSize: String? = null,
+        private val entryActionHasEffect: Boolean = true,
+        private val specTapResult: FreshActionResult = FreshActionResult.FAILED,
+        private val specTapHasEffect: Boolean = true,
         private val sizeSelectsOnFailedClick: Boolean = false,
         private val selectedSizeSummaryOverride: String? = null,
         private val hideSizeSelectedState: Boolean = false,
         private val hideColorAfterQuantitySet: Boolean = false,
         private val hideSizeAfterQuantitySet: Boolean = false,
         private val hideSelectedSummaryAfterQuantitySet: Boolean = false,
+        private val restoreHiddenColorOnDownSwipe: Boolean = false,
+        private val selectedColorOverrideAfterQuantitySet: String? = null,
         private val selectedSummaryOverrideAfterQuantitySet: String? = null,
         private val finalSizesAfterQuantitySet: List<String>? = null,
         soldOut: Boolean = false,
@@ -780,11 +1248,14 @@ class PurchaseRehearsalExecutorTest {
         private val nonScrollablePanel: Boolean = false,
         private val unrecognizedPanel: Boolean = false,
         private val purchaseSwipeSucceeds: Boolean = true,
+        initiallyInAgent: Boolean = false,
+        private val panelBecomesUnknownAfterSizeProof: Boolean = false,
     ) : PurchaseUiDriver {
         var browser = false
+        private var inAgent = initiallyInAgent
         var panel = false
         var color: String? = null
-        var size: String? = null
+        var size: String? = initialSize
         var quantity = 1L
         var swipeCount = 0
         var upSwipeCount = 0
@@ -792,20 +1263,58 @@ class PurchaseRehearsalExecutorTest {
         var sizeClickCount = 0
         var pullDownCount = 0
         var backCount = 0
+        var specTapCount = 0
+        val horizontalSpecDirections = mutableListOf<SwipeDirection>()
+        val horizontalSpecDimensions = mutableListOf<String>()
+        val horizontalSpecAnchorPaths = mutableListOf<String>()
+        val swipeInPaths = mutableListOf<String>()
         private var soldOut = soldOut
         private var allSpecsUnavailable = allSpecsUnavailable
         private var productEvidenceLost = false
         private var reviewPage = false
+        private var pddCaptureCount = 0
+        private var browserCaptureCount = 0
+        private var hiddenColorRestored = false
+        private var horizontalColorPage = 0
+        private var horizontalSizePage = 0
+        private var capturesAfterSizeSelection = 0
         val clicked = mutableListOf<String>()
         val clickedPaths = mutableListOf<String>()
 
         override fun capture(): UiSnapshot {
+            if (inAgent) {
+                return UiSnapshot("cn.ilapage.goauto.agent", "MainActivity", listOf(node("content", "", 0, 0, 1080, 2200)))
+            }
             if (browser && !panel && color == null && size == null) {
+                browserCaptureCount++
+                if (browserCaptureCount <= browserOpenVisibleAfterCaptures) {
+                    return UiSnapshot("com.heytap.browser", "BrowserActivity", listOf(node("content", "", 0, 0, 1080, 2200)))
+                }
                 val openNodes = mutableListOf(node("open", "打开", 0, 100, 300, 180, clickable = true))
                 if (duplicateOpen) openNodes += node("open2", "打开", 400, 100, 700, 180, clickable = true)
                 openNodes += node("content", "", 0, 0, 1080, 2200)
                 return UiSnapshot("com.heytap.browser", "BrowserActivity", openNodes)
             }
+            if (panelBecomesUnknownAfterSizeProof && panel && size != null) {
+                capturesAfterSizeSelection++
+                if (capturesAfterSizeSelection > 1) {
+                    return UiSnapshot(PDD, ACTIVITY, listOf(
+                        node("content", "", 0, 0, 1080, 2200),
+                        node("price", "¥20.00", 20, 300, 300, 360),
+                        node("quantity", "1", 400, 800, 600, 870, className = "android.widget.EditText"),
+                        node("confirm", "确定", 20, 900, 500, 980, clickable = true),
+                    ))
+                }
+            }
+            pddCaptureCount++
+            if (pddCaptureCount <= loadingPddCaptures) {
+                return UiSnapshot(PDD, ACTIVITY, listOf(node("content", "", 0, 0, 1080, 2200)))
+            }
+            if (pddProblemLabels.isNotEmpty()) {
+                return UiSnapshot(PDD, ACTIVITY, pddProblemLabels.mapIndexed { index, label ->
+                    node("problem-$index", label, 20, 100 + index * 100, 900, 180 + index * 100)
+                })
+            }
             if (!panel) {
                 if (reviewPage) {
                     return UiSnapshot(PDD, ACTIVITY, listOf(
@@ -821,18 +1330,21 @@ class PurchaseRehearsalExecutorTest {
                 if (soldOut) {
                     return UiSnapshot(PDD, ACTIVITY, listOf(
                         node("content", "", 0, 0, 1080, 2200),
+                        node("title", "测试商品标题文本", 20, 200, 900, 280, className = "android.widget.ViewPager"),
                         node("sold-out", "商品已售罄", 100, 300, 900, 380),
                         node("similar", "相似商品", 100, 500, 900, 580),
                     ))
                 }
                 val nodes = mutableListOf(
                     node("content", "", 0, 0, 1080, 2200),
+                    node("title", "测试商品标题文本", 20, 200, 900, 280, className = "android.widget.ViewPager"),
                 )
-                if (bottomPurchaseEntry) {
+                val specEntryReady = pddCaptureCount > specEntryVisibleAfterPddCaptures
+                if (bottomPurchaseEntry && specEntryReady) {
                     nodes += node("buy", "", 500, 1800, 1080, 2180, clickable = true)
                     nodes += node("buy/price", "¥20.00", 560, 1840, 760, 1910, parentPath = "buy")
                     nodes += node("buy/label", "免拼购买", 780, 1840, 1040, 1910, parentPath = "buy")
-                } else if (!missingSpecEntry) {
+                } else if (!missingSpecEntry && specEntryReady) {
                     nodes += node("spec", "选择规格", 20, 1000, 900, 1100, clickable = true)
                 }
                 if (includeReviewEntry) nodes += node("review", "商品评价", 20, 1200, 900, 1300, clickable = true)
@@ -844,8 +1356,9 @@ class PurchaseRehearsalExecutorTest {
                     node("panel-title", "确认款式", 20, 396, 300, 430),
                 ))
             }
-            val hideColor = hideColorAfterQuantitySet && quantity == 2L
-            val hideSize = hideSizeAfterQuantitySet && quantity == 2L
+            val singleHeading = prefixlessSingleHeadingAfterColor && color != null
+            val hideColor = singleHeading || (hideColorAfterQuantitySet && quantity == 2L && !hiddenColorRestored)
+            val hideSize = (hideSizeAfterQuantitySet && quantity == 2L) || (hideSizeAfterSelection && size != null)
             val hideSummary = hideSelectedSummaryAfterQuantitySet && quantity == 2L
             val displayedSummary = if (quantity == 2L && selectedSummaryOverrideAfterQuantitySet != null) {
                 selectedSummaryOverrideAfterQuantitySet
@@ -858,51 +1371,89 @@ class PurchaseRehearsalExecutorTest {
                 node("title", "确认款式", 20, 396, 300, 430),
             )
             if (!nonScrollablePanel) nodes += node("scroll", "", 0, 400, 1080, 950, scrollable = true)
-            if (!hideSummary) {
+            if (singleHeading) {
+                nodes += node("info", "", 0, 300, 1080, 400)
+                nodes += node("info/summary", displayedSummary, 20, 320, 700, 350, parentPath = "info")
+                nodes += node("close", "关闭", 980, 300, 1060, 350, clickable = true)
+                nodes += node("minus", "减少数量", 300, 360, 380, 390, clickable = true)
+                nodes += node("plus", "增加数量", 620, 360, 700, 390, clickable = true)
+                nodes += node("payment", "微信支付", 600, 1000, 900, 1050)
+            } else if (!hideSummary) {
                 nodes += node("selected", "已选 $displayedSummary", 20, 365, 700, 395)
             }
             if (!hideColor) {
                 nodes += node("scroll/color-heading", "颜色分类", 20, 410, 300, 450, parentPath = "scroll")
-                colors.forEachIndexed { index, value ->
-                    nodes += node("scroll/color-$index", value, 20 + index * 220, 470, 200 + index * 220, 540, clickable = true, selected = color == value, enabled = !allSpecsUnavailable, parentPath = "scroll")
+                val selectedColor = if (quantity == 2L) selectedColorOverrideAfterQuantitySet ?: color else color
+                val visibleColors = horizontalColorPages?.get(horizontalColorPage) ?: colors
+                val colorParent = if (horizontalColorPages != null && visibleColors.size > 1) "scroll/color-row" else "scroll"
+                if (colorParent != "scroll") {
+                    nodes += node(colorParent, "", 0, 460, 1080, 550, scrollable = true, parentPath = "scroll")
+                }
+                visibleColors.forEachIndexed { index, value ->
+                    nodes += node(
+                        "scroll/color-$index",
+                        value,
+                        20 + index * 220,
+                        470,
+                        200 + index * 220,
+                        540,
+                        clickable = true,
+                        selected = selectedColor == value,
+                        enabled = !allSpecsUnavailable,
+                        parentPath = colorParent,
+                    )
                 }
             }
             if (!hideSize) {
                 nodes += node("scroll/size-heading", "尺码", 20, 650, 300, 690, parentPath = "scroll")
-                val visibleSizes = if (quantity == 2L && finalSizesAfterQuantitySet != null) {
+                val visibleSizes = if (revealGridSizeAfterUpSwipes != null) {
+                    if (upSwipeCount >= revealGridSizeAfterUpSwipes) sizes else listOf("S", "M")
+                } else horizontalSizePages?.get(horizontalSizePage) ?: if (quantity == 2L && finalSizesAfterQuantitySet != null) {
                     finalSizesAfterQuantitySet
                 } else if (upSwipeCount >= hiddenSizeUntilUpSwipes) {
                     sizes
                 } else {
                     listOf("S")
                 }
+                val sizeParent = if (horizontalSizePages != null) "scroll/size-row" else "scroll"
+                if (horizontalSizePages != null) {
+                    nodes += node(sizeParent, "", 0, 700, 1080, 800, scrollable = true, parentPath = "scroll")
+                }
                 visibleSizes.forEachIndexed { index, visibleSize ->
                     nodes += node(
-                        "scroll/size-$index",
+                        "$sizeParent/size-$index",
                         visibleSize,
                         20 + index * 250,
-                        710,
+                        710 - if (revealGridSizeAfterUpSwipes != null) upSwipeCount.coerceAtMost(10) * 2 else 0,
                         220 + index * 250,
-                        780,
+                        780 - if (revealGridSizeAfterUpSwipes != null) upSwipeCount.coerceAtMost(10) * 2 else 0,
                         clickable = true,
                         selected = !hideSizeSelectedState && size == visibleSize,
                         enabled = !allSpecsUnavailable && visibleSize !in unavailableSizes,
-                        parentPath = "scroll",
+                        parentPath = sizeParent,
                     )
                 }
             }
-            nodes += node("quantity", quantity.toString(), 400, 800, 600, 870, className = "android.widget.EditText")
-            nodes += node("confirm", "确定", 20, 900, 500, 980, clickable = true)
-            nodes += node("order", "提交订单", 20, 1100, 500, 1180, clickable = true)
+            nodes += if (singleHeading) node("info/quantity", quantity.toString(), 400, 360, 600, 390, className = "android.widget.EditText", parentPath = "info")
+                else node("quantity", quantity.toString(), 400, 800, 600, 870, className = "android.widget.EditText")
+            if (!singleHeading) nodes += node("confirm", "确定", 20, 900, 500, 980, clickable = true)
+            nodes += node("order", "提交订单", 20, if (singleHeading) 2000 else 1100, 500, if (singleHeading) 2080 else 1180, clickable = true)
             nodes += node("pay", "立即支付", 520, 1100, 1020, 1180, clickable = true)
             return UiSnapshot(PDD, ACTIVITY, nodes)
         }
 
+        fun leaveAgentAndOpenBrowser() {
+            inAgent = false
+            browser = true
+        }
+
         override fun clickFresh(target: SnapshotNode): FreshActionResult {
             clicked += target.label
             clickedPaths += target.path
             if (target.path == "buy") {
-                if (openReviewOnBottomClick) reviewPage = true else panel = true
+                if (entryActionHasEffect) {
+                    if (openReviewOnBottomClick) reviewPage = true else panel = true
+                }
                 return FreshActionResult.SUCCESS
             }
             when (target.label) {
@@ -912,14 +1463,14 @@ class PurchaseRehearsalExecutorTest {
                     if (result == FreshActionResult.SUCCESS || openPddOnFailedClick) browser = false
                     return result
                 }
-                "选择规格", "免拼购买" -> panel = true
-                in sizes -> {
+                "选择规格", "免拼购买" -> if (entryActionHasEffect) panel = true
+                in (horizontalSizePages.orEmpty().flatten() + sizes) -> {
                     sizeClickCount++
                     val result = sizeClickResults.removeFirstOrNull() ?: FreshActionResult.SUCCESS
                     if (result == FreshActionResult.SUCCESS || sizeSelectsOnFailedClick) size = target.label
                     return result
                 }
-                in colors -> color = target.label
+                in (horizontalColorPages?.flatten() ?: colors) -> color = target.label
                 "增加数量" -> quantity++
                 "减少数量" -> quantity--
             }
@@ -936,7 +1487,7 @@ class PurchaseRehearsalExecutorTest {
                 }
                 return FreshClickOutcome(result, forcedEntryClickReason)
             }
-            if (target.label in sizes && forcedSizeClickReason != null) {
+            if (target.label in (horizontalSizePages?.flatten() ?: sizes) && forcedSizeClickReason != null) {
                 sizeClickCount++
                 val result = when (forcedSizeClickReason) {
                     FreshClickReason.ROOT_UNAVAILABLE, FreshClickReason.TARGET_NOT_FOUND -> FreshActionResult.NOT_FOUND
@@ -958,6 +1509,17 @@ class PurchaseRehearsalExecutorTest {
 
         override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult = clickFresh(target)
 
+        override fun tapSpecFresh(target: SnapshotNode): FreshActionResult {
+            specTapCount++
+            if (specTapResult != FreshActionResult.SUCCESS || !specTapHasEffect) return specTapResult
+            when {
+                target.path in setOf("spec", "buy") -> panel = true
+                target.label in (horizontalSizePages?.flatten() ?: sizes) -> size = target.label
+                target.label in colors -> color = target.label
+            }
+            return FreshActionResult.SUCCESS
+        }
+
         override fun inputFresh(target: SnapshotNode, value: String): FreshActionResult {
             quantity = value.toLong()
             return FreshActionResult.SUCCESS
@@ -969,8 +1531,35 @@ class PurchaseRehearsalExecutorTest {
             return purchaseSwipeSucceeds
         }
 
-        override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean =
-            swipePurchase(direction, durationMs)
+        override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
+            swipeInPaths += target.path
+            if (restoreHiddenColorOnDownSwipe && quantity == 2L && direction == SwipeDirection.DOWN) {
+                hiddenColorRestored = true
+            }
+            return swipePurchase(direction, durationMs)
+        }
+
+        override fun swipeSpecRow(target: SnapshotNode, direction: SwipeDirection): Boolean {
+            horizontalSpecDirections += direction
+            horizontalSpecAnchorPaths += target.path
+            val dimension = if (target.label in (horizontalSizePages?.flatten() ?: emptyList())) "size" else "color"
+            horizontalSpecDimensions += dimension
+            if (!horizontalSpecSwipeSucceeds) return false
+            if (dimension == "size") {
+                horizontalSizePage = when (direction) {
+                    SwipeDirection.LEFT -> (horizontalSizePage + 1).coerceAtMost((horizontalSizePages?.lastIndex ?: 0))
+                    SwipeDirection.RIGHT -> (horizontalSizePage - 1).coerceAtLeast(0)
+                    else -> horizontalSizePage
+                }
+            } else {
+                horizontalColorPage = when (direction) {
+                    SwipeDirection.LEFT -> (horizontalColorPage + 1).coerceAtMost((horizontalColorPages?.lastIndex ?: 0))
+                    SwipeDirection.RIGHT -> (horizontalColorPage - 1).coerceAtLeast(0)
+                    else -> horizontalColorPage
+                }
+            }
+            return true
+        }
 
         override fun pullDownGoodsPage(): Boolean {
             pullDownCount++

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseResultBubblePolicyTest.kt

@@ -0,0 +1,72 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePolicy
+import cn.ilapage.goauto.agent.ui.PurchaseResultBubbleSession
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PurchaseResultBubblePolicyTest {
+    @Test
+    fun `spec probe does not display a final result bubble`() {
+        assertNull(PurchaseResultBubblePolicy.create(69, "spec_probe_completed", "probeSpecs", "规格已回传"))
+    }
+
+    @Test
+    fun `failure includes the real step and sanitized reason for eight seconds`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            69,
+            "failed",
+            "selectSpec",
+            "没有找到精确规格\n请重试 token=secret-value",
+        ))
+
+        assertEquals("CG-69 失败于：选择颜色与尺码", result.title)
+        assertEquals("没有找到精确规格 请重试 token=[已隐藏]", result.message)
+        assertTrue(result.isFailure)
+        assertEquals(8_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `unknown order result is presented as a failure requiring manual check`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            70,
+            "order_result_unknown",
+            "readOrderResult",
+            "无法确认订单是否创建，请人工检查",
+        ))
+
+        assertEquals("CG-70 待人工核对｜读取订单编号和下单时间", result.title)
+        assertTrue(result.isFailure)
+        assertEquals(8_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `successful order uses a short factual summary for three seconds`() {
+        val result = requireNotNull(PurchaseResultBubblePolicy.create(
+            71,
+            "order_created",
+            "readOrderResult",
+            "ignored",
+        ))
+
+        assertEquals("CG-71 采购完成", result.title)
+        assertEquals("已获取订单编号和下单时间", result.message)
+        assertFalse(result.isFailure)
+        assertEquals(3_000L, result.durationMillis)
+    }
+
+    @Test
+    fun `new result and dismiss invalidate an older scheduled bubble`() {
+        val session = PurchaseResultBubbleSession()
+        val first = session.replace()
+        val second = session.replace()
+        assertFalse(session.isCurrent(first))
+        assertTrue(session.isCurrent(second))
+
+        session.dismiss()
+        assertFalse(session.isCurrent(second))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseRetryPolicyTest.kt

@@ -16,18 +16,22 @@ class PurchaseRetryPolicyTest {
     }
 
     @Test
-    fun `retry confirmation explains same task latest rule and no payment`() {
+    fun `ordinary retry uses same task new attempt and no payment`() {
         val message = PurchaseRetryPolicy.confirmationMessage()
-        assertTrue(message.contains("当前任务"))
-        assertTrue(message.contains("最新采购规则"))
-        assertFalse(message.contains("新采购任务"))
+        assertTrue(PurchaseRetryPolicy.usesInPlaceReset(continuing = false))
+        assertTrue(message.contains("复用原采购任务"))
+        assertTrue(message.contains("新一次执行"))
+        assertTrue(message.contains("当前有效采购规则"))
+        assertTrue(message.contains("任务快照保持不变"))
         assertTrue(message.contains("待付款订单"))
         assertTrue(message.contains("不会支付"))
+        assertFalse(message.contains("新采购任务"))
     }
 
     @Test
     fun `continue confirmation remains a new purchase task`() {
         val message = PurchaseRetryPolicy.confirmationMessage(continuing = true)
+        assertFalse(PurchaseRetryPolicy.usesInPlaceReset(continuing = true))
         assertTrue(message.contains("新采购任务"))
         assertTrue(message.contains("替代商品"))
         assertTrue(message.contains("不会支付"))

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseScrollLocatorTest.kt

@@ -0,0 +1,39 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.NodeBounds
+import cn.ilapage.goauto.agent.automation.PurchaseScrollCandidate
+import cn.ilapage.goauto.agent.automation.PurchaseScrollLocator
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class PurchaseScrollLocatorTest {
+    private val outer = PurchaseScrollCandidate("0/1", "RecyclerView", NodeBounds(0, 1038, 1080, 2079))
+    private val inner = PurchaseScrollCandidate("0/1/0", "RecyclerView", NodeBounds(36, 1149, 1080, 2007))
+
+    @Test fun nestedContainersWithNearbyCentersResolveOuter() {
+        assertEquals(outer, PurchaseScrollLocator.locate(outer, listOf(inner, outer)))
+    }
+
+    @Test fun pathDisambiguatesIdenticalBounds() {
+        val nested = outer.copy(path = "0/1/0")
+        assertEquals(outer, PurchaseScrollLocator.locate(outer, listOf(nested, outer)))
+    }
+
+    @Test fun changedPathRequiresUniqueFullBoundsMatch() {
+        val moved = outer.copy(path = "0/2")
+        assertEquals(moved, PurchaseScrollLocator.locate(outer, listOf(inner, moved)))
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(moved, moved.copy(path = "0/3"))))
+    }
+
+    @Test fun reusedPathWithDifferentGeometryIsRejected() {
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(inner.copy(path = outer.path))))
+    }
+
+    @Test fun classAndAllEdgesAreValidated() {
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(outer.copy(className = "ScrollView"))))
+        assertNull(PurchaseScrollLocator.locate(outer, listOf(
+            outer.copy(bounds = NodeBounds(0, 1138, 1080, 1979)),
+        )))
+    }
+}

docs/00-project-profile.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Project-Profile
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Project-Profile.-
-wiki_revision: 6207da4ffac6b5821eda7869b9ea335b7585826d
-synchronized_at: 2026-08-31T16:06:21Z
+wiki_revision: 3b78360779ae520f1ff9e51be3118a04cd549f51
+synchronized_at: 2026-09-07T09:27:40Z
 <!-- gitea-wiki-mirror:end -->
 
 # 项目档案
@@ -21,16 +21,20 @@ synchronized_at: 2026-08-31T16:06:21Z
 | 后续设计范围 | 从 SYB 创建采购任务、创建待付款订单、物流采集与自动回填 |
 | 预计规模 | 20 台 Android；每天约 100 个采集任务、200 个采购任务 |
 
+## 项目治理模式
+
+GoAuto 默认采用轻量治理：文案、注释、格式、局部样式或布局、预期行为明确的小 Bug，以及不改变接口、数据结构、权限和安全边界的单模块低风险调整可以直接实施，无需为了留痕补建工单。完整独立需求、新页面、跨模块功能，以及涉及 API、数据结构、权限、安全、迁移或范围不明确的变化必须建立单元工单。采购、创建订单、真实个人或生产数据、权限、安全、并发、迁移、删除、发布和不可逆操作始终升级为高风险，必须具备对象和范围明确的人工授权；已有有效授权时不机械重复确认，范围或环境发生实质变化时重新确认。永久禁止付款以及设备、隐私、AI 和真机安全红线不可裁剪。
+
 ## 建设基线
 
 | 基线 | 来源与版本 | 许可证 / 使用方式 | GoAuto 适配 |
 |---|---|---|---|
-| DevHarness | `D:\OPC\dev_harness`，目标提交 `4bbacf4d7fb265984396bb5589c544105043fa0b` | 开发流程与文档模板 | 2026-08-27 升级（#114）：在 #76 已采用的单人工单事实源基础上，增量加入部署模板、Gitea MCP 与最小工单读取、线上原型默认审核与按需 HTML 导出、PowerShell UTF-8/ExecutionPolicy 边界；继续保留 GoAuto 专用安全与设计门禁 |
+| DevHarness | `D:\OPC\dev_harness`，目标提交 `ecab899` | 开发流程与文档模板 | 2026-09-05 升级（#221）：在既有单人工单事实源基础上，选择性加入轻量治理、明确授权边界、中文默认沟通、Windows PowerShell 安全规则，以及按 revision 增量同步与显式深度检查；继续保留 GoAuto 专用高风险与安全门禁 |
 | 服务端 | `go-admin` v2.3.0 | 上游开源管理端基线；升级时复核许可证和安全公告 | 保留认证、菜单、配置和管理端基础能力，新增 GoAuto 业务模块 |
 | 管理端 | `go-admin-ui` v3.0.0，`web/package.json` 标注 MIT | Vue 管理界面基线 | 保留应用外壳与通用组件，新增 GoAuto 页面 |
 | Android | 原生 Kotlin Agent | 自研业务客户端 | 通过管理员明确配置的 HTTP 或 HTTPS Origin 直连服务端，不保留 Windows 桌面 Client/ADB 作为生产拓扑 |
 
-升级必须比较当前记录的目标提交与新的明确提交，不能笼统复制“最新版”。本次上一基线为 `bfdf648962d11a8024f62768380d8571e1f45f68`，目标为 `4bbacf4d7fb265984396bb5589c544105043fa0b`，区间共 13 个提交；更早基线 `b1f500128d6eb100985792d4a715db8b6b5ae203` 的适配见 #47。模板内容一律按 GoAuto 事实改写：不复制 DevHarness 的项目事实、任务记录、占位部署参数或历史归档；`harness.py` 继续校验 GoAuto 实际核心页面与产品 README，GoAuto 更严格的付款、订单、设备、数据和真机门禁继续优先。
+升级必须比较当前记录的目标提交与新的明确提交，不能笼统复制“最新版”。本次上一基线为 `4bbacf4d7fb265984396bb5589c544105043fa0b`，目标为 `ecab899`，选择性适配其后的 7 个提交；更早基线适配见 #47 与 #114。模板内容一律按 GoAuto 事实改写：不复制 DevHarness 的项目事实、任务记录、占位部署参数或历史归档；`harness.py` 继续校验 GoAuto 实际核心页面与产品 README，GoAuto 更严格的付款、订单、设备、数据和真机门禁继续优先。
 
 ## 交付单元
 
@@ -57,6 +61,7 @@ synchronized_at: 2026-08-31T16:06:21Z
 ## 环境与凭据
 
 - 服务端正式环境默认必须使用 HTTPS。仅当管理员接受 Device Token、任务内容和执行结果明文传输风险，并显式设置 `GOAUTO_ALLOW_INSECURE_AGENT_HTTP=true` 时，Agent `/api/agent/v1/**` 可通过 HTTP；管理端和第三方服务不因此放宽。
+- #237 客户端密钥例外（用户 2026-09-07 明确接受风险）：提交 `71f7751` 起，管理员密钥管理及 `/api/client/v1` 默认兼容 HTTP/HTTPS，无开关；HTTP 明文传输密钥及业务数据，建议优先 HTTPS。实际迁移部署仍须单独授权；此例外不改变其他第三方服务的安全边界。
 - 每台设备使用独立 Device Token；Token 只存安全配置，不进入仓库。
 - PDD 账号密码、Cookie、验证码和用户个人数据不得进入日志。
 - 根目录 `gitea.env` 是本机工单访问配置，已被 Git 忽略。

docs/01-workflow.md

@@ -2,12 +2,18 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Development-Workflow
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Development-Workflow.-
-wiki_revision: 3167457d79824afe532dd5560990af8a485a57d1
-synchronized_at: 2026-08-27T09:37:51Z
+wiki_revision: 62ddbe4469740c02ce4a6ca2fd1966a89a79322f
+synchronized_at: 2026-09-05T07:16:44Z
 <!-- gitea-wiki-mirror:end -->
 
 # 开发工作流
 
+## 语言与术语
+
+- 用户可以使用中文、英文或合理的中英混合语言交流；默认使用中文分析、回复、编写工单和维护内部项目文档。
+- 代码标识符、命令、参数、路径、文件名、API 名称、协议名、日志和错误原文保持原样；必要时补充简短中文解释。
+- 用户明确要求某次回复或交付物使用其他语言时，按该次要求执行，不改写接口契约或影响搜索和执行的原文。
+
 ## 事实来源
 
 | 信息 | 唯一事实来源 |
@@ -18,7 +24,7 @@ synchronized_at: 2026-08-27T09:37:51Z
 | 源码、迁移、测试、版本绑定分析、本地原型和核心 Wiki 镜像 | Git |
 | 可编辑交互设计 | QuantUX；App ID、版本、链接和确认状态记录在工单 |
 
-核心页面通过 `wiki-docs.json` 显式映射，固定执行 Wiki → `docs/` 单向同步。既有 Wiki 任务归档和 `docs/task/` 只作历史兼容；标准任务不创建或导出，只有用户明确要求专项快照时才使用 `archive` / `export`。
+核心页面通过 `wiki-docs.json` 显式映射，固定执行 Wiki → `docs/` 单向同步。日常 `sync` 与 `sync --check` 先比较页面 revision，revision 未变化时不重复下载正文；疑似镜像损坏或需要完整核对时显式使用 `sync --deep-check`。既有 Wiki 任务归档和 `docs/task/` 只作历史兼容；标准任务不创建或导出，只有用户明确要求专项快照时才使用 `archive` / `export`。
 
 ## 权威源与事实边界
 
@@ -53,6 +59,19 @@ synchronized_at: 2026-08-27T09:37:51Z
 - 每个核心页面写入后必须在线回读并取得 revision。页面缺失、回读失败或没有 revision 时停止初始化。
 - 产品编码前运行 `python dev_scripts/harness.py sync --verify`；全部成功才表示初始化完成。
 
+## 项目治理模式与不可裁剪底线
+
+GoAuto 默认采用轻量治理。文案、注释、格式、局部样式或布局、预期行为明确的小 Bug，以及不改变接口、数据结构、权限和安全边界的单模块低风险调整可以直接实施，无需为了留痕补建工单。完整独立需求、新页面、跨模块功能，以及 API、数据结构、权限、安全、迁移或范围不明确的变化必须建单。
+
+采购、创建订单、真实个人或生产数据、权限、安全、并发、数据库迁移、删除数据、发布和其他不可逆操作始终升级为高风险。无论任务采用何种最小门禁，凭据保护、永久禁止付款、个人与生产数据最小化、设备互斥、Agent 禁止 OCR/VLM、控件树与整屏截图禁存、工作区保护、真实测试和人工验收均不可裁剪。
+
+### 明确授权后的执行
+
+- 当前聊天中用户给出的明确指令，或 Gitea 工单中能够归属于有权人工的明确授权，可以作为执行依据，不要求把同一授权重复复制到工单后再次确认。
+- 授权必须能识别操作、对象和范围；Agent 自动生成的工单、草稿、摘要或对用户意图的转述不能单独构成人工授权。
+- 获得有效授权后，只核对准确目标、授权范围和当前状态等最小必要前提，不得仅因操作不可逆而重复询问或拒绝。
+- 授权不自动覆盖相邻对象或后续任务；环境、对象、范围或影响发生实质变化时重新确认。平台自身强制的审批、安全策略或权限限制继续有效。
+
 ## 工单与设计证据双门禁
 
 正式实施前先判断是否需要工单，再判断需要什么设计证据。工单不能替代原型确认，原型也不能替代技术方案、安全检查和单元工单。

docs/02-architecture-and-code-map.md

@@ -2,16 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Architecture-and-Code-Map
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: de7e400503d6e7b9c335657114893de345bfead5
-synchronized_at: 2026-08-31T03:33:36Z
-<!-- gitea-wiki-mirror:end -->
-
-<!-- gitea-wiki-mirror:start -->
-generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
-wiki_page: Architecture-and-Code-Map
-wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: dc5ccd2104e8ded715c0c0bb23d3827dc9a7fd7a
-synchronized_at: 2026-08-29T01:39:35Z
+wiki_revision: d547c17924ac53422232ad9d6c55a34c8cd8d63c
+synchronized_at: 2026-09-08T07:16:20Z
 <!-- gitea-wiki-mirror:end -->
 
 # 架构与代码地图
@@ -56,7 +48,7 @@ Android Portal/Agent
 - Android 本地互斥与服务端原子领取共同保证单设备串行。
 - 正式采购在 Android 本地 SQLite 事务中先保存不可逆状态、稳定服务端请求 ID 和脱敏最终确认快照，再通知服务端并只允许一次创建订单点击；重启后只重放服务端标记、只读核单或上报，不再次点击。
 - 原始控件树和截图不持久化；Android Agent 端第一期不使用 OCR/VLM。服务端 SYB 登录验证码识别是唯一例外，见 [#48](https://git.ilapage.cn/OPC/goauto/issues/48)。
-- 蝦皮规格映射独立保存在 `shopee_product.specs_json`：颜色只能选择关联 PDD 当前可选颜色，允许多个蝦皮颜色共用一个 PDD 颜色；尺码自动匹配只预览格式统一后的唯一确定结果。PDD 目标规格消失后页面标记失效，映射保存和采购创建均拒绝继续使用；无需新增数据库表或 Android 能力。
+- 蝦皮规格映射独立保存在 `shopee_product.specs_json`：颜色只能选择关联 PDD 当前可选颜色，允许多个蝦皮颜色共用一个 PDD 颜色。Admin 商品详情的“一键匹配颜色和尺码”在服务端统一计算两个维度：保留当前仍有效的已确认映射，将唯一确定匹配及达到阈值、具备理由且候选仍有效的 AI 匹配，在重新校验规格上下文后于同一事务直接写为 `confirmed`，无需人工确认；低置信度或无结果保持未匹配，Provider 异常或上下文变化时不写入任何本次结果。PDD 目标规格消失后页面标记失效，映射保存和采购创建均拒绝继续使用；无需新增数据库表或 Android 能力。
 
 ## 最小业务数据
 
@@ -76,6 +68,8 @@ Android Portal/Agent
 | `pdd_account` | 可选的账号调度引用，只保存名称和状态，不保存凭据 |
 | `purchase_task` | 商品外键和不可变快照、执行模式、状态/租约 guard、价格边界、订单、人工支付复核、物流与回填事实 |
 | `purchase_task_attempt` | `task_id + attempt_id` 幂等执行记录、阶段、规则哈希、固化规格决策和结构化错误 |
+
+> #241 新增：`server/app/goauto/purchase/order_backfill.go` 与 `order_backfill_handler.go` 提供 `POST /api/agent/v1/purchase-tasks/order-backfill`（Device Token 鉴权，逐条事务、逐条结果）；`server/app/goauto/models/purchase_order_guard.go` 在 `PurchaseTask.BeforeSave` 上全局强制订单号唯一，以 `purchase_rule_setting` 单例行串行化订单号分配，避免新增唯一索引迁移；`purchasecontract.ParseAddressSuffix` 为 `AddressSuffix` 的反解，通过回比而非负向前瞻实现（Go RE2 不支持前瞻）。
 | `ai_matching_setting` | 唯一单例的启用状态、OpenAI-compatible Base URL、模型、超时、内部部署明文 API Key 和更新人；仅管理员设置接口可以读取该字段 |
 
 `collection_task` 的状态仅为 `pending`、`running`、`completed`、`completed_partial`、`failed`。设备身份和心跳表属于 Agent 领取任务的必要基础，不承载 PDD 业务数据。
@@ -318,3 +312,57 @@ PddProductDetailCollector
 - `GET /api/admin/v1/pdd-products/{productId}/related-syb-products` 返回统一扁平分页，参数为 `page`、`pageSize`（默认 20、最大 100）、`scope=actionable|all`（默认 actionable）和可选 `shopeeProductId`。管理员和采购员可读，其他角色由 Casbin 拒绝。
 - `purchase.Service.ProcessStages` 是 SYB 页和 PDD 关联订单共用的只读阶段入口；批量加载、不调用 AI。当前采购规则缺失或无效时仍返回基础关联、采集和已有任务事实，依赖规则才能创建的行明确标记不可采购。
 - Web 的 PDD 商品详情把“创建备货采购”保留在顶部，把“关联订单继续采购”放在关联商品区块；订单行使用统一分页，并复用既有 `batch-preview` / `batch` 创建路径。
+
+## 蝦皮规格自动匹配批处理（#195）
+
+- 服务端在 `server/app/goauto/shopeeproduct/auto_match_batch.go` 复用单商品“一键匹配颜色和尺码”原子服务，定时任务与 Admin 手动执行共用同一批处理入口。
+- `shopee_spec_auto_match_run` 保存触发来源、稳定 `requestId`、运行摘要和可空唯一 `active_slot`；活动槽与租约保证多实例、定时和手动同时触发时全局最多一个运行批次。
+- `shopee_spec_auto_match_work_item` 按蝦皮商品唯一保存输入指纹、尝试次数、下次尝试时间和逐商品租约。已完成或低置信度/无结果的相同输入不重复调用 AI；规格、关联或 AI 设置更新时间变化后才允许重新处理。
+- 迁移 `1788290000000_shopee_spec_auto_match.go` 幂等创建两张表并写入调用目标 `GoAutoShopeeSpecAutoMatch`。系统任务默认关闭，默认 Cron 为每小时第 15 分钟、每批最多 20 个商品。
+- Admin 蝦皮商品列表通过异步手动接口启动同一批次并轮询最近运行摘要；该入口仅管理员可用，不创建采购任务、订单，不调用 Android Agent，也不执行付款。
+
+## SYB 异常规格 AI 定时解析（#198）
+
+- `server/app/goauto/sybimport/ai_parse_batch.go` 以 SYB 明细为单位执行“确定性重解析 → 封闭候选 AI 解析”，与 #195 的“蝦皮规格 → PDD 规格”任务保持独立。
+- `syb_spec_ai_parse_run` 保存全局批次、活动槽、租约与结构化计数；`syb_spec_ai_parse_work_item` 按 `syb_product_id` 唯一保存输入指纹、尝试次数、冷却和逐行租约。
+- `syb_product` 的 `ai_confirmed`、置信度、限长理由、确认时间和隐藏输入指纹记录 AI 确认事实；`parse_status` 仍只记录确定性解析器结果，`manually_confirmed` 仍只代表人工决定。
+- Provider 只接收单条 `productSpec` 和关联蝦皮商品的颜色/尺码候选；返回值必须逐字属于对应候选。采购可信门禁接受仍有效的 AI 确认，但候选消失后立即 fail-closed。
+
+## 定时任务持久化执行历史（#199）
+
+- `server/app/jobs/execution_log.go` 为 Exec 与 HTTP 两类调度入口统一记录一次执行生命周期；`server/app/jobs/models/sys_job_execution_log.go` 对应表 `sys_job_execution_log`，保存执行标识、任务/调用目标快照、定时触发类型、开始/结束时间、耗时、`running` / `succeeded` / `failed` / `interrupted` 状态及脱敏错误码和摘要。
+- 服务启动时按当前“每个数据库一个调度器实例”的拓扑，把上次进程遗留的 `running` 记录安全收敛为 `interrupted`；任务删除后历史仍保留并可只读查询。
+- `GET /api/v1/sysjob/:id/execution-logs` 由 `server/app/jobs/service/execution_log.go`、`apis/execution_log.go` 和 `router/sys_job.go` 提供任务级分页、状态与开始时间过滤；沿用隐藏菜单 `JobLog` 的角色菜单绑定和精确 GET 权限。Web 入口为 `web/src/views/schedule/index.vue` 的单选“日志”按钮，详情页为 `web/src/views/schedule/log.vue`。
+- 执行历史明确不保存任务参数、AI Provider 地址或密钥、第三方原始响应和业务原始载荷；当前不提供删除、保留期限自动化、WebSocket 实时流或立即执行动作。
+- 追加迁移为 `server/cmd/migrate/migration/version-local/1788357000000_sys_job_execution_log.go`：创建执行历史表、登记只读 API、关联 `JobLog` 菜单，并只给迁移前已绑定该菜单的角色补充精确 Casbin 权限。
+
+## 客户端密钥访问架构（#237）
+
+代码基线 `71f7751`（含用户确认的默认 HTTP/HTTPS 兼容），2026-09-07 完成 Server/Web 代码与隔离测试；本机迁移、管理员菜单写入与 Server/Web 启动已于 2026-09-07 授权完成，真实 HTTP 管理列表和模块目录加载通过；线上仍未部署。
+
+- `server/app/goauto/clientkey` 管理独立密钥、授权及审计；`clientapi/routes.go` 的显式 Inventory 将 `/api/client/v1` 映射到既有业务处理器，绝不转发任意 Admin 路由。
+- `clientapi/gateway.go` 默认接受 HTTP 与 HTTPS，无协议开关或转发协议头门禁，按 Bearer 密钥、模块及能力顺序校验，每次请求读取数据库，无授权缓存。`common/clientprincipal` 传递独立客户端身份，不生成或伪装管理员 JWT。
+- `client_api_key` 保存名称、随机 256 位密钥的 SHA-256 摘要、前缀、授权 JSON、启用状态、版本、创建/修改人和最后使用时间；完整密钥仅创建响应一次返回。`client_api_key_audit` 保存管理变更和客户端请求元数据，不保存请求正文、查询参数、响应正文或凭据。
+- 编辑与停用采用启用状态和 version 条件更新，并与变更审计同事务提交；冲突返回 409。业务执行前先持久化请求审计意图，失败则不执行业务。完成后更新状态；更新失败或进程中断可能留下 status=0，表示结果待核对，不能据此自动重放。
+- 部分既有业务操作人字段使用该密钥最近授权管理员的 ID 兼容现有外键；实际调用方以独立审计的 key_id 为准，不能把业务字段当成人工操作证据。
+- Admin 页面 `web/src/views/goauto/client-keys/index.vue` 复用创建/编辑授权弹窗；菜单位于“采采管理”，仅管理员可见。新追加迁移 `1788798000000_client_api_key.go` 创建两表及管理员菜单，不改 Android。
+
+## 采购规格面板预滑动兼容（#238）
+
+代码基线 `58a6c1c`，Android 0.9.60 / versionCode 73（构建完成不等同于已安装/发布）。`PurchaseRehearsalExecutor.applyPostAction` 对 `openSpecPanel.swipeAfter` 只兼容解析、不执行机械预滑动，`waitAfterMs` 保留；首趟继续原 `probeSpecs` 遍历，第二趟继续原 `selectSpec` 精确查找与容器内有界滚动。其他动作的后置滑动仍沿用既有执行语义，失败不会被统一忽略。
+
+`GoAutoAccessibilityService.swipePurchase` 的失败分类由 `PurchaseSwipeFailureReason` 枚举提供；共享 `swipeNode` 仅增加可选分类回调，不改变手势目标、轨迹、1500ms 回调等待或其他调用者行为。`GoAutoPurchasePanel` 日志经 `AgentForegroundService` 关联 task、attempt、device 与规则快照哈希，新增预滑动跳过/必需滑动失败标量；不记录节点文字、坐标、原始控件树、截图或凭据。
+
+Server/Web、数据库和任务快照不变；旧 APK 仍有预滑动行为，必须更新 Agent 才生效。相关验证在 `PurchaseRehearsalExecutorTest`，Android 全量测试与 APK 构建入口不变。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；代码已实现不代表当前线上已部署。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+入口为 `SyncWithShopSnapshot → loadDailyList → importSyncPage`；`server/app/goauto/sybimport/sync_page.go` 封装页事务和提交后计数；`import_handler.go` 判定终态，`sync_run.go` 保存及筛选，Web 复用 `web/src/views/goauto/syb-sync-runs/index.vue`。

docs/03-business-rules-and-glossary.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Business-Rules-and-Glossary
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Business-Rules-and-Glossary.-
-wiki_revision: 9b195f3c578f980b808e6eb28f36e7bf5294e75b
-synchronized_at: 2026-09-03T01:55:28Z
+wiki_revision: 1eb380d07183157a8430c7ced868479e72fbdfe3
+synchronized_at: 2026-09-08T07:49:50Z
 <!-- gitea-wiki-mirror:end -->
 
 # 业务规则与术语
@@ -41,6 +41,8 @@ synchronized_at: 2026-09-03T01:55:28Z
 
 - 一行对应 SYB 一条明确的商品/颜色/尺码/数量明细；唯一键为「蝦皮订单号 `code` + 来源明细 `id`」组合，不是全局唯一 ID（未在多货运单样本中验证过全局唯一性）。
 - `productSpec` 自由文本解析：按最后一个逗号切分为颜色/尺码 → 剥离【】备注 → 判断残留分隔符；解析状态分 `success`/`uncertain`/`failed`，永不猜测原文中不存在的颜色或尺码。
+
+- 采购放行不以 uncertain 单独阻断：success 与已提取出至少一个非空颜色或尺码的 uncertain 明细，都可继续进入规格匹配和采购预检；只有 failed 或颜色、尺码均为空的异常明细才要求人工处理。uncertain 状态与解析说明继续保留供审计，不会自动猜测规格。
 - 只有 `success` 状态的解析结果会合并进虾皮商品档案的规格值（来源标记 `import`）；`uncertain`/`failed` 只停留在明细行上供人工复核，不污染共享档案。
 - 金额单位按接口分别定义：`/am/stock/detail/listByStock` 的 `productPrice` 是十进制金额，与 `/am/stock/list` 的 `amtOrder`（×100 整数）不是同一套换算，不可共用。
 - 关联虾皮商品档案：命中存活记录直接关联；命中软删除记录则复活并保留原有人工映射；均不存在时创建最小档案。命中既有档案时只补写为空的参考图与售价，不覆盖人工修改过的标题、店铺和映射。
@@ -56,24 +58,32 @@ synchronized_at: 2026-09-03T01:55:28Z
 - 对采购人员展示的阶段固定为：待人工处理、未关联 PDD、PDD 待采集、PDD 采集中、PDD 采集失败、规格待匹配、可创建采购、已创建任务、采购成功、待人工核对。
 - 主阶段优先级为：待人工核对 → 采购成功 → 已创建任务 → 待人工处理 → 未关联 PDD → PDD 待采集/采集中/采集失败 → 规格待匹配 → 可创建采购。每行只显示一个阶段和对应下一步。
 - “待人工核对”表示订单结果不明确，必须先人工核查并禁止自动重试；“采购成功”表示已取得 PDD 订单号和下单时间，不代表已经支付。
+- 一个 PDD 订单号只能属于一个采购任务，该唯一性在采购任务保存路径上全局强制（#241）。人工处理结果未知、取消及 lifecycle 保存路径撞号时返回 `PURCHASE_ORDER_NUMBER_ALREADY_USED`，提示订单号已属于哪个任务，由采购员人工核对，不静默覆盖原值。
+- 不可逆边界之后的 `order_created` 结果回传是上述规则的例外：此时 PDD 真单已创建，发现订单号已属于其他任务时不回滚、不判失败，而是把任务降级为 `order_result_unknown`，冲突订单号以「读到订单号 X，但该号已属于任务 CG-yy」保存在任务与 attempt 的 `error_message`，`pdd_order_no` 留空以维持唯一性，保留下单时间与不可逆时间，进入既有人工处理结果未知通道。首要目标是保住「真单已存在」这一事实，不制造无记录的真实订单。
+- Agent 可按收货地址后缀 `_cg<任务号>` 批量回填订单号与下单时间（#241）。
+- Agent 侧回填为**人工触发的只读扫描**（#242）：入口在采购记录页搜索按钮右侧，输入天数（默认 2）后确认启动。天数口径为滚动 N×24 小时，基准是页面读到的下单时间。采集、采购、回填三者互斥，复用既有任务互斥锁并加原子防重入，忙碌时拒绝启动而不排队、不抢占。
+- 回填扫描不假设订单列表有序：只有连续观察到至少 5 单且下单时间严格递减、期间无缺失时间时，才允许「超过指定时间即停止」；一旦出现时间回升或缺失，改为扫至内部上限并明确标记「未完整扫描」，不得把不完整结果显示为已扫完。内部上限用于限制设备占用，不作为用户可配置的门禁。
+- 回填扫描全程只读：确认收货、申请退款、催发货、去支付、立即支付、提交订单、付款、退款、取消订单、再次购买、删除订单永久排除为点击目标；点击目标必须自身可点、子树不含上述词，且不与任何含上述词的可见控件几何重叠；不得按固定坐标盲点。遇登录、验证码或风控立即停止并报告。
+- 解析不出规范后缀的订单一律跳过，其订单数据不缓存、不上传、不入日志；上传载荷只含后缀、订单号与可选下单时间。本地缓存只采纳服务端确认的事实，并区分页面读到的真实时间与 `irreversible_at` 回落估算值。后缀只承载任务号，请求不含地址全文或收件人信息；只允许回填该设备自己的正式采购任务；页面下单时间优先，缺失时回落该任务的 `irreversible_at` 并标记时间来源，两者皆空则该条失败。
 - 已失败、已取消或演练完成的旧采购任务不单独占用主阶段；当前数据仍满足条件时恢复显示“可创建采购”，旧任务继续在采购管理留痕和按既有规则处理。
 - 未选择处理阶段时，商品列表仍先返回，当前页阶段和采购准备继续异步批量读取且不调用 AI Provider；选择阶段筛选时，服务端必须先对完整查询结果派生并筛选阶段，再计算总数和分页，不能只过滤当前页。
 
 ## SYB 店铺过滤
 
 - `syb_shop` 保存允许导入的 SYB 店铺；店铺名比较前统一去除首尾空白、转换全角/半角字符并忽略大小写。规范化后同名的店铺只能保留一条有效记录。
+- 版本迁移会对历史存活店铺回填 `normalized_name = Normalize(display_name)`；回填只改匹配键且可重复执行。若两个存活店铺回填后会得到同一键，迁移必须整体失败并保留原数据，管理员先人工消除歧义后再执行，不能静默合并、删除或改变店铺启用状态。
 - 店铺可以从 SYB 真实货运单列表发现，也允许管理员手工补充。只有管理员可以新增、改名、启停和软删除，采购员等其他角色只读。
 - 没有任何启用店铺时，导入必须在读取凭据、建立会话、验证码 OCR 和任意 SYB 网络请求之前失败，并给出“请先启用店铺”的可读提示。
-- 同步必须先拉取并校验当天原始全量列表的总数、分页和唯一 ID，再按本次同步开始时固定的启用店铺快照过滤；过滤不能降低完整性校验的请求范围或容量上限。
+- 同步先预检全范围总数及上限，每页校验原始列表条数、合法 ID 和重复，再按冻结店铺快照获取明细并页事务保存；整日结束核对总数。过滤不能降低完整性校验范围，已保存不能冒充整日完整（#239，c6a962d，已于 2026-09-08 随 d403f3b 部署线上）。
 - 只有列表与明细响应的店铺名都非空且命中启用快照时才允许写入。明细店铺名为空、变化为未启用店铺或无法匹配时跳过，并计入跳过数量。
 - 停用或软删除店铺只影响后续导入，不删除历史 SYB 商品、虾皮商品或任务数据。已有错误导入数据的清理必须先给出精确 SQL 和影响行数，再由用户单独确认。
 
 ## SYB 后台导入记录
 
-- 导入由管理员创建，创建成功后立即转入后台执行；页面关闭不取消任务。采购员等其他已登录角色可以查看同步记录，不能开始导入。
+- 导入允许管理员和采购员（purchaser）创建，创建成功后立即转入后台执行；页面关闭不取消任务。其他已登录角色只能查看同步记录，不能开始导入（#236）。
 - 系统同一时刻只运行一个 SYB 导入任务。`syb_sync_run` 的唯一执行槽负责跨进程互斥，内存锁减少同一进程内的竞争；服务重启后遗留的执行中记录标记为“已中断”。
 - 导入失败或中断时保留已写入商品，记录明确的失败原因和已处理进度；重新导入相同范围按「订单号 + 明细 ID」覆盖，不产生重复商品。
-- 每条同步记录保存本次启用店铺集合的 SHA-256 哈希以及各店铺“已导入/已跳过”数量，不保存账号、密码、Cookie、验证码图片或 SYB 原始响应。
+- 创建同步记录时冻结本次启用店铺的规范化匹配集合、展示名称快照及 SHA-256 哈希；后台执行必须只使用这一份快照，不得在开始后重新读取 `syb_shop`。同步详情保存并返回快照可用标记、快照店铺名称、哈希及各店铺“已导入/已跳过”数量。#212 之前的历史记录只有哈希和统计，明确标记为无完整快照。上述记录不保存账号、密码、Cookie、Token、验证码图片或 SYB 原始响应。
 - 后台任务创建前的内部失败仍向普通用户显示“服务端处理失败”，但使用稳定错误码区分阶段：店铺预检为 `SYNC_SHOP_PREFLIGHT_FAILED`，同步记录创建为 `SYNC_RUN_CREATE_FAILED`。服务端只记录阶段和经过脱敏、截断的底层原因，不记录请求体、凭据、Cookie、Token、验证码或原始响应。
 
 ## 采集规则
@@ -84,12 +94,14 @@ synchronized_at: 2026-09-03T01:55:28Z
 - 删除采用软删除；删除后不能创建新任务，但已有任务继续执行自身快照。
 - 商品详情步骤应声明精确 `activityName`，并与包名和唯一控件共同作为页面证据；进入 PDD 登录 Activity 必须返回 `PDD_LOGIN_REQUIRED`，不能提交采集成功。
 - 唯一文字节点不可点击时，Agent 只可点击其最近的可点击父容器；不得改点兄弟节点或相似文字。
-- 商品页规格入口只接受带明确选择语义的规格摘要，或底部真实“购买/拼单”文字按钮；评价、评论、晒单、问答区域及其父容器一律排除。商品评价页与详情页共用 Activity 时，首次误触只允许安全返回并重新定位一次，重复误触明确失败；点击无变化、误入评价页和面板结构无法确认使用不同错误码。
+- 商品页规格入口只接受带明确选择语义的规格摘要，或底部真实“购买/拼单”文字按钮。若“请选择”和颜色/尺码语义分散在同一可点击父容器的子节点中，也只能在该容器唯一、位于非底部动作区且同时具备两类语义时作为规格入口；规则别名只能收窄已识别的安全候选，不能按页面原始文字扩张。底部购买入口在通过全部安全过滤后仍存在多个候选时，按最右优先（`centerX` 降序，并列时可点击面积升序）确定性选出唯一入口，不再因候选不唯一直接失败；该情形记为 `bottom_purchase_rightmost`，唯一候选仍记为 `bottom_purchase`。“单独购买”与“发起拼单”打开同一规格面板，但对应不同成交形态与价格，最右优先是经人工确认的取舍。评价、评论、晒单、问答、订单、提交订单、支付和付款区域及其父容器一律排除。商品评价页与详情页共用 Activity 时，首次误触只允许安全返回并重新定位一次，重复误触明确失败；点击无变化、误入评价页和面板结构无法确认使用不同错误码。
 - v2 规则使用类型化动作和固定阶段钩子。已由 Agent 支持的选择器、别名、超时、滑动方向和有限次数可以只更新规则；新增动作类型或页面算法才需要升级 Agent。
 - v2 任务首次未进入精确商品详情页时，可以按规则显式重开同一浏览器 URL 一次；登录、验证码、风控、无效链接和详情页内采集失败不触发该恢复。
 - 假售罄恢复只使用主商品规格/购买强证据判断页面是否正常；顶部“相似商品”可以作为受控兜底证据，推荐卡片的标题、价格和销量不得冒充主商品证据。
 - 商品规格遍历必须用已识别规格节点锁定横向颜色容器和纵向面板容器；颜色按视觉行蛇形遍历，滑动完成后重新读取节点，尺码只读并允许在标题滚出后沿已锁定容器续页。
 - PDD 已选规格的订单确认形态只可由详情页、选择摘要、唯一数量控件、支付区、唯一底部提交动作和唯一主要滚动容器的组合证据确认；底部提交动作只读且永久禁止点击。Agent 只在该已确认容器内最多三次向下拖动回顶，每次重新读取节点；“参考分类”作为尺码的精确标题别名处理。
+
+- PDD 完整规格选择器若无主滚动容器且尚未选择规格而没有已选摘要，仍可识别为非滚动规格面板，但必须同时出现至少两个已解析维度、至少两个可选项、唯一数量控件和唯一底部订单动作；缺少其中任一强证据时保持未识别。该订单动作仍仅作页面证据，永久禁止点击。
 - Agent 可扩展，但规则必须按任务类型授权：采集规则不能创建订单，采购规则只能使用独立审核的创建订单能力。当前项目不实现支付动作、入口或测试；支付、下单和订单相关文字可以作为只读页面证据配置，但不得成为点击目标。后续支付能力必须单独评估并至少具备显式能力位、服务端开关、单笔金额上限和人工授权。
 
 ## 采集任务
@@ -135,27 +147,27 @@ synchronized_at: 2026-09-03T01:55:28Z
 - 演练规则在服务端契约层拒绝改地址、创建订单和核单动作；正式动作还必须通过版本化能力协商。规则只包含类型化动作，禁止任意脚本。
 - 价格保护保存参考单价、最低单价、最高单价和币种，执行时以 PDD App 实际单价判断；价格越界明确失败，不考虑优惠券。
 - Admin 从 SYB 当前页选择商品，可在“创建采购”和“重新解析”两种批量用途间切换；采购模式只允许选择预检合格行，表头全选不跨页。批量预检和正式创建均最多 100 条并逐条重新校验，每条 SYB 明细只创建一个独立任务；部分失败不回滚其他成功项。
-- SYB 商品列表在列表数据返回后立即展示，采购准备状态独立异步加载；只读批量预检只执行批量数据库读取、已确认映射和本地确定性识别，禁止调用 AI Provider。未保存的确定性结果仍显示“规格待匹配”，不能作为“可创建采购”的依据。SYB 批量创建采购按最新数据完整复核，只有目标颜色和尺码都已保存为确认映射，且共同命中最近一次成功或部分成功采集中的完整可售 SKU 组合时才允许创建；否则必须先执行批量 AI 匹配或人工确认，不能把未匹配明细带入采购任务内的人工匹配步骤。
+- SYB 商品列表在列表数据返回后立即展示，采购准备状态独立异步加载；只读批量预检只执行批量数据库读取和本地确定性识别，禁止调用 AI Provider。自 #215 起，未保存或已失效的长期规格映射不再阻断创建采购；满足商品关联、PDD 状态、价格、规则、设备和订单安全门禁后即可创建任务，每个新 SYB 采购任务都在首个 attempt 以当次 PDD 页面候选重新决策。
 - SYB 商品页的 PDD 采集资格独立于采购处理阶段：只要已关联的 PDD 商品未停用、没有 `pending` / `running` 采集任务且存在可用采集规则，即可创建采集任务；因此已完成采集并进入“可创建采购”的商品也可以重新采集。相同 PDD 商品在批量创建前按商品去重，服务端创建时仍按最新状态复核。
 - 批量创建读取管理员选定的当前采购规则并重新执行契约校验，每条任务保存不可变快照；当前规则缺失或无效时明确阻断，不回退到代码常量。设备默认人工指定，也可以留空由符合能力的空闲设备领取。
 - 批量创建的价格保护来自 PDD 商品档案而不是 SYB/Shopee 的 TWD 售价：当前采购规则可用 `priceGuard.minRatio`（0.1～1.0）和 `maxRatio`（1.0～3.0）配置比例，缺省仍为 0.2 / 1.5；最低价向下取整、最高价向上取整到人民币分。已确认颜色映射时按该颜色计算，待规格探测时以全部可用颜色的最低/最高价计算，参考价取最高价；没有可用颜色价格时不能创建。
-- 地址后缀为 `_cg{purchase_task.id}`。选好规格和数量后，Agent 仍停留在当前规格/下单面板；若收货地址被面板裁切，只允许在唯一、可见且占据主要宽度的纵向滚动容器内有限向下拉动来显示地址，禁止按页面最大滚动区域盲目滑动。Agent 只在唯一地址入口、唯一修改按钮和唯一详细地址输入框均成立时修改；脱敏手机号文字本身不可点击时，仍以该唯一文字节点的中心坐标执行一次精确手势点击，不沿用可能覆盖整个下单面板的可点击祖先。“修改”“保存”和“提交订单”等文字节点即使依赖可点击父节点，也必须保留原始文字节点作为每次重新定位的锚点，父节点只用于验证存在可点击路径。近乎完全重叠的无障碍重复节点按一个目标处理，仍有多个独立目标或页面切换超时则明确失败。按首个 `-` 或 `_` 截取地址主体后追加当前后缀，保存后必须回读完整新地址。修改或回读失败时禁止创建订单，地址全文和控件树不落库。
+- 地址后缀为 `_cg{purchase_task.id}`。精确规格、数量、价格和摘要核验通过后，若仍处于已识别的规格面板，Agent 只允许点击唯一、可见、启用、可点击且文案精确命中“确定/确认”别名的规格确认控件；不得点击提交订单、确认购买、付款、支付、地址修改或地址保存控件，也不使用中心手势兜底。点击后必须重新读取并确认已出现订单确认页或地址入口强证据，否则明确失败。进入订单确认页后，若收货地址被面板裁切，只允许在唯一、可见且占据主要宽度的纵向滚动容器内有限向下拉动来显示地址，禁止按页面最大滚动区域盲目滑动。Agent 只在唯一地址入口、唯一修改按钮和唯一详细地址输入框均成立时修改；脱敏手机号文字本身不可点击时，仍以该唯一文字节点的中心坐标执行一次精确手势点击，不沿用可能覆盖整个下单面板的可点击祖先。“修改”“保存”和“提交订单”等文字节点即使依赖可点击父节点，也必须保留原始文字节点作为每次重新定位的锚点，父节点只用于验证存在可点击路径。近乎完全重叠的无障碍重复节点按一个目标处理，仍有多个独立目标或页面切换超时则明确失败。按首个 `-` 或 `_` 截取地址主体后追加当前后缀，保存后必须回读完整新地址。修改或回读失败时禁止创建订单，地址全文和控件树不落库。
 - 地址编辑页可以同时存在收货人、手机号和详细地址等多个输入框；Agent 只选择与“详细地址”标签纵向重叠且位于其右侧的唯一输入框，不能用页面输入框总数或顺序猜测。
 - 点击创建订单前，Agent 必须先在本地事务保存 `order_submit_started`、不可逆时间、稳定请求 ID 和不含地址全文的最终确认快照，再用同一请求 ID通知服务端；两侧成功后才允许精确点击唯一创建订单按钮一次。
 - 进入不可逆边界后，进程重启、断网、点击结果不明或无法取得唯一订单号/下单时间时只允许只读核单并进入 `order_result_unknown`，禁止再次点击；任务与订单正式关联仍以完整 PDD 订单号为准。
-- 创建订单后出现 Android 多微信应用选择器时，Agent 只有在系统包和 `ChooserActivity` / `ResolverActivity` 白名单、已知选择器标题、微信候选三类证据同时成立时，才允许按一次返回，绝不点击微信候选。若已进入真实微信包 `com.tencent.mm`，Agent 不点击、不输入、不登录、不支付、不强制停止微信，只允许用一次无参数 PDD 启动 Intent 把既有 PDD 任务栈拉回前台；第二次仍见微信或拉起失败即保持结果未知。回到 PDD 已知支付 Activity 或明确支付动作页面后最多再返回一次，再只读读取唯一订单号和下单时间；任一页面不在白名单、恢复动作重复、无法到达订单详情或结果不唯一时保持 `order_result_unknown`，禁止重下单或支付。
+- 创建订单后出现 Android 多微信应用选择器时，Agent 只有在系统包和 `ChooserActivity` / `ResolverActivity` 白名单、已知选择器标题、微信候选三类证据同时成立时，才允许按一次返回，绝不点击微信候选。若已进入真实微信包 `com.tencent.mm`，Agent 不点击、不输入、不登录、不支付、不强制停止微信，只允许用一次无参数 PDD 启动 Intent 把既有 PDD 任务栈拉回前台；第二次仍见微信或拉起失败即保持结果未知。回到 PDD 已知支付 Activity 或明确支付动作页面后最多再返回一次，再只读读取唯一订单号和下单时间；下单成功页仅可点击唯一、精确的“查看订单”或“订单详情”入口一次，进入 PDD 订单详情后才允许有限向上手势下翻读取折叠内容。PDD 页面出现“待付款”“待支付”“订单编号”或“下单时间”等订单结果信号时，该只读信号优先于复用的支付 Activity 名称：允许在唯一主要纵向容器内有限下翻并重新读取，仍不得点击支付；没有任何订单结果信号的支付页或未知页面不得盲目滑动。入口缺失或不唯一、点击后未出现详情证据、任一页面不在白名单、恢复动作重复或结果不唯一时保持 `order_result_unknown`，禁止重下单或支付。
 - Agent 本地 SQLite/Outbox 负责断网和重启恢复，服务端以 `task_id + task_attempt_id` 幂等接收并保存最终事实。
 - 人工支付复核只记录 `paid` / `unpaid`；系统不执行或识别支付。快递单号与回填状态属于采购任务，后续物流工单实现。
 - 采购任务领取时同时占用设备租约和可选 PDD 账号租约；租约过期后才可释放并重新领取。设备还存在采集任务时不能领取采购任务。
-- 采购规格由服务端按顺序决策：先使用已确认的人工映射；否则仅在同一规格角色的可选 PDD 原始标签中做唯一确定性匹配（繁体转简体、空格/全半角/大小写统一，以及公斤/斤换算）；仍无唯一结果才调用已启用的服务端 AI。AI 必须返回候选集中的原始标签，候选不完整、歧义、AI 无结果或服务不可用均明确失败，不派发第二趟、更不创建订单。
+- 自 #215 起，每个新 SYB 采购任务无论是否存在已确认长期映射，都先由 Agent 在当次 PDD 规格面板内有界遍历颜色和尺码并回传原始候选。服务端只以任务冻结的 SYB 目标规格与当次候选先做唯一确定性匹配（繁体转简体、空格/全半角/大小写统一，以及公斤/斤换算），仍无唯一结果才调用已启用的服务端 AI。AI 必须逐字返回当次候选集中的原始标签；候选不完整、集合外返回、歧义、AI 无结果或服务不可用均明确失败，不派发第二趟、更不创建订单。
 - Agent 选择服务端下发的精确颜色或尺码时，只能在已确认打开的规格面板内有限纵向滑动、每次重新读取可选节点并按完整原始文字点击；连续没有新证据或达到上限即停止，不得点击相近规格。第一趟探测并固化规格后，第二趟仍无法精确选择而再次提交探测时，服务端必须明确失败并释放活动槽，保留第一次决策证据，禁止清空决策、循环派发或进入地址与创建订单动作。
 - 采购 Agent 在确认进入 PDD 商品页后、打开规格前，复用采集侧的假售罄识别；规格面板已打开且当前解析到的规格值全部不可选时也按售罄处理。两种情况都只允许关闭规格面板后对商品页执行一次有界恢复（默认下拉 2 次、间隔 1000 毫秒、等待 2000 毫秒），恢复动作失败或恢复后仍售罄时返回 `PDD_GOODS_SOLD_OUT`，恢复后商品页证据丢失时按页面规则不匹配失败；不得继续选择规格、修改地址或创建订单。该失败码继续进入既有替代商品资格判定。
-- 规格映射不完整、已保存的确认映射对当前 PDD 档案失效、确定性匹配失败、PDD 档案为待采集或没有规格时，规则必须具有 `purchase.spec-probe.v1`；自 #190 起前两种情况不再拒绝创建，而是把 `spec_source` 降级为 `unresolved` 并交由规格探测解析，规则不具备该能力时仍然拒绝创建；第一趟只探测规格并释放租约，服务端固化同一 attempt 的决策后才派发第二趟。Android 不自行匹配或猜测；其只接收服务端已经固化的精确原始规格标签。
+- 所有新 SYB 采购任务的规则都必须具有 `purchase.spec-probe.v1`；创建时任务级 `mappedColor` / `mappedSize` 为空且 `spec_source=unresolved`，长期映射和 PDD 档案候选都不能跳过首趟探测。第一趟只探测规格并释放租约，服务端固化同一 attempt 的决策后才派发第二趟；探测阶段从服务端拒绝进入 `order_submit_started`。Android 不自行匹配或猜测，只在第二趟接收并精确选择服务端固化的当次 PDD 原始标签。
 - Agent 提交的相同 attempt 最终结果只能写入一次；相同请求重放返回原事实，不同内容拒绝覆盖。`order_result_unknown` 不参与自动派发，只能人工解除。
 - 已创建订单默认禁止再次采购；管理员或采购员可以做一次性重新采购授权，新任务创建成功时在同一事务消耗授权，旧任务和旧订单保留。已标记为已支付的订单不能授权或创建重新采购任务。
 - 人工回填候选只允许从已支付订单选择；同一 SYB 明细后来选择的订单覆盖旧候选，但不删除旧订单事实。
 - Admin 采购管理只查看和处理已有任务，不提供创建入口或支付按钮；单条和批量采购任务都从 SYB 商品列表发起。订单结果未知时必须先人工核对并解除；处于该状态时页面不提供重新采购授权。
-- 采购失败任务可在采购管理当前页批量勾选重试，最多 100 条。重试不修改旧任务，而是用当前 SYB/PDD 档案、当前规格映射、当前价格保护和当前采购规则创建新的 `pending` 任务，并生成新任务编号与地址后缀；来源蝦皮订单号沿用失败任务的不可变快照。
+- 采购失败任务可在采购管理当前页批量勾选重试，最多 100 条。重试不修改旧任务，而是用当前 SYB/PDD 档案、目标规格、当前价格保护和当前采购规则创建新的 `pending` 任务，并生成新任务编号与地址后缀；来源蝦皮订单号沿用失败任务的不可变快照。新任务不复用旧任务或长期档案的执行规格，仍必须先完成当次真机规格探测。
 - 只有正式采购、未进入不可逆边界、没有订单号或下单时间、且仍是同一 SYB 最新记录的 `failed` 任务可重试。原设备离线、停用、忙碌或能力不足时该项失败且不自动换机；未指定设备时仍由空闲设备领取。
 - 批量重试逐项处理并允许部分成功；同一请求幂等重放不会重复创建。失败任务不再使用一次性重新采购授权，该授权只保留给已经创建过订单且满足条件的任务。
 
@@ -163,7 +175,7 @@ synchronized_at: 2026-09-03T01:55:28Z
 
 - 管理端固定支持 `admin`（管理员）和 `purchaser`（采购员）两类业务角色；用户必须绑定一个存在且启用的角色，`role_id=0` 或停用角色不能创建或保存。
 - 采购员可读取设备状态，维护 PDD/虾皮商品和规格映射，查看与修正 SYB 商品，读取 SYB 店铺及同步记录，读取采集规则，创建/重置/删除采集任务，并创建、查看、重试及人工处理采购任务。
-- 仅管理员可管理用户、角色、菜单、接口、部门和岗位；停用设备或吊销 Device Token；新增、改名、启停、删除或发现 SYB 店铺；手动启动 SYB 同步；新增、编辑或删除采集规则；保存或测试 AI Provider 配置。
+- 仅管理员可管理用户、角色、菜单、接口、部门和岗位；停用设备或吊销 Device Token；新增、改名、启停、删除或发现 SYB 店铺；新增、编辑或删除采集规则；保存或测试 AI Provider 配置。
 - AI 规格匹配菜单对采购员硬排除：采购员不显示该菜单，角色配置也不能为采购员选中该模块；既有 API 权限不变，仍只允许读取是否启用，不得读取 Provider 地址、模型、API Key，也不得保存或测试。
 - GoAuto 菜单由代码维护的模块定义幂等写入系统菜单和菜单/API 关联；迁移只为采购员追加首次引入且默认开放的模块，不会把采购员人工取消勾选的既有模块重新加回。
 - 采购员 Casbin API 白名单由代码权限矩阵全量重建，不从角色菜单勾选反推；减少权限时旧策略必须删除。菜单勾选只控制可见模块，不能扩大采购员 API 权限。
@@ -225,7 +237,7 @@ synchronized_at: 2026-09-03T01:55:28Z
 - 定时任务失败时明确记录失败原因，不自动重试。服务重启后由既有启动恢复逻辑处理遗留的运行中记录。
 - 单次同步内部的 SYB 只读请求（货运单总数、列表和明细）遇到暂时网络故障、5xx 或异常响应时最多执行 3 次，分别退避 1 秒、2 秒，单次 HTTP 总超时 60 秒；这不等于失败任务自动重试。明确未登录、业务失败、数据完整性错误以及任何写操作均不自动重试。
 - SYB 商品页不再提供“导入”和“同步记录”快捷按钮，也不查询、展示或轮询同步状态；后台同步成功、失败或中断均不在商品页弹出消息，商品数据由用户主动查询或刷新获取。
-- 独立“SYB 同步记录”页面是同步结果的唯一 Web 展示位置，保留运行状态、进度、数量、失败原因和店铺统计；go-admin 定时任务中的 `GoAutoSYBHourlySync` 提供“执行记录”入口。管理员可在同步记录页人工发起覆盖昨天和今天的同步，采购员只读；人工与定时同步共用导入服务、执行记录和互斥，不排队、不并发，也不立即重试。
+- 独立“SYB 同步记录”页面是同步结果的唯一 Web 展示位置，保留运行状态、进度、数量、失败原因和店铺统计；go-admin 定时任务中的 `GoAutoSYBHourlySync` 提供“执行记录”入口。管理员和采购员可在同步记录页人工发起覆盖昨天和今天的同步，其他角色只读（#236）；人工与定时同步共用导入服务、执行记录和互斥，不排队、不并发，也不立即重试。
 
 
 ## cmautobuy 商品导入
@@ -251,16 +263,14 @@ synchronized_at: 2026-09-03T01:55:28Z
 
 ## Agent 受控重试采购
 
-- 当前设备只可就地重跑自身最近 30 天内、服务端标记 `retryable=true` 的正式采购失败任务；列表和详情都只能发起单任务重试，不支持多选、批量或自动重试。
-- 普通“重试采购”复用原 `purchase_task.id`，不新建任务，不改变商品、虾皮/SYB 身份、目标规格、已映射规格、价格保护、地址后缀与其他业务快照。重试只把任务恢复为 `pending`，清理错误、租约和运行守卫。
-- 重试时刷新服务端当前采购规则及其类型、schema 和能力要求。#127 尚未实施前，当前规则仍为服务端内置规则；#127 完成后才切换为数据库单例设置，不能在本工单提前引入第二事实源。
-- 新规则下发前必须重新校验原设备在线、空闲且具备全部能力。规则不可用或能力不匹配时拒绝重试，原任务保持失败状态。
-- 已出现 `order_submit_started` 证据，或存在不可逆时间、订单提交请求、PDD 订单号、下单时间的任务一律拒绝就地重试，并提示走既有“授权重新采购”流程，防止重复下单。
-- 每次成功受理就地重试都会为同一任务预建一个新的 `pending` attempt，保存本次规则哈希；正常 Start 复用并转为 `running`。因此尝试次数、每次规则哈希和失败原因均可追溯，且不限制人工重试次数。
-- `requestId` 按“任务 + 请求”幂等；相同请求重放不重复修改任务或增加 attempt。
-- Agent 详情显示已尝试次数与上次失败原因。确认界面必须说明同一任务使用最新规则重跑、可能创建待付款订单且系统不会支付。
-- “继续采购”与普通“重试采购”语义不同：替代商品匹配完成后的“继续采购”继续调用既有 `AgentRetry → BatchRetry → Create`，保留旧任务并按当前替代商品档案创建新任务；Admin 批量重试同样继续创建新任务。二者均不得改成就地更新旧任务。
-- 取消订单、修改既有订单和支付仍禁止；真机重跑可能进入创建待付款订单流程，执行前必须再次取得人工授权。
+- 当前设备只可重试自身最近 30 天内、服务端标记 `retryable=true` 的正式采购失败任务；列表和详情都只能发起单任务重试，不支持多选、批量或自动重试。
+- 普通“重试采购”调用就地 `/reset`：复用原 `purchase_task.id`，只新增 attempt；新 attempt 使用当前有效采购规则和最新版 Agent 代码，商品、目标规格、执行规格、数量、价格、地址及既有规格决策等业务快照保持不变。
+- 就地重试不恢复已经消耗的真机规格探测资格；目标规格存在但对应执行规格为空时必须拒绝，不能进入正式采购阶段。需要按替代商品或已变化业务规格重新决策时，必须走明确的新任务流程。
+- 已出现 `order_submit_started` 证据，或存在不可逆时间、订单提交请求、PDD 订单号、下单时间的任务一律拒绝重试，并提示走既有“授权重新采购”流程，防止重复下单。
+- `requestId` 按“任务 + 重置请求”幂等；相同请求重放返回同一 task ID 和 attempt，不重复递增。
+- Android 只在服务端 `retryable=true` 且状态为 `failed` 时显示普通“重试采购”。确认和成功反馈必须说明复用原任务、新增一次执行、使用当前规则但业务快照不变、可能创建待付款订单且系统不会支付。
+- `/reset` 不得把“目标规格存在但对应执行规格为空”的任务恢复到正式采购阶段；此类异常快照必须拒绝，并提示使用明确的新任务流程。
+- 替代商品匹配完成后的“继续采购”继续调用 `AgentRetry → BatchRetry → Create`，按当前档案创建不同 task ID；Admin 批量重试也保持新任务语义。取消订单、修改既有订单和支付仍禁止。真机重试可能进入创建待付款订单流程，执行前必须再次取得人工授权。
 
 ## Agent 状态页手动检查任务
 
@@ -331,12 +341,16 @@ synchronized_at: 2026-09-03T01:55:28Z
 - 自动确认必须保存来源、实际置信度和脱敏限长原因；人工确认完成后同步对应分项及主表总体状态。worker 不得覆盖已由人工改变的映射。
 - 纠错不能简单执行 B→C；必须把原 A→B 记录置为 `superseded`，建立 A→C，并只处理原记录冻结的虾皮商品影响集合。
 
-## 创建采购任务时的异步规格匹配（#148）
+## 历史：创建采购任务时的异步规格匹配（#148，#215 后仅兼容存量）
 
-- 创建任务继续同步使用已确认映射和唯一确定性 `exact_match`；只有需要外部 AI 时，任务与 `purchase_spec_match_work_item` 在同一事务创建，接口立即返回。活动工作项或 `manual_required` 未处理前，`Next`、`Claim`、`Start` 均拒绝任务。
-- AI 结果只固化到采购任务快照，不自动写回虾皮商品长期规格映射。`ai_match` 必须达到设置阈值、严格属于当前候选、原因非空且写入前输入指纹未变化；否则转人工，Agent 不猜测。
-- provider 网络、超时或 5xx 按 30 秒、2 分钟、10 分钟退避，最多尝试 3 次；预算内恢复会自动继续，耗尽后转 `manual_required`。Admin 可重新入队或从当前候选人工选择。
-- 异步 provider 单次调用最长 60 秒，即 `min(配置超时, 60 秒)`；设置页测试连接仍使用完整配置超时。取消任务会同时终结活动工作项，输入变化会关闭旧工作项并要求重新入队。
+- #215 起，新建 SYB 采购任务不再根据 PDD 档案创建 `purchase_spec_match_work_item`，也不在首次派发前调用外部 AI；规格决策统一来自首趟真机探测的当次候选。
+- 部署前已存在的匹配工作项继续保留审计、恢复、重试和人工处理能力；其 AI 封闭候选、置信度、输入指纹、退避和最长 60 秒调用边界不变，但不能成为新任务跳过当次探测的依据。
+
+## SYB 采购强制当次规格探测（#215）
+
+- 每个新 SYB 采购任务固定执行“首趟只读探测 → 服务端确定性优先/必要时 AI → 固化任务级精确规格 → 第二趟正式采购”。首趟只打开一次浏览器商品链接；匹配期间当前设备保留给同一任务，不领取其他采购或采集任务。连续进入第二趟且当前仍有 PDD 商品页或规格面板强证据时复用当前页、不再次打开链接；手动同任务重试，或当前处于 Agent、其他应用及缺少上述强证据时，重新打开任务固化的商品 URL。复用或重开均不严格核验标题、goodsId 或页面指纹，但仍要求 PDD 包名与商品/规格/订单页面结构安全证据。已有长期映射只作商品档案事实，不直接进入任务执行规格。
+- 首趟候选与 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和幂等结果哈希关联；第二趟失败不得回到首趟循环探测。备货 `stock/direct_select` 没有 SYB 目标规格，继续使用用户逐字选择的档案规格，不进入本规则。
+- 候选和 Provider 结果仅保存颜色、尺码原始标签及结构化决策，不保存控件树、整屏截图、账号、地址、订单或支付数据；付款仍永久禁止。
 
 ## Agent 手动采集替代商品（#130）
 
@@ -386,6 +400,13 @@ synchronized_at: 2026-09-03T01:55:28Z
 - Agent APK 版本由管理员在设备页抽屉中上传、核对并显式设为当前。服务端从 APK Manifest 读取整数 `versionCode` 和 `versionName`，保存 SHA-256、大小、说明和创建人；APK 位于非公开目录，Admin 与设备下载均需认证。
 - Agent 只以整数 `versionCode` 判断更新。启动时静默检查一次，设置页可手动检查、显示下载进度并取消；下载完成必须校验大小和 SHA-256。设备有活动任务时禁止检查、下载和安装；安装始终交给 Android 系统确认，项目不绕过未知来源权限。
 
+## Android 采购规格动作安全执行（#214）
+
+- 规格入口与精确规格选择统一按“重新定位唯一目标 → 执行一次无障碍点击 → 读取新页面验证”执行；不得复用旧无障碍节点，不选择相近规格，也不在多候选时默认点击第一个。
+- 无障碍点击后页面完全无变化时，只允许对解析器已确认的安全规格入口或服务端下发且唯一命中的精确规格执行一次中心手势兜底。目标必须可见、启用、边界有效，手势后仍须以规格面板强证据或精确选中证据确认结果。
+- 页面发生变化但规格面板强证据不足时，不再继续手势或猜测页面，明确失败并只记录面板类型、候选数量和证据布尔值等无敏感标量。原始控件树、节点文字集合和整屏截图仍不得保存或上传。
+- 规格已处于精确选中状态时不得重复点击。规格查找只在解析器唯一识别的规格面板容器内有限滚动，每次滚动后重新定位容器与目标；容器缺失、歧义、到边或验证失败均 fail-closed。
+- 中心手势兜底不得用于修改/保存地址、创建或提交订单、订单详情入口以及任何支付/付款目标；正式创建订单的一次性不可逆门禁与永久禁止支付规则不变。
 ## PDD 商品反向关联与继续订单采购（#161）
 
 - 一个 PDD 商品可被多个虾皮商品共用。PDD 详情返回全部关联虾皮商品摘要；订单行由独立统一分页接口读取，不按虾皮商品伪造嵌套分页。
@@ -409,3 +430,55 @@ synchronized_at: 2026-09-03T01:55:28Z
 - AI 只在关联蝦皮商品的封闭候选集合中返回原始颜色/尺码，并必须提供达到当前自动确认阈值的置信度和非空理由；集合外值、缺失角色、低置信度、歧义、无结果和输入漂移都不得确认。
 - `parse_status` 保留确定性解析器结论；AI 与人工确认分别记录，人工优先级最高。重复同步不得覆盖人工值；完全相同输入保留 AI 值，来源或关联变化会清除旧 AI 确认。
 - 同一输入的低置信度或无结果不重复调用 Provider；临时故障至少 60 分钟后重试，最多 3 次。任务不创建采集/采购任务、订单，不执行 Android 动作或付款。
+
+## 设备身份恢复
+
+- 管理员可在设备管理对未停用设备发起“重置设备身份”。此动作不删除设备记录、不改变设备 ID、能力或已绑定的待领取任务；它立即使旧 Token 无效，并只生成一次、有效期 10 分钟的恢复码。
+- 恢复码仅显示给发起操作的管理员一次，服务端只保存摘要；不得进入列表、日志、任务记录、Android 持久化或普通接口。手机操作员必须在同一安装实例的 Agent 设置中手动输入。
+- 服务端只接受同一 `installId`、未过期且尚未使用的恢复码完成重新注册，成功后签发新 Token 并使恢复码失效。过期、重复使用、installId 不符或停用均明确失败；不能通过清空数据、直接改库或“吊销 Token”恢复原任务归属。
+
+- 自 #223 起，任务创建时把与冻结 SYB 目标对应的已确认商品规格映射保存为不可变的探测指导快照，但仍不得跳过首趟真机探测。探测完成后，每个角色先验证快照映射能否按既有规范化规则唯一对应当次候选，能对应时固化当次候选原文；不能对应时只对该未解决角色执行确定性匹配，仍无结果才调用 AI。已解决角色不重复交给 AI，任一最终值仍必须逐字属于当次候选；历史映射失效、规范化后歧义或角色不符时不得复用。候选完整但无法决策时提示“已采集到当前规格，但未能确定颜色或尺码映射”，不再误报候选不存在。
+
+## 采购商品深链入口（#232）
+
+- Android 采购新任务（含探测与人工重试）打开商品时，优先使用指定 PDD 包名的 ACTION_VIEW，并设置 NEW_TASK 与 CLEAR_TASK，以清理旧任务栈后交付该任务链接。清理的是 Activity 返回历史，不是清除应用数据或强制停止进程。
+- 直接启动失败（包括无可处理 Activity）时回退既有浏览器入口；启动请求被接受后仍由执行器验证稳定商品页面，停留首页不会仅因启动成功而判定完成。
+- 清栈不用于改地址后返回、下单后回到 PDD、订单核查；采集入口继续使用既有浏览器流程，避免绕过规则中的浏览器步骤。
+- 当前通用商品页面结构验证不能独立证明页面 goods_id；解析结果携带的任务 goodsId 不是页面回读证据。首次直接深链上线仍需以实际目标商品真机核对，ADB 实验不替代 Agent 上下文验证。
+## SYB 批量采购设备偏好（#233）
+
+- SYB 商品页“批量创建采购任务”按当前登录用户 ID、当前浏览器来源与 API 环境记住最近一次设备选择；主动清空也记忆为不指定设备。只保存设备 ID，不保存 Token、账号凭据或订单信息。
+- 弹窗打开后先按现有在线/可选/采购能力条件加载设备，再恢复选择并以相同设备预检。记忆设备当前不可用时保留偏好并提示用户重新选择或明确清空，不静默切换设备或自动领取。
+- 预检加载中、失败或记忆设备不可用时不能提交；过期预检结果不覆盖新的设备选择。服务端原有设备及采购资格校验不变。
+- 偏好只作用于此入口，不影响采集、其他创建入口和采购重试。浏览器存储失败时仍允许手动操作；刷新或关闭再打开浏览器可恢复，清理浏览器数据或沿用现有退出登录清理存储行为后需重新选择。
+
+## 客户端密钥与可编辑模块授权（#237）
+
+以下为提交 `71f7751` 已实现的规则；2026-09-07 本机已迁移并验证管理页面可用，2026-09-08 已随 d403f3b 完成线上迁移与部署，真实客户端密钥执行闭环尚未验证。
+
+- 仅管理员创建、查看、编辑授权或停用密钥。首版不提供密钥改名、到期、轮换、恢复启用、删除或任意接口授权。
+- 模块选择复用“采集采购/采采管理”现有 12 个业务模块；分组勾选只影响当前子模块，新菜单不会自动获得授权。客户端密钥管理、系统账号权限及支付不在可授权模块中。
+- 勾选模块默认只读，至少保留一个模块。读写仅开放清单中的普通写操作；同步、采集、采购、删除、导入、重解析、匹配、回写及切换当前采购规则分别独立授权，默认关闭。没有普通写接口的模块不允许勾选读写。
+- 编辑既有密钥不会更换密钥，名称和前缀只读；移除模块同时移除其动作。取消保留原授权；失败保留输入；版本冲突要求刷新重开。停用不可编辑或恢复。
+- 保存后新请求按最新授权校验，已经通过校验的在途请求可能完成，不追溯回滚。模块授权不是行级、店铺级或租户隔离，授予读取即允许读取该模块明确接口可返回的业务范围。
+- 用户于 2026-09-07 明确接受明文风险：密钥管理及客户端接口默认兼容 HTTP/HTTPS，无需开关。HTTP 会明文传输密钥与业务数据，建议优先使用 HTTPS；兼容不改变管理员身份与模块授权边界。
+- 客户端与 Admin 登录 JWT、Agent Device Token 独立。响应排除凭据及原始载荷字段；AI 设置只返回 enabled，不开放 Provider 配置读写或连接测试。设备仅开放列表，不开放身份重置、令牌或解锁接口。
+- 执行动作复用既有业务门禁、幂等参数及状态机；客户端采购 batch-retry 沿用 Admin 原有语义，不等同于 Agent 就地 reset。授权重采购、支付复核、取消订单等未列入接口不开放；永久禁止付款。
+- 创建响应丢失时不可找回完整密钥，应核对列表并停用可能已创建的记录，再明确创建新密钥，不能盲目自动重试。完整密钥只在创建结果弹窗内存中显示，关闭或离开页面清空，不写浏览器持久存储。
+
+## 打开采购规格面板后按需滚动（#238）
+
+- Android 0.9.60 / versionCode 73，代码 `58a6c1c` 起，规则 `openSpecPanel.swipeAfter` 保留格式校验与旧快照兼容，但不执行打开面板后的固定次数预滑动；不以“必须滑两次成功”作为进入规格探测/选择的条件。动作后的 `waitAfterMs` 仍生效。
+- 首趟规格探测和第二趟精确选择仍使用各自既有的按需横向/纵向、有界与稳定终止策略。取消预滑动不等于不探测隐藏规格，也不等于只看首屏。目标不存在、歧义、页面证据不足或必要的有界查找失败时仍明确失败。
+- 此调整覆盖所有已经安全识别打开的面板，不再仅特判 NON_SCROLLABLE_CONFIRMATION；不弱化面板验证、精确选中、地址、价格、任务租约、创建订单边界或禁止支付规则。
+- 其他动作的后置滑动沿用原行为，必需滑动失败仍返回 RULE_ACTION_FAILED。旧规则 JSON 不回写、不迁移；原任务 ID、历史 attempt、商品与规格快照不变。旧 APK 行为不变，需升级 Agent；本单未改线上规则或执行 CG68 真机采购。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；2026-09-08 已随 d403f3b 部署线上，未手动触发真实同步验收；#240 上游尾页超时尚未修复。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。

docs/04-local-development-and-verification.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Local-Development-and-Verification
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Local-Development-and-Verification.-
-wiki_revision: 0bb8d63fe2a3c6b1021bfa18800f5062de726868
-synchronized_at: 2026-08-31T16:06:55Z
+wiki_revision: 835494c4a63a1494601658561fde1ab76657be3d
+synchronized_at: 2026-09-05T07:17:05Z
 <!-- gitea-wiki-mirror:end -->
 
 # 本地开发与验证
@@ -24,6 +24,32 @@ T01 已建立可执行的三端骨架。建议从仓库根目录运行统一脚
 - 不得仅为设置编码重复启动一层 PowerShell；嵌套进程会增加启动时间、转义复杂度和错误定位成本。
 - 代码发现优先使用项目配置的代码图工具；检索字符串、配置和非代码文件，或图工具不足时使用 `rg`。
 
+### PowerShell 语法与外部命令
+
+- Windows 命令不得默认套用 Bash 语法；复杂正则优先先赋给变量或使用 `rg -e`，避免在多层引号中继续嵌套。
+- 多行 Python 或 JSON 正文使用单引号 PowerShell here-string，避免 `$()`、反引号和变量被 PowerShell 提前展开：
+
+```powershell
+$script = @'
+print("保持原文")
+'@
+$script | python -
+```
+
+- `foreach`、`if` 等语句块应保留在同一个 PowerShell 解析上下文中；需要收集表达式结果时使用数组表达式：
+
+```powershell
+$items = @(foreach ($path in $paths) {
+    if (Test-Path -LiteralPath $path) { Get-Item -LiteralPath $path }
+})
+```
+
+- `rg` 使用真实目录配合 `-g/--glob`，不要把 Bash 风格通配路径作为目录参数：
+
+```powershell
+rg -n -g '*.md' 'sync --check' docs
+```
+
 ### 文件编码与控制台输出
 
 文件解码和控制台输出是两个边界。读取 UTF-8 文本时，在命令支持的情况下显式指定字面路径与编码：

docs/05-common-changes.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Common-Changes
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Common-Changes.-
-wiki_revision: b7d5520da954c544248e979c4ababb86d2784a43
-synchronized_at: 2026-08-27T09:38:36Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:12Z
 <!-- gitea-wiki-mirror:end -->
 
 # 常见修改指南

docs/06-troubleshooting.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Troubleshooting
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Troubleshooting
-wiki_revision: a8d4790811aa825c78830cb9c71c6b21723e4584
-synchronized_at: 2026-08-28T03:35:05Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:16Z
 <!-- gitea-wiki-mirror:end -->
 
 # 故障排查

docs/07-mvp-requirements.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Product-Requirements-Overview
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Product-Requirements-Overview.-
-wiki_revision: 0d9924b4566e567edf167ba678fedde28a41cfd3
-synchronized_at: 2026-08-28T02:27:12Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:20Z
 <!-- gitea-wiki-mirror:end -->
 
 # 产品需求总览与当前 MVP

docs/08-agent-api-contract.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Android-Agent-API-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Android-Agent-API-Contract.-
-wiki_revision: c214791a0b055e5b56c0ad05e73829a1f141dd46
-synchronized_at: 2026-09-01T08:03:51Z
+wiki_revision: 1f5ee1b29c66773fa571d862241b63f02dae283b
+synchronized_at: 2026-09-08T07:09:23Z
 <!-- gitea-wiki-mirror:end -->
 
 # MVP 共享 API 契约
@@ -75,9 +75,9 @@ POST /api/admin/v1/syb-products/reparse-batch
 PATCH /api/admin/v1/syb-products/{productId}/correction
 ```
 
-`import` 仅允许管理员调用。请求体提交 `dateFrom`、`dateTo` 后创建持久化后台任务并立即以 `202` 返回 `runId` 和 `status=running`；关闭弹窗、刷新或离开页面不影响任务。没有启用店铺时必须在读取凭据、登录、验证码 OCR 和任意 SYB 网络请求之前返回 `422`。任意时刻只能有一条 `running` 记录，内存锁与数据库唯一执行槽共同阻止单进程和跨进程重复导入；冲突时返回正在执行任务的日期范围。
+`import` 允许已认证的管理员（admin）和采购员（purchaser）调用（#236），仍须通过 Casbin 权限校验；其他角色返回 403。采购员的 POST 权限由既有启动权限对账写入，不需要新增数据库迁移。操作人取已认证 claims，不接受客户端冒名。请求体提交 `dateFrom`、`dateTo` 后创建持久化后台任务并立即以 `202` 返回 `runId` 和 `status=running`；关闭弹窗、刷新或离开页面不影响任务。没有启用店铺时必须在读取凭据、登录、验证码 OCR 和任意 SYB 网络请求之前返回 `422`。任意时刻只能有一条 `running` 记录，内存锁与数据库唯一执行槽共同阻止单进程和跨进程重复导入；冲突时返回正在执行任务的日期范围。
 
-`sync-runs` 列表支持 `page`、`pageSize`、`status`、`dateFrom`、`dateTo`，详情返回日期范围、状态（`running` / `succeeded` / `failed` / `interrupted`）、处理天数、货运单/明细/新增/覆盖数量、店铺准入与跳过数量、店铺筛选快照哈希、按店铺的 `accepted` / `skipped` 统计、操作人和起止时间。列表和详情对已登录角色只读开放。服务启动时遗留的 `running` 任务改为 `interrupted`；中途失败或中断已经写入的数据保留，重新导入仍按唯一键覆盖。
+`sync-runs` 列表支持 `page`、`pageSize`、`status`、`dateFrom`、`dateTo`，详情返回日期范围、状态（`running` / `succeeded` / `partial_success` / `failed` / `interrupted`）、处理天数、货运单/明细/新增/覆盖数量、店铺准入与跳过数量、店铺筛选快照哈希、按店铺的 `accepted` / `skipped` 统计、操作人和起止时间。列表和详情对已登录角色只读开放。服务启动时遗留的 `running` 任务改为 `interrupted`；中途失败或中断已经写入的数据保留，重新导入仍按唯一键覆盖。
 
 列表返回结构化字段（`orderCode`、`shopeeItemId`、`productTitle`、`targetColor`、`targetSize`、`quantity`、`unitPriceCent`、`imageUrl`、`parseStatus`、`parseNote`、`manuallyConfirmed`），不含原始 JSON；`keyword` 匹配订单号、虾皮商品ID 或商品标题，`parseStatus` 筛选 `success`/`uncertain`/`failed`。详情额外返回 `rawJson`（原始 `details[]` 元素，未做任何改写）。
 
@@ -405,7 +405,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 
 - `executionMode` 只能是 `rehearsal` 或 `live`，创建后不可修改。
 - 正式 `live` 任务必须引用一条 `syb_product`；无副作用的 `rehearsal` 可以不引用 SYB。
-- 创建时固化 SYB、蝦皮订单号、虾皮商品、PDD 商品、目标规格、映射规格、数量、价格区间、币种、URL、`goods_id`、规则和可选 PDD 账号引用。正式任务的 `shopeeOrderNoSnapshot` 来自创建时的 `syb_product.order_code`；同一订单号可对应多条任务，之后来源商品修改不会改写任务快照。
+- 创建时固化 SYB、蝦皮订单号、虾皮商品、PDD 商品、目标规格、数量、价格区间、币种、URL、`goods_id`、规则和可选 PDD 账号引用。新建 SYB 任务的执行映射初始为空，首趟当次 PDD 规格探测决策成功后才固化 `mappedColor` / `mappedSize`；正式任务的 `shopeeOrderNoSnapshot` 来自创建时的 `syb_product.order_code`，之后来源商品修改不会改写任务快照。
 - Android 无法可靠读取当前 PDD 账号，因此 `pddAccountId` 和 `pddAccountRefSnapshot` 均可空。已知账号时参与账号级串行，未知时不阻止任务。
 - 地址后缀由任务 ID 唯一确定为 `_cg{taskId}`；#34 创建任务时必须在同一事务内回写快照。
 - 一个任务最多对应一个 PDD 订单；重新采购必须新建任务，旧任务和旧订单保留。
@@ -415,7 +415,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 | 状态 | 含义 | 是否占用 SYB 活动槽 |
 |---|---|---|
 | `pending` | 待执行 | 是 |
-| `spec_probe_pending` | 第一趟探测结束，待服务端固化规格并重新派发 | 是 |
+| `spec_probe_pending` | 第一趟探测结束，服务端规格匹配中；当前设备保留同任务连续流程且不得领取其他任务 | 是 |
 | `running` | Agent 执行中 | 是 |
 | `rehearsal_completed` | 演练安全结束，未改地址、未创建订单 | 否 |
 | `order_submit_started` | 不可逆标记已落库，只能核单，禁止再次点击 | 是 |
@@ -472,7 +472,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 |---|---:|---:|---:|---:|
 | `openProduct` | 是 | 是 | 是 | 否 |
 | `verifyProduct` | 是 | 是 | 否 | 否 |
-| `openSpecPanel` | 是 | 是 | 是 | 否 |
+| `openSpecPanel` | 是 | 是 | 兼容读取、不执行（0.9.60+，见 #238） | 否 |
 | `selectSpec` | 是 | 是 | 是 | 否 |
 | `setQuantity` | 是 | 是 | 否 | 否 |
 | `verifyUnitPrice` | 是 | 是 | 否 | 否 |
@@ -486,13 +486,23 @@ POST /api/agent/v1/tasks/{taskId}/fail
 - 文字候选按控件文字或内容描述**精确匹配**；候选合并后必须唯一命中。点击动作只允许点击唯一文字节点或其最近的可点击父容器，不允许模糊匹配、猜测相近候选、改点兄弟节点。
 - 动作 `textAliases` 不能包含地址修改、创建/提交订单、订单号或支付相关文字，防止用安全 action 绕过危险动作类型和能力门禁。只读识别字段使用独立校验：允许订单和支付证据，仍拒绝修改地址、收货地址，并沿用各字段声明的数量、长度、去重和空白限制。
 - `waitAfterMs` 表示动作成功后的等待时间，范围为 0～30000 毫秒；省略时为 0。
-- `swipeAfter` 表示动作成功后执行一个有限滑动计划。`direction` 只能为 `up` / `down` / `left` / `right`，`count` 为 1～10，`durationMs` 为 100～2000，`intervalMs` 为 0～5000 且省略时为 0。
+- `swipeAfter` 通常表示动作成功后执行一个有限滑动计划；Android 0.9.60+ 的 `openSpecPanel` 例外，只兼容读取而不执行预滑动（见 #238）。`direction` 只能为 `up` / `down` / `left` / `right`，`count` 为 1～10，`durationMs` 为 100～2000，`intervalMs` 为 0～5000 且省略时为 0。
 - 未在矩阵中授权的 action/参数组合、未知字段、空候选和越界值一律拒绝。`updateShippingAddress`、`createOrder`、`readOrderResult` 等正式动作在其独立高风险契约完成前不接受上述参数。
 - 旧的仅含 `actions[].type` 的规则继续有效：候选使用 Agent 内置语义，等待为 0，不执行动作后滑动。
 - 服务端保存创建任务时收到的完整原始规则快照；规则后来更新为规则 B，不会改变已有任务中的规则 A 快照。
 
 演练规则必须包含 `purchase.rehearsal.v1`，并且不能包含 `updateShippingAddress`、`createOrder`、`readOrderResult`。正式规则必须包含 `purchase.live.v1`；改地址和创建订单还分别要求 `purchase.address-update.v1`、`purchase.order-create.v1`。`probeSpecs` 要求 `purchase.spec-probe.v1`。任意模式下，尚未实现的 `pay`、名称包含 `payment` 的动作以及未知动作一律拒绝；服务端不下发任意脚本。
 
+### Android 规格动作执行边界（#214）
+
+本工单不改变采购规则 schema、Agent HTTP 字段或能力标识，只收紧 Android 对 `openSpecPanel` 与 `selectSpec` 的执行语义：
+
+- 每次操作从最新 `rootInActiveWindow` 重新定位；规格入口必须是解析器已接受的唯一安全候选，规格值必须逐字等于任务固化的服务端映射值且在当前维度唯一、可用。
+- 动作前先检查后置条件；规格已精确选中时直接成功，不重复点击。否则最多分发一次 `ACTION_CLICK`，再从新快照验证规格面板强证据或精确选中证据。
+- `ACTION_CLICK` 后页面结构完全无变化时，Android 可以重新定位同一唯一目标，并在目标可见、启用、中心点位于屏幕内且边界有效时执行一次中心手势。手势后仍未取得后置证据时明确失败，不继续点击。
+- 点击后页面已变化但面板分类仍为未知时返回 `PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED`；两种点击后页面均无变化时返回 `PURCHASE_SPEC_ENTRY_CLICK_NO_EFFECT`。诊断只携带面板类型、滚动容器数、标题数、选项数及证据布尔值，不携带节点文字或完整控件树。
+- 有界查找规格时只使用当前解析结果中的唯一 `specPanelContainer`；每次滚动前重新定位该容器，优先使用节点滚动动作，失败后才在容器边界内使用手势。缺少唯一容器时停止，不回退到全页面最大滚动区域。
+- 受控中心手势接口固定拒绝地址、保存地址、创建/提交/确认订单、确认购买和支付/付款语义；`updateShippingAddress`、`createOrder`、`readOrderResult` 不使用该兜底。创建订单的一次性不可逆状态机与禁止支付契约不变。
 ### 管理端接口
 
 | 方法 | 路径 | 幂等键 / 说明 |
@@ -501,7 +511,7 @@ POST /api/agent/v1/tasks/{taskId}/fail
 | `GET` | `/api/admin/v1/purchase-tasks/{taskId}` | 只读任务详情与 attempt 历史；不返回规则原文、Token、凭据、完整地址、控件树或截图 |
 | `POST` | `/api/admin/v1/purchase-tasks` | `requestId`；单条创建 |
 | `POST` | `/api/admin/v1/purchase-tasks/stock` | 创建备货采购；`requestId`、`executionMode`、`pddProductId`、可选 `deviceId` / `pddAccountId`、`color`、可选 `size`、`quantity`、`minUnitPriceCent`、`maxUnitPriceCent`。服务端使用内置规则并从所选颜色归档派生参考价；相同 `requestId` 幂等返回原任务 |
-| `POST` | `/api/admin/v1/purchase-tasks/batch-preview` | `sybProductIds`（1～100）和可选 `deviceId`；逐条返回采购是否可创建、价格区间、原因和下一步，并独立返回 PDD 采集资格 `collectionEligible` / `collectionDisabledReason` 与规格匹配资格 `aiMatchEligible` / `aiMatchDisabledReason`，不创建任务。只有目标颜色和尺码已保存为确认映射，且共同命中最近一次成功或部分成功采集中的完整可售 SKU 组合时，`eligible` 才为 `true`；只在内存中得到的确定性结果不算采购就绪 |
+| `POST` | `/api/admin/v1/purchase-tasks/batch-preview` | `sybProductIds`（1～100）和可选 `deviceId`；逐条返回采购是否可创建、价格区间、原因和下一步，并独立返回 PDD 采集资格 `collectionEligible` / `collectionDisabledReason` 与长期规格匹配资格 `aiMatchEligible` / `aiMatchDisabledReason`，不创建任务且不调用 AI Provider。自 #215 起，长期映射缺失或失效不再单独使 `eligible=false`；新任务会在首趟当次 PDD 页面探测中决定执行规格 |
 | `POST` | `/api/admin/v1/purchase-tasks/batch-spec-match` | `sybProductIds`（1～100）；仅处理服务端预检 `aiMatchEligible=true` 的明细，其他明细按具体禁用原因返回 `skipped`，并逐条返回 `auto_confirmed` / `pending` / `failed` / `skipped`。资格要求 SYB 采购规格解析成功、蝦皮与 PDD 关联完整、PDD 当前规格可用，且最近一次成功或部分成功采集存在完整可售 SKU 组合证据；未人工确认的 `parse_status=uncertain` 不进入自动确认，`manuallyConfirmed=true` 与 `parse_status=success` 同等视为可信规格。唯一确定性 `exact_match` 不调用 Provider，直接通过独立路径保存为 `confirmed`；其余结果只有 `ai_match` 置信度达到 `autoConfirmMinConfidence`、理由非空、返回值属于当前候选且颜色+尺码命中同一个可售 SKU 组合时才保存为 `confirmed`。低置信度、无效组合和 Provider 异常不改写现有映射 |
 | `POST` | `/api/admin/v1/purchase-tasks/batch` | 批次 `requestId`、`sybProductIds`（1～100）和可选 `deviceId`；每条派生稳定幂等键并独立创建，部分失败不回滚成功项 |
 | `POST` | `/api/admin/v1/purchase-tasks/{taskId}/authorize-repurchase` | 一次性授权；创建新任务后自动消耗 |
@@ -519,17 +529,17 @@ Admin 列表与详情由 #35 实现；#67 增加 `shopeeOrderNoSnapshot` 的列
 
 | 方法 | 路径 | 说明 |
 |---|---|---|
-| `GET` | `/api/agent/v1/purchase-tasks/next` | 返回与设备能力兼容的指定任务或空闲任务 |
+| `GET` | `/api/agent/v1/purchase-tasks/next` | 优先返回当前设备的运行任务；存在 `spec_probe_pending` 时返回同一等待任务以阻止其他任务插队，否则返回能力兼容的指定任务或空闲任务 |
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/claim` | `requestId` 原子领取，并建立设备/可选账号租约 |
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/start` | 创建不可变 `taskAttemptId` |
-| `POST` | `/api/agent/v1/purchase-tasks/{taskId}/order-submit-started` | 创建订单前先落不可逆标记；演练任务永远拒绝 |
+| `POST` | `/api/agent/v1/purchase-tasks/{taskId}/order-submit-started` | 创建订单前先落不可逆标记；演练任务和 `spec_probe` attempt 永远拒绝 |
 | `POST` | `/api/agent/v1/purchase-tasks/{taskId}/result` | 请求体携带 `taskAttemptId` 和 `requestId`；幂等提交演练、规格探测、订单或失败结果 |
 
-创建阶段需要外部 AI 的任务会先以 `pending` 与持久匹配工作项同事务创建并立即返回 Admin。工作项处于 `pending`、`running`、`retry_wait` 或 `manual_required` 时，`next` 不返回该任务，直接调用 `claim` 或 `start` 也会返回状态冲突。匹配完成后 Agent 仍只接收服务端固化的精确 PDD 原始标签；Android 接口和请求体不新增 AI、候选或人工决策字段。
+自 #215 起，新建 SYB 采购任务不再从 PDD 档案创建持久匹配工作项，也不在首次派发前调用外部 AI；部署前已存在的 `purchase_spec_match_work_item` 继续按原状态兼容处理。新任务首次 `start` 固定得到 `phase=spec_probe`，Android 通过浏览器打开任务链接一次并经既有结果字段回传当次候选；匹配成功后的第二次 `start` 才得到 `phase=purchase` 和服务端固化的精确 PDD 原始标签。连续第二阶段仅在当前 PDD 页面仍有商品页或规格面板强证据时复用首趟页面、不再次打开浏览器链接；手动同任务重试，或当前为 Agent、其他应用及缺少上述强证据时，Android 重新打开任务 `urlSnapshot`。两种路径都不以标题、goodsId 或页面指纹做严格同页校验，仍必须通过 PDD 包名和商品/规格/订单页面结构安全证据。Android 不接收 AI 配置或自由决策权限。
 
-结果提交至少关联 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和结构化结果。相同 attempt 的相同结果重复提交返回同一事实；不同内容拒绝覆盖。慢路径第一趟提交规格后释放设备与已知账号租约，任务进入 `spec_probe_pending`；服务端先使用已确认人工映射，否则对实时/档案可选规格做繁简、空白/全半角/大小写及公斤/斤的唯一确定性匹配，仍无唯一结果才调用 AI。第二趟只会收到服务端已固化的精确 PDD 原始标签；Agent 只在已打开的规格面板内做有限纵向滑动，每次重新读取节点并按完整规范化文字精确点击，连续没有新证据或达到上限即停止。尺码的任务目标与页面值在选择边界使用同一安全尾价规范化；不改写任务快照，规范化为空、仍含货币符号或多个原始候选折叠为同一值时安全失败。
+结果提交至少关联 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和结构化结果。相同 attempt 的相同结果重复提交返回同一事实；不同内容拒绝覆盖。每个新 SYB 采购任务的第一趟只读遍历当次 PDD 规格面板并提交颜色、尺码原始候选，随后释放数据库租约和已知账号运行守卫并进入 `spec_probe_pending`，但服务端调度与 Agent 必须把当前设备保留给同一采购流程：`next` 返回该等待任务，Agent 只轮询等待，不领取其他采购或采集任务。服务端只以任务冻结的 SYB 目标和当次候选先做繁简、空白/全半角/大小写及公斤/斤的唯一确定性匹配，仍无唯一结果才调用 AI。AI 的颜色和尺码必须逐字属于当次对应候选，否则按无匹配失败。第二趟只会收到服务端固化的精确 PDD 原始标签；Agent 复用首趟仍打开的页面，只在已打开的规格面板内做有限纵向滑动，每次重新读取节点并按完整规范化文字精确点击，连续没有新证据或达到上限即停止。尺码的任务目标与页面值在选择边界使用同一安全尾价规范化；不改写任务快照，规范化为空、仍含货币符号或多个原始候选折叠为同一值时安全失败。
 
-任务 payload 新增必传布尔字段 `specResolutionAllowed`，它是 Android 是否可以把一次 `PURCHASE_SPEC_TARGET_NOT_VISIBLE` 转为 `spec_probe_completed` 的唯一资格事实。服务端仅在 `taskType=syb_order`、规则声明 `purchase.spec-probe.v1`、没有固化 `SpecDecisionRequestID` 且规格来源允许既有慢路径时返回 `true`；`stock`、`direct_select`、已固化规格决策、能力缺失及其他组合均返回 `false`。普通就地重试保留 `SpecDecisionRequestID`、目标规格、映射规格和规格决策快照，不能恢复探测资格。Android 不得根据映射是否非空、执行 phase、错误文字或本地判断扩大资格。
+任务 payload 的必传布尔字段 `specResolutionAllowed` 是 Android 是否可以提交规格探测的唯一资格事实。新建 `taskType=syb_order` 任务必须由声明 `purchase.spec-probe.v1` 的规则创建，初始 `SpecDecisionRequestID` 为空且 `specSource=unresolved`，首趟返回 `true`；当次决策固化后返回 `false`。`stock`、`direct_select`、已固化规格决策、能力缺失及其他组合均返回 `false`。普通 Agent 重试使用就地 `/reset`，保留 `SpecDecisionRequestID`、目标规格、映射规格和规格决策快照，不能恢复探测资格；映射不完整时必须拒绝，不能进入正式采购阶段。只有替代商品“继续采购”或 Admin 批量重试创建的新任务才按 #215 重新取得一次探测资格。Android 不得根据映射是否非空、错误文字或本地判断扩大资格。
 
 Android 规格失败使用五个稳定阶段：`PURCHASE_SPEC_TARGET_NOT_VISIBLE`、`PURCHASE_SPEC_TARGET_AMBIGUOUS`、`PURCHASE_SPEC_SAFE_TARGET_MISSING`、`PURCHASE_SPEC_CLICK_FAILED` 和 `PURCHASE_SPEC_SELECTION_UNCONFIRMED`。`PURCHASE_SPEC_CLICK_FAILED` 的 `errorMessage` 只允许稳定子原因 `root_unavailable`、`target_stale`、`no_clickable_ancestor`、`action_click_false` 或 `unknown`；其他阶段的消息不得包含规格原文、坐标、控件树或截图。只有 `PURCHASE_SPEC_TARGET_NOT_VISIBLE && specResolutionAllowed=true` 可以提交规格探测，其他四态直接提交真实失败，服务端原样保留稳定阶段/子原因。旧 Agent 在资格已用尽后再次提交 `spec_probe_completed` 时，服务端以 `PURCHASE_SPEC_REPROBE_REJECTED` fail-closed，释放租约并保留第一次规格决策，不再冒充新的选择根因或再次派发。无匹配、候选不完整、歧义或 Provider 异常同样使任务失败。`order_result_unknown` 只允许管理员或采购员人工解除，永不自动重派。
 
@@ -546,7 +556,9 @@ Android #42/#36 使用本地 SQLite 保存恢复与重传所需的任务、attem
 创建订单前先在本地事务保存 `order_submit_started`、不可逆时间、稳定的 `orderSubmitRequestId` 和脱敏最终确认快照，再调用服务端同名接口；只有两侧标记完成并重新校验商品、规格、数量、单价、地址后缀、PDD 包/Activity 与唯一创建订单按钮后，才点击一次。重启时重放同一标记请求并只读核单；无法取得唯一未付款订单号和 PDD 下单时间时提交 `order_result_unknown`。支付文字仅用于识别未付款/离开支付页，永不点击。服务端数据库仍是最终事实来源；双方均不保存原始控件树、截图、PDD 凭据或完整收货地址。
 
 创建订单后若出现 Android 多微信应用选择器，只读核单器必须同时确认前台包为 `android` / `com.android.intentresolver`、Activity 为白名单 `ChooserActivity` / `ResolverActivity`、页面出现已知系统选择器标题且至少一个候选以“微信”开头，才允许执行一次系统返回；不得点击任何微信候选。若前台已经是精确微信包 `com.tencent.mm`，只读核单器不得点击、输入、登录、支付或强制停止微信，只允许执行一次无参数 PDD 启动 Intent 并等待既有 PDD 任务栈回到前台；`startActivity()` 成功只表示恢复请求已发起。请求后在固定最多 15 次、每次 200ms 的宽限期内允许微信或空窗口短暂残留，不执行点击、返回、输入或滑动；观察到 PDD 后结束宽限，宽限超时、已经观察到 PDD 后再次进入微信或出现稳定未知应用时返回未知结果。随后若前台为 PDD `com.xunmeng.pinduoduo.app_pay.core.PayActivity` 或当前页面出现支付动作文字，最多再返回一次。返回后只读解析唯一订单号和下单时间；选择器或支付页重复出现、白名单不成立、恢复动作重复、无法到达订单详情、结果不唯一或超时均返回未知结果，禁止再次点击创建订单、取消订单或支付。
-`order_result_unknown` 保持订单号和下单时间为空，但允许携带创建订单前已经严格验证的 `actualUnitPriceCent`。Agent 同时提交脱敏稳定失败阶段，服务端只接受白名单并按错误码写入固定提示，不信任或保存页面原文；阶段覆盖空窗口超时、选择器返回失败、微信恢复失败/超时、未知应用、支付页返回失败/重复、订单上下文缺失、订单号缺失/歧义、下单时间缺失/无效和待付款证据缺失。任务与 attempt 保存同一错误阶段，Admin 和 Agent 历史读取数据库最终事实；旧 Agent 未提交阶段时归一为 `PURCHASE_ORDER_RESULT_UNKNOWN`。
+Agent 主动提交 `order_result_unknown` 时保持订单号和下单时间为空，但允许携带创建订单前已经严格验证的 `actualUnitPriceCent`。Agent 同时提交脱敏稳定失败阶段，服务端只接受白名单并按错误码写入固定提示，不信任或保存页面原文；阶段覆盖空窗口超时、选择器返回失败、微信恢复失败/超时、未知应用、支付页返回失败/重复、订单上下文缺失、订单号缺失/歧义、下单时间缺失/无效和待付款证据缺失。任务与 attempt 保存同一错误阶段，Admin 和 Agent 历史读取数据库最终事实；旧 Agent 未提交阶段时归一为 `PURCHASE_ORDER_RESULT_UNKNOWN`。
+
+#241 追加：全局订单号唯一性校验在人工处理结果未知、取消及 lifecycle 保存路径返回 `PURCHASE_ORDER_NUMBER_ALREADY_USED`（HTTP 409、`retryable=false`），提示“订单号已属于任务 CG-任务ID”；批量回填继续使用原有 `PURCHASE_BACKFILL_ORDER_ALREADY_USED`。不可逆边界后的 `order_created` 结果回传为例外：发现该号已属于其他任务时成功受理结果，将 `order_submit_started` 降级为 `order_result_unknown`，不回滚或自动重派。冲突订单号不写入 `pdd_order_no`，而以“读到订单号 X，但该号已属于任务 CG-yy”保存到任务和 attempt 的 `error_message`，两者 `error_code` 均为 `PURCHASE_ORDER_NUMBER_ALREADY_USED`；保留下单时间、不可逆时间及实际单价。attempt 以 failed 结束并保留原始 `order_created` 结果类型、请求 ID 和摘要，重复提交按原幂等协议返回；任务释放租约和运行槽，进入既有人工处理结果未知通道，权限不变。
 
 | 错误码 | 普通提示 |
 |---|---|
@@ -607,12 +619,12 @@ Content-Type: application/json
 - 响应返回 `taskId`、`attemptNumber`、`status` 和可选的 `replayed`，不返回规则快照、URL、Token、控件树或截图。
 - 设备离线、任务非终态、设备忙、规则不可用或同商品存在活动任务时返回明确冲突，不支持离线排队。
 
-## Agent 受控采购重试（#95、#157）
+## Agent 受控采购重试（#95、#157、#217、#225）
 
-普通失败任务的“重试采购”改为就地重跑：
+替代商品匹配完成后的“继续采购”调用新任务接口；普通失败任务的“重试采购”使用下方同任务重置接口：
 
 ```http
-POST /api/agent/v1/purchase-tasks/{taskId}/reset
+POST /api/agent/v1/purchase-tasks/{taskId}/retry
 Authorization: Bearer <device-token>
 Content-Type: application/json
 
@@ -624,37 +636,35 @@ Content-Type: application/json
 ```json
 {
   "data": {
-    "taskId": 12,
-    "taskNo": "CG-12",
-    "attemptNumber": 2,
-    "status": "pending",
+    "sourceTaskId": 12,
+    "sourceTaskNo": "CG-12",
+    "taskId": 13,
+    "taskNo": "CG-13",
     "replayed": false
   }
 }
 ```
 
-- 原任务必须属于当前 Device Token、在最近 30 天内、状态为 `failed`，且是分配给该设备的正式 SYB 采购任务；跨设备或超期按任务不存在处理。
-- 任务不得存在 `irreversibleAt`、`orderSubmitRequestId`、PDD 订单号或下单时间。已有任何不可逆证据时返回 `PURCHASE_RETRY_UNSAFE`，提示走“授权重新采购”，不得恢复为待执行。
-- 服务端在同一事务锁定任务和设备，确认同一 SYB 商品没有更新任务、设备在线且空闲，然后读取当前服务端采购规则，重新校验 schema、动作安全边界与设备能力。
-- 成功时复用原 `purchase_task.id`，只刷新 `ruleSnapshot`、`ruleType`、`ruleSchemaVersion`、`requiredCapabilities`，清除错误、租约和运行守卫并恢复 `pending`。商品、Target、Mapped、价格保护、数量、地址后缀及其他业务快照逐字段保持不变。
-- 每次受理创建该任务的新 `pending` attempt 并记录规则哈希；Start 复用该 attempt 转为 `running`，不会重复创建执行记录。相同 `requestId` 重放返回相同 attempt 且 `replayed=true`；不同请求可在任务再次失败后继续重试，不限制次数。
-- 采购详情新增 `attemptCount`、可选 `lastFailureCode` 和 `lastFailureMessage`，供 Agent 显示已尝试次数与上次失败原因；不返回规则快照、Token、地址、控件树或截图。
-- Android 仍只在服务端 `retryable=true` 且状态为 `failed` 时显示普通“重试采购”。确认文案必须说明任务号不变、使用最新规则重跑、可能产生待付款订单且系统不会支付。
-- 规则无效、设备离线/忙、能力不匹配、任务状态变化或同一 SYB 商品已有更新任务时，服务端明确拒绝且不得部分修改任务。
+- 来源任务必须属于当前 Device Token、在最近 30 天内、状态为 `failed`，且是分配给该设备的正式 SYB 采购任务；跨设备或超期按任务不存在处理。
+- 来源任务不得存在 `irreversibleAt`、`orderSubmitRequestId`、PDD 订单号或下单时间。已有任何不可逆证据时返回 `PURCHASE_RETRY_UNSAFE`，提示走“授权重新采购”，不得创建新任务。
+- `AgentRetry → BatchRetry → Create` 保留来源失败任务并创建不同 `purchase_task.id` 的新任务；新任务重新读取当前 SYB、虾皮/PDD 档案、当前采购规则、价格保护和设备能力，重新生成地址后缀，不继承来源任务的旧规格决策。
+- 新 SYB 任务按 #215 固定从 `spec_probe` 开始。相同 `requestId` 重放返回同一新任务且 `replayed=true`；不同 requestId 再次请求受同一 SYB 商品最新任务和设备并发门禁约束。
+- 本新任务接口只供替代商品“继续采购”；确认和成功反馈必须说明保留来源任务、按当前替代商品档案创建新任务、可能产生待付款订单且系统不会支付。
+- 规则无效、当前档案或价格不合格、设备离线/忙、能力不匹配、任务状态变化或同一 SYB 商品已有更新任务时，服务端明确拒绝且不得部分创建。
+- Admin 批量重试继续使用相同的新任务语义；替代商品“继续采购”仍在 AgentRetry 前额外验证替换分项与继续采购资格。
 
-既有新建任务接口保留原语义：
+普通失败任务的“重试采购”调用同任务重置接口：
 
 ```http
-POST /api/agent/v1/purchase-tasks/{taskId}/retry
+POST /api/agent/v1/purchase-tasks/{taskId}/reset
 Authorization: Bearer <device-token>
 Content-Type: application/json
 
 {"requestId":"<uuid>"}
 ```
 
-- `/retry` 的 `AgentRetry → BatchRetry → Create` 行为不变：保留来源失败任务并创建新任务，返回 `sourceTaskId`、`sourceTaskNo`、新 `taskId`、新 `taskNo` 和 `replayed`。
-- Android 普通“重试采购”不再调用 `/retry`；只有 #132 替代商品规格匹配完成后的“继续采购”继续调用它。Admin 批量重试行为也不变。
-- “继续采购”会重新解析替代商品、规格映射与价格并生成新地址后缀；这与普通失败任务保持快照的就地重跑不可互换。
+- `/reset` 只允许当前设备的安全失败任务且不得存在不可逆证据或更新任务；它复用原 `purchase_task.id`、新增 attempt、刷新当前有效规则，并保持商品、目标/执行规格、数量、价格、地址和规格决策等业务快照不变。
+- 目标颜色存在但映射颜色为空，或目标尺码存在但映射尺码为空时，必须返回 `PURCHASE_SPEC_MAPPING_REQUIRED`，不得创建 `purchase` attempt 或下发正式采购 payload。相同 `requestId` 重放返回同一 task ID 和 attempt，不重复递增；Android 必须明确提示复用原任务和新的 attempt 序号。
 - 两个入口都不执行支付。真机调用可能创建待付款订单，必须先取得人工授权。
 
 ## Agent 任务记录范围与同步（#99）
@@ -845,3 +855,208 @@ file=<JPEG 二进制>
 | `GET` | `/api/agent/v1/app/releases/{releaseId}/download` | Device Token；私有 APK 下载 |
 
 Agent 只比较整数 `versionCode`。设备有活动任务时禁止检查、下载和安装；下载到应用私有缓存并校验响应大小与 SHA-256，失败立即删除。安装使用 FileProvider 和 Android 系统安装确认页；未知来源权限必须由用户在系统设置授权，不静默安装。
+
+## 设备身份恢复（#201）
+
+```http
+POST /api/admin/v1/devices/{deviceId}/identity-reset
+POST /api/agent/v1/register
+X-GoAuto-Device-Recovery-Code: <one-time-code>
+```
+
+仅管理员可以对未停用的既有设备发起身份重置。服务端立即使旧 Device Token 无效，并生成 10 分钟内仅能使用一次的恢复码；恢复码只在该管理员操作的响应中返回一次，服务端仅保存不可逆摘要，管理端设备列表、日志、任务接口和 Android 本地持久化均不得保存或返回原文。管理员将恢复码经受控人工渠道输入同一安装实例的 Agent 设置页。
+
+Agent 携带既有 Token（可已失效）及恢复码重新调用注册接口。服务端必须同时校验同一 `installId`、未停用状态、恢复码摘要、未过期和未使用；成功后使用原 `deviceId` 写入新 Token 摘要并返回一次新 Token，清除恢复码摘要和有效期。旧 Token 与恢复码都立即失效，已分配的 pending 采集或采购任务保持原 `deviceId`，不创建替代设备记录。缺少或错误恢复码仍为 `DEVICE_INSTALL_ID_CONFLICT`；过期码为 `DEVICE_RECOVERY_EXPIRED`；停用设备为 `DEVICE_DISABLED`。
+
+自 #223 起，新建 SYB 任务在保持 `mappedColor` / `mappedSize` 为空和首趟 `spec_probe` 不变的同时，把创建时与目标规格对应的 confirmed 商品映射冻结为仅供服务端决策的指导快照。服务端收到当次候选后按角色验证该快照：只有规范化后唯一对应当次候选时才复用，并固化当次候选原文；否则该角色继续执行确定性匹配，仍未解决才把该角色及其封闭候选交给 AI。已解决角色不得重复发送给 AI，最终颜色和尺码仍须逐字属于各自当次候选。任务决策快照通过 `roleSources` 记录每个角色的 `manual_mapping` / `exact_match` / `ai_match` 来源；任务级 `specSource` 使用现有枚举汇总，不新增 Agent 决策权限。
+
+## 客户端 API 与管理员密钥管理（#237）
+
+实现基线 `71f7751`；以下接口已通过隔离测试；2026-09-07 本机 MySQL 迁移及管理员通过 HTTP 读取列表、模块目录已验证，真实密钥创建/编辑/停用及业务访问仍未联调，线上尚未部署。Android 接口不变。
+
+### 管理接口
+
+前缀 `/api/admin/v1/client-keys`，要求 Admin JWT 和 admin 角色，默认接受 HTTP/HTTPS，响应 `Cache-Control: no-store`。
+
+| 方法与相对路径 | 输入 | 成功 data |
+|---|---|---|
+| GET 空路径 | page，固定每页 20 | items、total、page、pageSize |
+| GET /modules | 无 | 模块数组：key、title、group、writable、actions |
+| POST 空路径 | name（1～80 字符）、grants | key 元数据与仅本次返回的 secret |
+| PATCH /:keyId/grants | version、grants | 更新后的元数据 |
+| POST /:keyId/disable | version | 停用后的元数据 |
+
+授权示例：`{"module":"pdd_products","write":false,"actions":[]}`；grants 为非空数组。元数据包括 id、name、prefix、enabled、version、grants、createdBy、updatedBy、createdAt、updatedAt、lastUsedAt，不返回摘要或完整密钥。管理请求只接受单个 JSON 对象、拒绝未知字段、最大 64 KiB。成功 code=200；无效输入 422、不存在 404、授权版本冲突或已停用 409。
+
+### 客户端访问与错误语义
+
+- 前缀 `/api/client/v1`，只接受 `Authorization: Bearer <客户端密钥>`，不接受 Cookie 或 URL 凭据，不与 JWT、Device Token 通用。
+- 根据用户 2026-09-07 的明确确认，管理与客户端接口在所有环境默认接受 HTTP/HTTPS，不设置协议开关，也不依赖 X-Forwarded-Proto 或 GOAUTO_TRUST_FORWARDED_PROTO。HTTP 明文传输密钥及业务数据，优先使用 HTTPS；不影响其他接口各自的协议要求。
+- 不再因 HTTP 返回 426；401 为缺失、无效或停用密钥；403 为模块/动作未授权；400 为查询参数携带凭据；503 为认证或审计暂不可用。业务错误沿用各既有接口。
+- 一般请求体最大 16 MiB；响应只支持有限 JSON（32 MiB），递归过滤凭据与原始载荷字段。不支持直接流式/二进制文件接口。响应不可序列化或超限时返回 502；业务可能已执行，必须先核对结果，不要自动重试。
+- 通过密钥认证的请求由服务端生成 `X-Client-Request-Id` 关联审计；它不是业务幂等键，原业务接口要求的 requestId 等字段仍须提供。允许请求必须先落审计意图；完成状态更新失败可留下 status=0。无效密钥没有 key_id 关联审计；拒绝授权的 403 审计为尽力记录。
+- GET `/ai-matching-settings` 只返回 `data.enabled`。POST `/ai-matching-settings/resolve` 接受 targetColor、targetSize、colors、sizes；每组最多 200 项，每个值最多 255 字符，总请求最大 64 KiB；确定性优先，必要时使用当前 Provider，返回 mappedColor、mappedSize、source；不保存映射、不创建任务，无法可靠匹配返回 422 安全提示。
+
+### 明确开放的接口清单
+
+下表路径均相对 `/api/client/v1`；普通业务请求字段沿用本文对应 Admin 业务契约。read=选中模块，write=模块读写，其他值均需 actions 逐项授权。没有列出的 Admin 接口不能用客户端密钥调用；新增 Admin 路由不会自动开放。
+
+| 方法 | 路径 | 模块键 | 能力 |
+|---|---|---|---|
+| POST | `/ai-matching-settings/resolve` | ai_matching | match |
+| GET | `/devices` | devices | read |
+| GET | `/pdd-products` | pdd_products | read |
+| GET | `/pdd-products/:productId` | pdd_products | read |
+| POST | `/pdd-products` | pdd_products | write |
+| PATCH | `/pdd-products/:productId` | pdd_products | write |
+| GET | `/shopee-products` | shopee_products | read |
+| GET | `/shopee-products/:productId` | shopee_products | read |
+| POST | `/shopee-products` | shopee_products | write |
+| PATCH | `/shopee-products/:productId` | shopee_products | write |
+| POST | `/shopee-products/:productId/link-pdd` | shopee_products | write |
+| POST | `/shopee-products/:productId/specs/values` | shopee_products | write |
+| PUT | `/shopee-products/:productId/specs/mapping` | shopee_products | write |
+| DELETE | `/shopee-products/:productId/specs/values` | shopee_products | delete |
+| DELETE | `/shopee-products/:productId/specs/mapping` | shopee_products | delete |
+| POST | `/shopee-products/batch-delete` | shopee_products | delete |
+| POST | `/shopee-products/:productId/specs/mapping/auto-match` | shopee_products | match |
+| POST | `/shopee-products/:productId/specs/mapping/confirm` | shopee_products | match |
+| GET | `/syb-products` | syb_products | read |
+| GET | `/syb-products/:productId` | syb_products | read |
+| PATCH | `/syb-products/:productId/correction` | syb_products | write |
+| POST | `/syb-products/:productId/reparse` | syb_products | reparse |
+| POST | `/syb-products/reparse-batch` | syb_products | reparse |
+| GET | `/syb-products/sync-runs` | syb_sync_runs | read |
+| GET | `/syb-products/sync-runs/:runId` | syb_sync_runs | read |
+| POST | `/syb-products/import` | syb_sync_runs | sync |
+| GET | `/syb-inner-codes` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/:recordId` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/match-jobs/:jobId` | syb_inner_codes | read |
+| GET | `/syb-inner-codes/apply-batches/:batchId` | syb_inner_codes | read |
+| POST | `/syb-inner-codes/rematch` | syb_inner_codes | match |
+| POST | `/syb-inner-codes/import` | syb_inner_codes | import |
+| POST | `/syb-inner-codes/batch-delete` | syb_inner_codes | delete |
+| POST | `/syb-inner-codes/apply-preview` | syb_inner_codes | writeback |
+| POST | `/syb-inner-codes/apply` | syb_inner_codes | writeback |
+| POST | `/syb-inner-codes/:recordId/recheck` | syb_inner_codes | match |
+| GET | `/syb-shops` | syb_shops | read |
+| POST | `/syb-shops` | syb_shops | write |
+| PATCH | `/syb-shops/:shopId/name` | syb_shops | write |
+| PATCH | `/syb-shops/:shopId/enabled` | syb_shops | write |
+| DELETE | `/syb-shops/:shopId` | syb_shops | delete |
+| GET | `/collection-rules` | collection_rules | read |
+| POST | `/collection-rules` | collection_rules | write |
+| PATCH | `/collection-rules/:ruleId` | collection_rules | write |
+| DELETE | `/collection-rules/:ruleId` | collection_rules | delete |
+| GET | `/purchase-rules` | purchase_rules | read |
+| GET | `/purchase-rules/current` | purchase_rules | read |
+| POST | `/purchase-rules` | purchase_rules | write |
+| PATCH | `/purchase-rules/:ruleId` | purchase_rules | write |
+| DELETE | `/purchase-rules/:ruleId` | purchase_rules | delete |
+| PUT | `/purchase-rules/current` | purchase_rules | activate |
+| GET | `/collection-tasks` | collection_tasks | read |
+| GET | `/collection-tasks/:taskId` | collection_tasks | read |
+| POST | `/collection-tasks` | collection_tasks | collect |
+| POST | `/collection-tasks/batch` | collection_tasks | collect |
+| POST | `/collection-tasks/:taskId/reset` | collection_tasks | collect |
+| DELETE | `/collection-tasks/:taskId` | collection_tasks | delete |
+| GET | `/purchase-tasks` | purchase_tasks | read |
+| GET | `/purchase-tasks/:taskId` | purchase_tasks | read |
+| POST | `/purchase-tasks/batch-preview` | purchase_tasks | purchase |
+| POST | `/purchase-tasks` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/batch` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/batch-retry` | purchase_tasks | purchase |
+| POST | `/purchase-tasks/stock` | purchase_tasks | purchase |
+| GET | `/ai-matching-settings` | ai_matching | read |
+
+### openSpecPanel 后置滑动兼容与诊断（#238）
+
+版本边界：Android 0.9.60 / versionCode 73，代码 `58a6c1c`。不修改 JSON schema、能力标识、任务接口或已有快照哈希。`openSpecPanel.swipeAfter` 仍按 direction/count/durationMs/intervalMs 原约束校验；解析成功后不执行该准备性滑动，`waitAfterMs` 保留。其他动作后置滑动沿用旧执行语义。旧 Server 可继续下发原快照；旧 APK 仍按原策略执行，不能将本契约描述当作旧设备已获得兼容。
+
+规格探测与精确选择自行负责按需有界滚动，原始候选、精确点击和选中复核不变。跳过预滑动不作为规格探测成功或订单创建证据。
+
+本地 `GoAutoPurchasePanel` 脱敏结构日志关联 task、attempt、device、rule（规则 SHA-256），不上传原始页面。新增事件：`postSwipe=skipped;action=openSpecPanel;reason=spec_panel_on_demand;panel=<枚举>`；其他必需滑动失败为 `postSwipe=failed;action=<动作枚举>;direction=<方向枚举>;swipeIndex=<本动作内第几次滑动>;reason=<固定分类>`。
+固定失败分类：unknown、root_unavailable、no_scrollable、invalid_bounds、gesture_unsupported、gesture_rejected、gesture_cancelled、gesture_timeout。日志不含规格值、节点文本、坐标、地址、订单、凭据、原始树或截图；结果错误码仍为 RULE_ACTION_FAILED，现有结果提交字段不变。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；代码已实现不代表当前线上已部署。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+## Agent 采购订单批量回填（#241）
+
+本节为 #241 服务端实现契约，2026-09-08 按用户授权直接更新本地镜像；线上 Wiki 与其他长期文档由审核阶段同步。本节不表示已经部署或完成真机验收。
+
+`POST /api/agent/v1/purchase-tasks/order-backfill`
+
+使用 `Authorization: Bearer <Device Token>`，沿用 `RequireAgentHTTPS`、`GOAUTO_ALLOW_INSECURE_AGENT_HTTP` 与既有可信转发协议策略。无需 Admin JWT、claim、start 或 attempt。设备号只从认证读取，请求不得指定 deviceId、地址全文、收件人、手机号或原始控件树；未知 JSON 字段拒绝。此接口只记录已观察到的订单事实，不执行设备动作、创建订单或付款。
+
+请求示例（页面时间先按 Asia/Shanghai 理解，再以带时区 RFC3339/RFC3339Nano 发送）：
+
+```json
+{
+  "requestId": "5826cdda-dcd6-442e-90c3-9b75ba6fb8d8",
+  "items": [
+    {"addressSuffix": "_cg7", "pddOrderNo": "EXAMPLE-ORDER-7", "orderSubmittedAt": "2026-09-08T20:30:00+08:00"},
+    {"addressSuffix": "_cg72", "pddOrderNo": "EXAMPLE-ORDER-72"}
+  ]
+}
+```
+
+- requestId 必须为 UUID；items 为 1～50 条，保持输入顺序；请求体上限沿用 1 MiB。
+- addressSuffix 只接受 `AddressSuffix(id)` 生成的完整字符串。任务号为非零 uint64，拒绝前导零、正负号、空格、尾随文本、多个后缀与溢出；`_cg7` 与 `_cg72` 分别定位任务 7 和 72。
+- pddOrderNo 必填，最多 100 个 Unicode 字符，不接受首尾空白、换行或制表符，不自动裁剪后覆盖旧值。
+- orderSubmittedAt 缺失或 null 时回落任务 irreversible_at；空字符串、无时区文本及非法时间是条目错误，不触发回落。存储统一 UTC。页面值与 irreversible_at 都缺失时该条失败。
+
+有效批次返回 HTTP 200，包括全部条目失败的批次；每条独立事务，失败不撤销其他条目已提交的数据。响应包裹为 `data`，并设 `Cache-Control: no-store`：
+
+```json
+{
+  "data": {
+    "requestId": "5826cdda-dcd6-442e-90c3-9b75ba6fb8d8",
+    "items": [
+      {"index": 0, "taskId": 7, "result": "backfilled", "code": "BACKFILLED", "status": "order_created", "statusVersion": 5, "pddOrderNo": "EXAMPLE-ORDER-7", "orderSubmittedAt": "2026-09-08T12:30:00Z", "timeSource": "page", "retryable": false},
+      {"index": 1, "taskId": 72, "result": "backfilled", "code": "BACKFILLED", "status": "order_created", "statusVersion": 4, "pddOrderNo": "EXAMPLE-ORDER-72", "orderSubmittedAt": "2026-09-08T12:31:00Z", "timeSource": "irreversible_at", "retryable": false}
+    ]
+  }
+}
+```
+
+index 从 0 开始；后缀无法解析时不返回 taskId。result 为 `backfilled`、`already_backfilled`、`conflict` 或 `failed`。已认证设备所属任务可返回提交后的状态、版本、已保存订单号及时间；拒绝条目尽可能返回当前已提交事实。跨设备任务和不存在任务不返回这些业务字段，事务回滚后的内存值绝不作为最终事实返回。
+
+timeSource 说明已保存时间的来源：`page` 为页面值，`irreversible_at` 为估算回落，`existing_unknown` 为原先已创建的历史订单且没有可证明的来源。没有已保存时间时省略 timeSource。客户端必须保留估算标记，不得把回落值或 unknown 宣称为页面真实时间。重复回填不会用新页面时间自动校正旧时间。
+
+| 条目 code | result | 含义 |
+|---|---|---|
+| `BACKFILLED` | backfilled | 本条完成回填 |
+| `ALREADY_BACKFILLED` | already_backfilled | 正式任务已为 order_created 且订单号相同，无写入 |
+| `PURCHASE_BACKFILL_SUFFIX_INVALID` | failed | 非法、非规范、零、溢出或歧义后缀 |
+| `PURCHASE_TASK_NOT_FOUND` | failed | 任务不存在 |
+| `PURCHASE_BACKFILL_DEVICE_MISMATCH` | failed | 未绑定设备或不属于认证设备 |
+| `PURCHASE_STATE_CONFLICT` | failed | 非正式采购，或状态不允许回填 |
+| `PURCHASE_INVALID_REQUEST` | failed | 订单号非法 |
+| `PURCHASE_ORDER_TIME_INVALID` | failed | 提供的页面时间无效 |
+| `PURCHASE_ORDER_TIME_MISSING` | failed | 页面时间与 irreversible_at 均无有效值 |
+| `PURCHASE_BACKFILL_ORDER_CONFLICT` | conflict | 任务已有不同订单号 |
+| `PURCHASE_BACKFILL_BATCH_CONFLICT` | conflict | 同批同任务出现多个不同订单号，该任务所有条目均拒绝 |
+| `PURCHASE_BACKFILL_ORDER_ALREADY_USED` | conflict | 同一订单号已对应其他任务 |
+| `INTERNAL_ERROR` | failed | 数据库失败、死锁等，retryable=true，可安全重放 |
+
+批级 JSON/UUID/数量错误为 HTTP 422 `PURCHASE_INVALID_REQUEST`；鉴权、停用设备和 HTTPS 限制复用既有错误（401 `DEVICE_TOKEN_INVALID`、403 `DEVICE_DISABLED`、426 `HTTPS_REQUIRED`）。批级失败使用既有 `{code,message,retryable}` 包裹，未开始条目写入。
+
+### 状态、幂等与并发
+
+新服务在事务中锁定任务并检查来源状态，仅允许当前设备的 `live + order_result_unknown` 首次写入；`live + order_created` 只在订单号相同时返回已回填。其他状态（包括 running、failed、cancelled 与演练）均拒绝。复用 SetStatus 同步占用字段，同一事务递增 statusVersion、设置 statusChangedAt、清空主任务当前错误及租约；原始 attempt、规则快照、支付与物流、SYB 回写字段不变。
+
+requestId 沿用 UUID 约定，不增加批次表或全局幂等缓存。既有 unknown_resolve_request_id 槽存储 `backfill:<page|irreversible_at>:<由 requestId 和后缀派生的 UUID>`（最多 61 字符），用于任务级关联和保留本功能时间来源。相同任务和订单号即使更换 requestId 也无写入；同 requestId 改内容仍重新执行设备、状态和订单冲突检查，不凭 requestId 直接放行。批内不同任务提交同一订单号时，先成功提交者占用，其余条目返回订单已被使用；已存在的历史重复订单号不自动修复。
+
+订单号尚无唯一索引，本实现不迁移数据库。共享模型保存钩子复用 `purchase_rule_setting.id=1` 行作短事务互斥锁，再以锁定读检查订单号归属，覆盖回填、原人工解除和旧结果提交路径；单例缺失时拒绝写入，数据库死锁时回滚失败事务。原 ResolveUnknown 与 Admin 鉴权代码保持不变。禁止通过跳过模型钩子的直接 SQL 写入宣称具备此保证。
+
+新回填路径禁用包含绑定参数的 SQL 日志，不记录请求正文、订单号、地址或原始树；任务号和认证设备号沿既有任务关联不可变 ruleSnapshot。此接口未新增日志载荷或任务/attempt。
+
+本地测试覆盖事务回滚、并发服务调用和旧写入路径，使用 SQLite；MySQL 8.4 多连接/多进程的实际行锁、生产数据和真机端到端回填尚待环境验收，不以单元测试替代。

docs/09-delivery-issues.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Delivery-Issues
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Delivery-Issues.-
-wiki_revision: 0eed28dd5dc629ce66071833d5fefbdf24d567d3
-synchronized_at: 2026-08-24T02:35:58Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:28Z
 <!-- gitea-wiki-mirror:end -->
 
 # 当前 MVP 交付工单索引

docs/10-real-device-acceptance.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: OnePlus-Real-Device-Acceptance
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/OnePlus-Real-Device-Acceptance.-
-wiki_revision: 5b74a3b915cda6307cd59087bf9ce295f4c5e806
-synchronized_at: 2026-08-21T08:08:57Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:32Z
 <!-- gitea-wiki-mirror:end -->
 
 # 一加真机验收记录

docs/11-pdd-detail-rule-migration-analysis.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: PDD-Detail-Rule-Migration-Analysis
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/PDD-Detail-Rule-Migration-Analysis.-
-wiki_revision: 1fe9ed083c4fc565a50b4186571233d1dfab58a7
-synchronized_at: 2026-08-17T03:28:38Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:37Z
 <!-- gitea-wiki-mirror:end -->
 
 # PDD 商品详情采集规则迁移分析

docs/12-syb-erp-interface.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: SYB-ERP-Interface-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/SYB-ERP-Interface-Contract.-
-wiki_revision: f596931468caf524cbd9d90b3c299b32a8cf8228
-synchronized_at: 2026-08-28T02:29:07Z
+wiki_revision: 214485db630141aeb03d4b49b22a65e572fb592a
+synchronized_at: 2026-09-08T02:24:10Z
 <!-- gitea-wiki-mirror:end -->
 
 # 12 顺云宝（SYB）ERP 接口契约
@@ -220,17 +220,19 @@ Admin 默认 `max_matches = 10000`，可以在配置中调整；上限针对整
 有限重试：单次 HTTP 总超时 60 秒，最多执行 3 次，重试前分别等待 1 秒、2 秒，等待须
 响应 context 取消。HTTP 401/403、明确会话失效、业务失败、接口数据完整性错误和本地
 校验失败不得重试；登录、验证码、单件码写入和任何回填请求也不得使用该机制。重试
-耗尽后返回最后一次错误，外层继续保留日期、页码和已获取数量上下文并将同步标为失败。
+耗尽后返回最后一次错误，外层保留日期、页码和已获取数量上下文，按最终已保存成果将同步标为失败或部分成功。
 
-今天的货运单会在同步期间持续新增。只有 UTC+8 下的今天发生上述快照漂移时，
-允许只重试今天的列表分页，最多 3 次；已经完成的历史日期不得重复拉取，每次尝试
-也必须使用独立 ID 集合。第三次仍不稳定时，可以对最后一次取得的合法唯一 ID
-读取完整明细并按既有 upsert 保存，但本次同步仍记为失败、明确提示当天未形成
-稳定快照且不推进游标，下一次继续覆盖今天。任何尝试都不得突破 `max_matches`；
-网络/业务错误、非法 ID 或不完整明细不属于可放宽的快照漂移。
+自 #239（实现提交 c6a962d，已于 2026-09-08 随 d403f3b 部署线上）起，改为按页验证和保存：每页先验证条数、合法 ID、页内/跨页重复，再按冻结店铺快照获取并验证全部明细；外部请求完成后才开启页事务。页内任一入库失败回滚整页，已提交的前页保留，计数在事务提交后累计。
+
+当天和历史日期统一处理：分页/明细失败或最终总数漂移时停止该日期并继续后续日期，不在同次运行中重新扫描当天，以避免重复写入和计数。数据库故障、进度持久化失败、明确会话失效、上下文取消或总任务超时停止整个范围。下一次人工或定时同步重新扫描日期，按 (order_code, detail_id) 幂等覆盖并保留人工确认。跨页重复不去重后冒充完整数据；最终日期完整性校验仍覆盖所有店铺。此流程替代此前 #235 的当天三次整日快照重扫。
+
+重复诊断只记录日期、首次/当前页码和行号、start、pageSize、expectedTotal、已获取唯一数量，不记录真实重复 ID、原始响应或个人数据。
 
 ### 4.4 统一日期范围同步与覆盖游标
 
+GoAuto 同步记录页的立即同步允许管理员和采购员（purchaser）使用（#236），固定覆盖昨天和今天；其他已登录角色仅可查看记录。复用既有同步互斥、日期校验、启用店铺筛选及操作人审计，不授予店铺配置、凭据或定时任务管理权限。权限代码发布并完成启动对账后生效。
+
+
 页面只有一个同步入口，操作员确认工具条上的开始日和结束日后发起。首次打开页面
 固定默认昨天到今天，不因 `last_synced_at` 更早而自动扩大范围；需要补历史缺口时
 由操作员明确选择日期，单次仍不得超过 31 天。
@@ -247,7 +249,7 @@ Admin 默认 `max_matches = 10000`，可以在配置中调整；上限针对整
 或超过 `max_matches` 时不推进游标。
 
 `[必须]` 每批明细响应必须与请求的货运单 ID 一一对应。缺失、重复、出现未请求
-ID，或某张货运单返回空商品明细，都视为不完整并停止同步；已经写入的幂等数据
+ID，或某张货运单返回空商品明细，都视为不完整并停止当前日期，继续后续日期；已经写入的幂等数据
 可以保留，但只有所有日期全部成功才推进游标。
 
 `[必须]` 登录和验证码只是同步前置步骤。日期范围经过自动 OCR 降级、手工
@@ -393,19 +395,32 @@ POST /am/stock/detail/listByStock?hist=0
 
 顺运宝给的是**商品级 ID + 规格原文**，没有規格 ID。
 
-### 6.3 `productSpec` 的格式和蝦皮报表完全一致
+### 6.3 `productSpec` 的角色顺序不是固定的
 
 ```text
 蝦皮目录 `spec_raw`       黑色,M【建議40-50公斤】
 顺运宝 productSpec       白色,L【建議50-60公斤】
-                         黑色+白色【純棉兩件裝】 簡約親膚,L【建議52.5-60公斤】
+                         均碼,黑色
 ```
 
-`[必须]` 规格身份统一复用 `spec.SpecKey()`：只折叠空白，不猜颜色、尺码或建议。
-第三方目录脚本提交 `spec_raw` 和明确的解析结果；顺运宝匹配不到时交给人工确认。
+2026-09-04 的真实数据确认：`productSpec` 至少存在 `颜色,尺码` 与
+`尺码,颜色` 两种顺序，不能再固定把逗号前当颜色、逗号后当尺码。
+
+`[必须]` 先按最后一个 ASCII 逗号拆成两段并剥离 `【...】` 备注。只有两侧
+恰好一侧带有明确尺码信号（如均码、字母尺码或明确尺码单位）时，才把该侧判为
+尺码、另一侧判为颜色。两侧都像尺码时标记存疑；不得使用模糊颜色词库、AI 或
+跨维度候选猜测角色。两侧都没有明确尺码信号时，暂按既有 `颜色,尺码` 契约兼容，
+并继续执行原有复杂分隔符和空值校验。
+
+`[必须]` 修正规格角色时保留原始 `raw_json`，不得覆盖人工确认值。已错误写入
+虾皮档案的导入规格只能在确认无其他 SYB 明细引用且没有规格映射时移除；人工规格、
+映射及历史采购任务保持不变。
+
+`[必须]` 规格身份继续复用 `spec.SpecKey()`：只折叠空白，不改写用于 PDD
+精确点击的原始候选标签。第三方目录脚本提交 `spec_raw` 和明确解析结果；角色或
+规格比对不明确时保持存疑，不得跨颜色/尺码猜测。
 
 ### 6.4 由此推导出的匹配路径
-
 ```text
 productId    ──→ shopee_products.goods_id            商品级，直接相等
 productSpec  ──→ SpecKey() ──→ 稳定规格身份键
@@ -476,9 +491,9 @@ POST /am/stock/detail/updateDetailCode?t=0&id={stockID}&detailId={detailID}&code
 > 以下「店铺准入」已由 GoAuto #49 采纳并实现；店铺规范化还包括全角/半角统一和忽略大小写。
 
 `[必须]` **同步先校验原始全量，再做店铺准入。** 顺序固定为：按日期查询原始总数
-并执行单次容量熔断 → 拉完当天原始列表并核对分页前后总数、页长和唯一 ID → 按
+并执行单次容量熔断 → 逐页核对页长和唯一 ID，整日结束复核总数 → 按
 `shopName` 去除首尾空白后与启用店铺精确匹配 → 只为接受的货运单请求明细和入库。
-不能先过滤再做完整性校验，否则非目标店铺的分页漂移会被掩盖。
+店铺过滤只决定明细获取和入库，不能减少原始列表完整性校验范围；已保存不代表整日完整。
 
 `[必须]` 同步开始时只读取一次启用店铺，整次运行使用同一个快照。列表允许但明细
 响应中的 `shopName` 变为空或非允许店铺时再次拦截。没有启用店铺时在会话/OCR/
@@ -633,3 +648,13 @@ settings:
 - 客户端实现：`server/app/goauto/sybclient/`
 - 落库与解析：`server/app/goauto/sybimport/`
 - 相关工单：[#48 客户端移植](https://git.ilapage.cn/OPC/goauto/issues/48)、[#41 SYB 货运单商品导入](https://git.ilapage.cn/OPC/goauto/issues/41)、[#37 物流调度与货运宝回填](https://git.ilapage.cn/OPC/goauto/issues/37)
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；2026-09-08 已随 d403f3b 部署线上，未手动触发真实同步验收；#240 上游尾页超时尚未修复。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。

docs/13-deployment-and-operations.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-and-Operations
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-and-Operations.-
-wiki_revision: 80ae5c8cea87c624fff63ce3e302aa7bf204811e
-synchronized_at: 2026-08-31T16:07:03Z
+wiki_revision: df033d06fd94a4b02a447a27ced8d711521342f3
+synchronized_at: 2026-09-08T02:23:08Z
 <!-- gitea-wiki-mirror:end -->
 
 # 部署与运维
@@ -39,6 +39,57 @@ GOAUTO_ALLOW_INSECURE_AGENT_HTTP=true
 
 发布、重启、设置当前 Agent 版本和真机安装都属于高风险操作，必须有对应工单和人工确认。不得在部署过程中执行付款、创建订单或清理生产数据。
 
+### API 长请求超时约束
+
+Admin 蝦皮规格 AI 匹配会同步等待外部 Provider：Provider 配置允许 3～600 秒，复合的一键匹配共享 600 秒总预算，Admin 客户端等待 610 秒。因此服务端 `settings.application.writetimeout` 必须至少为 620 秒，受版本管理的标准配置固定为 `620`；启动时低于该值必须明确失败，禁止以 2 秒等短写超时运行，否则连接会在领域错误返回前被截断并表现为代理 502。反向代理的读/发送超时也必须大于服务端窗口。
+
+Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、上游 HTTP 状态码或网络错误分类；不得记录 API Key、Authorization、Provider URL、模型输入、候选规格、商品原始内容或响应正文。Provider 失败时接口返回 HTTP 503 与 `AI_MATCHING_UNAVAILABLE`，供 Admin 显示安全中文提示。
+
 ## 回滚
 
 服务异常时把 `/home/goauto/current` 切回上一已验证发布目录并重启 `goauto.service`，随后复核服务状态和 Agent 接口。不要删除当前或历史 APK/发布目录来代替回滚；数据库变化如需回退必须单独评估。
+
+## 蝦皮规格自动匹配任务运维（#195）
+
+- 迁移 `1788290000000_shopee_spec_auto_match.go` 创建运行与工作状态表，并幂等写入 `sys_job.invoke_target=GoAutoShopeeSpecAutoMatch`。首次部署状态为关闭，迁移重跑不会覆盖管理员后来修改的 Cron、参数或启停状态。
+- 默认 Cron 为 `0 15 * * * *`（每小时第 15 分钟），默认 `batchLimit` 为 20，合法范围 1～100。上线后先保持关闭，在 Admin 蝦皮商品列表手动执行小批次并核对运行摘要和映射，再由管理员在定时任务页明确启用。
+- 定时和手动触发共享数据库唯一活动槽。看到“已有自动匹配正在运行”属于正常互斥结果；运行租约超过 30 分钟会在下次触发时安全释放并把旧运行标记失败。处理每个商品前会续租。
+- Provider 临时失败的商品至少 60 分钟后重试，最多 3 次；低置信度或无结果在输入指纹不变时不会重复调用。排错优先查看 `shopee_spec_auto_match_run` 的结构化计数与脱敏错误，以及 `shopee_spec_auto_match_work_item` 的状态、尝试次数、下次尝试时间和租约；不得输出或复制 API Key、Provider 原始响应、商品原始 JSON 或个人数据。
+- 紧急回退只需关闭系统任务并停止使用 Admin 手动入口；保留运行记录和既有已确认映射用于审计，不删除数据，也不回滚 #194。
+
+## SYB 异常规格 AI 定时任务（#198）
+
+- 追加迁移 `1788354164329_syb_spec_ai_parse.go` 创建 AI 确认字段、`syb_spec_ai_parse_run`、`syb_spec_ai_parse_work_item`，并幂等写入 `sys_job.invoke_target=GoAutoSYBSpecAIParse`。
+- 系统任务默认关闭，默认 Cron 为每小时第 5 分钟、参数 `{"batchLimit":20}`；迁移重跑不得覆盖管理员后续修改的 Cron、参数或启停状态。建议先运行该任务，再由默认第 15 分钟的 #195 完成蝦皮到 PDD 的规格匹配。
+- 多实例通过可空唯一活动槽和租约保证全局单批运行；逐行工作项按输入指纹去重。Provider 临时失败至少 60 分钟后重试且最多 3 次，低置信度/无结果在输入不变时不重复调用。
+- 上线顺序为：备份数据库、执行追加迁移、发布服务并保持任务关闭、核验表/字段/任务种子，再由管理员决定是否启用。排错只查看运行计数、工作状态和脱敏错误，不输出 API Key、Provider 原始响应、完整 RawJSON 或订单数据。
+
+## 定时任务执行历史运维（#199）
+
+- 发布 #199 时先备份数据库，再执行追加迁移 `1788357000000_sys_job_execution_log.go`，随后发布服务与 Web。迁移创建 `sys_job_execution_log`、登记 `GET /api/v1/sysjob/:id/execution-logs`，并只为原本绑定隐藏菜单 `JobLog` 的角色写入精确读取权限；菜单缺失时迁移明确失败，不扩大角色授权。
+- 服务启动会将上次进程遗留的 `running` 执行记录标记为 `interrupted`。该恢复依赖当前线上每个数据库只运行一个调度器实例；扩展为多调度器前必须另建工单引入实例租约，不能直接复用此判断。
+- 排错从 Admin 定时任务页单选任务后进入“日志”，按状态和开始时间查询。记录只含稳定错误码和脱敏摘要；需要定位细节时查看受控服务日志，不得把任务参数、Provider 配置/响应、密钥或业务原始数据复制进执行历史。
+- 当前没有执行历史删除接口和自动保留策略；删除定时任务不删除历史。数据库容量治理需要另建工单评估。#198 的 `GoAutoSYBSpecAIParse` 在 #199 发布和迁移后仍保持关闭，启用必须由管理员另行确认。
+
+## 客户端密钥部署与验证（#237）
+
+实现基线 `71f7751`；2026-09-07 已按用户授权完成本机 MySQL 迁移、管理员菜单写入和 Server/Web 构建重启；管理页面 HTTP 列表与模块加载已验证。2026-09-08 经用户授权，线上已发布 Server/Web 基线 `d403f3b`，执行迁移 `1788798000000` 并重启 GoAuto/Nginx；迁移记录、两张密钥表、仅管理员菜单关联已回读。HTTP 页面与健康检查通过；未登录管理请求 HTTP 200、业务码 401。真实密钥创建及客户端业务读写闭环尚未验证。
+
+- 发布前须单独授权追加迁移 `server/cmd/migrate/migration/version-local/1788798000000_client_api_key.go`，按既有迁移流程创建 client_api_key、client_api_key_audit 和“采采管理/客户端密钥”管理员菜单。前置父菜单必须存在；不应以赋予普通用户管理员角色代替迁移或权限核验。
+- 用户于 2026-09-07 明确确认默认兼容 HTTP/HTTPS、不设开关并接受明文风险；部署本版本并执行迁移后，现有 `http://185.216.248.75:9527` 可以使用客户端密钥管理及客户端 API。2026-09-08 线上部署及未登录拒绝检查已通过，真实密钥读写验收仍待进行。HTTP 会明文传输密钥和业务数据，仍建议使用 HTTPS。
+- 客户端密钥功能不依赖 GOAUTO_TRUST_FORWARDED_PROTO、X-Forwarded-Proto 或 Agent HTTP 例外。既有其他路由的协议和代理配置保持不变；不伪造协议头，不新增明文放行开关。
+- 代理、APM、应用日志均不得记录 Authorization、创建响应 secret 或原始业务载荷。应用对两类客户端密钥路由跳过旧请求/响应正文日志，使用专用元数据审计；实际代理日志脱敏仍须部署验收。
+- 请求审计 status=0 可能表示在途、进程中断或结果审计更新失败；先按请求关联号核对业务结果，不自动重试采购、采集、同步等操作。停用阻止后续认证，不保证取消已开始的业务操作。
+- 隔离验证：Server `go test ./app/goauto/clientkey ./app/goauto/clientapi ./cmd/migrate/migration/version-local`；Web `pnpm exec jest tests/unit/client-keys.spec.js --runInBand` 与 `pnpm run build:prod`。浏览器模拟入口 `/tests/fixtures/client-keys.html` 仅由本地 Vite 开发服务承载，使用内存模拟请求和无效示例密钥，不连接真实数据库，不证明线上鉴权已验收。
+- 真实部署验收须另行验证实际 HTTP/HTTPS 入口、管理员创建/编辑/停用、普通用户拒绝、读写/独立动作隔离、停用后的后续请求拒绝及日志无密钥；任何真实业务执行继续按独立授权范围进行。
+
+
+## Windows 本机运行目录与 #237 迁移验证（2026-09-07）
+
+- Supervisor 实际配置 `D:/supervisor/programs/goauto.conf`；程序仅 `goauto-admin-api` 和 `goauto-admin-ui`。从已有干净工作区 `D:/OPC/goauto-worktrees/main-runtime` 的 main 分支运行；源码运行基线 `ac3c63e`，版本化启动模板更新提交 `9a10d82`。
+- 原目录 `D:/OPC/goauto` 的用户改动保持原样；本机敏感配置继续读取 `D:/OPC/goauto/config.yaml`，不复制凭据到运行工作区或版本库。数据库 `127.0.0.1:3307/goauto`，API `http://127.0.0.1:8010`，Web `http://127.0.0.1:9527`。
+- API 命令：`pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml" -SkipMigration`；Web 同目录 `scripts/start-web.ps1` 与相同 ConfigPath。已验证无需 ExecutionPolicy Bypass。
+- 真实迁移必须单独授权并先确认唯一待执行版本；常驻 API 加 `-SkipMigration`，日常重启不自动执行未来待审核迁移。#237 迁移 `1788798000000_client_api_key.go` 已执行，sys_migration 记录 `1788798000000`、两张密钥表及管理员菜单已回读；其他角色未新增菜单关联。任务启停状态未改。
+- 范围明确的服务控制：`D:/supervisor/supervisord.exe -c D:/supervisor/supervisord.conf ctl status goauto-admin-api goauto-admin-ui`，启动/停止/重启将 status 分别替换为 start/stop/restart。不得为了 GoAuto 重启整个 Supervisor 或其他项目。配置内容变化后需重新读取配置；本次调用 `supervisor.reloadConfig`，再对上述两个程序定向 start，已通过进程命令行核对新目录。
+- 日志：`D:/supervisor/logs/goauto-admin-api.log`、`D:/supervisor/logs/goauto-admin-ui.log`；对外分享只能保留脱敏结构摘要。迁移输出不得暴露凭据或业务原文。
+- 管理员刷新页面后可进入 `http://127.0.0.1:9527/#/client-keys/index`；菜单缓存未更新时重新登录。已验证列表空态、创建弹窗加载 12 模块及 HTTP 风险提示；未实际创建密钥，真实客户端读写及停用闭环仍待范围明确的验证。本节为 2026-09-07 本机验证记录；线上已于 2026-09-08 另行授权发布，见上节。

docs/README.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Home
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Home
-wiki_revision: d5a46210da9dffa27247d80b20ab31b40790e48a
-synchronized_at: 2026-08-31T16:06:14Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:29:34Z
 <!-- gitea-wiki-mirror:end -->
 
 # GoAuto 文档中心

docs/templates/deployment.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-Template
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-Template.-
-wiki_revision: 389f09d292b0aa408f26f1967e33eec82d37cedf
-synchronized_at: 2026-08-27T09:39:50Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:41Z
 <!-- gitea-wiki-mirror:end -->
 
 # 部署文档模板

docs/templates/task-archive.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Task-Archive-Template
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Task-Archive-Template.-
-wiki_revision: 53927b3b69fa26943f323f9be53153f80ed54530
-synchronized_at: 2026-08-24T08:23:07Z
+wiki_revision: b1b1b343917e66288f4282bc6b3b90ea4ff3cca0
+synchronized_at: 2026-09-04T11:30:46Z
 <!-- gitea-wiki-mirror:end -->
 
 > 本模板只用于用户明确要求的专项历史快照或读取既有归档，不属于标准任务闭环。单次任务的唯一事实来源是 Gitea 工单；不要为了完成普通任务创建本页面，也不要自动导出到 `docs/task/`。

scripts/supervisor/goauto.conf

@@ -1,6 +1,6 @@
 [program:goauto-admin-api]
-command=pwsh.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "D:/OPC/goauto/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
-directory=D:/OPC/goauto
+command=pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-server.ps1" -ConfigPath "D:/OPC/goauto/config.yaml" -SkipMigration
+directory=D:/OPC/goauto-worktrees/main-runtime
 autostart=true
 autorestart=true
 startsecs=3
@@ -14,8 +14,8 @@ stdout_logfile_maxbytes=50MB
 stdout_logfile_backups=5
 
 [program:goauto-admin-ui]
-command=pwsh.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "D:/OPC/goauto/scripts/start-web.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
-directory=D:/OPC/goauto
+command=pwsh.exe -NoLogo -NoProfile -File "D:/OPC/goauto-worktrees/main-runtime/scripts/start-web.ps1" -ConfigPath "D:/OPC/goauto/config.yaml"
+directory=D:/OPC/goauto-worktrees/main-runtime
 autostart=true
 autorestart=true
 startsecs=3

server/app/admin/router/init_router.go

@@ -1,6 +1,7 @@
 package router
 
 import (
+	goautoclientapi "go-admin/app/goauto/clientapi"
 	"os"
 
 	"github.com/gin-gonic/gin"
@@ -53,6 +54,7 @@ func InitRouter() {
 
 	// 注册 GoAuto Agent 与设备管理路由。
 	goautodevice.InitRouter(r, authMiddleware)
+	goautoclientapi.InitRouter(r, authMiddleware)
 	goautoapprelease.InitRouter(r, authMiddleware)
 	goautoaimatching.InitRouter(r, authMiddleware)
 	goautotask.InitRouter(r, authMiddleware)

server/app/goauto/access/modules.go

@@ -136,6 +136,8 @@ func moduleKeyForAPI(path string) string {
 		return ModulePDDProducts
 	case strings.HasPrefix(path, "/api/admin/v1/shopee-products"):
 		return ModuleShopeeProducts
+	case strings.HasPrefix(path, "/api/admin/v1/shopee-spec-auto-match"):
+		return ModuleShopeeProducts
 	case strings.HasPrefix(path, "/api/admin/v1/syb-products/sync-runs"):
 		return ModuleSYBSyncRuns
 	case strings.HasPrefix(path, "/api/admin/v1/syb-products"):

server/app/goauto/access/purchaser.go

@@ -48,13 +48,15 @@ var AdminAPIs = []APIPermission{
 	{"AI 建议颜色映射", "/api/admin/v1/shopee-products/:productId/specs/mapping/suggest-colors", "POST", true},
 	{"AI 建议尺码映射", "/api/admin/v1/shopee-products/:productId/specs/mapping/suggest-sizes", "POST", true},
 	{"一键匹配并确认颜色尺码", "/api/admin/v1/shopee-products/:productId/specs/mapping/auto-match", "POST", true},
+	{"手动执行虾皮规格自动匹配", "/api/admin/v1/shopee-spec-auto-match/runs", "POST", false},
+	{"查看最近虾皮规格自动匹配", "/api/admin/v1/shopee-spec-auto-match/runs/latest", "GET", false},
 
 	{"查看 SYB 商品", "/api/admin/v1/syb-products", "GET", true},
 	{"查看 SYB 商品详情", "/api/admin/v1/syb-products/:productId", "GET", true},
 	{"重新解析 SYB 商品", "/api/admin/v1/syb-products/:productId/reparse", "POST", true},
 	{"批量重新解析 SYB 商品", "/api/admin/v1/syb-products/reparse-batch", "POST", true},
 	{"人工修正 SYB 商品", "/api/admin/v1/syb-products/:productId/correction", "PATCH", true},
-	{"手动同步 SYB 商品", "/api/admin/v1/syb-products/import", "POST", false},
+	{"手动同步 SYB 商品", "/api/admin/v1/syb-products/import", "POST", true},
 	{"查看 SYB 同步记录", "/api/admin/v1/syb-products/sync-runs", "GET", true},
 	{"查看 SYB 同步详情", "/api/admin/v1/syb-products/sync-runs/:runId", "GET", true},
 

server/app/goauto/access/purchaser_test.go

@@ -15,10 +15,12 @@ func TestPurchaserPermissionMatrixHasNoDuplicates(t *testing.T) {
 
 func TestPurchaserExcludesAdministratorOperations(t *testing.T) {
 	denied := map[string]bool{
-		"POST /api/admin/v1/devices/:deviceId/disable": true,
-		"POST /api/admin/v1/syb-products/import":       true,
-		"POST /api/admin/v1/collection-rules":          true,
-		"PUT /api/admin/v1/ai-matching-settings":       true,
+		"POST /api/admin/v1/devices/:deviceId/disable":         true,
+		"POST /api/admin/v1/syb-shops/discover":                true,
+		"POST /api/admin/v1/collection-rules":                  true,
+		"PUT /api/admin/v1/ai-matching-settings":               true,
+		"POST /api/admin/v1/shopee-spec-auto-match/runs":       true,
+		"GET /api/admin/v1/shopee-spec-auto-match/runs/latest": true,
 	}
 	for _, permission := range PurchaserAPIs() {
 		if denied[permission.Method+" "+permission.Path] {

server/app/goauto/access/reconcile_test.go

@@ -55,7 +55,9 @@ func TestReconcilePurchaserPermissions(t *testing.T) {
 	}
 
 	assertPolicyCount(t, db, "custom-role", "/custom", "GET", 1)
-	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-products/import", "POST", 0)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-products/import", "POST", 1)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-shops/discover", "POST", 0)
+	assertPolicyCount(t, db, RolePurchaser, "/api/admin/v1/syb-shops", "POST", 0)
 }
 
 func TestReconcilePurchaserPermissionsRemovesOnlyStalePurchaserGrant(t *testing.T) {

server/app/goauto/aimatching/service.go

@@ -25,12 +25,28 @@ const (
 	defaultAutoConfirmMinConfidence = 0.9
 )
 
+// MaxProviderTimeout is also the total budget used by composite synchronous
+// AI operations. This keeps their HTTP response inside the Admin and API
+// transport windows even when an operation needs more than one provider call.
+const MaxProviderTimeout = 600 * time.Second
+
 // Service owns the internal AI Provider configuration. The API key exception
 // is deliberately narrow: it is plain text only in the dedicated settings
 // table and is returned only by the administrator settings handler.
 type Service struct {
-	DB         *gorm.DB
-	HTTPClient *http.Client
+	DB                    *gorm.DB
+	HTTPClient            *http.Client
+	ProviderFailureLogger func(ProviderFailureDiagnostic)
+}
+
+// ProviderFailureDiagnostic deliberately contains no URL, model, prompt,
+// candidates, response body or credential. It is safe for operational logs.
+type ProviderFailureDiagnostic struct {
+	CallID     string
+	Operation  string
+	Kind       string
+	StatusCode int
+	Duration   time.Duration
 }
 
 func NewService(db *gorm.DB) *Service {
@@ -179,6 +195,58 @@ func (s *Service) Resolve(ctx context.Context, request MatchRequest) (MatchResul
 	return result, nil
 }
 
+// ResolveSYBSpec parses one SYB productSpec into the linked Shopee product's
+// exact color/size labels. Unlike Resolve, this operation does not map to PDD:
+// every non-empty answer must be an exact member of the supplied Shopee set.
+func (s *Service) ResolveSYBSpec(ctx context.Context, request SYBSpecParseRequest) (SYBSpecParseResult, error) {
+	request.ProductSpec = strings.TrimSpace(request.ProductSpec)
+	request.Colors = usableCandidates(request.Colors)
+	request.Sizes = usableCandidates(request.Sizes)
+	if request.ProductSpec == "" || (len(request.Colors) == 0 && len(request.Sizes) == 0) {
+		return SYBSpecParseResult{}, fail(CodeNoMatch, "SYB 采购规格缺少可判断的原文或蝦皮候选")
+	}
+	setting, apiKey, err := s.activeSetting(ctx)
+	if err != nil {
+		return SYBSpecParseResult{}, err
+	}
+	payload := openAIChatRequest{Model: setting.Model, Temperature: 0, Messages: []openAIMessage{
+		{Role: "system", Content: "你只负责把一条 SYB 商品规格原文解析成给定蝦皮候选中的原始颜色和尺码。不得猜测、不得改写候选、不得返回候选外文本。只返回 JSON：{\"color\":\"颜色候选原文或空\",\"size\":\"尺码候选原文或空\",\"reason\":\"简短原因\",\"confidence\":0到1}。提供了某角色候选时必须唯一可靠地选择一个，否则对应字段留空。"},
+		{Role: "user", Content: sybSpecParsePrompt(request)},
+	}}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return SYBSpecParseResult{}, &Error{Code: CodeProviderUnavailable, Message: "SYB 规格 AI 解析请求生成失败", Cause: err}
+	}
+	ctx, cancel := context.WithTimeout(ctx, time.Duration(setting.TimeoutSeconds)*time.Second)
+	defer cancel()
+	httpRequest, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint(setting.BaseURL, "chat/completions"), bytes.NewReader(body))
+	if err != nil {
+		return SYBSpecParseResult{}, fail(CodeInvalidSetting, "AI 服务地址无效")
+	}
+	httpRequest.Header.Set("Authorization", "Bearer "+apiKey)
+	httpRequest.Header.Set("Content-Type", "application/json")
+	response, err := s.httpClient().Do(httpRequest)
+	if err != nil {
+		return SYBSpecParseResult{}, &Error{Code: CodeProviderUnavailable, Message: "SYB 规格 AI 解析服务暂时不可用", Cause: err}
+	}
+	defer response.Body.Close()
+	responseBody, readErr := io.ReadAll(io.LimitReader(response.Body, 1<<20))
+	if readErr != nil || response.StatusCode < http.StatusOK || response.StatusCode >= http.StatusMultipleChoices {
+		return SYBSpecParseResult{}, fail(CodeProviderUnavailable, "SYB 规格 AI 解析服务暂时不可用")
+	}
+	choice, err := parseProviderChoice(responseBody)
+	if err != nil || !validClosedChoice(choice.Color, request.Colors) || !validClosedChoice(choice.Size, request.Sizes) {
+		return SYBSpecParseResult{}, fail(CodeNoMatch, "AI 未能在蝦皮候选中唯一解析采购规格")
+	}
+	if choice.Confidence == nil || *choice.Confidence < 0 || *choice.Confidence > 1 || strings.TrimSpace(choice.Reason) == "" {
+		return SYBSpecParseResult{}, fail(CodeNoMatch, "AI 解析结果缺少有效置信度或理由")
+	}
+	return SYBSpecParseResult{
+		Color: choice.Color, Size: choice.Size, Provider: ProviderOpenAICompatible,
+		Model: setting.Model, Reason: safeReason(choice.Reason), Confidence: choice.Confidence,
+	}, nil
+}
+
 func (s *Service) activeSetting(ctx context.Context) (models.AIMatchingSetting, string, error) {
 	setting, err := s.setting(ctx)
 	if errors.Is(err, gorm.ErrRecordNotFound) || !setting.Enabled {
@@ -294,6 +362,22 @@ func validChoice(target, selected string, candidates []string) bool {
 	return false
 }
 
+func validClosedChoice(selected string, candidates []string) bool {
+	selected = strings.TrimSpace(selected)
+	if len(candidates) == 0 {
+		return selected == ""
+	}
+	if selected == "" {
+		return false
+	}
+	for _, candidate := range candidates {
+		if candidate == selected {
+			return true
+		}
+	}
+	return false
+}
+
 func safeReason(reason string) string {
 	reason = strings.TrimSpace(reason)
 	if reason == "" {
@@ -316,6 +400,16 @@ func matchPrompt(request MatchRequest) string {
 	return string(raw)
 }
 
+func sybSpecParsePrompt(request SYBSpecParseRequest) string {
+	payload := struct {
+		ProductSpec string   `json:"productSpec"`
+		Colors      []string `json:"shopeeColorCandidates,omitempty"`
+		Sizes       []string `json:"shopeeSizeCandidates,omitempty"`
+	}{request.ProductSpec, request.Colors, request.Sizes}
+	raw, _ := json.Marshal(payload)
+	return string(raw)
+}
+
 type openAIMessage struct {
 	Role    string `json:"role"`
 	Content string `json:"content"`

server/app/goauto/aimatching/service_test.go

@@ -2,6 +2,7 @@ package aimatching
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
@@ -135,3 +136,61 @@ func TestAutoConfirmThresholdDefaultsPersistsAndValidates(t *testing.T) {
 		t.Fatalf("invalid threshold err=%v", err)
 	}
 }
+
+func TestResolveSYBSpecUsesOnlyProductSpecAndClosedShopeeCandidates(t *testing.T) {
+	service := matcherTestService(t)
+	if _, err := service.SaveSettings(context.Background(), SaveSettingsRequest{Enabled: true, BaseURL: "https://provider.example/v1", Model: "test-model", APIKey: "test-secret", TimeoutSeconds: 8}, 7); err != nil {
+		t.Fatal(err)
+	}
+	var sent map[string]any
+	service.HTTPClient = &http.Client{Transport: roundTripper(func(request *http.Request) (*http.Response, error) {
+		raw, err := io.ReadAll(request.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := json.Unmarshal(raw, &sent); err != nil {
+			t.Fatal(err)
+		}
+		body := `{"choices":[{"message":{"content":"{\"color\":\"黑色\",\"size\":\"XL\",\"reason\":\"原文对应唯一候选\",\"confidence\":0.95}"}}]}`
+		return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body)), Request: request}, nil
+	})}
+	result, err := service.ResolveSYBSpec(context.Background(), SYBSpecParseRequest{ProductSpec: "黑色 XL【备注】", Colors: []string{"黑色", "白色"}, Sizes: []string{"L", "XL"}})
+	if err != nil || result.Color != "黑色" || result.Size != "XL" || result.Confidence == nil || *result.Confidence != 0.95 {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+	encoded, _ := json.Marshal(sent)
+	for _, forbidden := range []string{"orderCode", "address", "rawJson", "price", "test-secret"} {
+		if strings.Contains(string(encoded), forbidden) {
+			t.Fatalf("provider payload leaked forbidden field %q: %s", forbidden, encoded)
+		}
+	}
+	for _, required := range []string{"productSpec", "shopeeColorCandidates", "shopeeSizeCandidates"} {
+		if !strings.Contains(string(encoded), required) {
+			t.Fatalf("provider payload missing %q: %s", required, encoded)
+		}
+	}
+}
+
+func TestResolveSYBSpecRejectsCandidateOutsideClosedSetAndMissingConfidence(t *testing.T) {
+	service := matcherTestService(t)
+	if _, err := service.SaveSettings(context.Background(), SaveSettingsRequest{Enabled: true, BaseURL: "https://provider.example/v1", Model: "test-model", APIKey: "test-secret", TimeoutSeconds: 8}, 7); err != nil {
+		t.Fatal(err)
+	}
+	responses := []string{
+		`{"choices":[{"message":{"content":"{\"color\":\"灰色\",\"size\":\"XL\",\"reason\":\"猜测\",\"confidence\":0.99}"}}]}`,
+		`{"choices":[{"message":{"content":"{\"color\":\"黑色\",\"size\":\"XL\",\"reason\":\"候选\"}"}}]}`,
+	}
+	service.HTTPClient = &http.Client{Transport: roundTripper(func(request *http.Request) (*http.Response, error) {
+		body := responses[0]
+		responses = responses[1:]
+		return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body)), Request: request}, nil
+	})}
+	request := SYBSpecParseRequest{ProductSpec: "黑 XL", Colors: []string{"黑色"}, Sizes: []string{"XL"}}
+	for i := 0; i < 2; i++ {
+		_, err := service.ResolveSYBSpec(context.Background(), request)
+		var target *Error
+		if !errors.As(err, &target) || target.Code != CodeNoMatch {
+			t.Fatalf("attempt %d err=%v", i, err)
+		}
+	}
+}

server/app/goauto/aimatching/suggest.go

@@ -10,6 +10,9 @@ import (
 	"net/http"
 	"strings"
 	"time"
+
+	log "github.com/go-admin-team/go-admin-core/logger"
+	"github.com/google/uuid"
 )
 
 // Suggestion limits are enforced defensively here too, even though callers
@@ -95,18 +98,26 @@ func (s *Service) SuggestBatch(ctx context.Context, request SuggestRequest) (Sug
 	}
 	httpRequest.Header.Set("Authorization", "Bearer "+apiKey)
 	httpRequest.Header.Set("Content-Type", "application/json")
+	callID, startedAt := uuid.NewString(), time.Now()
 	response, err := s.httpClient().Do(httpRequest)
 	if err != nil {
+		s.logProviderFailure(ProviderFailureDiagnostic{CallID: callID, Operation: "suggest_batch", Kind: providerNetworkErrorKind(err), Duration: time.Since(startedAt)})
 		return SuggestResult{}, &Error{Code: CodeProviderUnavailable, Message: "AI 建议服务暂时不可用", Cause: err}
 	}
 	defer response.Body.Close()
 	limited := io.LimitReader(response.Body, 1<<20)
 	responseBody, readErr := io.ReadAll(limited)
-	if readErr != nil || response.StatusCode < http.StatusOK || response.StatusCode >= http.StatusMultipleChoices {
+	if readErr != nil {
+		s.logProviderFailure(ProviderFailureDiagnostic{CallID: callID, Operation: "suggest_batch", Kind: "read_error", StatusCode: response.StatusCode, Duration: time.Since(startedAt)})
+		return SuggestResult{}, fail(CodeProviderUnavailable, "AI 建议服务暂时不可用")
+	}
+	if response.StatusCode < http.StatusOK || response.StatusCode >= http.StatusMultipleChoices {
+		s.logProviderFailure(ProviderFailureDiagnostic{CallID: callID, Operation: "suggest_batch", Kind: "http_status", StatusCode: response.StatusCode, Duration: time.Since(startedAt)})
 		return SuggestResult{}, fail(CodeProviderUnavailable, "AI 建议服务暂时不可用")
 	}
 	raw, err := parseSuggestChoices(responseBody)
 	if err != nil {
+		s.logProviderFailure(ProviderFailureDiagnostic{CallID: callID, Operation: "suggest_batch", Kind: "invalid_response", StatusCode: response.StatusCode, Duration: time.Since(startedAt)})
 		return SuggestResult{}, fail(CodeProviderUnavailable, "AI 建议响应无效")
 	}
 
@@ -145,6 +156,22 @@ func (s *Service) SuggestBatch(ctx context.Context, request SuggestRequest) (Sug
 	return SuggestResult{Decisions: decisions, Provider: ProviderOpenAICompatible, Model: setting.Model}, nil
 }
 
+func (s *Service) logProviderFailure(diagnostic ProviderFailureDiagnostic) {
+	if s.ProviderFailureLogger != nil {
+		s.ProviderFailureLogger(diagnostic)
+		return
+	}
+	log.Warnf("AI provider call failed: call_id=%s operation=%s kind=%s status=%d duration_ms=%d",
+		diagnostic.CallID, diagnostic.Operation, diagnostic.Kind, diagnostic.StatusCode, diagnostic.Duration.Milliseconds())
+}
+
+func providerNetworkErrorKind(err error) string {
+	if errors.Is(err, context.DeadlineExceeded) {
+		return "timeout"
+	}
+	return "network_error"
+}
+
 func suggestSystemPrompt(dimension string) string {
 	noun := "颜色或尺码"
 	switch dimension {

server/app/goauto/aimatching/suggest_test.go

@@ -6,7 +6,9 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
+	"time"
 
 	"go-admin/app/goauto/models"
 
@@ -134,3 +136,93 @@ func TestSuggestBatchRequiresConfiguredProvider(t *testing.T) {
 		t.Fatalf("expected CodeNotConfigured, got %v", target.Code)
 	}
 }
+
+func TestSuggestBatchLogsSafeDiagnosticForProvider502(t *testing.T) {
+	const sensitiveBody = "api-key-and-provider-body-must-not-be-logged"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, sensitiveBody, http.StatusBadGateway)
+	}))
+	defer server.Close()
+
+	db := openSuggestTestDB(t)
+	seedEnabledSetting(t, db, server.URL)
+	var diagnostic ProviderFailureDiagnostic
+	service := NewService(db)
+	service.ProviderFailureLogger = func(value ProviderFailureDiagnostic) { diagnostic = value }
+
+	_, err := service.SuggestBatch(context.Background(), SuggestRequest{
+		Sources:    []SuggestSource{{ID: "s1", Label: "sensitive-source"}},
+		Candidates: []SuggestCandidate{{ID: "c1", Label: "sensitive-candidate"}},
+	})
+	if err == nil {
+		t.Fatal("expected provider failure")
+	}
+	if diagnostic.Operation != "suggest_batch" || diagnostic.Kind != "http_status" || diagnostic.StatusCode != http.StatusBadGateway || diagnostic.CallID == "" {
+		t.Fatalf("unexpected diagnostic: %+v", diagnostic)
+	}
+	printed := fmt.Sprintf("%+v", diagnostic)
+	for _, secret := range []string{sensitiveBody, "sensitive-source", "sensitive-candidate", "test-key", server.URL} {
+		if strings.Contains(printed, secret) {
+			t.Fatalf("diagnostic leaked %q: %s", secret, printed)
+		}
+	}
+}
+
+func TestSuggestBatchClassifiesProviderTimeout(t *testing.T) {
+	db := openSuggestTestDB(t)
+	seedEnabledSetting(t, db, "http://provider.invalid")
+	var diagnostic ProviderFailureDiagnostic
+	service := NewService(db)
+	service.HTTPClient = &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
+		return nil, context.DeadlineExceeded
+	})}
+	service.ProviderFailureLogger = func(value ProviderFailureDiagnostic) { diagnostic = value }
+
+	_, err := service.SuggestBatch(context.Background(), SuggestRequest{
+		Sources: []SuggestSource{{ID: "s1", Label: "黑色"}}, Candidates: []SuggestCandidate{{ID: "c1", Label: "黑色"}},
+	})
+	if err == nil || diagnostic.Kind != "timeout" || diagnostic.StatusCode != 0 {
+		t.Fatalf("timeout was not safely classified: diagnostic=%+v err=%v", diagnostic, err)
+	}
+}
+
+func TestSuggestBatchClassifiesInvalidResponseWithoutLoggingBody(t *testing.T) {
+	const sensitiveBody = "not-json-with-sensitive-provider-details"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(sensitiveBody))
+	}))
+	defer server.Close()
+	db := openSuggestTestDB(t)
+	seedEnabledSetting(t, db, server.URL)
+	var diagnostic ProviderFailureDiagnostic
+	service := NewService(db)
+	service.ProviderFailureLogger = func(value ProviderFailureDiagnostic) { diagnostic = value }
+
+	_, err := service.SuggestBatch(context.Background(), SuggestRequest{
+		Sources: []SuggestSource{{ID: "s1", Label: "黑色"}}, Candidates: []SuggestCandidate{{ID: "c1", Label: "黑色"}},
+	})
+	if err == nil || diagnostic.Kind != "invalid_response" || strings.Contains(fmt.Sprintf("%+v", diagnostic), sensitiveBody) {
+		t.Fatalf("invalid response diagnostic is unsafe or missing: diagnostic=%+v err=%v", diagnostic, err)
+	}
+}
+
+func TestSuggestBatchAllowsProviderResponseAfterTwoSeconds(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(2100 * time.Millisecond)
+		chatCompletionResponder(`{"suggestions":[{"sourceId":"s1","candidateId":"c1","confidence":0.95,"reason":"match"}]}`)(w, r)
+	}))
+	defer server.Close()
+
+	db := openSuggestTestDB(t)
+	seedEnabledSetting(t, db, server.URL)
+	result, err := NewService(db).SuggestBatch(context.Background(), SuggestRequest{
+		Sources: []SuggestSource{{ID: "s1", Label: "黑色"}}, Candidates: []SuggestCandidate{{ID: "c1", Label: "黑色"}},
+	})
+	if err != nil || result.Decisions["s1"].CandidateID != "c1" {
+		t.Fatalf("delayed provider response failed: result=%+v err=%v", result, err)
+	}
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (fn roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { return fn(request) }

server/app/goauto/aimatching/types.go

@@ -29,17 +29,36 @@ type MatchRequest struct {
 	Sizes       []string
 }
 
+// SYBSpecParseRequest contains the only source text and closed Shopee
+// candidate sets that may leave GoAuto for an AI-assisted SYB parse. It must
+// never contain the shipment/order, account, address, price or full raw JSON.
+type SYBSpecParseRequest struct {
+	ProductSpec string
+	Colors      []string
+	Sizes       []string
+}
+
+type SYBSpecParseResult struct {
+	Color      string
+	Size       string
+	Provider   string
+	Model      string
+	Reason     string
+	Confidence *float64
+}
+
 type CandidateSnapshot struct {
 	Colors []string `json:"colors,omitempty"`
 	Sizes  []string `json:"sizes,omitempty"`
 }
 
 type DecisionSnapshot struct {
-	Source     string            `json:"source"`
-	Provider   string            `json:"provider,omitempty"`
-	Model      string            `json:"model,omitempty"`
-	Candidates CandidateSnapshot `json:"candidates"`
-	Matched    struct {
+	Source      string            `json:"source"`
+	Provider    string            `json:"provider,omitempty"`
+	Model       string            `json:"model,omitempty"`
+	Candidates  CandidateSnapshot `json:"candidates"`
+	RoleSources map[string]string `json:"roleSources,omitempty"`
+	Matched     struct {
 		Color string `json:"color,omitempty"`
 		Size  string `json:"size,omitempty"`
 	} `json:"matched"`

server/app/goauto/apprelease/apk_test.go

@@ -18,7 +18,7 @@ func TestParseBuiltAgentAPKWhenAvailable(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if metadata.VersionCode != 49 || metadata.VersionName != "0.9.36" {
+	if metadata.VersionCode != 54 || metadata.VersionName != "0.9.41" {
 		t.Fatalf("metadata=%+v", metadata)
 	}
 }

server/app/goauto/clientapi/gateway.go

@@ -0,0 +1,158 @@
+package clientapi
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/common/clientprincipal"
+	"gorm.io/gorm"
+)
+
+// Both HTTP and HTTPS are supported by explicit operator decision (#237).
+// Transport does not grant identity or permissions; secrets remain non-cacheable.
+func NoStore(c *gin.Context) {
+	c.Header("Cache-Control", "no-store")
+	c.Next()
+}
+func Gate(db *gorm.DB, e Endpoint) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Cache-Control", "no-store")
+		deny := func(status int, message string) {
+			c.AbortWithStatusJSON(status, gin.H{"code": status, "message": message})
+		}
+		// Never accept a credential supplied through a URL or cookie fallback.
+		for k := range c.Request.URL.Query() {
+			if sensitive(k) || strings.EqualFold(k, "token") {
+				deny(400, "密钥只能通过 Authorization 请求头发送")
+				return
+			}
+		}
+		header := strings.Fields(c.GetHeader("Authorization"))
+		if len(header) != 2 || !strings.EqualFold(header[0], "Bearer") {
+			deny(401, "需要客户端密钥")
+			return
+		}
+		connection := db
+		var err error
+		if connection == nil {
+			connection, err = pkg.GetOrm(c)
+		}
+		if err != nil || connection == nil {
+			deny(503, "客户端认证暂不可用")
+			return
+		}
+		key, err := (clientkey.Service{DB: connection}).Authenticate(c.Request.Context(), header[1])
+		if err != nil {
+			if errors.Is(err, clientkey.ErrCredential) {
+				deny(401, "客户端密钥无效或已停用")
+			} else {
+				deny(503, "客户端认证暂不可用")
+			}
+			return
+		}
+		random := make([]byte, 16)
+		if _, err = rand.Read(random); err != nil {
+			deny(503, "审计暂不可用")
+			return
+		}
+		requestID := hex.EncodeToString(random)
+		c.Header("X-Client-Request-Id", requestID)
+		record := clientkey.Audit{KeyID: key.ID, Event: "request", RequestID: requestID, Method: e.Method, Route: "/api/client/v1" + e.Path}
+		if !key.Allows(e.Module, e.Capability) {
+			record.Status = 403
+			_ = connection.Create(&record).Error
+			deny(403, "密钥未授权此模块或执行动作")
+			return
+		}
+		// The intent must be durable before any business handler can run.
+		if err = connection.WithContext(c.Request.Context()).Create(&record).Error; err != nil {
+			deny(503, "审计暂不可用，未执行操作")
+			return
+		}
+		clientprincipal.Set(c, clientprincipal.Identity{KeyID: key.ID, RequestID: requestID, AuthorizedBy: key.UpdatedBy})
+		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 16<<20)
+		original := c.Writer
+		buffer := &responseBuffer{ResponseWriter: original, status: 200}
+		c.Writer = buffer
+		defer func() { c.Writer = original }()
+		c.Next()
+		c.Writer = original
+		status := buffer.status
+		var value any
+		if buffer.overflow || json.Unmarshal(buffer.body.Bytes(), &value) != nil {
+			status = 502
+			value = gin.H{"code": 502, "message": "无法生成客户端响应，请先核对操作结果，不要自动重试"}
+		} else {
+			value = redact(value)
+		}
+		auditCtx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		_ = connection.WithContext(auditCtx).Model(&clientkey.Audit{}).Where("id = ?", record.ID).Update("status", status).Error
+		now := time.Now().UTC()
+		_ = connection.WithContext(auditCtx).Model(&clientkey.Key{}).Where("id = ?", key.ID).UpdateColumn("last_used_at", now).Error
+		c.JSON(status, value)
+	}
+}
+
+type responseBuffer struct {
+	gin.ResponseWriter
+	body     bytes.Buffer
+	status   int
+	overflow bool
+}
+
+func (w *responseBuffer) WriteHeader(status int) { w.status = status }
+func (w *responseBuffer) WriteHeaderNow()        {}
+func (w *responseBuffer) Status() int            { return w.status }
+func (w *responseBuffer) Size() int              { return w.body.Len() }
+func (w *responseBuffer) Written() bool          { return w.body.Len() > 0 }
+func (w *responseBuffer) Write(b []byte) (int, error) {
+	if w.body.Len()+len(b) > 32<<20 {
+		w.overflow = true
+		return len(b), nil
+	}
+	return w.body.Write(b)
+}
+func (w *responseBuffer) WriteString(s string) (int, error) { return w.Write([]byte(s)) }
+func (w *responseBuffer) Flush()                            {}
+
+func sensitive(k string) bool {
+	key := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(k, "_", ""), "-", ""))
+	for _, part := range []string{"password", "passwd", "secret", "credential", "cookie", "authorization", "apikey", "accesstoken", "devicetoken", "refreshtoken", "recoverycode"} {
+		if strings.Contains(key, part) {
+			return true
+		}
+	}
+	switch key {
+	case "token", "tokenhash", "digest", "rawjson", "rawpayload", "rawresponse", "requestheaders", "responseheaders":
+		return true
+	}
+	return false
+}
+func redact(v any) any {
+	switch value := v.(type) {
+	case map[string]any:
+		for k, item := range value {
+			if sensitive(k) {
+				delete(value, k)
+			} else {
+				value[k] = redact(item)
+			}
+		}
+	case []any:
+		for i, item := range value {
+			value[i] = redact(item)
+		}
+	}
+	return v
+}

server/app/goauto/clientapi/gateway_test.go

@@ -0,0 +1,165 @@
+package clientapi
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/common/clientprincipal"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func fixture(t *testing.T) (*gorm.DB, clientkey.Service) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sql, _ := db.DB()
+	sql.SetMaxOpenConns(1)
+	t.Cleanup(func() { sql.Close() })
+	if err = db.AutoMigrate(&clientkey.Key{}, &clientkey.Audit{}); err != nil {
+		t.Fatal(err)
+	}
+	return db, clientkey.Service{DB: db, Modules: Catalog(Inventory())}
+}
+func TestEveryRouteIsExplicitlyScoped(t *testing.T) {
+	db, s := fixture(t)
+	routes := Inventory()
+	if len(s.Modules) != 12 {
+		t.Fatal("menu groups lost")
+	}
+	router := gin.New()
+	seen := map[string]bool{}
+	for _, e := range routes {
+		key := e.Method + e.Path
+		if seen[key] {
+			t.Fatal("duplicate route")
+		}
+		seen[key] = true
+		if strings.Contains(e.Path, "payment") || strings.Contains(e.Path, "token") || strings.Contains(e.Path, "client-keys") || e.Handle == nil {
+			t.Fatal("forbidden route")
+		}
+		router.Handle(e.Method, "/api/client/v1"+e.Path, Gate(db, e), func(c *gin.Context) { c.JSON(200, gin.H{"data": "ok"}) })
+		if e.Method != "GET" && e.Capability == "read" {
+			t.Fatal("mutating read permission")
+		}
+	}
+	for _, e := range routes {
+		for _, scheme := range []string{"http", "https"} {
+			grant := clientkey.Grant{Module: e.Module}
+			v, token, err := s.Create(context.Background(), "test", []clientkey.Grant{grant}, 1)
+			if err != nil {
+				t.Fatal(err)
+			}
+			path := e.Path
+			for _, param := range []string{":productId", ":runId", ":recordId", ":jobId", ":batchId", ":shopId", ":ruleId", ":taskId"} {
+				path = strings.ReplaceAll(path, param, "1")
+			}
+			req := httptest.NewRequest(e.Method, scheme+"://example.test/api/client/v1"+path, nil)
+			req.Header.Set("Authorization", "Bearer "+token)
+			rr := httptest.NewRecorder()
+			router.ServeHTTP(rr, req)
+			want := 200
+			if e.Capability != "read" {
+				want = 403
+			}
+			if rr.Code != want {
+				t.Fatalf("%s got %d want %d", keyFor(e), rr.Code, want)
+			}
+			if e.Capability == "write" {
+				grant.Write = true
+			} else if e.Capability != "read" {
+				grant.Actions = []string{e.Capability}
+			}
+			if _, err = s.Update(context.Background(), v.ID, 1, 1, []clientkey.Grant{grant}, false); err != nil {
+				t.Fatal(err)
+			}
+			rr = httptest.NewRecorder()
+			router.ServeHTTP(rr, req.Clone(context.Background()))
+			if rr.Code != 200 {
+				t.Fatalf("authorized %s failed: %d", keyFor(e), rr.Code)
+			}
+		}
+	}
+}
+func keyFor(e Endpoint) string { return e.Method + " " + e.Path }
+func TestRevocationTransportRedactionAndAudit(t *testing.T) {
+	db, s := fixture(t)
+	v, token, err := s.Create(context.Background(), "test", []clientkey.Grant{{Module: "pdd_products"}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e := Endpoint{Method: "GET", Path: "/pdd-products", Module: "pdd_products", Capability: "read"}
+	router := gin.New()
+	calls := 0
+	router.GET("/api/client/v1/pdd-products", Gate(db, e), func(c *gin.Context) {
+		calls++
+		id, ok := clientprincipal.Get(c)
+		if !ok || id.KeyID != v.ID {
+			t.Error("client attribution missing")
+		}
+		c.JSON(200, gin.H{"code": 200, "data": gin.H{"apiKey": "sentinel-secret", "rawJson": "sentinel-raw", "title": "product", "nested": []any{gin.H{"device_token": "sentinel-token"}}}})
+	})
+	send := func(tlsOn bool, credential, path string) *httptest.ResponseRecorder {
+		req := httptest.NewRequest("GET", "http://example.test"+path, nil)
+		if tlsOn {
+			req.TLS = &tls.ConnectionState{}
+		}
+		req.Header.Set("Authorization", "Bearer "+credential)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, req)
+		return rr
+	}
+	path := "/api/client/v1/pdd-products"
+	for _, tlsOn := range []bool{false, true} {
+		if send(tlsOn, "jwt", path).Code != 401 || send(tlsOn, "", path).Code != 401 || send(tlsOn, token, path+"?token=invalid").Code != 400 {
+			t.Fatal("credential fallback accepted")
+		}
+		rr := send(tlsOn, token, path)
+		if rr.Code != 200 || strings.Contains(rr.Body.String(), "sentinel") || !strings.Contains(rr.Body.String(), "product") {
+			t.Fatal("redaction failed")
+		}
+		if rr.Header().Get("Cache-Control") != "no-store" || rr.Header().Get("X-Client-Request-Id") == "" {
+			t.Fatal("cache or audit headers missing")
+		}
+	}
+	if _, err = s.Update(context.Background(), v.ID, 1, 1, nil, true); err != nil {
+		t.Fatal(err)
+	}
+	if send(true, token, path).Code != 401 || send(false, token, path).Code != 401 || calls != 2 {
+		t.Fatal("revocation not immediate")
+	}
+	var logs []clientkey.Audit
+	db.Find(&logs)
+	raw, _ := json.Marshal(logs)
+	if strings.Contains(string(raw), token) || strings.Contains(string(raw), "sentinel") {
+		t.Fatal("audit leaked payload")
+	}
+}
+func TestAuditUnavailableDoesNotExecute(t *testing.T) {
+	db, s := fixture(t)
+	_, token, err := s.Create(context.Background(), "test", []clientkey.Grant{{Module: "pdd_products", Write: true}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	db.Migrator().DropTable(&clientkey.Audit{})
+	router := gin.New()
+	called := false
+	e := Endpoint{Method: "POST", Path: "/pdd-products", Module: "pdd_products", Capability: "write"}
+	router.POST(e.Path, Gate(db, e), func(c *gin.Context) { called = true; c.JSON(200, gin.H{}) })
+	req := httptest.NewRequest("POST", "https://example.test"+e.Path, nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	if rr.Code != 503 || called {
+		t.Fatal("executed without audit")
+	}
+}

server/app/goauto/clientapi/integration_test.go

@@ -0,0 +1,81 @@
+package clientapi
+
+import (
+	"context"
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/product"
+	"go-admin/common/middleware"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestClientCanCreateProductWithoutLoginAndReplay(t *testing.T) {
+	db, s := fixture(t)
+	if err := db.AutoMigrate(&models.PDDProduct{}); err != nil {
+		t.Fatal(err)
+	}
+	_, token, err := s.Create(context.Background(), "test", []clientkey.Grant{{Module: "pdd_products", Write: true}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	e := Endpoint{Method: "POST", Path: "/pdd-products", Module: "pdd_products", Capability: "write"}
+	router := gin.New()
+	router.Use(func(c *gin.Context) { c.Set("db", db); c.Next() })
+	router.POST("/api/client/v1/pdd-products", Gate(db, e), product.Handler{}.Create)
+	for n := 0; n < 2; n++ {
+		req := httptest.NewRequest("POST", "https://example.test/api/client/v1/pdd-products", strings.NewReader(`{"requestId":"00000000-0000-4000-8000-000000000237","url":"https://mobile.yangkeduo.com/goods.html?goods_id=100000000001"}`))
+		req.Header.Set("Authorization", "Bearer "+token)
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, req)
+		if rr.Code != 200 {
+			t.Fatalf("product create failed status %d", rr.Code)
+		}
+		var body struct {
+			Data struct {
+				Replayed bool `json:"replayed"`
+			}
+		}
+		json.Unmarshal(rr.Body.Bytes(), &body)
+		if (n == 1) != body.Data.Replayed {
+			t.Fatal("business idempotency changed")
+		}
+	}
+	var count int64
+	db.Model(&models.PDDProduct{}).Count(&count)
+	if count != 1 {
+		t.Fatal("duplicate business write")
+	}
+}
+
+func TestManagementRequiresAdminNotClientIdentity(t *testing.T) {
+	db, s := fixture(t)
+	h := clientkey.Handler{DB: db, Modules: s.Modules}
+	for _, role := range []string{"admin", "purchaser", "client", ""} {
+		for _, scheme := range []string{"http", "https"} {
+			router := gin.New()
+			router.Use(func(c *gin.Context) {
+				c.Set(jwt.JwtPayloadKey, jwt.MapClaims{"rolekey": role, "identity": float64(7)})
+				c.Next()
+			})
+			router.POST("/keys", middleware.RequireRoleKey("admin"), NoStore, h.Create)
+			req := httptest.NewRequest("POST", scheme+"://example.test/keys", strings.NewReader(`{"name":"test","grants":[{"module":"pdd_products","write":false,"actions":[]}]}`))
+			rr := httptest.NewRecorder()
+			router.ServeHTTP(rr, req)
+			want := 403
+			if role == "admin" {
+				want = 200
+			}
+			if rr.Code != want {
+				t.Fatalf("role %q status %d", role, rr.Code)
+			}
+			if role == "admin" && rr.Header().Get("Cache-Control") != "no-store" {
+				t.Fatal("one-time secret cacheable")
+			}
+		}
+	}
+}

server/app/goauto/clientapi/matching.go

@@ -0,0 +1,45 @@
+package clientapi
+
+import (
+	"encoding/json"
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	"go-admin/app/goauto/aimatching"
+	"io"
+	"net/http"
+)
+
+// resolveSpecs accepts only specification text, never a provider URL/key,
+// prompt, raw order, address or account. It returns a suggestion, not an order.
+func resolveSpecs(c *gin.Context) {
+	var req struct {
+		TargetColor string   `json:"targetColor"`
+		TargetSize  string   `json:"targetSize"`
+		Colors      []string `json:"colors"`
+		Sizes       []string `json:"sizes"`
+	}
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 64<<10)
+	d := json.NewDecoder(c.Request.Body)
+	d.DisallowUnknownFields()
+	if d.Decode(&req) != nil || d.Decode(&struct{}{}) != io.EOF || len(req.Colors) > 200 || len(req.Sizes) > 200 {
+		c.JSON(422, gin.H{"code": 422, "message": "规格请求无效"})
+		return
+	}
+	for _, s := range append(append([]string{req.TargetColor, req.TargetSize}, req.Colors...), req.Sizes...) {
+		if len([]rune(s)) > 255 {
+			c.JSON(422, gin.H{"code": 422, "message": "规格值过长"})
+			return
+		}
+	}
+	db, err := pkg.GetOrm(c)
+	if err != nil {
+		c.JSON(503, gin.H{"code": 503})
+		return
+	}
+	v, err := aimatching.NewService(db).Resolve(c.Request.Context(), aimatching.MatchRequest{TargetColor: req.TargetColor, TargetSize: req.TargetSize, Colors: req.Colors, Sizes: req.Sizes})
+	if err != nil {
+		c.JSON(422, gin.H{"code": 422, "message": "未获得可靠匹配，请检查候选规格或联系管理员"})
+		return
+	}
+	c.JSON(200, gin.H{"code": 200, "data": gin.H{"mappedColor": v.MappedColor, "mappedSize": v.MappedSize, "source": v.Source}})
+}

server/app/goauto/clientapi/routes.go

@@ -0,0 +1,170 @@
+// Package clientapi exposes only the reviewed client route inventory. It never
+// forwards arbitrary URLs or synthesizes a logged-in administrator identity.
+package clientapi
+
+import (
+	"go-admin/app/goauto/access"
+	"go-admin/app/goauto/aimatching"
+	"go-admin/app/goauto/clientkey"
+	"go-admin/app/goauto/device"
+	"go-admin/app/goauto/product"
+	"go-admin/app/goauto/purchase"
+	"go-admin/app/goauto/purchaserule"
+	"go-admin/app/goauto/rule"
+	"go-admin/app/goauto/shopeeproduct"
+	"go-admin/app/goauto/sybimport"
+	"go-admin/app/goauto/sybinnercode"
+	"go-admin/app/goauto/sybshop"
+	"go-admin/app/goauto/task"
+	"go-admin/common/middleware"
+	"sort"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
+)
+
+type Endpoint struct {
+	Method, Path, Module, Capability string
+	Handle                           gin.HandlerFunc
+}
+
+func Inventory() []Endpoint {
+	p := product.Handler{}
+	s := shopeeproduct.Handler{}
+	y := sybimport.Handler{}
+	i := sybinnercode.Handler{}
+	shop := sybshop.Handler{}
+	r := rule.Handler{}
+	pr := purchaserule.Handler{}
+	t := task.Handler{}
+	buy := purchase.Handler{}
+	return []Endpoint{
+		{"POST", "/ai-matching-settings/resolve", access.ModuleAIMatching, "match", resolveSpecs},
+		{"GET", "/devices", access.ModuleDevices, "read", device.Handler{}.List},
+		{"GET", "/pdd-products", access.ModulePDDProducts, "read", p.List},
+		{"GET", "/pdd-products/:productId", access.ModulePDDProducts, "read", p.Detail},
+		{"POST", "/pdd-products", access.ModulePDDProducts, "write", p.Create},
+		{"PATCH", "/pdd-products/:productId", access.ModulePDDProducts, "write", p.Update},
+		{"GET", "/shopee-products", access.ModuleShopeeProducts, "read", s.List},
+		{"GET", "/shopee-products/:productId", access.ModuleShopeeProducts, "read", s.Detail},
+		{"POST", "/shopee-products", access.ModuleShopeeProducts, "write", s.Create},
+		{"PATCH", "/shopee-products/:productId", access.ModuleShopeeProducts, "write", s.Update},
+		{"POST", "/shopee-products/:productId/link-pdd", access.ModuleShopeeProducts, "write", s.LinkPDD},
+		{"POST", "/shopee-products/:productId/specs/values", access.ModuleShopeeProducts, "write", s.AddSpecValue},
+		{"PUT", "/shopee-products/:productId/specs/mapping", access.ModuleShopeeProducts, "write", s.SetMapping},
+		{"DELETE", "/shopee-products/:productId/specs/values", access.ModuleShopeeProducts, "delete", s.RemoveSpecValue},
+		{"DELETE", "/shopee-products/:productId/specs/mapping", access.ModuleShopeeProducts, "delete", s.ClearMapping},
+		{"POST", "/shopee-products/batch-delete", access.ModuleShopeeProducts, "delete", s.BatchDelete},
+		{"POST", "/shopee-products/:productId/specs/mapping/auto-match", access.ModuleShopeeProducts, "match", s.AutoMatchMappings},
+		{"POST", "/shopee-products/:productId/specs/mapping/confirm", access.ModuleShopeeProducts, "match", s.ConfirmMapping},
+		{"GET", "/syb-products", access.ModuleSYBProducts, "read", y.List},
+		{"GET", "/syb-products/:productId", access.ModuleSYBProducts, "read", y.Detail},
+		{"PATCH", "/syb-products/:productId/correction", access.ModuleSYBProducts, "write", y.ManualCorrect},
+		{"POST", "/syb-products/:productId/reparse", access.ModuleSYBProducts, "reparse", y.Reparse},
+		{"POST", "/syb-products/reparse-batch", access.ModuleSYBProducts, "reparse", y.ReparseBatch},
+		{"GET", "/syb-products/sync-runs", access.ModuleSYBSyncRuns, "read", y.ListSyncRuns},
+		{"GET", "/syb-products/sync-runs/:runId", access.ModuleSYBSyncRuns, "read", y.SyncRunDetail},
+		{"POST", "/syb-products/import", access.ModuleSYBSyncRuns, "sync", y.Import},
+		{"GET", "/syb-inner-codes", access.ModuleSYBInnerCodes, "read", i.List},
+		{"GET", "/syb-inner-codes/:recordId", access.ModuleSYBInnerCodes, "read", i.Detail},
+		{"GET", "/syb-inner-codes/match-jobs/:jobId", access.ModuleSYBInnerCodes, "read", i.MatchJob},
+		{"GET", "/syb-inner-codes/apply-batches/:batchId", access.ModuleSYBInnerCodes, "read", i.ApplyBatch},
+		{"POST", "/syb-inner-codes/rematch", access.ModuleSYBInnerCodes, "match", i.Rematch},
+		{"POST", "/syb-inner-codes/import", access.ModuleSYBInnerCodes, "import", i.Import},
+		{"POST", "/syb-inner-codes/batch-delete", access.ModuleSYBInnerCodes, "delete", i.Delete},
+		{"POST", "/syb-inner-codes/apply-preview", access.ModuleSYBInnerCodes, "writeback", i.ApplyPreview},
+		{"POST", "/syb-inner-codes/apply", access.ModuleSYBInnerCodes, "writeback", i.Apply},
+		{"POST", "/syb-inner-codes/:recordId/recheck", access.ModuleSYBInnerCodes, "match", i.Recheck},
+		{"GET", "/syb-shops", access.ModuleSYBShops, "read", shop.List},
+		{"POST", "/syb-shops", access.ModuleSYBShops, "write", shop.Create},
+		{"PATCH", "/syb-shops/:shopId/name", access.ModuleSYBShops, "write", shop.Rename},
+		{"PATCH", "/syb-shops/:shopId/enabled", access.ModuleSYBShops, "write", shop.SetEnabled},
+		{"DELETE", "/syb-shops/:shopId", access.ModuleSYBShops, "delete", shop.Delete},
+		{"GET", "/collection-rules", access.ModuleCollectionRules, "read", r.List},
+		{"POST", "/collection-rules", access.ModuleCollectionRules, "write", r.Create},
+		{"PATCH", "/collection-rules/:ruleId", access.ModuleCollectionRules, "write", r.Update},
+		{"DELETE", "/collection-rules/:ruleId", access.ModuleCollectionRules, "delete", r.Delete},
+		{"GET", "/purchase-rules", access.ModulePurchaseRules, "read", pr.List},
+		{"GET", "/purchase-rules/current", access.ModulePurchaseRules, "read", pr.Current},
+		{"POST", "/purchase-rules", access.ModulePurchaseRules, "write", pr.Create},
+		{"PATCH", "/purchase-rules/:ruleId", access.ModulePurchaseRules, "write", pr.Update},
+		{"DELETE", "/purchase-rules/:ruleId", access.ModulePurchaseRules, "delete", pr.Delete},
+		{"PUT", "/purchase-rules/current", access.ModulePurchaseRules, "activate", pr.SetCurrent},
+		{"GET", "/collection-tasks", access.ModuleCollectionTasks, "read", t.AdminList},
+		{"GET", "/collection-tasks/:taskId", access.ModuleCollectionTasks, "read", t.AdminDetail},
+		{"POST", "/collection-tasks", access.ModuleCollectionTasks, "collect", t.AdminCreate},
+		{"POST", "/collection-tasks/batch", access.ModuleCollectionTasks, "collect", t.AdminBatchCreate},
+		{"POST", "/collection-tasks/:taskId/reset", access.ModuleCollectionTasks, "collect", t.AdminReset},
+		{"DELETE", "/collection-tasks/:taskId", access.ModuleCollectionTasks, "delete", t.AdminDelete},
+		{"GET", "/purchase-tasks", access.ModulePurchaseTasks, "read", buy.AdminList},
+		{"GET", "/purchase-tasks/:taskId", access.ModulePurchaseTasks, "read", buy.AdminDetail},
+		{"POST", "/purchase-tasks/batch-preview", access.ModulePurchaseTasks, "purchase", buy.AdminBatchPreview},
+		{"POST", "/purchase-tasks", access.ModulePurchaseTasks, "purchase", buy.AdminCreate},
+		{"POST", "/purchase-tasks/batch", access.ModulePurchaseTasks, "purchase", buy.AdminBatchCreate},
+		{"POST", "/purchase-tasks/batch-retry", access.ModulePurchaseTasks, "purchase", buy.AdminBatchRetry},
+		{"POST", "/purchase-tasks/stock", access.ModulePurchaseTasks, "purchase", buy.AdminCreateStock},
+		{"GET", "/ai-matching-settings", access.ModuleAIMatching, "read", func(c *gin.Context) {
+			db, err := pkg.GetOrm(c)
+			if err != nil {
+				c.JSON(500, gin.H{"code": 500})
+				return
+			}
+			v, err := aimatching.NewService(db).Settings(c.Request.Context())
+			if err != nil {
+				c.JSON(500, gin.H{"code": 500})
+				return
+			}
+			c.JSON(200, gin.H{"code": 200, "data": gin.H{"enabled": v.Enabled}})
+		}},
+	}
+}
+
+func Catalog(routes []Endpoint) []clientkey.Module {
+	mods := map[string]clientkey.Module{}
+	for _, m := range access.GoAutoModules() {
+		mods[m.Key] = clientkey.Module{Key: m.Key, Title: m.Title, Actions: []string{}}
+	}
+	for _, e := range routes {
+		m := mods[e.Module]
+		if e.Capability == "write" {
+			m.Writable = true
+		} else if e.Capability != "read" {
+			found := false
+			for _, a := range m.Actions {
+				if a == e.Capability {
+					found = true
+				}
+			}
+			if !found {
+				m.Actions = append(m.Actions, e.Capability)
+			}
+		}
+		mods[e.Module] = m
+	}
+	out := []clientkey.Module{}
+	for _, g := range access.GoAutoMenuGroups() {
+		for _, key := range g.ModuleKeys {
+			m := mods[key]
+			m.Group = g.Title
+			sort.Strings(m.Actions)
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+func InitRouter(engine *gin.Engine, auth *jwt.GinJWTMiddleware) {
+	routes := Inventory()
+	catalog := Catalog(routes)
+	h := clientkey.Handler{Modules: catalog}
+	management := engine.Group("/api/admin/v1/client-keys", auth.MiddlewareFunc(), middleware.RequireRoleKey("admin"), NoStore)
+	management.GET("", h.List)
+	management.GET("/modules", h.Catalog)
+	management.POST("", h.Create)
+	management.PATCH("/:keyId/grants", h.Edit)
+	management.POST("/:keyId/disable", h.Disable)
+	for _, e := range routes {
+		engine.Handle(e.Method, "/api/client/v1"+e.Path, Gate(nil, e), e.Handle)
+	}
+}

server/app/goauto/clientkey/handler.go

@@ -0,0 +1,127 @@
+package clientkey
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg"
+	"github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth/user"
+	"gorm.io/gorm"
+)
+
+type Handler struct {
+	DB      *gorm.DB
+	Modules []Module
+}
+
+func (h Handler) service(c *gin.Context) (Service, bool) {
+	db := h.DB
+	var err error
+	if db == nil {
+		db, err = pkg.GetOrm(c)
+	}
+	if err != nil || db == nil {
+		failure(c, errors.New("database unavailable"))
+		return Service{}, false
+	}
+	c.Header("Cache-Control", "no-store")
+	return Service{db, h.Modules}, true
+}
+func failure(c *gin.Context, err error) {
+	status, message := 500, "服务端处理失败"
+	switch {
+	case errors.Is(err, ErrInvalid):
+		status, message = 422, ErrInvalid.Error()
+	case errors.Is(err, ErrConflict):
+		status, message = 409, ErrConflict.Error()
+	case errors.Is(err, gorm.ErrRecordNotFound):
+		status, message = 404, "密钥不存在"
+	}
+	c.AbortWithStatusJSON(status, gin.H{"code": status, "message": message})
+}
+func (h Handler) Catalog(c *gin.Context) { c.JSON(200, gin.H{"code": 200, "data": h.Modules}) }
+func (h Handler) List(c *gin.Context) {
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	if page < 1 {
+		page = 1
+	}
+	size := 20
+	var total int64
+	var keys []Key
+	if err := s.DB.WithContext(c.Request.Context()).Model(&Key{}).Count(&total).Error; err != nil {
+		failure(c, err)
+		return
+	}
+	if err := s.DB.WithContext(c.Request.Context()).Order("id DESC").Offset((page - 1) * size).Limit(size).Find(&keys).Error; err != nil {
+		failure(c, err)
+		return
+	}
+	items := make([]View, 0, len(keys))
+	for _, k := range keys {
+		items = append(items, view(k))
+	}
+	c.JSON(200, gin.H{"code": 200, "data": gin.H{"items": items, "total": total, "page": page, "pageSize": size}})
+}
+func decode(c *gin.Context, v any) bool {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 64<<10)
+	d := json.NewDecoder(c.Request.Body)
+	d.DisallowUnknownFields()
+	if d.Decode(v) != nil || d.Decode(&struct{}{}) != io.EOF {
+		failure(c, ErrInvalid)
+		return false
+	}
+	return true
+}
+func (h Handler) Create(c *gin.Context) {
+	var req struct {
+		Name   string  `json:"name"`
+		Grants []Grant `json:"grants"`
+	}
+	if !decode(c, &req) {
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	result, secret, err := s.Create(c.Request.Context(), req.Name, req.Grants, uint64(user.GetUserId(c)))
+	if err != nil {
+		failure(c, err)
+		return
+	}
+	c.JSON(200, gin.H{"code": 200, "data": gin.H{"key": result, "secret": secret}})
+}
+func (h Handler) Edit(c *gin.Context)    { h.update(c, false) }
+func (h Handler) Disable(c *gin.Context) { h.update(c, true) }
+func (h Handler) update(c *gin.Context, disable bool) {
+	id, err := strconv.ParseUint(c.Param("keyId"), 10, 64)
+	if err != nil {
+		failure(c, ErrInvalid)
+		return
+	}
+	var req struct {
+		Version uint64  `json:"version"`
+		Grants  []Grant `json:"grants"`
+	}
+	if !decode(c, &req) {
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	result, err := s.Update(c.Request.Context(), id, req.Version, uint64(user.GetUserId(c)), req.Grants, disable)
+	if err != nil {
+		failure(c, err)
+		return
+	}
+	c.JSON(200, gin.H{"code": 200, "data": result})
+}

server/app/goauto/clientkey/service.go

@@ -0,0 +1,222 @@
+// Package clientkey implements independent, revocable client credentials (#237).
+package clientkey
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"sort"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+var ErrInvalid = errors.New("名称或授权无效")
+var ErrConflict = errors.New("密钥已停用或授权已被修改，请刷新后重试")
+var ErrCredential = errors.New("客户端密钥无效或已停用")
+
+type Grant struct {
+	Module  string   `json:"module"`
+	Write   bool     `json:"write"`
+	Actions []string `json:"actions"`
+}
+type Module struct {
+	Key      string   `json:"key"`
+	Title    string   `json:"title"`
+	Group    string   `json:"group"`
+	Writable bool     `json:"writable"`
+	Actions  []string `json:"actions"`
+}
+type Key struct {
+	ID         uint64     `gorm:"primaryKey" json:"id"`
+	Name       string     `gorm:"size:80;not null" json:"name"`
+	Prefix     string     `gorm:"size:24;not null" json:"prefix"`
+	Digest     string     `gorm:"size:64;uniqueIndex;not null" json:"-"`
+	GrantsJSON string     `gorm:"type:text;not null" json:"-"`
+	Enabled    bool       `gorm:"not null" json:"enabled"`
+	Version    uint64     `gorm:"not null" json:"version"`
+	CreatedBy  uint64     `json:"createdBy"`
+	UpdatedBy  uint64     `json:"updatedBy"`
+	CreatedAt  time.Time  `json:"createdAt"`
+	UpdatedAt  time.Time  `json:"updatedAt"`
+	LastUsedAt *time.Time `json:"lastUsedAt"`
+}
+
+func (Key) TableName() string { return "client_api_key" }
+
+type Audit struct {
+	ID        uint64 `gorm:"primaryKey"`
+	KeyID     uint64 `gorm:"index;not null"`
+	ActorID   uint64
+	Event     string `gorm:"size:32;not null"`
+	RequestID string `gorm:"size:32;index"`
+	Method    string `gorm:"size:10"`
+	Route     string `gorm:"size:180"`
+	Status    int
+	Changes   string `gorm:"type:text"`
+	CreatedAt time.Time
+}
+
+func (Audit) TableName() string { return "client_api_key_audit" }
+
+type View struct {
+	Key
+	Grants []Grant `json:"grants"`
+}
+
+func view(k Key) View {
+	var g []Grant
+	_ = json.Unmarshal([]byte(k.GrantsJSON), &g)
+	return View{Key: k, Grants: g}
+}
+
+type Service struct {
+	DB      *gorm.DB
+	Modules []Module
+}
+
+func (s Service) Normalize(in []Grant) ([]Grant, error) {
+	if len(in) == 0 || len(in) > len(s.Modules) {
+		return nil, ErrInvalid
+	}
+	catalog := map[string]Module{}
+	for _, m := range s.Modules {
+		catalog[m.Key] = m
+	}
+	seen := map[string]bool{}
+	out := make([]Grant, 0, len(in))
+	for _, g := range in {
+		m, ok := catalog[g.Module]
+		if !ok || seen[g.Module] || (g.Write && !m.Writable) {
+			return nil, ErrInvalid
+		}
+		seen[g.Module] = true
+		allowed := map[string]bool{}
+		for _, a := range m.Actions {
+			allowed[a] = true
+		}
+		used := map[string]bool{}
+		actions := []string{}
+		for _, a := range g.Actions {
+			if !allowed[a] || used[a] {
+				return nil, ErrInvalid
+			}
+			used[a] = true
+			actions = append(actions, a)
+		}
+		sort.Strings(actions)
+		out = append(out, Grant{g.Module, g.Write, actions})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Module < out[j].Module })
+	return out, nil
+}
+func (s Service) Create(ctx context.Context, name string, grants []Grant, actor uint64) (View, string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" || len([]rune(name)) > 80 || actor == 0 {
+		return View{}, "", ErrInvalid
+	}
+	g, err := s.Normalize(grants)
+	if err != nil {
+		return View{}, "", err
+	}
+	raw, _ := json.Marshal(g)
+	secret := make([]byte, 32)
+	if _, err = rand.Read(secret); err != nil {
+		return View{}, "", err
+	}
+	token := "gak_" + hex.EncodeToString(secret)
+	digest := sha256.Sum256([]byte(token))
+	k := Key{Name: name, Prefix: token[:16], Digest: hex.EncodeToString(digest[:]), GrantsJSON: string(raw), Enabled: true, Version: 1, CreatedBy: actor, UpdatedBy: actor}
+	err = s.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.Create(&k).Error; err != nil {
+			return err
+		}
+		return tx.Create(&Audit{KeyID: k.ID, ActorID: actor, Event: "create", Changes: string(raw)}).Error
+	})
+	if err != nil {
+		return View{}, "", err
+	}
+	return view(k), token, nil
+}
+func (s Service) Update(ctx context.Context, id, version, actor uint64, grants []Grant, disable bool) (View, error) {
+	if id == 0 || version == 0 || actor == 0 {
+		return View{}, ErrInvalid
+	}
+	var raw []byte
+	if !disable {
+		g, err := s.Normalize(grants)
+		if err != nil {
+			return View{}, err
+		}
+		raw, _ = json.Marshal(g)
+	}
+	var k Key
+	err := s.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := tx.First(&k, id).Error; err != nil {
+			return err
+		}
+		changes := map[string]any{"version": version + 1, "updated_by": actor, "updated_at": time.Now().UTC()}
+		event := "edit"
+		if disable {
+			changes["enabled"] = false
+			event = "disable"
+		} else {
+			changes["grants_json"] = string(raw)
+		}
+		result := tx.Model(&Key{}).Where("id = ? AND version = ? AND enabled = ?", id, version, true).Updates(changes)
+		if result.Error != nil {
+			return result.Error
+		}
+		if result.RowsAffected != 1 {
+			return ErrConflict
+		}
+		diff, _ := json.Marshal(map[string]string{"before": k.GrantsJSON, "after": string(raw)})
+		if err := tx.Create(&Audit{KeyID: id, ActorID: actor, Event: event, Changes: string(diff)}).Error; err != nil {
+			return err
+		}
+		return tx.First(&k, id).Error
+	})
+	return view(k), err
+}
+func (s Service) Authenticate(ctx context.Context, token string) (Key, error) {
+	if len(token) != 68 || !strings.HasPrefix(token, "gak_") {
+		return Key{}, ErrCredential
+	}
+	if _, err := hex.DecodeString(token[4:]); err != nil {
+		return Key{}, ErrCredential
+	}
+	digest := sha256.Sum256([]byte(token))
+	var k Key
+	err := s.DB.WithContext(ctx).Where("digest = ? AND enabled = ?", hex.EncodeToString(digest[:]), true).First(&k).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return Key{}, ErrCredential
+	}
+	return k, err
+}
+func (k Key) Allows(module, capability string) bool {
+	var grants []Grant
+	if json.Unmarshal([]byte(k.GrantsJSON), &grants) != nil {
+		return false
+	}
+	for _, g := range grants {
+		if g.Module != module {
+			continue
+		}
+		if capability == "read" {
+			return true
+		}
+		if capability == "write" {
+			return g.Write
+		}
+		for _, a := range g.Actions {
+			if a == capability {
+				return true
+			}
+		}
+	}
+	return false
+}

server/app/goauto/clientkey/service_test.go

@@ -0,0 +1,115 @@
+package clientkey
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+	"strings"
+	"testing"
+)
+
+func testService(t *testing.T) Service {
+	t.Helper()
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sql, _ := db.DB()
+	sql.SetMaxOpenConns(1)
+	t.Cleanup(func() { sql.Close() })
+	if err = db.AutoMigrate(&Key{}, &Audit{}); err != nil {
+		t.Fatal(err)
+	}
+	return Service{db, []Module{{Key: "products", Writable: true, Actions: []string{"delete"}}, {Key: "devices", Actions: []string{}}}}
+}
+func TestCredentialLifecycle(t *testing.T) {
+	s := testService(t)
+	ctx := context.Background()
+	v, token, err := s.Create(ctx, "Tool", []Grant{{Module: "products"}}, 7)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(token) != 68 || v.Digest == token {
+		t.Fatal("invalid credential generation")
+	}
+	wire, _ := json.Marshal(v)
+	if strings.Contains(string(wire), token) || strings.Contains(string(wire), v.Digest) {
+		t.Fatal("secret serialized")
+	}
+	k, err := s.Authenticate(ctx, token)
+	if err != nil || !k.Allows("products", "read") || k.Allows("products", "write") || k.Allows("devices", "read") {
+		t.Fatal("default grants")
+	}
+	updated, err := s.Update(ctx, k.ID, 1, 8, []Grant{{Module: "products", Write: true, Actions: []string{"delete"}}}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	k, err = s.Authenticate(ctx, token)
+	if err != nil || !k.Allows("products", "write") || !k.Allows("products", "delete") || updated.Version != 2 || k.Digest != v.Digest {
+		t.Fatal("edit changed credential or failed to apply grants")
+	}
+	if _, err = s.Update(ctx, k.ID, 1, 8, []Grant{{Module: "devices"}}, false); !errors.Is(err, ErrConflict) {
+		t.Fatal("stale edit accepted")
+	}
+	if _, err = s.Update(ctx, k.ID, 2, 8, nil, true); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Authenticate(ctx, token); !errors.Is(err, ErrCredential) {
+		t.Fatal("disabled credential accepted")
+	}
+	if _, err = s.Update(ctx, k.ID, 3, 8, []Grant{{Module: "products"}}, false); !errors.Is(err, ErrConflict) {
+		t.Fatal("disabled key edited")
+	}
+	var logs []Audit
+	s.DB.Find(&logs)
+	if len(logs) != 3 {
+		t.Fatalf("audit count %d", len(logs))
+	}
+	data, _ := json.Marshal(logs)
+	if strings.Contains(string(data), token) {
+		t.Fatal("secret in audit")
+	}
+}
+func TestInvalidGrantsAndCredentials(t *testing.T) {
+	s := testService(t)
+	for _, g := range [][]Grant{nil, {{Module: "admin"}}, {{Module: "devices", Write: true}}, {{Module: "products", Actions: []string{"payment"}}}, {{Module: "products"}, {Module: "products"}}} {
+		if _, err := s.Normalize(g); err == nil {
+			t.Fatal("invalid grant accepted")
+		}
+	}
+	for _, token := range []string{"", "jwt", "gak_" + strings.Repeat("z", 64), strings.Repeat("a", 68)} {
+		if _, err := s.Authenticate(context.Background(), token); !errors.Is(err, ErrCredential) {
+			t.Fatal("invalid credential accepted")
+		}
+	}
+}
+func TestAuditFailureRollsBack(t *testing.T) {
+	s := testService(t)
+	ctx := context.Background()
+	v, _, err := s.Create(ctx, "Tool", []Grant{{Module: "products"}}, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = s.DB.Migrator().DropTable(&Audit{}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Update(ctx, v.ID, 1, 1, nil, true); err == nil {
+		t.Fatal("audit failure ignored")
+	}
+	var k Key
+	s.DB.First(&k, v.ID)
+	if !k.Enabled || k.Version != 1 {
+		t.Fatal("mutation not rolled back")
+	}
+	if _, secret, err := s.Create(ctx, "Failed", []Grant{{Module: "products"}}, 1); err == nil || secret != "" {
+		t.Fatal("creation audit failure ignored")
+	}
+	var count int64
+	s.DB.Model(&Key{}).Count(&count)
+	if count != 1 {
+		t.Fatal("key persisted without audit")
+	}
+}

server/app/goauto/migrations/migrate.go

@@ -34,7 +34,11 @@ func MigratedModels() []any {
 		&models.PDDProduct{},
 		&models.AIMatchingSetting{},
 		&models.ShopeeProduct{},
+		&models.ShopeeSpecAutoMatchRun{},
+		&models.ShopeeSpecAutoMatchWorkItem{},
 		&models.SYBProduct{},
+		&models.SYBSpecAIParseRun{},
+		&models.SYBSpecAIParseWorkItem{},
 		&models.SYBSession{},
 		&models.SYBShop{},
 		&models.SYBSyncRun{},

server/app/goauto/models/purchase.go

@@ -202,7 +202,15 @@ func (task *PurchaseTask) BeforeCreate(_ *gorm.DB) error {
 	return task.syncPurchaseGuardSlots()
 }
 
-func (task *PurchaseTask) BeforeSave(_ *gorm.DB) error { return task.syncPurchaseGuardSlots() }
+func (task *PurchaseTask) BeforeSave(tx *gorm.DB) error {
+	if err := task.syncPurchaseGuardSlots(); err != nil {
+		return err
+	}
+	if task.PDDOrderNo != nil && *task.PDDOrderNo != "" {
+		return CheckPurchaseOrderNumber(tx, task.ID, *task.PDDOrderNo)
+	}
+	return nil
+}
 
 func (task *PurchaseTask) SetStatus(status string) error {
 	task.Status = status

server/app/goauto/models/purchase_order_guard.go

@@ -0,0 +1,41 @@
+package models
+
+import (
+	"errors"
+	"fmt"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+var ErrPurchaseOrderNumberUsed = errors.New("purchase order number belongs to another task")
+
+type PurchaseOrderNumberUsedError struct {
+	TaskID uint64
+}
+
+func (e *PurchaseOrderNumberUsedError) Error() string {
+	return fmt.Sprintf("订单号已属于任务 CG-%d", e.TaskID)
+}
+
+func (e *PurchaseOrderNumberUsedError) Unwrap() error { return ErrPurchaseOrderNumberUsed }
+
+// CheckPurchaseOrderNumber must run inside the caller's write transaction.
+// The existing singleton setting row serializes order assignments across
+// processes, including an absent order number, without relying on gap locks or
+// a new schema constraint. Locking reads see the latest committed assignment.
+// A missing singleton fails closed. Deadlocks roll back the losing transaction.
+func CheckPurchaseOrderNumber(tx *gorm.DB, taskID uint64, orderNo string) error {
+	var setting PurchaseRuleSetting
+	if err := tx.Session(&gorm.Session{NewDB: true}).Clauses(clause.Locking{Strength: "UPDATE"}).First(&setting, 1).Error; err != nil {
+		return err
+	}
+	var others []PurchaseTask
+	if err := tx.Session(&gorm.Session{NewDB: true}).Select("id").Clauses(clause.Locking{Strength: "UPDATE"}).Where("pdd_order_no = ? AND id <> ?", orderNo, taskID).Find(&others).Error; err != nil {
+		return err
+	}
+	if len(others) != 0 {
+		return &PurchaseOrderNumberUsedError{TaskID: others[0].ID}
+	}
+	return nil
+}

server/app/goauto/models/schema.go

@@ -536,6 +536,15 @@ type SYBProduct struct {
 	// recording the parser's own last output for audit even after a manual
 	// correction; it is not overwritten by the correction itself.
 	ManuallyConfirmed bool `json:"manuallyConfirmed" gorm:"not null;default:false"`
+	// AIConfirmed is independent of ParseStatus: ParseStatus remains the
+	// deterministic parser's audit result, while these fields record a closed-
+	// candidate, high-confidence AI decision. Human correction always clears
+	// and supersedes this decision.
+	AIConfirmed        bool       `json:"aiConfirmed" gorm:"not null;default:false;index"`
+	AIConfidence       *float64   `json:"aiConfidence,omitempty"`
+	AIReason           string     `json:"aiReason,omitempty" gorm:"size:500;not null;default:''"`
+	AIConfirmedAt      *time.Time `json:"aiConfirmedAt,omitempty"`
+	AIInputFingerprint string     `json:"-" gorm:"size:64;not null;default:'';index"`
 
 	// RawJSON is the untouched `details[]` element as SYB returned it. It is
 	// what reparse (#41: "适用于解析规则更新后批量重跑，只读取已保存的原始

server/app/goauto/models/shopee_spec_auto_match.go

@@ -0,0 +1,56 @@
+package models
+
+import "time"
+
+// ShopeeSpecAutoMatchRun is one scheduled or administrator-triggered batch.
+// ActiveSlot is 1 only while running; its nullable unique index is the
+// database-level cross-process mutex shared by both trigger paths.
+type ShopeeSpecAutoMatchRun struct {
+	ID             uint64     `json:"id" gorm:"primaryKey;autoIncrement"`
+	RequestID      string     `json:"requestId" gorm:"size:36;not null;uniqueIndex:ux_shopee_spec_auto_match_run_request"`
+	Trigger        string     `json:"trigger" gorm:"size:16;not null;index"`
+	Status         string     `json:"status" gorm:"size:24;not null;index"`
+	ActiveSlot     *uint8     `json:"-" gorm:"uniqueIndex:ux_shopee_spec_auto_match_run_active"`
+	LeaseOwner     string     `json:"-" gorm:"size:64;not null;default:''"`
+	LeaseExpiresAt *time.Time `json:"-" gorm:"index"`
+	RequestedBy    *uint64    `json:"requestedBy,omitempty"`
+	BatchLimit     int        `json:"batchLimit" gorm:"not null;default:20"`
+	ScannedCount   int        `json:"scannedCount" gorm:"not null;default:0"`
+	EligibleCount  int        `json:"eligibleCount" gorm:"not null;default:0"`
+	ProcessedCount int        `json:"processedCount" gorm:"not null;default:0"`
+	ConfirmedCount int        `json:"confirmedCount" gorm:"not null;default:0"`
+	UnmatchedCount int        `json:"unmatchedCount" gorm:"not null;default:0"`
+	FailedCount    int        `json:"failedCount" gorm:"not null;default:0"`
+	ErrorSummary   string     `json:"errorSummary,omitempty" gorm:"size:500;not null;default:''"`
+	StartedAt      time.Time  `json:"startedAt" gorm:"not null"`
+	FinishedAt     *time.Time `json:"finishedAt,omitempty"`
+	CreatedAt      time.Time  `json:"createdAt"`
+	UpdatedAt      time.Time  `json:"updatedAt"`
+}
+
+func (ShopeeSpecAutoMatchRun) TableName() string { return "shopee_spec_auto_match_run" }
+
+// ShopeeSpecAutoMatchWorkItem remembers the last input fingerprint and retry
+// state for each product, preventing unchanged low-confidence inputs from
+// repeatedly spending AI calls.
+type ShopeeSpecAutoMatchWorkItem struct {
+	ID               uint64     `json:"id" gorm:"primaryKey;autoIncrement"`
+	ShopeeProductID  uint64     `json:"shopeeProductId" gorm:"not null;uniqueIndex:ux_shopee_spec_auto_match_work_product"`
+	RunID            *uint64    `json:"runId,omitempty" gorm:"index"`
+	InputFingerprint string     `json:"inputFingerprint" gorm:"size:128;not null;default:'';index"`
+	Status           string     `json:"status" gorm:"size:24;not null;index"`
+	AttemptCount     int        `json:"attemptCount" gorm:"not null;default:0"`
+	NextAttemptAt    *time.Time `json:"nextAttemptAt,omitempty" gorm:"index"`
+	LeaseOwner       string     `json:"-" gorm:"size:64;not null;default:''"`
+	LeaseExpiresAt   *time.Time `json:"-" gorm:"index"`
+	ConfirmedCount   int        `json:"confirmedCount" gorm:"not null;default:0"`
+	UnmatchedCount   int        `json:"unmatchedCount" gorm:"not null;default:0"`
+	LastErrorCode    string     `json:"lastErrorCode,omitempty" gorm:"size:64;not null;default:''"`
+	LastError        string     `json:"lastError,omitempty" gorm:"size:500;not null;default:''"`
+	CreatedAt        time.Time  `json:"createdAt"`
+	UpdatedAt        time.Time  `json:"updatedAt"`
+}
+
+func (ShopeeSpecAutoMatchWorkItem) TableName() string {
+	return "shopee_spec_auto_match_work_item"
+}

server/app/goauto/models/syb_spec_ai_parse.go

@@ -0,0 +1,48 @@
+package models
+
+import "time"
+
+// SYBSpecAIParseRun is one globally serialized scheduled batch.
+type SYBSpecAIParseRun struct {
+	ID             uint64     `json:"id" gorm:"primaryKey;autoIncrement"`
+	RequestID      string     `json:"requestId" gorm:"size:36;not null;uniqueIndex:ux_syb_spec_ai_parse_run_request"`
+	Trigger        string     `json:"trigger" gorm:"size:16;not null;index"`
+	Status         string     `json:"status" gorm:"size:24;not null;index"`
+	ActiveSlot     *uint8     `json:"-" gorm:"uniqueIndex:ux_syb_spec_ai_parse_run_active"`
+	LeaseOwner     string     `json:"-" gorm:"size:64;not null;default:''"`
+	LeaseExpiresAt *time.Time `json:"-" gorm:"index"`
+	BatchLimit     int        `json:"batchLimit" gorm:"not null;default:20"`
+	ScannedCount   int        `json:"scannedCount" gorm:"not null;default:0"`
+	EligibleCount  int        `json:"eligibleCount" gorm:"not null;default:0"`
+	ProcessedCount int        `json:"processedCount" gorm:"not null;default:0"`
+	ConfirmedCount int        `json:"confirmedCount" gorm:"not null;default:0"`
+	UnmatchedCount int        `json:"unmatchedCount" gorm:"not null;default:0"`
+	FailedCount    int        `json:"failedCount" gorm:"not null;default:0"`
+	ErrorSummary   string     `json:"errorSummary,omitempty" gorm:"size:500;not null;default:''"`
+	StartedAt      time.Time  `json:"startedAt" gorm:"not null"`
+	FinishedAt     *time.Time `json:"finishedAt,omitempty"`
+	CreatedAt      time.Time  `json:"createdAt"`
+	UpdatedAt      time.Time  `json:"updatedAt"`
+}
+
+func (SYBSpecAIParseRun) TableName() string { return "syb_spec_ai_parse_run" }
+
+// SYBSpecAIParseWorkItem prevents unchanged ambiguous input from repeatedly
+// spending provider calls and owns the per-row recovery lease.
+type SYBSpecAIParseWorkItem struct {
+	ID               uint64     `json:"id" gorm:"primaryKey;autoIncrement"`
+	SYBProductID     uint64     `json:"sybProductId" gorm:"not null;uniqueIndex:ux_syb_spec_ai_parse_work_product"`
+	RunID            *uint64    `json:"runId,omitempty" gorm:"index"`
+	InputFingerprint string     `json:"inputFingerprint" gorm:"size:64;not null;default:'';index"`
+	Status           string     `json:"status" gorm:"size:24;not null;index"`
+	AttemptCount     int        `json:"attemptCount" gorm:"not null;default:0"`
+	NextAttemptAt    *time.Time `json:"nextAttemptAt,omitempty" gorm:"index"`
+	LeaseOwner       string     `json:"-" gorm:"size:64;not null;default:''"`
+	LeaseExpiresAt   *time.Time `json:"-" gorm:"index"`
+	LastErrorCode    string     `json:"lastErrorCode,omitempty" gorm:"size:64;not null;default:''"`
+	LastError        string     `json:"lastError,omitempty" gorm:"size:500;not null;default:''"`
+	CreatedAt        time.Time  `json:"createdAt"`
+	UpdatedAt        time.Time  `json:"updatedAt"`
+}
+
+func (SYBSpecAIParseWorkItem) TableName() string { return "syb_spec_ai_parse_work_item" }

server/app/goauto/purchase/agent_retry_test.go

@@ -2,7 +2,6 @@ package purchase
 
 import (
 	"context"
-	"strings"
 	"testing"
 	"time"
 
@@ -72,6 +71,11 @@ func TestAgentRetryCreatesOneFixedDeviceTaskAndReplays(t *testing.T) {
 	setCollectedPDDPrice(t, db, f.pdd.ID)
 	service := testService(db)
 	failed := failedLiveTask(t, db, service, f)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Updates(map[string]any{
+		"target_color": "当前黑色", "target_size": "均碼",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
 
 	history, err := service.AgentHistoryDetail(context.Background(), failed.ID, f.token)
 	if err != nil || !history.Task.Retryable || history.Task.RetryDisabledReason != "" {
@@ -93,6 +97,9 @@ func TestAgentRetryCreatesOneFixedDeviceTaskAndReplays(t *testing.T) {
 	if oldTask.Status != models.PurchaseTaskStatusFailed || newTask.Status != models.PurchaseTaskStatusPending || newTask.DeviceID == nil || *newTask.DeviceID != f.device.ID || newTask.AddressSuffix == oldTask.AddressSuffix {
 		t.Fatalf("retry did not preserve old task or fix new task to device: old=%+v new=%+v", oldTask, newTask)
 	}
+	if newTask.TargetColorSnapshot != "当前黑色" || newTask.TargetSizeSnapshot != "均碼" || newTask.SpecSource != "unresolved" || purchaseAttemptPhase(newTask) != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("retry did not use current SYB targets and a fresh probe: %+v", newTask)
+	}
 
 	replay, err := service.AgentRetry(context.Background(), failed.ID, request, f.token)
 	if err != nil || !replay.Replayed || replay.TaskID != first.TaskID {
@@ -158,7 +165,7 @@ func TestMatchedReplacementExposesContinueAndReusesAgentRetry(t *testing.T) {
 	}
 }
 
-func TestMatchedReplacementRejectsClearedMappingWithoutCallingAI(t *testing.T) {
+func TestMatchedReplacementAllowsRetryWithoutPersistedMappingAndDoesNotCallAI(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), true)
 	setCollectedPDDPrice(t, db, f.pdd.ID)
@@ -172,11 +179,11 @@ func TestMatchedReplacementRejectsClearedMappingWithoutCallingAI(t *testing.T) {
 	service.Matcher = matcher
 
 	detail, err := service.AgentHistoryDetail(context.Background(), failed.ID, f.token)
-	if err != nil || detail.ContinuePurchaseEligible || !strings.Contains(detail.ContinuePurchaseDisabledReason, "规格匹配已失效") || matcher.calls != 0 {
+	if err != nil || !detail.ContinuePurchaseEligible || detail.ContinuePurchaseDisabledReason != "" || matcher.calls != 0 {
 		t.Fatalf("cleared mapping qualification mismatch: detail=%+v calls=%d error=%v", detail, matcher.calls, err)
 	}
-	_, err = service.AgentRetry(context.Background(), failed.ID, AgentRetryRequest{RequestID: uuid.NewString()}, f.token)
-	if code(err) != CodeMappingRequired || matcher.calls != 0 {
-		t.Fatalf("cleared mapping reached AI or retry: code=%s calls=%d error=%v", code(err), matcher.calls, err)
+	created, err := service.AgentRetry(context.Background(), failed.ID, AgentRetryRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || created.TaskID == 0 || matcher.calls != 0 {
+		t.Fatalf("cleared mapping retry did not create probe task: result=%+v calls=%d error=%v", created, matcher.calls, err)
 	}
 }

server/app/goauto/purchase/ai_match_eligibility.go

@@ -32,10 +32,44 @@ type skuCombinationRow struct {
 }
 
 func sybSpecsTrusted(syb models.SYBProduct) bool {
-	if syb.ParseStatus == models.SYBParseStatusFailed {
+	if strings.TrimSpace(syb.TargetColor) == "" && strings.TrimSpace(syb.TargetSize) == "" {
 		return false
 	}
-	return strings.TrimSpace(syb.TargetColor) != "" || strings.TrimSpace(syb.TargetSize) != ""
+	return syb.ParseStatus != models.SYBParseStatusFailed || syb.ManuallyConfirmed || syb.AIConfirmed
+}
+
+func aiConfirmedSpecsCurrent(syb models.SYBProduct, shopee models.ShopeeProduct) bool {
+	if !syb.AIConfirmed {
+		return true
+	}
+	specs, err := shopeeproduct.Unmarshal(shopee.SpecsJSON)
+	if err != nil {
+		return false
+	}
+	wanted := map[string]string{shopeeproduct.RoleColor: strings.TrimSpace(syb.TargetColor), shopeeproduct.RoleSize: strings.TrimSpace(syb.TargetSize)}
+	foundAny := false
+	for role, target := range wanted {
+		if target == "" {
+			continue
+		}
+		foundAny = true
+		found := false
+		for _, dimension := range specs {
+			if dimension.Role != role {
+				continue
+			}
+			for _, value := range dimension.Values {
+				if value.Name == target {
+					found = true
+					break
+				}
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+	return foundAny
 }
 
 func (s *Service) loadLatestSKUCombinations(ctx context.Context, pddIDs []uint64, dataset *batchPreviewDataset) error {

server/app/goauto/purchase/batch.go

@@ -105,8 +105,7 @@ func (s *Service) BatchPreview(ctx context.Context, req BatchPreviewRequest) (Ba
 	items := make([]BatchPreviewItem, 0, len(ids))
 	eligible := 0
 	for _, id := range ids {
-		item := s.previewFromDataset(ctx, id, dataset, false, guard)
-		item.enforcePersistedMatch(id, dataset)
+		item := s.previewFromDataset(id, dataset, guard)
 		item.applyCollectionEligibility(id, dataset)
 		qualification := aiMatchQualificationForDataset(id, dataset)
 		item.AIMatchEligible = qualification.Eligible
@@ -331,22 +330,6 @@ func (s *Service) validateBatchDevice(ctx context.Context, deviceID *uint64, rul
 	return ensureCapabilities(record, purchasecontract.RequiredCapabilities(rule))
 }
 
-func (s *Service) previewOne(ctx context.Context, id uint64) BatchPreviewItem {
-	_, _, currentRule, ruleErr := purchaserule.CurrentRule(ctx, s.DB, models.PurchaseExecutionModeLive)
-	if ruleErr != nil {
-		item := BatchPreviewItem{SYBProductID: id}
-		item.ReasonCode, item.Reason, item.NextAction = serviceErrorFields(ruleErr)
-		return item
-	}
-	dataset, err := s.loadBatchPreviewDataset(ctx, []uint64{id})
-	if err != nil {
-		item := BatchPreviewItem{SYBProductID: id}
-		item.ReasonCode, item.Reason, item.NextAction = CodeInternal, "服务端处理失败", "retry"
-		return item
-	}
-	return s.previewFromDataset(ctx, id, dataset, true, purchasecontract.EffectivePriceGuard(currentRule))
-}
-
 func (s *Service) previewOneDeterministic(ctx context.Context, id uint64, guard purchasecontract.PriceLimits) BatchPreviewItem {
 	dataset, err := s.loadBatchPreviewDataset(ctx, []uint64{id})
 	if err != nil {
@@ -354,8 +337,7 @@ func (s *Service) previewOneDeterministic(ctx context.Context, id uint64, guard
 		item.ReasonCode, item.Reason, item.NextAction = CodeInternal, "服务端处理失败", "retry"
 		return item
 	}
-	item := s.previewFromDataset(ctx, id, dataset, false, guard)
-	item.enforcePersistedMatch(id, dataset)
+	item := s.previewFromDataset(id, dataset, guard)
 	return item
 }
 
@@ -379,7 +361,7 @@ func taskPointerValue(value *uint64) uint64 {
 	return *value
 }
 
-func (s *Service) previewFromDataset(ctx context.Context, id uint64, dataset batchPreviewDataset, allowAI bool, guard purchasecontract.PriceLimits) BatchPreviewItem {
+func (s *Service) previewFromDataset(id uint64, dataset batchPreviewDataset, guard purchasecontract.PriceLimits) BatchPreviewItem {
 	item := BatchPreviewItem{SYBProductID: id}
 	syb, found := dataset.sybByID[id]
 	if !found {
@@ -406,6 +388,10 @@ func (s *Service) previewFromDataset(ctx context.Context, id uint64, dataset bat
 		item.ReasonCode, item.Reason, item.NextAction = "SHOPEE_NOT_FOUND", "关联的蝦皮商品不存在，请先处理商品档案", "open_shopee"
 		return item
 	}
+	if !aiConfirmedSpecsCurrent(syb, shopee) {
+		item.ReasonCode, item.Reason, item.NextAction = "SYB_PARSE_FAILED", "AI 解析依据已变化，请等待重新解析或人工修正", "reparse"
+		return item
+	}
 	if shopee.PDDProductID == nil {
 		item.ReasonCode, item.Reason, item.NextAction = "PDD_NOT_LINKED", "尚未关联 PDD 商品，请先关联", processActionOpenPDDLink
 		return item
@@ -423,26 +409,15 @@ func (s *Service) previewFromDataset(ctx context.Context, id uint64, dataset bat
 	}
 	mappedColor, mappedSize, source := confirmedMappings(shopee.SpecsJSON, syb.TargetColor, syb.TargetSize)
 	item.MappedColor, item.MappedSize = mappedColor, mappedSize
-	candidates, archiveUsable := archiveCandidates(pdd.SpecsJSON, syb.TargetColor, syb.TargetSize)
+	candidates, _ := archiveCandidates(pdd.SpecsJSON, syb.TargetColor, syb.TargetSize)
 	// #190：失效的已保存映射不再拦截，降级为 unresolved，与创建路径保持一致。
 	if source != "unresolved" && !mappingTargetsValid(candidates, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) {
 		mappedColor, mappedSize, source = "", "", "unresolved"
 		item.MappedColor, item.MappedSize = "", ""
 	}
 	if source == "unresolved" {
-		if !archiveUsable {
-			item.ReasonCode, item.Reason, item.NextAction = CodeMappingRequired, "关联的 PDD 商品没有完整可选规格", "open_pdd"
-			return item
-		}
 		request := aimatching.MatchRequest{TargetColor: syb.TargetColor, TargetSize: syb.TargetSize, Colors: candidates.Colors, Sizes: candidates.Sizes}
-		if allowAI {
-			matched, matchErr := s.matcher().Resolve(ctx, request)
-			if matchErr != nil {
-				item.ReasonCode, item.Reason, item.NextAction = serviceErrorFields(purchaseMatchError(matchErr))
-				return item
-			}
-			item.MappedColor, item.MappedSize = matched.MappedColor, matched.MappedSize
-		} else if matched, ok := aimatching.DeterministicMatch(request); ok {
+		if matched, ok := aimatching.DeterministicMatch(request); ok {
 			item.MappedColor, item.MappedSize = matched.MappedColor, matched.MappedSize
 		}
 		// #190：映射不完整不再拦截，任务以 unresolved 建立并交由规格探测解析。
@@ -476,42 +451,6 @@ func (s *Service) previewFromDataset(ctx context.Context, id uint64, dataset bat
 	return item
 }
 
-// enforcePersistedMatch is the #188 gate for the SYB list and batch-create
-// workflow. A transient deterministic result is not purchase readiness: the
-// color/size mapping must already be confirmed on the Shopee product and must
-// still identify one complete, available SKU combination when collection
-// evidence exists. Manually entered or externally imported PDD products may
-// legitimately have no such collection record.
-func (item *BatchPreviewItem) enforcePersistedMatch(id uint64, dataset batchPreviewDataset) {
-	if item.ReasonCode != "" && item.ReasonCode != CodeMappingRequired {
-		return
-	}
-	syb, ok := dataset.sybByID[id]
-	if !ok || syb.ShopeeProductID == nil {
-		return
-	}
-	shopee, ok := dataset.shopeeByID[*syb.ShopeeProductID]
-	if !ok || shopee.PDDProductID == nil {
-		return
-	}
-	pdd, ok := dataset.pddByID[*shopee.PDDProductID]
-	if !ok || pdd.Status != "active" {
-		return
-	}
-	mappedColor, mappedSize, source := confirmedMappings(shopee.SpecsJSON, syb.TargetColor, syb.TargetSize)
-	item.MappedColor, item.MappedSize = mappedColor, mappedSize
-	if source == "unresolved" {
-		item.Eligible = false
-		item.ReasonCode, item.Reason, item.NextAction = CodeMappingRequired, "规格尚未匹配并保存，请先完成 AI 匹配或人工确认", "open_mapping"
-		return
-	}
-	combinations := dataset.skuCombinationsByPDD[pdd.ID]
-	if len(combinations) > 0 && !validSKUCombination(combinations, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) {
-		item.Eligible = false
-		item.ReasonCode, item.Reason, item.NextAction = CodeMappingRequired, "已保存规格映射不属于当前可售的 PDD 规格组合，请重新匹配", "open_mapping"
-	}
-}
-
 func purchasePriceRange(raw, mappedColor string, guard purchasecontract.PriceLimits) (reference, minPrice, maxPrice int64, err error) {
 	var dimensions []productspec.Dimension
 	if json.Unmarshal([]byte(raw), &dimensions) != nil {

server/app/goauto/purchase/batch_spec_match_test.go

@@ -9,7 +9,6 @@ import (
 	"go-admin/app/goauto/models"
 	"go-admin/app/goauto/shopeeproduct"
 
-	"github.com/google/uuid"
 	"gorm.io/gorm"
 )
 
@@ -137,18 +136,14 @@ func exactBatchSpecFixture(t *testing.T) (*Service, fixture) {
 	return testService(db), f
 }
 
-func TestBatchSpecMatchPersistsExactMatchBeforePurchaseCreation(t *testing.T) {
+func TestBatchSpecMatchPersistsExactMatchButPurchaseDoesNotWaitForIt(t *testing.T) {
 	service, f := exactBatchSpecFixture(t)
 	matcher := &batchSpecMatcher{}
 	service.Matcher = matcher
 
 	before, err := service.BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{f.syb.ID}})
-	if err != nil || len(before.Items) != 1 || before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStageColorMapping {
-		t.Fatalf("unpersisted exact match was not gated: %+v err=%v", before, err)
-	}
-	blocked, err := service.BatchCreate(context.Background(), BatchCreateRequest{RequestID: uuid.NewString(), SYBProductIDs: []uint64{f.syb.ID}, DeviceID: &f.device.ID})
-	if err != nil || blocked.CreatedCount != 0 || blocked.FailedCount != 1 || blocked.Items[0].ReasonCode != CodeMappingRequired {
-		t.Fatalf("batch create bypassed persisted mapping gate: %+v err=%v", blocked, err)
+	if err != nil || len(before.Items) != 1 || !before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("live-probe purchase was incorrectly gated by persisted mapping: %+v err=%v", before, err)
 	}
 
 	matched, err := service.BatchSpecMatch(context.Background(), BatchSpecMatchRequest{SYBProductIDs: []uint64{f.syb.ID}})
@@ -186,8 +181,8 @@ func TestExtractedUncertainSpecsCanBeMatchedBeforePurchase(t *testing.T) {
 	service.Matcher = matcher
 
 	before, err := service.BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{f.syb.ID}})
-	if err != nil || len(before.Items) != 1 || before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStageColorMapping {
-		t.Fatalf("extracted uncertain specs did not enter matching: %+v err=%v", before, err)
+	if err != nil || len(before.Items) != 1 || !before.Items[0].Eligible || !before.Items[0].AIMatchEligible || before.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("extracted uncertain specs were not purchase-ready for live probing: %+v err=%v", before, err)
 	}
 	matched, err := service.BatchSpecMatch(context.Background(), BatchSpecMatchRequest{SYBProductIDs: []uint64{f.syb.ID}})
 	if err != nil || matched.AutoConfirmedCount != 1 || matcher.calls != 0 {
@@ -236,7 +231,7 @@ func TestBatchPreviewExposesExplicitAIMatchEligibility(t *testing.T) {
 		t.Fatalf("preview failed: %+v err=%v", preview, err)
 	}
 	item := preview.Items[0]
-	if !item.AIMatchEligible || item.AIMatchDisabledReason != "" || item.Eligible || item.ProcessStage != ProcessStageColorMapping {
+	if !item.AIMatchEligible || item.AIMatchDisabledReason != "" || !item.Eligible || item.ProcessStage != ProcessStagePurchaseReady {
 		t.Fatalf("explicit AI eligibility mismatch: %+v", item)
 	}
 }

server/app/goauto/purchase/batch_test.go

@@ -54,6 +54,9 @@ func TestSybSpecsTrustedOnlyBlocksFailedOrEmptyExtraction(t *testing.T) {
 		{"uncertain with color", models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain, TargetColor: "套装"}, true},
 		{"uncertain with size", models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain, TargetSize: "均码"}, true},
 		{"failed with values", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, TargetColor: "黑色"}, false},
+		{"failed AI confirmed", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, TargetColor: "黑色", AIConfirmed: true}, true},
+		{"failed manually confirmed", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, TargetColor: "黑色", ManuallyConfirmed: true}, true},
+		{"AI confirmed without values", models.SYBProduct{ParseStatus: models.SYBParseStatusFailed, AIConfirmed: true}, false},
 		{"uncertain without values", models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain}, false},
 	}
 	for _, tt := range tests {
@@ -65,6 +68,28 @@ func TestSybSpecsTrustedOnlyBlocksFailedOrEmptyExtraction(t *testing.T) {
 	}
 }
 
+func TestSYBSpecsTrustedAcceptsAIWithoutCallingItManual(t *testing.T) {
+	row := models.SYBProduct{ParseStatus: models.SYBParseStatusUncertain, TargetColor: "黑色", AIConfirmed: true}
+	if !sybSpecsTrusted(row) {
+		t.Fatal("a valid AI-confirmed parse must pass the purchase parse gate")
+	}
+	if row.ManuallyConfirmed {
+		t.Fatal("AI confirmation must not be represented as human confirmation")
+	}
+}
+
+func TestAIConfirmedSpecsBecomeUntrustedWhenShopeeCandidateDisappears(t *testing.T) {
+	row := models.SYBProduct{TargetColor: "黑色", TargetSize: "XL", ParseStatus: models.SYBParseStatusUncertain, AIConfirmed: true}
+	product := models.ShopeeProduct{SpecsJSON: `[{"name":"颜色","role":"color","values":[{"name":"白色","source":"import"}]},{"name":"尺码","role":"size","values":[{"name":"XL","source":"import"}]}]`}
+	if aiConfirmedSpecsCurrent(row, product) {
+		t.Fatal("removed Shopee candidate must invalidate the AI parse gate")
+	}
+	product.SpecsJSON = `[{"name":"颜色","role":"color","values":[{"name":"黑色","source":"import"}]},{"name":"尺码","role":"size","values":[{"name":"XL","source":"import"}]}]`
+	if !aiConfirmedSpecsCurrent(row, product) {
+		t.Fatal("unchanged exact Shopee candidates should keep AI parse valid")
+	}
+}
+
 func TestBatchPreviewExposesIndependentCollectionEligibility(t *testing.T) {
 	db := testDB(t)
 	fixture := seed(t, db, liveCaps(), true)
@@ -288,8 +313,24 @@ func TestBatchPreviewBulkLoadsAndNeverCallsAIMatcher(t *testing.T) {
 	if queries != 7 {
 		t.Fatalf("batch preview used %d queries, want 7 bounded queries including collection eligibility and current purchase rule", queries)
 	}
-	if len(response.Items) != 2 || response.Items[0].Eligible || response.Items[1].Eligible || response.Items[0].ReasonCode != CodeMappingRequired {
-		t.Fatalf("unresolved rows must not be reported as purchase-ready: %+v", response)
+	if len(response.Items) != 2 || !response.Items[0].Eligible || !response.Items[1].Eligible || response.EligibleCount != 2 {
+		t.Fatalf("unresolved rows must be ready for mandatory live probing: %+v", response)
+	}
+}
+
+func TestBatchPreviewAllowsIncompleteArchivedCandidatesForMandatoryLiveProbe(t *testing.T) {
+	db := testDB(t)
+	fixture := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.PDDProduct{}).Where("id = ?", fixture.pdd.ID).Update(
+		"specs_json",
+		`[{"name":"颜色","role":"color","values":[{"name":"黑色","selectable":true,"priceCent":2000}]}]`,
+	).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	response, err := testService(db).BatchPreview(context.Background(), BatchPreviewRequest{SYBProductIDs: []uint64{fixture.syb.ID}})
+	if err != nil || len(response.Items) != 1 || !response.Items[0].Eligible || response.Items[0].ProcessStage != ProcessStagePurchaseReady {
+		t.Fatalf("incomplete archive blocked live probe task creation: %+v err=%v", response, err)
 	}
 }
 

server/app/goauto/purchase/handler.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"go-admin/common/clientprincipal"
 	"io"
 	"net/http"
 	"strconv"
@@ -470,6 +471,9 @@ func writeAdminReplay(c *gin.Context, data any, replayed bool) {
 }
 
 func allowedOperator(c *gin.Context) bool {
+	if _, ok := clientprincipal.Get(c); ok {
+		return true
+	}
 	role, _ := jwt.ExtractClaims(c)["rolekey"].(string)
 	if role == "admin" || role == "purchaser" {
 		return true
@@ -538,12 +542,15 @@ func writeError(c *gin.Context, err error) {
 		status = http.StatusForbidden
 	case CodeTaskNotFound:
 		status = http.StatusNotFound
-	case CodeStateConflict, CodeCapabilityMismatch, CodeDeviceBusy, CodeTaskClaimed, CodeLeaseExpired, CodeMappingRequired, CodeResultConflict, CodeRePurchaseRequired:
+	case CodeStateConflict, CodeCapabilityMismatch, CodeDeviceBusy, CodeTaskClaimed, CodeLeaseExpired, CodeMappingRequired, CodeResultConflict, CodeRePurchaseRequired, CodeOrderNumberUsed:
 		status = http.StatusConflict
 	}
 	c.JSON(status, gin.H{"code": code, "message": msg, "retryable": retryable})
 }
 func operatorID(c *gin.Context) uint64 {
+	if id, ok := clientprincipal.Get(c); ok {
+		return id.AuthorizedBy
+	}
 	claims := jwt.ExtractClaims(c)
 	switch v := claims["identity"].(type) {
 	case float64:

server/app/goauto/purchase/lifecycle.go

@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"strings"
 	"time"
 
@@ -33,6 +34,19 @@ func (s *Service) Next(ctx context.Context, token string) (*TaskPayload, error)
 	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
 		return nil, internal(err)
 	}
+	// A completed probe reserves the device's purchase flow while the server
+	// resolves the exact specs. Returning that task as a waiting payload keeps
+	// the Agent from claiming another purchase or collection task and preserves
+	// the PDD page that the probe just inspected.
+	var waiting models.PurchaseTask
+	if err = s.DB.WithContext(ctx).
+		Where("device_id = ? AND status = ?", d.ID, models.PurchaseTaskStatusSpecProbePending).
+		Order("created_at, id").
+		First(&waiting).Error; err == nil {
+		return s.payload(waiting, nil, false)
+	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, internal(err)
+	}
 	now := s.Now()
 	var candidates []models.PurchaseTask
 	if err = s.DB.WithContext(ctx).Where("status IN ? AND (lease_expires_at IS NULL OR lease_expires_at <= ?) AND (device_id IS NULL OR device_id = ?)", []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusSpecProbePending}, now, d.ID).Order("CASE WHEN device_id IS NULL THEN 1 ELSE 0 END, created_at, id").Limit(100).Find(&candidates).Error; err != nil {
@@ -186,17 +200,14 @@ func (s *Service) Start(ctx context.Context, taskID uint64, req ActionRequest, t
 		if e = ensureAccountFree(tx, t.PDDAccountID, t.ID, s.Now()); e != nil {
 			return e
 		}
-		phase := models.PurchaseAttemptPhasePurchase
-		if t.SpecSource == "unresolved" {
-			phase = models.PurchaseAttemptPhaseSpecProbe
-		}
+		phase := purchaseAttemptPhase(t)
 		ruleSnapshotHash := purchaseRuleSnapshotHash(t.RuleSnapshot)
 		now := s.Now()
 		var a models.PurchaseTaskAttempt
 		if e = tx.Where("task_id = ? AND status = ?", t.ID, models.PurchaseAttemptStatusPending).Order("attempt_number DESC, id DESC").First(&a).Error; e == nil {
-			if a.DeviceID == nil || *a.DeviceID != d.ID || a.RuleSnapshotHash != ruleSnapshotHash {
+			if a.DeviceID == nil || *a.DeviceID != d.ID || a.RuleSnapshotHash != ruleSnapshotHash || a.Phase != phase {
 				failureCode := CodeStateConflict
-				message := "采购规则快照校验失败，请重新重试任务"
+				message := "采购任务执行快照校验失败，请重新创建任务"
 				a.Status = models.PurchaseAttemptStatusFailed
 				a.ErrorCode = &failureCode
 				a.ErrorMessage = &message
@@ -266,6 +277,9 @@ func (s *Service) MarkOrderSubmitStarted(ctx context.Context, taskID uint64, req
 		if t.ExecutionMode != models.PurchaseExecutionModeLive {
 			return TaskPayload{}, fail(CodeStateConflict, "演练任务不能创建订单")
 		}
+		if a.Phase != models.PurchaseAttemptPhasePurchase {
+			return TaskPayload{}, fail(CodeStateConflict, "规格探测阶段不能进入创建订单边界")
+		}
 		if _, e := uuid.Parse(req.RequestID); e != nil {
 			return TaskPayload{}, fail(CodeInvalidRequest, "requestId 无效")
 		}
@@ -365,6 +379,22 @@ func (s *Service) SubmitResult(ctx context.Context, taskID uint64, req ResultReq
 			t.PDDOrderNo = &req.PDDOrderNo
 			t.OrderSubmittedAt = req.OrderSubmittedAt
 			t.ActualUnitPriceCent = req.ActualUnitPriceCent
+			// Keep the assignment lock until commit. A conflicting observation
+			// after the irreversible boundary must reach manual resolution,
+			// not roll back the result or claim another task's order number.
+			if e := models.CheckPurchaseOrderNumber(tx, t.ID, req.PDDOrderNo); e != nil {
+				var conflict *models.PurchaseOrderNumberUsedError
+				if !errors.As(e, &conflict) {
+					return TaskPayload{}, conflictOrInternal(e)
+				}
+				next = models.PurchaseTaskStatusOrderResultUnknown
+				t.PDDOrderNo = nil
+				failureCode := CodeOrderNumberUsed
+				message := fmt.Sprintf("读到订单号 %s，但该号已属于任务 %s", req.PDDOrderNo, taskNumber(conflict.TaskID))
+				t.ErrorCode, t.ErrorMessage = &failureCode, &message
+				a.Status = models.PurchaseAttemptStatusFailed
+				a.ErrorCode, a.ErrorMessage = &failureCode, &message
+			}
 		case "order_result_unknown":
 			if t.ExecutionMode != models.PurchaseExecutionModeLive || t.Status != models.PurchaseTaskStatusOrderSubmitStarted {
 				return TaskPayload{}, fail(CodeStateConflict, "当前任务不能标记订单结果未知")
@@ -512,7 +542,10 @@ func (s *Service) applySpecDecision(ctx context.Context, taskID uint64, req Spec
 		}
 		t.StatusVersion++
 		t.StatusChangedAt = s.Now()
-		return tx.Save(&t).Error
+		if e := tx.Save(&t).Error; e != nil {
+			return conflictOrInternal(e)
+		}
+		return nil
 	})
 	return t, replayed, err
 }
@@ -536,19 +569,29 @@ func (s *Service) resolveProbedSpecs(ctx context.Context, taskID uint64, attempt
 		}
 		decision.NoMatch, decision.Decision = true, snapshot
 		decision.FailureCode, decision.FailureMessage = "PURCHASE_SPEC_NOT_MATCHED", "没有找到可采购的 PDD 颜色或尺码"
-	} else if matched, matchErr := s.matcher().Resolve(ctx, request); matchErr == nil {
-		snapshot, marshalErr := json.Marshal(matched.Decision)
-		if marshalErr != nil {
-			return TaskPayload{}, internal(marshalErr)
-		}
-		decision.MappedColor, decision.MappedSize, decision.Source, decision.Decision = matched.MappedColor, matched.MappedSize, matched.Source, snapshot
 	} else {
-		snapshot, marshalErr := json.Marshal(aimatching.NoMatchDecision(request, aimatching.SourceAI, purchaseMatchReason(matchErr)))
-		if marshalErr != nil {
-			return TaskPayload{}, internal(marshalErr)
+		matched, matchErr := s.resolveProbedMatch(ctx, task, request)
+		valid := matchErr == nil && (matched.Source == "manual_mapping" || matched.Source == aimatching.SourceExact || matched.Source == aimatching.SourceAI) &&
+			matchCandidateValid(request.TargetColor, matched.MappedColor, request.Colors) &&
+			matchCandidateValid(request.TargetSize, matched.MappedSize, request.Sizes)
+		if valid {
+			snapshot, marshalErr := json.Marshal(matched.Decision)
+			if marshalErr != nil {
+				return TaskPayload{}, internal(marshalErr)
+			}
+			decision.MappedColor, decision.MappedSize, decision.Source, decision.Decision = matched.MappedColor, matched.MappedSize, matched.Source, snapshot
+		} else {
+			reason := purchaseMatchReason(matchErr)
+			if matchErr == nil {
+				reason = "AI 规格匹配结果不属于当次 PDD 候选"
+			}
+			snapshot, marshalErr := json.Marshal(aimatching.NoMatchDecision(request, aimatching.SourceAI, reason))
+			if marshalErr != nil {
+				return TaskPayload{}, internal(marshalErr)
+			}
+			decision.NoMatch, decision.Decision = true, snapshot
+			decision.FailureCode, decision.FailureMessage = "PURCHASE_SPEC_NOT_MATCHED", reason
 		}
-		decision.NoMatch, decision.Decision = true, snapshot
-		decision.FailureCode, decision.FailureMessage = "PURCHASE_SPEC_NOT_MATCHED", purchaseMatchReason(matchErr)
 	}
 	updated, _, err := s.applySpecDecision(ctx, taskID, decision, nil)
 	if err != nil {
@@ -567,7 +610,7 @@ func purchaseMatchReason(err error) string {
 			return "AI 规格匹配暂时不可用，请稍后重新创建采购任务"
 		}
 	}
-	return "没有找到可采购的 PDD 颜色或尺码"
+	return "已采集到当前规格，但未能确定颜色或尺码映射"
 }
 
 type probedSpecCandidates struct {
@@ -649,7 +692,7 @@ func (s *Service) withRunning(ctx context.Context, taskID uint64, token string,
 
 func ensureDeviceFree(tx *gorm.DB, deviceID, taskID uint64, now time.Time) error {
 	var count int64
-	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND device_id = ? AND (status IN ? OR (status IN ? AND lease_expires_at > ?))", taskID, deviceID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted}, []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusSpecProbePending}, now).Count(&count).Error; e != nil {
+	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND device_id = ? AND (status IN ? OR (status = ? AND lease_expires_at > ?))", taskID, deviceID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusSpecProbePending}, models.PurchaseTaskStatusPending, now).Count(&count).Error; e != nil {
 		return internal(e)
 	}
 	if count > 0 {
@@ -668,7 +711,7 @@ func ensureAccountFree(tx *gorm.DB, accountID *uint64, taskID uint64, now time.T
 		return nil
 	}
 	var count int64
-	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND pdd_account_id = ? AND (status IN ? OR (status IN ? AND lease_expires_at > ?))", taskID, *accountID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted}, []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusSpecProbePending}, now).Count(&count).Error; e != nil {
+	if e := tx.Model(&models.PurchaseTask{}).Where("id <> ? AND pdd_account_id = ? AND (status IN ? OR (status = ? AND lease_expires_at > ?))", taskID, *accountID, []string{models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusSpecProbePending}, models.PurchaseTaskStatusPending, now).Count(&count).Error; e != nil {
 		return internal(e)
 	}
 	if count > 0 {
@@ -705,6 +748,10 @@ func purchaseNotFound(err error) error {
 	return internal(err)
 }
 func conflictOrInternal(err error) error {
+	var conflict *models.PurchaseOrderNumberUsedError
+	if errors.As(err, &conflict) {
+		return fail(CodeOrderNumberUsed, conflict.Error())
+	}
 	if isDuplicate(err) {
 		return fail(CodeDeviceBusy, "设备或拼多多账号已有运行任务")
 	}

server/app/goauto/purchase/manual.go

@@ -80,7 +80,10 @@ func (s *Service) SelectWriteback(ctx context.Context, id uint64, req ManualRequ
 		}
 		out.WritebackStatus = models.PurchaseWritebackStatusPending
 		out.WritebackSelectRequestID = &req.RequestID
-		return tx.Save(&out).Error
+		if e := tx.Save(&out).Error; e != nil {
+			return conflictOrInternal(e)
+		}
+		return nil
 	})
 	return out, replayed, err
 }
@@ -166,7 +169,10 @@ func (s *Service) manual(ctx context.Context, id uint64, req ManualRequest, appl
 				return internal(e)
 			}
 		}
-		return tx.Save(&out).Error
+		if e := tx.Save(&out).Error; e != nil {
+			return conflictOrInternal(e)
+		}
+		return nil
 	})
 	return out, replayed, err
 }

server/app/goauto/purchase/match_worker_test.go

@@ -40,6 +40,19 @@ func queuedMatchTask(t *testing.T) (*gorm.DB, fixture, models.PurchaseTask) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	fingerprint, snapshot, err := currentPurchaseMatchInput(db, task)
+	if err != nil {
+		t.Fatal(err)
+	}
+	work := models.PurchaseSpecMatchWorkItem{
+		PurchaseTaskID:    task.ID,
+		Status:            models.PurchaseMatchPending,
+		InputFingerprint:  fingerprint,
+		InputSnapshotJSON: snapshot,
+	}
+	if err := db.Create(&work).Error; err != nil {
+		t.Fatal(err)
+	}
 	return db, f, task
 }
 

server/app/goauto/purchase/order_backfill.go

@@ -0,0 +1,202 @@
+package purchase
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"go-admin/app/goauto/device"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/purchasecontract"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"gorm.io/gorm/logger"
+)
+
+const (
+	MaxOrderBackfillItems     = 50
+	CodeBackfillSuffix        = "PURCHASE_BACKFILL_SUFFIX_INVALID"
+	CodeBackfillDevice        = "PURCHASE_BACKFILL_DEVICE_MISMATCH"
+	CodeBackfillOrderConflict = "PURCHASE_BACKFILL_ORDER_CONFLICT"
+	CodeBackfillBatchConflict = "PURCHASE_BACKFILL_BATCH_CONFLICT"
+	CodeBackfillOrderUsed     = "PURCHASE_BACKFILL_ORDER_ALREADY_USED"
+)
+
+type OrderBackfillRequest struct {
+	RequestID string              `json:"requestId"`
+	Items     []OrderBackfillItem `json:"items"`
+}
+
+type OrderBackfillItem struct {
+	AddressSuffix string `json:"addressSuffix"`
+	PDDOrderNo    string `json:"pddOrderNo"`
+	// A string keeps an invalid page timestamp local to this item.
+	OrderSubmittedAt *string `json:"orderSubmittedAt,omitempty"`
+}
+
+type OrderBackfillResult struct {
+	Index            int        `json:"index"`
+	TaskID           uint64     `json:"taskId,omitempty"`
+	Result           string     `json:"result"`
+	Code             string     `json:"code"`
+	Status           string     `json:"status,omitempty"`
+	StatusVersion    uint64     `json:"statusVersion,omitempty"`
+	PDDOrderNo       *string    `json:"pddOrderNo,omitempty"`
+	OrderSubmittedAt *time.Time `json:"orderSubmittedAt,omitempty"`
+	TimeSource       string     `json:"timeSource,omitempty"`
+	Retryable        bool       `json:"retryable"`
+}
+
+type OrderBackfillResponse struct {
+	RequestID string                `json:"requestId"`
+	Items     []OrderBackfillResult `json:"items"`
+}
+
+func (s *Service) BackfillOrders(ctx context.Context, req OrderBackfillRequest, token string) (OrderBackfillResponse, error) {
+	out := OrderBackfillResponse{RequestID: req.RequestID}
+	d, err := device.NewService(s.DB).Authenticate(ctx, token)
+	if err != nil {
+		return out, err
+	}
+	if _, err := uuid.Parse(req.RequestID); err != nil || len(req.Items) == 0 || len(req.Items) > MaxOrderBackfillItems {
+		return out, fail(CodeInvalidRequest, "requestId 必须为 UUID，items 必须包含 1 到 50 条")
+	}
+	ids := make([]uint64, len(req.Items))
+	orders := make(map[uint64]string)
+	conflicts := make(map[uint64]bool)
+	for i, item := range req.Items {
+		id, err := purchasecontract.ParseAddressSuffix(item.AddressSuffix)
+		if err != nil {
+			continue
+		}
+		ids[i] = id
+		if previous, ok := orders[id]; ok && previous != item.PDDOrderNo {
+			conflicts[id] = true
+		}
+		orders[id] = item.PDDOrderNo
+	}
+	out.Items = make([]OrderBackfillResult, len(req.Items))
+	for i, item := range req.Items {
+		r := OrderBackfillResult{Index: i, TaskID: ids[i], Result: "failed"}
+		if ids[i] == 0 {
+			r.Code = CodeBackfillSuffix
+		} else {
+			r = s.backfillOrder(ctx, d.ID, ids[i], req.RequestID, item, conflicts[ids[i]])
+			r.Index = i
+		}
+		out.Items[i] = r
+	}
+	return out, nil
+}
+
+func (s *Service) backfillOrder(ctx context.Context, deviceID, taskID uint64, requestID string, item OrderBackfillItem, batchConflict bool) OrderBackfillResult {
+	r := OrderBackfillResult{TaskID: taskID, Result: "failed"}
+	var task models.PurchaseTask
+	// SQL errors must not print bound order numbers or the task's address snapshot.
+	db := s.DB.Session(&gorm.Session{Logger: logger.Default.LogMode(logger.Silent)}).WithContext(ctx)
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).First(&task, taskID).Error; err != nil {
+			return purchaseNotFound(err)
+		}
+		if task.DeviceID == nil || *task.DeviceID != deviceID {
+			return fail(CodeBackfillDevice, "任务不属于当前设备")
+		}
+		if batchConflict {
+			return fail(CodeBackfillBatchConflict, "同批任务有不同订单号")
+		}
+		if task.ExecutionMode != models.PurchaseExecutionModeLive || (task.Status != models.PurchaseTaskStatusOrderResultUnknown && task.Status != models.PurchaseTaskStatusOrderCreated) {
+			return fail(CodeStateConflict, "当前任务不允许回填")
+		}
+		if item.PDDOrderNo == "" || strings.TrimSpace(item.PDDOrderNo) != item.PDDOrderNo || utf8.RuneCountInString(item.PDDOrderNo) > 100 || strings.ContainsAny(item.PDDOrderNo, "\r\n\t") {
+			return fail(CodeInvalidRequest, "订单号无效")
+		}
+		if task.PDDOrderNo != nil && *task.PDDOrderNo != "" && *task.PDDOrderNo != item.PDDOrderNo {
+			return fail(CodeBackfillOrderConflict, "已有不同订单号")
+		}
+		// The shared model guard also protects manual resolution and late results.
+		if err := models.CheckPurchaseOrderNumber(tx, taskID, item.PDDOrderNo); err != nil {
+			return err
+		}
+		if task.Status == models.PurchaseTaskStatusOrderCreated {
+			if task.PDDOrderNo == nil || *task.PDDOrderNo != item.PDDOrderNo {
+				return fail(CodeStateConflict, "已创建订单缺少匹配订单号")
+			}
+			r.Result, r.Code = "already_backfilled", "ALREADY_BACKFILLED"
+			return nil
+		}
+		var submitted time.Time
+		source := "page"
+		if item.OrderSubmittedAt != nil {
+			var err error
+			submitted, err = time.Parse(time.RFC3339Nano, *item.OrderSubmittedAt)
+			if err != nil || submitted.IsZero() || submitted.Year() < 1000 || submitted.Year() > 9999 {
+				return fail(CodeOrderTimeInvalid, "下单时间必须为 RFC3339")
+			}
+		} else {
+			if task.IrreversibleAt == nil || task.IrreversibleAt.IsZero() {
+				return fail(CodeOrderTimeMissing, "下单时间和不可逆时间均缺失")
+			}
+			submitted, source = *task.IrreversibleAt, "irreversible_at"
+		}
+		submitted = submitted.UTC()
+		task.PDDOrderNo, task.OrderSubmittedAt = &item.PDDOrderNo, &submitted
+		if err := task.SetStatus(models.PurchaseTaskStatusOrderCreated); err != nil {
+			return internal(err)
+		}
+		task.StatusVersion++
+		task.StatusChangedAt = s.Now()
+		task.ErrorCode, task.ErrorMessage = nil, nil
+		task.LeaseExpiresAt = nil
+		// Reuse the existing resolution request slot. Scope a batch UUID to a
+		// task, and retain provenance without a schema change or replay cache.
+		marker := "backfill:" + source + ":" + uuid.NewSHA1(uuid.NameSpaceOID, []byte(requestID+":"+item.AddressSuffix)).String()
+		task.UnknownResolveRequestID = &marker
+		if err := tx.Save(&task).Error; err != nil {
+			return err
+		}
+		r.Result, r.Code = "backfilled", "BACKFILLED"
+		return nil
+	})
+	if err != nil {
+		r.Result, r.Code = "failed", CodeInternal
+		r.Retryable = true
+		var se *ServiceError
+		if errors.As(err, &se) {
+			r.Code, r.Retryable = se.Code, se.Retryable
+		}
+		if errors.Is(err, models.ErrPurchaseOrderNumberUsed) {
+			r.Code, r.Retryable = CodeBackfillOrderUsed, false
+		}
+		if r.Code == CodeBackfillBatchConflict || r.Code == CodeBackfillOrderConflict || r.Code == CodeBackfillOrderUsed {
+			r.Result = "conflict"
+		}
+	}
+	// Return only this device's committed facts, including on a rejected item.
+	// Never return in-memory changes from a rolled back transaction.
+	saved := task
+	readable := err == nil
+	if !readable {
+		saved = models.PurchaseTask{}
+		readable = db.Where("id = ? AND device_id = ?", taskID, deviceID).First(&saved).Error == nil
+	}
+	if readable {
+		r.Status, r.StatusVersion = saved.Status, saved.StatusVersion
+		r.PDDOrderNo, r.OrderSubmittedAt = saved.PDDOrderNo, saved.OrderSubmittedAt
+		if saved.OrderSubmittedAt != nil {
+			r.TimeSource = "existing_unknown"
+			if saved.UnknownResolveRequestID != nil {
+				if strings.HasPrefix(*saved.UnknownResolveRequestID, "backfill:page:") {
+					r.TimeSource = "page"
+				}
+				if strings.HasPrefix(*saved.UnknownResolveRequestID, "backfill:irreversible_at:") {
+					r.TimeSource = "irreversible_at"
+				}
+			}
+		}
+	}
+	return r
+}

server/app/goauto/purchase/order_backfill_handler.go

@@ -0,0 +1,25 @@
+package purchase
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h Handler) BackfillOrders(c *gin.Context) {
+	var req OrderBackfillRequest
+	if !decode(c, &req) {
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	out, err := s.BackfillOrders(c.Request.Context(), req, bearer(c.GetHeader("Authorization")))
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	c.Header("Cache-Control", "no-store")
+	c.JSON(http.StatusOK, gin.H{"data": out})
+}

server/app/goauto/purchase/order_backfill_test.go

@@ -0,0 +1,498 @@
+package purchase
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"go-admin/app/goauto/device"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/purchasecontract"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+func backfillTask(t *testing.T, db *gorm.DB, f fixture, status string) models.PurchaseTask {
+	t.Helper()
+	now := testService(db).Now()
+	task := models.PurchaseTask{TaskType: models.PurchaseTaskTypeStock, ExecutionMode: models.PurchaseExecutionModeLive,
+		Status: status, DeviceID: &f.device.ID, PDDProductID: f.pdd.ID, Quantity: 1, Currency: "CNY",
+		CreateRequestID: uuid.NewString(), RuleSnapshot: string(purchasecontract.DefaultLiveRule()),
+		SpecDecisionSnapshot: `{}`, RequiredCapabilitiesJSON: `[]`, IrreversibleAt: &now,
+		ErrorCode: strptr("ORIGINAL_ERROR"), ErrorMessage: strptr("original failure")}
+	if err := db.Create(&task).Error; err != nil {
+		t.Fatal(err)
+	}
+	return task
+}
+
+func strptr(s string) *string { return &s }
+
+func backfillItem(id uint64, order string) OrderBackfillItem {
+	return OrderBackfillItem{AddressSuffix: purchasecontract.AddressSuffix(id), PDDOrderNo: order}
+}
+
+func runBackfill(t *testing.T, s *Service, token, requestID string, items ...OrderBackfillItem) []OrderBackfillResult {
+	t.Helper()
+	out, err := s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: requestID, Items: items}, token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(out.Items) != len(items) || out.RequestID != requestID {
+		t.Fatalf("bad envelope: %+v", out)
+	}
+	return out.Items
+}
+
+func loadBackfillTask(t *testing.T, db *gorm.DB, id uint64) models.PurchaseTask {
+	t.Helper()
+	var task models.PurchaseTask
+	if err := db.First(&task, id).Error; err != nil {
+		t.Fatal(err)
+	}
+	return task
+}
+
+func TestOrderBackfillMixedBatchAndReplay(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	a.TaskType, a.SYBProductID = models.PurchaseTaskTypeSYBOrder, &f.syb.ID
+	if err := db.Save(&a).Error; err != nil {
+		t.Fatal(err)
+	}
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	c := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	if err := db.Model(&c).Update("irreversible_at", nil).Error; err != nil {
+		t.Fatal(err)
+	}
+	page := backfillItem(b.ID, "ORDER-B")
+	page.OrderSubmittedAt = strptr("2026-09-08T20:30:00+08:00")
+	rid := uuid.NewString()
+	items := []OrderBackfillItem{backfillItem(a.ID, "ORDER-A"), {AddressSuffix: "_cg0", PDDOrderNo: "bad"}, page, backfillItem(c.ID, "ORDER-C"), backfillItem(99999, "missing")}
+	results := runBackfill(t, s, f.token, rid, items...)
+	want := []string{"BACKFILLED", CodeBackfillSuffix, "BACKFILLED", CodeOrderTimeMissing, CodeTaskNotFound}
+	for i, r := range results {
+		if r.Code != want[i] || r.Index != i {
+			t.Fatalf("item %d: %+v", i, r)
+		}
+	}
+	if results[0].TimeSource != "irreversible_at" || !results[0].OrderSubmittedAt.Equal(*a.IrreversibleAt) {
+		t.Fatalf("fallback: %+v", results[0])
+	}
+	if results[2].TimeSource != "page" || results[2].OrderSubmittedAt.Format(time.RFC3339) != "2026-09-08T12:30:00Z" {
+		t.Fatalf("page: %+v", results[2])
+	}
+	saved := loadBackfillTask(t, db, a.ID)
+	if saved.StatusVersion != a.StatusVersion+1 || saved.ErrorCode != nil || saved.ErrorMessage != nil || saved.DeviceRunSlot != nil || saved.AccountRunSlot != nil || saved.ActiveSlot == nil || saved.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatalf("state metadata: %+v", saved)
+	}
+	if saved.PaymentReviewStatus != a.PaymentReviewStatus || saved.LogisticsStatus != a.LogisticsStatus || saved.WritebackStatus != a.WritebackStatus || saved.RuleSnapshot != a.RuleSnapshot {
+		t.Fatal("unrelated business facts changed")
+	}
+	for _, replayID := range []string{rid, uuid.NewString()} {
+		item := items[0]
+		item.OrderSubmittedAt = strptr("2026-09-09T00:00:00Z")
+		r := runBackfill(t, s, f.token, replayID, item)[0]
+		if r.Result != "already_backfilled" || r.TimeSource != "irreversible_at" {
+			t.Fatalf("replay: %+v", r)
+		}
+		if got := loadBackfillTask(t, db, a.ID); !reflect.DeepEqual(saved, got) {
+			t.Fatal("replay changed persisted task")
+		}
+	}
+	if got := loadBackfillTask(t, db, c.ID); got.PDDOrderNo != nil || got.StatusVersion != c.StatusVersion {
+		t.Fatal("missing time wrote data")
+	}
+}
+
+func TestOrderBackfillRejectsOwnershipStatesAndInvalidTime(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	for _, status := range []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusSpecProbePending, models.PurchaseTaskStatusFailed, models.PurchaseTaskStatusCancelled, models.PurchaseTaskStatusRehearsalCompleted} {
+		task := backfillTask(t, db, f, status)
+		before := loadBackfillTask(t, db, task.ID)
+		r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]
+		if r.Code != CodeStateConflict {
+			t.Fatalf("%s: %+v", status, r)
+		}
+		if got := loadBackfillTask(t, db, task.ID); !reflect.DeepEqual(got, before) {
+			t.Fatal("rejection wrote data")
+		}
+		// Release the fixture's device slot before testing the next running state.
+		if err := task.SetStatus(models.PurchaseTaskStatusCancelled); err != nil {
+			t.Fatal(err)
+		}
+		if err := db.Save(&task).Error; err != nil {
+			t.Fatal(err)
+		}
+	}
+	task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	if err := db.Model(&task).Update("device_id", nil).Error; err != nil {
+		t.Fatal(err)
+	}
+	r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]
+	if r.Code != CodeBackfillDevice || r.Status != "" || r.PDDOrderNo != nil {
+		t.Fatalf("ownership leaked: %+v", r)
+	}
+	other, err := device.NewService(db).Register(context.Background(), device.RegisterRequest{RequestID: uuid.NewString(), InstallID: uuid.NewString(), Name: "Other", Manufacturer: "Test", Model: "Test", AndroidVersion: "15", AgentVersion: "1", PDDVersion: "7", Capabilities: liveCaps()}, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Model(&task).Update("device_id", other.DeviceID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]; r.Code != CodeBackfillDevice {
+		t.Fatalf("cross device: %+v", r)
+	}
+	if err := db.Model(&task).Updates(map[string]any{"device_id": f.device.ID, "execution_mode": models.PurchaseExecutionModeRehearsal}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]; r.Code != CodeStateConflict {
+		t.Fatalf("rehearsal: %+v", r)
+	}
+	if err := db.Model(&task).Update("execution_mode", models.PurchaseExecutionModeLive).Error; err != nil {
+		t.Fatal(err)
+	}
+	for _, raw := range []string{"", "2026-09-08 12:00:00", "0001-01-01T00:00:00Z", "garbage"} {
+		item := backfillItem(task.ID, "ORDER")
+		item.OrderSubmittedAt = &raw
+		if r := runBackfill(t, s, f.token, uuid.NewString(), item)[0]; r.Code != CodeOrderTimeInvalid {
+			t.Fatalf("invalid time: %+v", r)
+		}
+	}
+}
+
+func TestOrderBackfillConflictsNeverOverwrite(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	rid := uuid.NewString()
+	r := runBackfill(t, s, f.token, rid, backfillItem(a.ID, "A"), backfillItem(a.ID, "B"), backfillItem(b.ID, "B"))
+	if r[0].Code != CodeBackfillBatchConflict || r[1].Code != CodeBackfillBatchConflict || r[2].Code != "BACKFILLED" {
+		t.Fatalf("batch: %+v", r)
+	}
+	r = runBackfill(t, s, f.token, rid, backfillItem(a.ID, "B"), backfillItem(b.ID, "C"))
+	if r[0].Code != CodeBackfillOrderUsed || r[1].Code != CodeBackfillOrderConflict {
+		t.Fatalf("changed requestId payload bypassed checks: %+v", r)
+	}
+	if got := loadBackfillTask(t, db, b.ID); *got.PDDOrderNo != "B" || got.StatusVersion != b.StatusVersion+1 {
+		t.Fatal("conflict overwrote")
+	}
+	if got := loadBackfillTask(t, db, a.ID); got.PDDOrderNo != nil {
+		t.Fatal("conflict wrote data")
+	}
+	// Even an unknown task with an existing conflicting value must preserve it.
+	a.PDDOrderNo = strptr("OLD")
+	if err := db.Save(&a).Error; err != nil {
+		t.Fatal(err)
+	}
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(a.ID, "NEW"))[0]; r.Code != CodeBackfillOrderConflict {
+		t.Fatalf("unknown existing: %+v", r)
+	}
+}
+
+func TestOrderBackfillConcurrentResolveUnknown(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	// SQLite serializes transactions through one connection. These concurrent
+	// service calls verify both winner orders; they do not certify MySQL locks.
+	sqlDB, _ := db.DB()
+	sqlDB.SetMaxOpenConns(1)
+	for i := 0; i < 12; i++ {
+		task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+		start := make(chan struct{})
+		var wg sync.WaitGroup
+		wg.Add(2)
+		var out OrderBackfillResponse
+		var backErr, manualErr error
+		go func() {
+			defer wg.Done()
+			<-start
+			out, backErr = s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(task.ID, "BACK-"+purchasecontract.AddressSuffix(task.ID))}}, f.token)
+		}()
+		go func() {
+			defer wg.Done()
+			<-start
+			_, _, manualErr = s.ResolveUnknown(context.Background(), task.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "MANUAL-" + purchasecontract.AddressSuffix(task.ID), OrderSubmittedAt: task.IrreversibleAt})
+		}()
+		close(start)
+		wg.Wait()
+		if backErr != nil {
+			t.Fatal(backErr)
+		}
+		got := loadBackfillTask(t, db, task.ID)
+		if got.StatusVersion != task.StatusVersion+1 || got.Status != models.PurchaseTaskStatusOrderCreated {
+			t.Fatal("competing writes changed version twice")
+		}
+		if manualErr == nil {
+			if out.Items[0].Code != CodeBackfillOrderConflict || !strings.HasPrefix(*got.PDDOrderNo, "MANUAL-") {
+				t.Fatalf("manual winner: %+v", out)
+			}
+		} else if code(manualErr) != CodeStateConflict || out.Items[0].Code != "BACKFILLED" || !strings.HasPrefix(*got.PDDOrderNo, "BACK-") {
+			t.Fatalf("backfill winner: %+v %v", out, manualErr)
+		}
+	}
+}
+
+func TestOrderBackfillConcurrentLateResultAndOtherTask(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	sqlDB, _ := db.DB()
+	sqlDB.SetMaxOpenConns(1)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	attempt := models.PurchaseTaskAttempt{TaskID: a.ID, AttemptID: uuid.NewString(), AttemptNumber: 1, Phase: models.PurchaseAttemptPhasePurchase, Status: models.PurchaseAttemptStatusFailed, DeviceID: &f.device.ID, RuleSnapshotHash: purchaseRuleSnapshotHash(a.RuleSnapshot), SpecDecisionSnapshot: `{}`}
+	if err := db.Omit("Task").Create(&attempt).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.First(&attempt, attempt.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	wg.Add(2)
+	var out OrderBackfillResponse
+	var backErr, lateErr error
+	go func() {
+		defer wg.Done()
+		<-start
+		out, backErr = s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(a.ID, "BACK")}}, f.token)
+	}()
+	go func() {
+		defer wg.Done()
+		<-start
+		_, lateErr = s.SubmitResult(context.Background(), a.ID, ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: attempt.AttemptID, ResultType: "order_created", PDDOrderNo: "LATE", OrderSubmittedAt: a.IrreversibleAt}, f.token)
+	}()
+	close(start)
+	wg.Wait()
+	if backErr != nil || out.Items[0].Code != "BACKFILLED" || code(lateErr) != CodeStateConflict {
+		t.Fatalf("late race: %+v %v %v", out, backErr, lateErr)
+	}
+	var savedAttempt models.PurchaseTaskAttempt
+	if err := db.First(&savedAttempt, attempt.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(savedAttempt, attempt) {
+		t.Fatal("backfill rewrote attempt")
+	}
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	_, _, err := s.ResolveUnknown(context.Background(), b.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "BACK", OrderSubmittedAt: b.IrreversibleAt})
+	if err == nil {
+		t.Fatal("manual path assigned another task's order")
+	}
+	if got := loadBackfillTask(t, db, b.ID); got.PDDOrderNo != nil || got.StatusVersion != b.StatusVersion {
+		t.Fatal("other task changed on conflict")
+	}
+}
+
+func TestOrderBackfillHTTPBoundary(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.POST("/order-backfill", device.RequireAgentHTTPS(false, false), (Handler{DB: db}).BackfillOrders)
+	body, _ := json.Marshal(OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(task.ID, "HTTP")}})
+	for _, test := range []struct {
+		body, token string
+		status      int
+	}{
+		{string(body), "", http.StatusUnauthorized},
+		{`{"requestId":"bad","items":[]}`, f.token, http.StatusUnprocessableEntity},
+		{`{"requestId":"x","address":"forbidden"}`, f.token, http.StatusUnprocessableEntity},
+		{string(body), f.token, http.StatusOK},
+	} {
+		req := httptest.NewRequest(http.MethodPost, "/order-backfill", strings.NewReader(test.body))
+		req.Header.Set("Authorization", "Bearer "+test.token)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+		if w.Code != test.status {
+			t.Fatalf("HTTP %d: %s", w.Code, w.Body.String())
+		}
+	}
+	_, err := testService(db).BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: make([]OrderBackfillItem, 51)}, f.token)
+	if code(err) != CodeInvalidRequest {
+		t.Fatalf("batch limit: %v", err)
+	}
+}
+
+func TestOrderBackfillConcurrentSameOrderDifferentTasks(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	sqlDB, _ := db.DB()
+	sqlDB.SetMaxOpenConns(1)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	start := make(chan struct{})
+	results := make(chan OrderBackfillResponse, 2)
+	errors := make(chan error, 2)
+	for _, id := range []uint64{a.ID, b.ID} {
+		go func(id uint64) {
+			<-start
+			out, err := s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(id, "SAME")}}, f.token)
+			results <- out
+			errors <- err
+		}(id)
+	}
+	close(start)
+	codes := make(map[string]int)
+	for i := 0; i < 2; i++ {
+		out := <-results
+		if err := <-errors; err != nil {
+			t.Fatal(err)
+		}
+		codes[out.Items[0].Code]++
+	}
+	if codes["BACKFILLED"] != 1 || codes[CodeBackfillOrderUsed] != 1 {
+		t.Fatalf("concurrent assignments: %+v", codes)
+	}
+	var count int64
+	if err := db.Model(&models.PurchaseTask{}).Where("pdd_order_no = ?", "SAME").Count(&count).Error; err != nil || count != 1 {
+		t.Fatalf("duplicate order: %d %v", count, err)
+	}
+}
+
+func TestOrderBackfillRejectsLateAssignmentOfSameOrder(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(a.ID, "SHARED"))[0]; r.Code != "BACKFILLED" {
+		t.Fatal(r)
+	}
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderSubmitStarted)
+	lease := s.Now().Add(time.Minute)
+	b.LeaseExpiresAt = &lease
+	if err := db.Save(&b).Error; err != nil {
+		t.Fatal(err)
+	}
+	attempt := models.PurchaseTaskAttempt{TaskID: b.ID, AttemptID: uuid.NewString(), AttemptNumber: 1, Phase: models.PurchaseAttemptPhasePurchase, Status: models.PurchaseAttemptStatusRunning, DeviceID: &f.device.ID, RuleSnapshotHash: purchaseRuleSnapshotHash(b.RuleSnapshot), SpecDecisionSnapshot: `{}`}
+	if err := db.Omit("Task").Create(&attempt).Error; err != nil {
+		t.Fatal(err)
+	}
+	req := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: attempt.AttemptID, ResultType: "order_created", PDDOrderNo: "SHARED", OrderSubmittedAt: b.IrreversibleAt}
+	out, err := s.SubmitResult(context.Background(), b.ID, req, f.token)
+	if err != nil || out.Status != models.PurchaseTaskStatusOrderResultUnknown {
+		t.Fatalf("conflicting result must commit as unknown: %+v %v", out, err)
+	}
+	got := loadBackfillTask(t, db, b.ID)
+	if got.Status != models.PurchaseTaskStatusOrderResultUnknown || got.StatusVersion != b.StatusVersion+1 || got.PDDOrderNo != nil {
+		t.Fatalf("duplicate assignment was not safely downgraded: %+v", got)
+	}
+	wantMessage := "读到订单号 SHARED，但该号已属于任务 " + taskNumber(a.ID)
+	if got.ErrorCode == nil || *got.ErrorCode != CodeOrderNumberUsed || got.ErrorMessage == nil || *got.ErrorMessage != wantMessage {
+		t.Fatalf("conflict evidence missing: %+v", got)
+	}
+	if got.OrderSubmittedAt == nil || !got.OrderSubmittedAt.Equal(*req.OrderSubmittedAt) || got.IrreversibleAt == nil || got.LeaseExpiresAt != nil || got.DeviceRunSlot != nil || got.AccountRunSlot != nil {
+		t.Fatalf("boundary evidence or released lease missing: %+v", got)
+	}
+	var saved models.PurchaseTaskAttempt
+	if err := db.First(&saved, attempt.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if saved.Status != models.PurchaseAttemptStatusFailed || saved.ResultRequestID == nil || *saved.ResultRequestID != req.RequestID || saved.ResultHash == nil || saved.ResultType == nil || *saved.ResultType != "order_created" || saved.FinishedAt == nil || saved.ErrorCode == nil || *saved.ErrorCode != CodeOrderNumberUsed || saved.ErrorMessage == nil || *saved.ErrorMessage != wantMessage {
+		t.Fatalf("attempt result and conflict evidence missing: %+v", saved)
+	}
+	out, err = s.SubmitResult(context.Background(), b.ID, req, f.token)
+	if err != nil || !out.Replayed || out.Status != models.PurchaseTaskStatusOrderResultUnknown || loadBackfillTask(t, db, b.ID).StatusVersion != got.StatusVersion {
+		t.Fatalf("unknown result replay failed: %+v %v", out, err)
+	}
+	owner := loadBackfillTask(t, db, a.ID)
+	if owner.PDDOrderNo == nil || *owner.PDDOrderNo != "SHARED" || owner.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatalf("existing owner changed: %+v", owner)
+	}
+	var count int64
+	if err := db.Model(&models.PurchaseTask{}).Where("pdd_order_no = ?", "SHARED").Count(&count).Error; err != nil || count != 1 {
+		t.Fatalf("duplicate order: %d %v", count, err)
+	}
+	resolved, _, err := s.ResolveUnknown(context.Background(), b.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "CORRECTED", OrderSubmittedAt: req.OrderSubmittedAt})
+	if err != nil || resolved.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatalf("manual resolution unavailable: %+v %v", resolved, err)
+	}
+}
+
+func TestOrderBackfillHTTPTransportPolicy(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	for _, allow := range []string{"false", "true"} {
+		t.Setenv("GOAUTO_ALLOW_INSECURE_AGENT_HTTP", allow)
+		r := gin.New()
+		r.POST("/order-backfill", device.RequireAgentHTTPS(true, false), (Handler{}).BackfillOrders)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/order-backfill", strings.NewReader(`{}`)))
+		if allow == "false" && w.Code != http.StatusUpgradeRequired {
+			t.Fatalf("HTTPS bypass: %d", w.Code)
+		}
+		if allow == "true" && w.Code == http.StatusUpgradeRequired {
+			t.Fatal("HTTP compatibility broken")
+		}
+	}
+}
+
+func TestOrderBackfillMultiConnectionResolveRace(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatal(err)
+	}
+	sqlDB.SetMaxOpenConns(4)
+	task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	wg.Add(2)
+	var back OrderBackfillResponse
+	var backErr, manualErr error
+	req := OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(task.ID, "BACK")}}
+	go func() { defer wg.Done(); <-start; back, backErr = s.BackfillOrders(context.Background(), req, f.token) }()
+	go func() {
+		defer wg.Done()
+		<-start
+		_, _, manualErr = s.ResolveUnknown(context.Background(), task.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "MANUAL", OrderSubmittedAt: task.IrreversibleAt})
+	}()
+	close(start)
+	wg.Wait()
+	// SQLite returns table-lock errors rather than waiting on FOR UPDATE.
+	// Only that documented DB contention or a domain conflict is acceptable;
+	// after the competing calls finish, replay must converge without overwrite.
+	if backErr != nil && !strings.Contains(backErr.Error(), "locked") {
+		t.Fatal(backErr)
+	}
+	if manualErr != nil && code(manualErr) != CodeStateConflict && !strings.Contains(manualErr.Error(), "locked") {
+		t.Fatal(manualErr)
+	}
+	if backErr == nil && back.Items[0].Code != "BACKFILLED" && back.Items[0].Code != CodeBackfillOrderConflict && !(back.Items[0].Code == CodeInternal && back.Items[0].Retryable) {
+		t.Fatalf("unexpected race result: %+v", back)
+	}
+	before := loadBackfillTask(t, db, task.ID)
+	replay := runBackfill(t, s, f.token, req.RequestID, req.Items...)[0]
+	after := loadBackfillTask(t, db, task.ID)
+	if before.PDDOrderNo != nil && !reflect.DeepEqual(before, after) {
+		t.Fatal("replay overwrote the concurrent winner")
+	}
+	if after.StatusVersion != task.StatusVersion+1 || after.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatal("race did not converge to a single transition")
+	}
+	if manualErr == nil {
+		if *after.PDDOrderNo != "MANUAL" || replay.Code != CodeBackfillOrderConflict {
+			t.Fatal("manual winner overwritten")
+		}
+	} else if *after.PDDOrderNo != "BACK" || (replay.Code != "BACKFILLED" && replay.Code != "ALREADY_BACKFILLED") {
+		t.Fatalf("backfill did not converge: %+v", replay)
+	}
+}

server/app/goauto/purchase/order_conflict_test.go

@@ -0,0 +1,74 @@
+package purchase
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"go-admin/app/goauto/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+func TestOrderNumberConflictBusinessErrors(t *testing.T) {
+	for _, path := range []string{"resolve_unknown", "cancel", "lifecycle"} {
+		t.Run(path, func(t *testing.T) {
+			db := testDB(t)
+			f := seed(t, db, liveCaps(), true)
+			s := testService(db)
+			owner := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+			if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(owner.ID, "SHARED"))[0]; r.Code != "BACKFILLED" {
+				t.Fatal(r)
+			}
+			status := models.PurchaseTaskStatusOrderResultUnknown
+			if path == "lifecycle" {
+				status = models.PurchaseTaskStatusRunning
+			}
+			task := backfillTask(t, db, f, status)
+			if path != "resolve_unknown" {
+				// Model legacy duplicate data predating the global save guard.
+				if err := db.Session(&gorm.Session{SkipHooks: true}).Model(&models.PurchaseTask{}).Where("id = ?", task.ID).Updates(map[string]any{"pdd_order_no": "SHARED", "lease_expires_at": s.Now().Add(time.Minute)}).Error; err != nil {
+					t.Fatal(err)
+				}
+			}
+			req := ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "SHARED", OrderSubmittedAt: task.IrreversibleAt, Reason: "人工取消"}
+			var err error
+			switch path {
+			case "resolve_unknown":
+				_, _, err = s.ResolveUnknown(context.Background(), task.ID, req)
+			case "cancel":
+				_, _, err = s.Cancel(context.Background(), task.ID, req)
+			case "lifecycle":
+				attempt := models.PurchaseTaskAttempt{TaskID: task.ID, AttemptID: uuid.NewString(), AttemptNumber: 1, Phase: models.PurchaseAttemptPhasePurchase, Status: models.PurchaseAttemptStatusRunning, DeviceID: &f.device.ID, RuleSnapshotHash: purchaseRuleSnapshotHash(task.RuleSnapshot), SpecDecisionSnapshot: `{}`}
+				if e := db.Omit("Task").Create(&attempt).Error; e != nil {
+					t.Fatal(e)
+				}
+				_, err = s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: req.RequestID}, f.token)
+			}
+			want := "订单号已属于任务 " + taskNumber(owner.ID)
+			if code(err) != CodeOrderNumberUsed || err.Error() != want {
+				t.Fatalf("unmapped conflict: %v", err)
+			}
+			w := httptest.NewRecorder()
+			c, _ := gin.CreateTestContext(w)
+			writeError(c, err)
+			var body struct {
+				Code      string `json:"code"`
+				Message   string `json:"message"`
+				Retryable bool   `json:"retryable"`
+			}
+			if e := json.Unmarshal(w.Body.Bytes(), &body); e != nil || w.Code != http.StatusConflict || body.Code != CodeOrderNumberUsed || body.Message != want || body.Retryable {
+				t.Fatalf("unexpected HTTP error: %d %s (%v)", w.Code, w.Body.String(), e)
+			}
+			got := loadBackfillTask(t, db, task.ID)
+			if got.Status != status || got.StatusVersion != task.StatusVersion || got.UnknownResolveRequestID != nil || got.CancelRequestID != nil || got.OrderSubmitRequestID != nil {
+				t.Fatalf("rejected mutation persisted: %+v", got)
+			}
+		})
+	}
+}

server/app/goauto/purchase/probe_resolution.go

@@ -0,0 +1,207 @@
+package purchase
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+
+	"go-admin/app/goauto/aimatching"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/shopeeproduct"
+)
+
+// resolveProbedMatch keeps the live probe as the source of executable labels.
+// Confirmed product mappings may guide the decision only when they still map
+// uniquely to a label observed by this attempt.
+func (s *Service) resolveProbedMatch(ctx context.Context, task models.PurchaseTask, request aimatching.MatchRequest) (aimatching.MatchResult, error) {
+	resolvedColor, resolvedSize := "", ""
+	roleSources := map[string]string{}
+
+	mappings := probeGuidanceFromSnapshot(task.SpecDecisionSnapshot)
+	if candidate, ok := currentMappedCandidate(mappings.color.value, request.Colors); ok {
+		resolvedColor, roleSources[shopeeproduct.RoleColor] = candidate, mappings.color.source
+	}
+	if candidate, ok := currentMappedCandidate(mappings.size.value, request.Sizes); ok {
+		resolvedSize, roleSources[shopeeproduct.RoleSize] = candidate, mappings.size.source
+	}
+
+	if task.TargetColorSnapshot != "" && resolvedColor == "" {
+		if exact, ok := aimatching.DeterministicMatch(aimatching.MatchRequest{TargetColor: task.TargetColorSnapshot, Colors: request.Colors}); ok {
+			resolvedColor, roleSources[shopeeproduct.RoleColor] = exact.MappedColor, aimatching.SourceExact
+		}
+	}
+	if task.TargetSizeSnapshot != "" && resolvedSize == "" {
+		if exact, ok := aimatching.DeterministicMatch(aimatching.MatchRequest{TargetSize: task.TargetSizeSnapshot, Sizes: request.Sizes}); ok {
+			resolvedSize, roleSources[shopeeproduct.RoleSize] = exact.MappedSize, aimatching.SourceExact
+		}
+	}
+
+	missingColor := task.TargetColorSnapshot != "" && resolvedColor == ""
+	missingSize := task.TargetSizeSnapshot != "" && resolvedSize == ""
+	var providerDecision aimatching.DecisionSnapshot
+	if missingColor || missingSize {
+		remaining := aimatching.MatchRequest{}
+		if missingColor {
+			remaining.TargetColor, remaining.Colors = task.TargetColorSnapshot, request.Colors
+		}
+		if missingSize {
+			remaining.TargetSize, remaining.Sizes = task.TargetSizeSnapshot, request.Sizes
+		}
+		matched, err := s.matcher().Resolve(ctx, remaining)
+		if err != nil {
+			return aimatching.MatchResult{}, err
+		}
+		if matched.Source != aimatching.SourceExact && matched.Source != aimatching.SourceAI {
+			return aimatching.MatchResult{}, &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "规格匹配来源无效"}
+		}
+		providerDecision = matched.Decision
+		if missingColor {
+			if !matchCandidateValid(remaining.TargetColor, matched.MappedColor, remaining.Colors) {
+				return aimatching.MatchResult{}, &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "AI 返回的颜色不属于当次候选"}
+			}
+			resolvedColor, roleSources[shopeeproduct.RoleColor] = matched.MappedColor, matched.Source
+		}
+		if missingSize {
+			if !matchCandidateValid(remaining.TargetSize, matched.MappedSize, remaining.Sizes) {
+				return aimatching.MatchResult{}, &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "AI 返回的尺码不属于当次候选"}
+			}
+			resolvedSize, roleSources[shopeeproduct.RoleSize] = matched.MappedSize, matched.Source
+		}
+	}
+
+	source := probeSourceSummary(roleSources)
+	reason := "当次候选完成确定性匹配"
+	if containsRoleSource(roleSources, "manual_mapping") || containsRoleSource(roleSources, aimatching.SourceAI) {
+		reason = "已确认映射经当次候选验证，未解决规格按确定性或 AI 匹配"
+	}
+	result := aimatching.RecordedMatch(request, source, resolvedColor, resolvedSize, reason)
+	result.Decision.RoleSources = roleSources
+	result.Decision.Provider = providerDecision.Provider
+	result.Decision.Model = providerDecision.Model
+	result.Decision.Confidence = providerDecision.Confidence
+	return result, nil
+}
+
+type confirmedProbeMapping struct {
+	value   string
+	source  string
+	invalid bool
+}
+
+type confirmedProbeMappingSet struct {
+	color confirmedProbeMapping
+	size  confirmedProbeMapping
+}
+
+type probeGuidanceSnapshot struct {
+	ConfirmedMappings map[string]probeGuidanceMapping `json:"confirmedMappings,omitempty"`
+}
+
+type probeGuidanceMapping struct {
+	Value  string `json:"value"`
+	Source string `json:"source"`
+}
+
+func newProbeGuidanceSnapshot(raw, targetColor, targetSize string) (string, error) {
+	mappings := confirmedProbeMappings(raw, targetColor, targetSize)
+	snapshot := probeGuidanceSnapshot{ConfirmedMappings: map[string]probeGuidanceMapping{}}
+	if mappings.color.value != "" {
+		snapshot.ConfirmedMappings[shopeeproduct.RoleColor] = probeGuidanceMapping{Value: mappings.color.value, Source: mappings.color.source}
+	}
+	if mappings.size.value != "" {
+		snapshot.ConfirmedMappings[shopeeproduct.RoleSize] = probeGuidanceMapping{Value: mappings.size.value, Source: mappings.size.source}
+	}
+	encoded, err := json.Marshal(snapshot)
+	return string(encoded), err
+}
+
+func probeGuidanceFromSnapshot(raw string) confirmedProbeMappingSet {
+	var snapshot probeGuidanceSnapshot
+	if json.Unmarshal([]byte(raw), &snapshot) != nil {
+		return confirmedProbeMappingSet{}
+	}
+	result := confirmedProbeMappingSet{}
+	if mapping, ok := snapshot.ConfirmedMappings[shopeeproduct.RoleColor]; ok {
+		result.color = confirmedProbeMapping{value: strings.TrimSpace(mapping.Value), source: mapping.Source}
+	}
+	if mapping, ok := snapshot.ConfirmedMappings[shopeeproduct.RoleSize]; ok {
+		result.size = confirmedProbeMapping{value: strings.TrimSpace(mapping.Value), source: mapping.Source}
+	}
+	return result
+}
+
+func confirmedProbeMappings(raw, targetColor, targetSize string) confirmedProbeMappingSet {
+	var specs []shopeeproduct.SpecDimension
+	if json.Unmarshal([]byte(raw), &specs) != nil {
+		return confirmedProbeMappingSet{}
+	}
+	result := confirmedProbeMappingSet{}
+	for _, dimension := range specs {
+		for _, value := range dimension.Values {
+			if value.Mapping == nil || value.Mapping.Status != shopeeproduct.MappingStatusConfirmed {
+				continue
+			}
+			mapping := confirmedProbeMapping{value: strings.TrimSpace(value.Mapping.PDDValue), source: mapSource(value.Mapping.Source)}
+			switch {
+			case dimension.Role == shopeeproduct.RoleColor && value.Name == targetColor:
+				result.color = mergeConfirmedProbeMapping(result.color, mapping)
+			case dimension.Role == shopeeproduct.RoleSize && value.Name == targetSize:
+				result.size = mergeConfirmedProbeMapping(result.size, mapping)
+			}
+		}
+	}
+	return result
+}
+
+func mergeConfirmedProbeMapping(current, incoming confirmedProbeMapping) confirmedProbeMapping {
+	if current.invalid {
+		return current
+	}
+	if current.value == "" {
+		return incoming
+	}
+	if current.value != incoming.value {
+		return confirmedProbeMapping{invalid: true}
+	}
+	return current
+}
+
+func currentMappedCandidate(mapped string, candidates []string) (string, bool) {
+	mapped = strings.TrimSpace(mapped)
+	if mapped == "" {
+		return "", false
+	}
+	matches := make([]string, 0, 1)
+	seen := map[string]bool{}
+	for _, candidate := range candidates {
+		candidate = strings.TrimSpace(candidate)
+		if candidate == "" || seen[candidate] || aimatching.Normalize(candidate) != aimatching.Normalize(mapped) {
+			continue
+		}
+		seen[candidate] = true
+		matches = append(matches, candidate)
+	}
+	if len(matches) != 1 {
+		return "", false
+	}
+	return matches[0], true
+}
+
+func probeSourceSummary(roleSources map[string]string) string {
+	if containsRoleSource(roleSources, "manual_mapping") {
+		return "manual_mapping"
+	}
+	if containsRoleSource(roleSources, aimatching.SourceAI) {
+		return aimatching.SourceAI
+	}
+	return aimatching.SourceExact
+}
+
+func containsRoleSource(roleSources map[string]string, target string) bool {
+	for _, source := range roleSources {
+		if source == target {
+			return true
+		}
+	}
+	return false
+}

server/app/goauto/purchase/process_stage.go

@@ -69,8 +69,7 @@ func (s *Service) ProcessStages(ctx context.Context, ids []uint64) (map[uint64]P
 		return nil, err
 	}
 	for _, id := range ids {
-		preview := s.previewFromDataset(ctx, id, dataset, false, guard)
-		preview.enforcePersistedMatch(id, dataset)
+		preview := s.previewFromDataset(id, dataset, guard)
 		qualification := aiMatchQualificationForDataset(id, dataset)
 		preview.AIMatchEligible = qualification.Eligible
 		preview.AIMatchDisabledReason = qualification.DisabledReason
@@ -137,7 +136,7 @@ func processStageFromDataset(id uint64, dataset batchPreviewDataset, preview Bat
 	if !ok {
 		return stage(ProcessStageManualAction, "SYB 商品不存在或已删除", "refresh")
 	}
-	if syb.ParseStatus == models.SYBParseStatusFailed {
+	if syb.ParseStatus == models.SYBParseStatusFailed && !syb.ManuallyConfirmed && !syb.AIConfirmed {
 		return stage(ProcessStageManualAction, "解析失败，请先处理", "reparse")
 	}
 	if syb.ShopeeProductID == nil {

server/app/goauto/purchase/reset.go

@@ -87,6 +87,9 @@ func (s *Service) reset(ctx context.Context, taskID uint64, req PurchaseResetReq
 		if err := validatePurchaseResetState(tx, task); err != nil {
 			return err
 		}
+		if task.SpecSource != "unresolved" && !hasCompletePurchaseSpec(task) {
+			return fail(CodeMappingRequired, "任务没有完整的精确商品规格，请创建新采购任务")
+		}
 		deviceRecord, err := lockPurchaseResetDevice(tx, task, authenticated)
 		if err != nil {
 			return err
@@ -130,10 +133,7 @@ func (s *Service) reset(ctx context.Context, taskID uint64, req PurchaseResetReq
 			return conflictOrInternal(err)
 		}
 
-		phase := models.PurchaseAttemptPhasePurchase
-		if task.SpecSource == "unresolved" {
-			phase = models.PurchaseAttemptPhaseSpecProbe
-		}
+		phase := purchaseAttemptPhase(task)
 		// MySQL normalizes values written to a JSON column. Reload the task before
 		// hashing so the pending attempt uses the exact representation Start will
 		// read later, rather than the pre-persistence DefaultLiveRule bytes.
@@ -155,6 +155,18 @@ func (s *Service) reset(ctx context.Context, taskID uint64, req PurchaseResetReq
 	return response, err
 }
 
+func purchaseAttemptPhase(task models.PurchaseTask) string {
+	if task.SpecSource == "unresolved" || !hasCompletePurchaseSpec(task) {
+		return models.PurchaseAttemptPhaseSpecProbe
+	}
+	return models.PurchaseAttemptPhasePurchase
+}
+
+func hasCompletePurchaseSpec(task models.PurchaseTask) bool {
+	return (strings.TrimSpace(task.TargetColorSnapshot) == "" || strings.TrimSpace(task.MappedColorSnapshot) != "") &&
+		(strings.TrimSpace(task.TargetSizeSnapshot) == "" || strings.TrimSpace(task.MappedSizeSnapshot) != "")
+}
+
 func validatePurchaseResetState(tx *gorm.DB, task models.PurchaseTask) error {
 	switch task.Status {
 	case models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusOrderCreated, models.PurchaseTaskStatusOrderResultUnknown:

server/app/goauto/purchase/reset_test.go

@@ -108,6 +108,36 @@ func TestPurchaseResetReusesTaskRefreshesRuleAndIsIdempotent(t *testing.T) {
 	}
 }
 
+func TestPurchaseResetRejectsResolvedDecisionWithoutExactSpec(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	service := testService(db)
+	failed := failedLiveTask(t, db, service, f)
+	decisionID := uuid.NewString()
+	if err := db.Session(&gorm.Session{SkipHooks: true}).Model(&models.PurchaseTask{}).Where("id = ?", failed.ID).Updates(map[string]any{
+		"spec_source": "ai_match", "spec_decision_request_id": decisionID,
+		"mapped_color_snapshot": "", "mapped_size_snapshot": "",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := service.ResetForDevice(context.Background(), failed.ID, PurchaseResetRequest{RequestID: uuid.NewString()}, f.token)
+	if code(err) != CodeMappingRequired {
+		t.Fatalf("resolved decision without exact spec was reset: %v", err)
+	}
+	var task models.PurchaseTask
+	if queryErr := db.First(&task, failed.ID).Error; queryErr != nil {
+		t.Fatal(queryErr)
+	}
+	if task.Status != models.PurchaseTaskStatusFailed {
+		t.Fatalf("rejected reset changed task status: %+v", task)
+	}
+	var attemptCount int64
+	if queryErr := db.Model(&models.PurchaseTaskAttempt{}).Where("task_id = ?", failed.ID).Count(&attemptCount).Error; queryErr != nil || attemptCount != 0 {
+		t.Fatalf("rejected reset created attempt: count=%d err=%v", attemptCount, queryErr)
+	}
+}
+
 func TestPurchaseStartPersistsPendingAttemptSnapshotMismatchAsFailure(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), true)

server/app/goauto/purchase/retry.go

@@ -218,7 +218,12 @@ func (s *Service) retryEligibility(ctx context.Context, task models.PurchaseTask
 		return decision
 	}
 
-	preview := s.previewOne(ctx, *task.SYBProductID)
+	_, _, currentRule, ruleErr := purchaserule.CurrentRule(ctx, s.DB, models.PurchaseExecutionModeLive)
+	if ruleErr != nil {
+		code, message, _ := serviceErrorFields(ruleErr)
+		return retryDecision{ReasonCode: code, Reason: message}
+	}
+	preview := s.previewOneDeterministic(ctx, *task.SYBProductID, purchasecontract.EffectivePriceGuard(currentRule))
 	if !preview.Eligible {
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
@@ -230,10 +235,9 @@ func (s *Service) retryEligibility(ctx context.Context, task models.PurchaseTask
 }
 
 // retryQueryEligibility is deliberately limited to local task and device
-// safety checks. Admin list/detail queries must never call previewOne because
-// previewOne can fall back to the external AI provider for unresolved specs.
-// The batch-retry command runs retryEligibility and performs that complete,
-// current-archive validation only after the operator submits the retry.
+// safety checks. The batch-retry command performs deterministic archive and
+// price validation, but specification resolution belongs to the new task's
+// mandatory live probe and never calls AI before task creation.
 func (s *Service) retryQueryEligibility(ctx context.Context, task models.PurchaseTask, checkDeviceBusy bool) retryDecision {
 	decision := s.retryStateEligibility(ctx, task)
 	if !decision.Allowed {
@@ -263,25 +267,20 @@ func (s *Service) continuePurchaseEligibility(ctx context.Context, task models.P
 	guard := purchasecontract.EffectivePriceGuard(currentRule)
 	syb, found := dataset.sybByID[*task.SYBProductID]
 	if !found || syb.ShopeeProductID == nil {
-		preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+		preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
 	shopee, found := dataset.shopeeByID[*syb.ShopeeProductID]
 	if !found || shopee.PDDProductID == nil {
-		preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+		preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
-	pdd, found := dataset.pddByID[*shopee.PDDProductID]
+	_, found = dataset.pddByID[*shopee.PDDProductID]
 	if !found {
-		preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+		preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}
-	mappedColor, mappedSize, source := confirmedMappings(shopee.SpecsJSON, syb.TargetColor, syb.TargetSize)
-	candidates, _ := archiveCandidates(pdd.SpecsJSON, syb.TargetColor, syb.TargetSize)
-	if source == "unresolved" || !mappingTargetsValid(candidates, syb.TargetColor, syb.TargetSize, mappedColor, mappedSize) {
-		return retryDecision{ReasonCode: CodeMappingRequired, Reason: "规格匹配已失效，请在 Admin 重新确认"}
-	}
-	preview := s.previewFromDataset(ctx, *task.SYBProductID, dataset, false, guard)
+	preview := s.previewFromDataset(*task.SYBProductID, dataset, guard)
 	if !preview.Eligible {
 		return retryDecision{ReasonCode: preview.ReasonCode, Reason: preview.Reason}
 	}

server/app/goauto/purchase/retry_test.go

@@ -223,7 +223,7 @@ func TestAdminListRetryEligibilityRejectsBusyOriginalDevice(t *testing.T) {
 	}
 }
 
-func TestAdminQueriesDoNotResolveSpecsButBatchRetryStillDoes(t *testing.T) {
+func TestAdminQueriesAndBatchRetryDoNotResolveArchivedSpecs(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	service := testService(db)
@@ -253,8 +253,8 @@ func TestAdminQueriesDoNotResolveSpecsButBatchRetryStillDoes(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if matcher.calls != 1 || retry.CreatedCount != 0 || retry.FailedCount != 1 || retry.Items[0].ReasonCode != CodeMappingRequired {
-		t.Fatalf("batch retry skipped full matching: result=%+v matcherCalls=%d", retry, matcher.calls)
+	if matcher.calls != 0 || retry.CreatedCount != 1 || retry.FailedCount != 0 {
+		t.Fatalf("batch retry did not create a mandatory probe task: result=%+v matcherCalls=%d", retry, matcher.calls)
 	}
 }
 

server/app/goauto/purchase/router.go

@@ -18,6 +18,7 @@ func InitRouter(engine *gin.Engine, auth *jwt.GinJWTMiddleware) {
 	agent := engine.Group("/api/agent/v1/purchase-tasks").Use(device.RequireAgentHTTPS(config.ApplicationConfig.Mode == "prod", trust))
 	agent.GET("", h.AgentHistory)
 	agent.GET("/next", h.Next)
+	agent.POST("/order-backfill", h.BackfillOrders)
 	agent.GET("/:taskId", h.AgentHistoryDetail)
 	agent.POST("/:taskId/retry", h.AgentRetry)
 	agent.POST("/:taskId/reset", h.AgentReset)

server/app/goauto/purchase/service.go

@@ -54,11 +54,6 @@ type SpecMatcher interface {
 	Resolve(context.Context, aimatching.MatchRequest) (aimatching.MatchResult, error)
 }
 
-type externalMatchPlan struct {
-	fingerprint string
-	snapshot    string
-}
-
 type matchFingerprint struct {
 	SYBProductID    uint64          `json:"sybProductId"`
 	TargetColor     string          `json:"targetColor"`
@@ -96,51 +91,6 @@ func (s *Service) Create(ctx context.Context, req CreateRequest) (models.Purchas
 	return call.task, call.replayed, call.err
 }
 
-func (s *Service) prepareExternalMatch(ctx context.Context, req CreateRequest) (*externalMatchPlan, error) {
-	if req.ExecutionMode != models.PurchaseExecutionModeLive || req.SYBProductID == nil {
-		return nil, nil
-	}
-	var syb models.SYBProduct
-	if err := s.DB.WithContext(ctx).First(&syb, *req.SYBProductID).Error; err != nil {
-		return nil, notFound(err, "顺云宝商品不存在")
-	}
-	if syb.ShopeeProductID == nil {
-		return nil, fail(CodeInvalidRequest, "该商品尚未关联蝦皮商品")
-	}
-	var shopee models.ShopeeProduct
-	if err := s.DB.WithContext(ctx).First(&shopee, *syb.ShopeeProductID).Error; err != nil {
-		return nil, notFound(err, "蝦皮商品不存在")
-	}
-	if shopee.PDDProductID == nil {
-		return nil, fail(CodeInvalidRequest, "该蝦皮商品尚未关联拼多多商品")
-	}
-	var pdd models.PDDProduct
-	if err := s.DB.WithContext(ctx).First(&pdd, *shopee.PDDProductID).Error; err != nil {
-		return nil, notFound(err, "拼多多商品不存在")
-	}
-	targetColor, targetSize := strings.TrimSpace(req.TargetColor), strings.TrimSpace(req.TargetSize)
-	if targetColor == "" {
-		targetColor = syb.TargetColor
-	}
-	if targetSize == "" {
-		targetSize = syb.TargetSize
-	}
-	_, _, source := confirmedMappings(shopee.SpecsJSON, targetColor, targetSize)
-	candidates, usable := archiveCandidates(pdd.SpecsJSON, targetColor, targetSize)
-	if pdd.Status != "active" || source != "unresolved" || !usable {
-		return nil, nil
-	}
-	request := aimatching.MatchRequest{TargetColor: targetColor, TargetSize: targetSize, Colors: candidates.Colors, Sizes: candidates.Sizes}
-	if _, deterministic := aimatching.DeterministicMatch(request); deterministic {
-		return nil, nil
-	}
-	fingerprint, snapshot, err := creationMatchInput(syb, shopee, pdd, request)
-	if err != nil {
-		return nil, internal(err)
-	}
-	return &externalMatchPlan{fingerprint: fingerprint, snapshot: snapshot}, nil
-}
-
 func creationMatchInput(syb models.SYBProduct, shopee models.ShopeeProduct, pdd models.PDDProduct, request aimatching.MatchRequest) (string, string, error) {
 	canonical := func(raw string) (json.RawMessage, error) {
 		var value any
@@ -194,10 +144,6 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
 		return models.PurchaseTask{}, false, internal(err)
 	}
-	externalPlan, err := s.prepareExternalMatch(ctx, req)
-	if err != nil {
-		return models.PurchaseTask{}, false, err
-	}
 	replayed := false
 	err = s.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
 		if err := tx.Where("create_request_id = ?", req.RequestID).First(&out).Error; err == nil {
@@ -334,22 +280,25 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 			if currency == "" {
 				currency = shopee.Currency
 			}
-			mappedColor, mappedSize, specSource = confirmedMappings(shopee.SpecsJSON, targetColor, targetSize)
+			// Every new SYB purchase must use the candidates observed on the
+			// current PDD page. Freeze confirmed mappings only as guidance for
+			// validation against that future probe; they never skip the probe.
+			mappedColor, mappedSize, specSource = "", "", "unresolved"
+			guidance, marshalErr := newProbeGuidanceSnapshot(shopee.SpecsJSON, targetColor, targetSize)
+			if marshalErr != nil {
+				return internal(marshalErr)
+			}
+			decisionSnapshot = guidance
 		}
 		candidates, archiveUsable := archiveCandidates(pdd.SpecsJSON, targetColor, targetSize)
 		matchRequest := aimatching.MatchRequest{TargetColor: targetColor, TargetSize: targetSize, Colors: candidates.Colors, Sizes: candidates.Sizes}
-		if externalPlan != nil {
-			fingerprint, fingerprintErr := creationMatchFingerprint(syb, shopee, pdd, matchRequest)
-			if fingerprintErr != nil {
-				return internal(fingerprintErr)
-			}
-			if fingerprint != externalPlan.fingerprint {
-				return fail(CodeMappingRequired, "规格匹配输入已变化，请重新创建采购任务")
-			}
-		}
 		if taskType == models.PurchaseTaskTypeStock {
 			// Direct stock selection was already validated above. It never enters
 			// mapping, deterministic matching, or the external AI fallback.
+		} else if req.ExecutionMode == models.PurchaseExecutionModeLive {
+			// The first attempt is always spec_probe for an SYB purchase. The
+			// exact task-level decision is frozen only from that probe result.
+			mappedColor, mappedSize, specSource = "", "", "unresolved"
 		} else if pdd.Status != "active" {
 			mappedColor, mappedSize, specSource = "", "", "unresolved"
 		} else if specSource == "manual_mapping" || specSource == "exact_match" || specSource == "ai_match" {
@@ -365,8 +314,6 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 			}
 		} else if !archiveUsable {
 			mappedColor, mappedSize, specSource = "", "", "unresolved"
-		} else if externalPlan != nil {
-			mappedColor, mappedSize, specSource = "", "", "unresolved"
 		} else if match, matched := aimatching.DeterministicMatch(matchRequest); !matched {
 			// #190：确定性匹配失败不再拒绝，降级为 unresolved 交给规格探测。
 			mappedColor, mappedSize, specSource = "", "", "unresolved"
@@ -404,17 +351,8 @@ func (s *Service) create(ctx context.Context, req CreateRequest) (models.Purchas
 		if err := tx.Model(&out).Update("address_suffix", out.AddressSuffix).Error; err != nil {
 			return internal(err)
 		}
-		if externalPlan != nil {
-			work := models.PurchaseSpecMatchWorkItem{PurchaseTaskID: out.ID, Status: models.PurchaseMatchPending, InputFingerprint: externalPlan.fingerprint, InputSnapshotJSON: externalPlan.snapshot}
-			if err := tx.Create(&work).Error; err != nil {
-				return internal(err)
-			}
-		}
 		return nil
 	})
-	if err == nil && !replayed && externalPlan != nil && s.StartMatching != nil {
-		s.StartMatching(s.DB)
-	}
 	return out, replayed, err
 }
 

server/app/goauto/purchase/service_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"go-admin/app/goauto/aimatching"
 	"go-admin/app/goauto/device"
 	"go-admin/app/goauto/migrations"
 	"go-admin/app/goauto/models"
@@ -29,6 +30,19 @@ type fixture struct {
 	token  string
 }
 
+type liveProbeMatcher struct {
+	result  aimatching.MatchResult
+	err     error
+	calls   int
+	request aimatching.MatchRequest
+}
+
+func (matcher *liveProbeMatcher) Resolve(_ context.Context, request aimatching.MatchRequest) (aimatching.MatchResult, error) {
+	matcher.calls++
+	matcher.request = request
+	return matcher.result, matcher.err
+}
+
 func testDB(t *testing.T) *gorm.DB {
 	t.Helper()
 	dsn := fmt.Sprintf("file:%s?mode=memory&cache=shared&_foreign_keys=on", strings.ReplaceAll(t.Name(), "/", "_"))
@@ -107,6 +121,30 @@ func createLive(t *testing.T, s *Service, f fixture) (models.PurchaseTask, error
 	r, _, err := s.Create(context.Background(), CreateRequest{RequestID: uuid.NewString(), ExecutionMode: models.PurchaseExecutionModeLive, SYBProductID: &f.syb.ID, DeviceID: &f.device.ID, MinUnitPriceCent: 400, MaxUnitPriceCent: 3000, RuleSnapshot: liveRule(true)})
 	return r, err
 }
+
+func startLivePurchaseAfterProbe(t *testing.T, s *Service, f fixture, task models.PurchaseTask) TaskPayload {
+	t.Helper()
+	if _, err := s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	probeAttempt, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || probeAttempt.Phase != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("probe start: %+v %v", probeAttempt, err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: probeAttempt.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黑色"]},{"key":"size","values":["XL"]}]}`)}
+	if _, err = s.SubmitResult(context.Background(), task.ID, probe, f.token); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	purchaseAttempt, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || purchaseAttempt.Phase != models.PurchaseAttemptPhasePurchase {
+		t.Fatalf("purchase start: %+v %v", purchaseAttempt, err)
+	}
+	return purchaseAttempt
+}
+
 func code(err error) string {
 	var e *ServiceError
 	if errors.As(err, &e) {
@@ -224,9 +262,23 @@ func TestCreateAndLifecycleValidateCapabilitiesAndIdempotentResult(t *testing.T)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if start.Phase != models.PurchaseAttemptPhasePurchase {
+	if start.Phase != models.PurchaseAttemptPhaseSpecProbe {
 		t.Fatalf("unexpected phase %s", start.Phase)
 	}
+	if _, err = s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); code(err) != CodeStateConflict {
+		t.Fatalf("probe entered order boundary: %v", err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: start.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黑色"]},{"key":"size","values":["XL"]}]}`)}
+	if _, err = s.SubmitResult(context.Background(), task.ID, probe, f.token); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	start, err = s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || start.Phase != models.PurchaseAttemptPhasePurchase {
+		t.Fatalf("purchase start: %+v %v", start, err)
+	}
 	if _, err = s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
 		t.Fatal(err)
 	}
@@ -243,7 +295,7 @@ func TestCreateAndLifecycleValidateCapabilitiesAndIdempotentResult(t *testing.T)
 	}
 	var count int64
 	db.Model(&models.PurchaseTaskAttempt{}).Where("task_id = ?", task.ID).Count(&count)
-	if count != 1 || first.Status != models.PurchaseTaskStatusOrderCreated {
+	if count != 2 || first.Status != models.PurchaseTaskStatusOrderCreated {
 		t.Fatalf("duplicate attempt or wrong status: %d %+v", count, first)
 	}
 	var stored models.PurchaseTask
@@ -344,6 +396,198 @@ func TestSlowPathUsesTwoAttemptsAndFreezesDecision(t *testing.T) {
 	}
 }
 
+func TestLiveProbeCallsAIOnlyAfterCandidatesAreReturned(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "象牙白").Error; err != nil {
+		t.Fatal(err)
+	}
+	request := aimatching.MatchRequest{TargetColor: "象牙白", TargetSize: "XL", Colors: []string{"米白色", "白色"}, Sizes: []string{"XL"}}
+	matcher := &liveProbeMatcher{result: aimatching.RecordedMatch(request, aimatching.SourceAI, "米白色", "XL", "在当次候选中唯一匹配")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil || matcher.calls != 0 || task.SpecSource != "unresolved" {
+		t.Fatalf("task creation called matcher or skipped probe: task=%+v calls=%d err=%v", task, matcher.calls, err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || first.Phase != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("probe start: %+v %v", first, err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["米白色","白色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || matcher.calls != 1 || resolved.Status != models.PurchaseTaskStatusPending || resolved.MappedColor != "米白色" || resolved.MappedSize != "XL" {
+		t.Fatalf("probe AI result: %+v calls=%d err=%v", resolved, matcher.calls, err)
+	}
+}
+
+func TestLiveProbeReusesConfirmedColorAndResolvesCurrentSizeWithoutAI(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Updates(map[string]any{
+		"target_color": "薑黃色",
+		"target_size":  "5XL",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+	specs := []shopeeproduct.SpecDimension{
+		{Name: "颜色", Role: shopeeproduct.RoleColor, Values: []shopeeproduct.SpecValue{{Name: "薑黃色", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "黄色", Source: shopeeproduct.MappingSourceManual, Status: shopeeproduct.MappingStatusConfirmed}}}},
+		{Name: "尺码", Role: shopeeproduct.RoleSize, Values: []shopeeproduct.SpecValue{{Name: "5XL", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "XXXXXL", Source: shopeeproduct.MappingSourceAIMatch, Status: shopeeproduct.MappingStatusConfirmed, Reason: "历史档案原文"}}}},
+	}
+	raw, _ := json.Marshal(specs)
+	if err := db.Model(&models.ShopeeProduct{}).Where("id = ?", f.shopee.ID).Update("specs_json", string(raw)).Error; err != nil {
+		t.Fatal(err)
+	}
+	matcher := &liveProbeMatcher{err: errors.New("AI should not be called")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil || task.MappedColorSnapshot != "" || task.MappedSizeSnapshot != "" {
+		t.Fatalf("live task skipped mandatory probe: %+v err=%v", task, err)
+	}
+	if err = db.Model(&models.ShopeeProduct{}).Where("id = ?", f.shopee.ID).Update("specs_json", `[]`).Error; err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["白色","黄色","黑色"]},{"key":"size","values":["4XL","5XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || matcher.calls != 0 || resolved.Status != models.PurchaseTaskStatusPending {
+		t.Fatalf("confirmed mapping resolution failed: %+v calls=%d err=%v", resolved, matcher.calls, err)
+	}
+	if resolved.MappedColor != "黄色" || resolved.MappedSize != "5XL" {
+		t.Fatalf("task did not freeze current probe labels: %+v", resolved)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	var decision struct {
+		RoleSources map[string]string `json:"roleSources"`
+	}
+	if err = json.Unmarshal([]byte(saved.SpecDecisionSnapshot), &decision); err != nil {
+		t.Fatal(err)
+	}
+	if saved.SpecSource != "manual_mapping" || decision.RoleSources[shopeeproduct.RoleColor] != "manual_mapping" || decision.RoleSources[shopeeproduct.RoleSize] != aimatching.SourceExact {
+		t.Fatalf("mixed role sources were not audited: task=%+v decision=%+v", saved, decision)
+	}
+}
+
+func TestLiveProbeCallsAIOnlyForRoleWithoutCurrentConfirmedMapping(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "薑黃色").Error; err != nil {
+		t.Fatal(err)
+	}
+	specs := []shopeeproduct.SpecDimension{
+		{Name: "颜色", Role: shopeeproduct.RoleColor, Values: []shopeeproduct.SpecValue{{Name: "薑黃色", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "旧黄色", Source: shopeeproduct.MappingSourceManual, Status: shopeeproduct.MappingStatusConfirmed}}}},
+		{Name: "尺码", Role: shopeeproduct.RoleSize, Values: []shopeeproduct.SpecValue{{Name: "XL", Source: shopeeproduct.ValueSourceImport, Mapping: &shopeeproduct.Mapping{PDDValue: "XL", Source: shopeeproduct.MappingSourceManual, Status: shopeeproduct.MappingStatusConfirmed}}}},
+	}
+	raw, _ := json.Marshal(specs)
+	if err := db.Model(&models.ShopeeProduct{}).Where("id = ?", f.shopee.ID).Update("specs_json", string(raw)).Error; err != nil {
+		t.Fatal(err)
+	}
+	aiRequest := aimatching.MatchRequest{TargetColor: "薑黃色", Colors: []string{"黄色"}}
+	matcher := &liveProbeMatcher{result: aimatching.RecordedMatch(aiRequest, aimatching.SourceAI, "黄色", "", "当前颜色候选匹配")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黄色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || matcher.calls != 1 || resolved.MappedColor != "黄色" || resolved.MappedSize != "XL" {
+		t.Fatalf("partial AI resolution failed: %+v request=%+v err=%v", resolved, matcher.request, err)
+	}
+	if matcher.request.TargetColor != "薑黃色" || matcher.request.TargetSize != "" || len(matcher.request.Colors) != 1 || len(matcher.request.Sizes) != 0 {
+		t.Fatalf("resolved size was unnecessarily sent to AI: %+v", matcher.request)
+	}
+}
+
+func TestLiveProbeRejectsMatcherValueOutsideCurrentCandidates(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "象牙黑").Error; err != nil {
+		t.Fatal(err)
+	}
+	request := aimatching.MatchRequest{TargetColor: "象牙黑", Colors: []string{"黑色"}}
+	matcher := &liveProbeMatcher{result: aimatching.RecordedMatch(request, aimatching.SourceAI, "候选外颜色", "XL", "无效返回")}
+	s := testService(db)
+	s.Matcher = matcher
+	task, err := createLive(t, s, f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黑色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || resolved.Status != models.PurchaseTaskStatusFailed || resolved.MappedColor != "" || resolved.MappedSize != "" {
+		t.Fatalf("out-of-candidate result was accepted: %+v err=%v", resolved, err)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil || saved.ErrorCode == nil || *saved.ErrorCode != "PURCHASE_SPEC_NOT_MATCHED" {
+		t.Fatalf("outside-candidate failure was not persisted: %+v err=%v", saved, err)
+	}
+	if saved.ErrorMessage == nil || *saved.ErrorMessage != "已采集到当前规格，但未能确定颜色或尺码映射" {
+		t.Fatalf("outside-candidate failure reason was not preserved: %+v", saved)
+	}
+}
+
+func TestLiveProbeUsesAccurateMessageWhenCompleteCandidatesCannotBeMatched(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), false)
+	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Update("target_color", "薑黃色").Error; err != nil {
+		t.Fatal(err)
+	}
+	s := testService(db)
+	s.Matcher = &liveProbeMatcher{err: &aimatching.Error{Code: aimatching.CodeNoMatch, Message: "no match"}}
+	task, err := createLive(t, s, f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["黄色"]},{"key":"size","values":["XL"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || resolved.Status != models.PurchaseTaskStatusFailed {
+		t.Fatalf("no-match probe did not converge: %+v err=%v", resolved, err)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if saved.ErrorMessage == nil || *saved.ErrorMessage != "已采集到当前规格，但未能确定颜色或尺码映射" {
+		t.Fatalf("complete candidates used misleading failure reason: %+v", saved)
+	}
+}
+
 func TestSecondSpecProbeFailsClosedWithoutClearingDecision(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
@@ -428,7 +672,7 @@ func TestSpecResolutionAllowedMatrix(t *testing.T) {
 	}
 }
 
-func TestCreateUsesDeterministicTraditionalAndWeightMatching(t *testing.T) {
+func TestLiveProbeUsesDeterministicTraditionalAndWeightMatching(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"浅蓝色","selectable":true,"priceCent":2000}]},{"name":"尺码","role":"size","values":[{"name":"4XL 160-170斤","selectable":true}]}]`).Error; err != nil {
@@ -437,12 +681,26 @@ func TestCreateUsesDeterministicTraditionalAndWeightMatching(t *testing.T) {
 	if err := db.Model(&models.SYBProduct{}).Where("id = ?", f.syb.ID).Updates(map[string]any{"target_color": "淺藍色", "target_size": "４XL 80-85公斤"}).Error; err != nil {
 		t.Fatal(err)
 	}
-	task, err := createLive(t, testService(db), f)
-	if err != nil || task.SpecSource != "exact_match" || task.MappedColorSnapshot != "浅蓝色" || task.MappedSizeSnapshot != "4XL 160-170斤" {
-		t.Fatalf("deterministic match failed: %+v %v", task, err)
+	s := testService(db)
+	task, err := createLive(t, s, f)
+	if err != nil || task.SpecSource != "unresolved" || task.MappedColorSnapshot != "" || task.MappedSizeSnapshot != "" {
+		t.Fatalf("live task skipped probe: %+v %v", task, err)
 	}
-	if strings.Contains(task.SpecDecisionSnapshot, "apiKey") || !strings.Contains(task.SpecDecisionSnapshot, "exact_match") {
-		t.Fatalf("task decision snapshot is unsafe or incomplete: %s", task.SpecDecisionSnapshot)
+	if _, err = s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
+	first, err := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	if err != nil || first.Phase != models.PurchaseAttemptPhaseSpecProbe {
+		t.Fatalf("probe start: %+v %v", first, err)
+	}
+	probe := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: first.TaskAttemptID, ResultType: "spec_probe_completed", ProbedSpecs: []byte(`{"dimensions":[{"key":"color","values":["浅蓝色"]},{"key":"size","values":["4XL 160-170斤"]}]}`)}
+	resolved, err := s.SubmitResult(context.Background(), task.ID, probe, f.token)
+	if err != nil || resolved.MappedColor != "浅蓝色" || resolved.MappedSize != "4XL 160-170斤" {
+		t.Fatalf("deterministic probe match failed: %+v %v", resolved, err)
+	}
+	var saved models.PurchaseTask
+	if err = db.First(&saved, task.ID).Error; err != nil || strings.Contains(saved.SpecDecisionSnapshot, "apiKey") || !strings.Contains(saved.SpecDecisionSnapshot, "exact_match") {
+		t.Fatalf("task decision snapshot is unsafe or incomplete: %s err=%v", saved.SpecDecisionSnapshot, err)
 	}
 }
 
@@ -457,12 +715,12 @@ func TestCreateDoesNotTrustMappedLabelsFromRequest(t *testing.T) {
 		SYBProductID: &f.syb.ID, DeviceID: &f.device.ID, MappedColor: "白色", MappedSize: "XL",
 		MinUnitPriceCent: 400, MaxUnitPriceCent: 3000, RuleSnapshot: liveRule(true),
 	})
-	if err != nil || task.SpecSource != "exact_match" || task.MappedColorSnapshot != "黑色" || task.MappedSizeSnapshot != "XL" {
-		t.Fatalf("request-provided mapping must not override server match: %+v %v", task, err)
+	if err != nil || task.SpecSource != "unresolved" || task.MappedColorSnapshot != "" || task.MappedSizeSnapshot != "" {
+		t.Fatalf("request-provided mapping must not skip live probe: %+v %v", task, err)
 	}
 }
 
-func TestCreateQueuesUsableArchiveWhenDeterministicMatchFails(t *testing.T) {
+func TestCreateDoesNotQueueArchiveMatchingBeforeLiveProbe(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"白色","selectable":true,"priceCent":2000}]},{"name":"尺码","role":"size","values":[{"name":"L","selectable":true}]}]`).Error; err != nil {
@@ -475,12 +733,12 @@ func TestCreateQueuesUsableArchiveWhenDeterministicMatchFails(t *testing.T) {
 		t.Fatalf("task=%+v err=%v", task, err)
 	}
 	var count int64
-	if err := db.Model(&models.PurchaseSpecMatchWorkItem{}).Where("purchase_task_id = ?", task.ID).Count(&count).Error; err != nil || count != 1 {
+	if err := db.Model(&models.PurchaseSpecMatchWorkItem{}).Where("purchase_task_id = ?", task.ID).Count(&count).Error; err != nil || count != 0 {
 		t.Fatalf("work count=%d err=%v", count, err)
 	}
 }
 
-func TestCreateQueuesExternalMatchingWithoutCallingProvider(t *testing.T) {
+func TestCreateDispatchesProbeInsteadOfExternalArchiveMatching(t *testing.T) {
 	db := testDB(t)
 	f := seed(t, db, liveCaps(), false)
 	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"白色","selectable":true,"priceCent":2000},{"name":"米白色","selectable":true,"priceCent":2000}]},{"name":"尺码","role":"size","values":[{"name":"XL","selectable":true}]}]`).Error; err != nil {
@@ -495,12 +753,48 @@ func TestCreateQueuesExternalMatchingWithoutCallingProvider(t *testing.T) {
 	if err != nil || task.ID == 0 || task.SpecSource != "unresolved" {
 		t.Fatalf("queued task=%+v err=%v", task, err)
 	}
-	var work models.PurchaseSpecMatchWorkItem
-	if err := db.Where("purchase_task_id = ?", task.ID).First(&work).Error; err != nil || work.Status != models.PurchaseMatchPending || work.InputFingerprint == "" {
-		t.Fatalf("work=%+v err=%v", work, err)
+	var count int64
+	if err := db.Model(&models.PurchaseSpecMatchWorkItem{}).Where("purchase_task_id = ?", task.ID).Count(&count).Error; err != nil || count != 0 {
+		t.Fatalf("unexpected archive match work count=%d err=%v", count, err)
 	}
-	if next, err := service.Next(context.Background(), f.token); err != nil || next != nil {
-		t.Fatalf("matching task dispatched: %+v %v", next, err)
+	if next, err := service.Next(context.Background(), f.token); err != nil || next == nil || next.MappedColor != "" || next.MappedSize != "" || !next.SpecResolutionAllowed {
+		t.Fatalf("probe task was not dispatchable: %+v %v", next, err)
+	}
+}
+
+func TestNextReturnsAssignedProbeWaitingTaskBeforeOtherWork(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	if err := db.Model(&models.PDDProduct{}).Where("id = ?", f.pdd.ID).Update("specs_json", `[{"name":"颜色","role":"color","values":[{"name":"黑色","selectable":true,"priceCent":1200}]},{"name":"尺码","role":"size","values":[{"name":"XL","selectable":true}]}]`).Error; err != nil {
+		t.Fatal(err)
+	}
+	service := testService(db)
+	request := StockCreateRequest{
+		RequestID: uuid.NewString(), ExecutionMode: models.PurchaseExecutionModeLive,
+		PDDProductID: f.pdd.ID, DeviceID: &f.device.ID, Color: "黑色", Size: "XL",
+		Quantity: 1, MinUnitPriceCent: 900, MaxUnitPriceCent: 1500,
+	}
+	waiting, _, err := service.CreateStock(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.RequestID = uuid.NewString()
+	other, _, err := service.CreateStock(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Session(&gorm.Session{SkipHooks: true}).Model(&models.PurchaseTask{}).Where("id = ?", waiting.ID).Updates(map[string]any{
+		"status": models.PurchaseTaskStatusSpecProbePending, "mapped_color_snapshot": "", "mapped_size_snapshot": "",
+	}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	next, err := service.Next(context.Background(), f.token)
+	if err != nil || next == nil || next.TaskID != waiting.ID || next.Status != models.PurchaseTaskStatusSpecProbePending {
+		t.Fatalf("waiting probe task not reserved: next=%+v other=%d err=%v", next, other.ID, err)
+	}
+	if _, err = service.Claim(context.Background(), other.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); code(err) != CodeDeviceBusy {
+		t.Fatalf("other purchase claimed while probe waits: %v", err)
 	}
 }
 
@@ -509,9 +803,10 @@ func TestOrderUnknownIsNotAutomaticallyRedispatched(t *testing.T) {
 	f := seed(t, db, liveCaps(), true)
 	s := testService(db)
 	task, _ := createLive(t, s, f)
-	s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	started, _ := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	started := startLivePurchaseAfterProbe(t, s, f, task)
+	if _, err := s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
 	actual := int64(1999)
 	if _, err := s.SubmitResult(context.Background(), task.ID, ResultRequest{
 		RequestID: uuid.NewString(), TaskAttemptID: started.TaskAttemptID, ResultType: "order_result_unknown",
@@ -527,7 +822,7 @@ func TestOrderUnknownIsNotAutomaticallyRedispatched(t *testing.T) {
 		t.Fatalf("unknown task evidence not preserved: %+v", saved)
 	}
 	var attempt models.PurchaseTaskAttempt
-	if err := db.Where("task_id = ?", task.ID).First(&attempt).Error; err != nil {
+	if err := db.Where("task_id = ?", task.ID).Order("attempt_number DESC").First(&attempt).Error; err != nil {
 		t.Fatal(err)
 	}
 	if attempt.ErrorCode == nil || *attempt.ErrorCode != CodeOrderTimeMissing || attempt.ErrorMessage == nil {
@@ -544,9 +839,10 @@ func TestOrderUnknownRejectsOrderFieldsAndUnapprovedFailureCode(t *testing.T) {
 	f := seed(t, db, liveCaps(), true)
 	s := testService(db)
 	task, _ := createLive(t, s, f)
-	s.Claim(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	started, _ := s.Start(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
-	s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token)
+	started := startLivePurchaseAfterProbe(t, s, f, task)
+	if _, err := s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: uuid.NewString()}, f.token); err != nil {
+		t.Fatal(err)
+	}
 
 	if _, err := s.SubmitResult(context.Background(), task.ID, ResultRequest{
 		RequestID: uuid.NewString(), TaskAttemptID: started.TaskAttemptID, ResultType: "order_result_unknown",

server/app/goauto/purchase/types.go

@@ -22,6 +22,7 @@ const (
 	CodeRetryStale          = "PURCHASE_RETRY_STALE"
 	CodeSpecReprobeRejected = "PURCHASE_SPEC_REPROBE_REJECTED"
 	CodeOrderResultUnknown  = "PURCHASE_ORDER_RESULT_UNKNOWN"
+	CodeOrderNumberUsed     = "PURCHASE_ORDER_NUMBER_ALREADY_USED"
 	CodeOrderEmptyTimeout   = "PURCHASE_ORDER_EMPTY_TIMEOUT"
 	CodeOrderChooserBack    = "PURCHASE_ORDER_CHOOSER_BACK_FAILED"
 	CodeOrderWechatRestore  = "PURCHASE_ORDER_WECHAT_RESTORE_FAILED"

server/app/goauto/purchasecontract/address_suffix_test.go

@@ -0,0 +1,17 @@
+package purchasecontract
+
+import "testing"
+
+func TestParseAddressSuffix(t *testing.T) {
+	for _, id := range []uint64{7, 72, ^uint64(0)} {
+		got, err := ParseAddressSuffix(AddressSuffix(id))
+		if err != nil || got != id {
+			t.Fatalf("id=%d got=%d err=%v", id, got, err)
+		}
+	}
+	for _, raw := range []string{"", "_cg", "_cg0", "_cg00", "_cg07", "_cg+7", "_cg-7", "_cg18446744073709551616", "_CG7", "_cg7x", "_cg7_cg72", "address_cg7", " _cg7", "_cg7 ", "_cg７", "_cg7\n"} {
+		if id, err := ParseAddressSuffix(raw); err == nil || id != 0 {
+			t.Errorf("accepted %q: %d", raw, id)
+		}
+	}
+}

server/app/goauto/purchasecontract/contract.go

@@ -9,6 +9,7 @@ import (
 	"math"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 	"unicode/utf8"
 )
@@ -360,6 +361,18 @@ func RequiredCapabilities(rule RuleSnapshot) []string {
 
 func AddressSuffix(taskID uint64) string { return fmt.Sprintf("_cg%d", taskID) }
 
+// ParseAddressSuffix accepts only the exact canonical suffix, never an address.
+func ParseAddressSuffix(suffix string) (uint64, error) {
+	if !strings.HasPrefix(suffix, "_cg") {
+		return 0, errors.New("invalid address suffix")
+	}
+	id, err := strconv.ParseUint(strings.TrimPrefix(suffix, "_cg"), 10, 64)
+	if err != nil || id == 0 || AddressSuffix(id) != suffix {
+		return 0, errors.New("invalid address suffix")
+	}
+	return id, nil
+}
+
 func ensureEOF(decoder *json.Decoder) error {
 	var extra any
 	if err := decoder.Decode(&extra); err != io.EOF {

server/app/goauto/shopeeproduct/auto_match.go

@@ -48,6 +48,9 @@ type autoMatchRef struct {
 // before the transaction; the transaction rechecks the complete spec context
 // and PDD candidate set so a stale decision can never be written.
 func (service *Service) AutoMatchMappings(ctx context.Context, id uint64, request AutoMatchRequest) (AutoMatchResponse, error) {
+	ctx, cancel := context.WithTimeout(ctx, aimatching.MaxProviderTimeout)
+	defer cancel()
+
 	requestID := strings.TrimSpace(request.RequestID)
 	if _, err := uuid.Parse(requestID); err != nil {
 		return AutoMatchResponse{}, invalidRequest("requestId 必须是 UUID")