docs: record verified navigation readiness contract #373

# Conflicts:
#	docs/02-architecture-and-code-map.md
#	docs/03-business-rules-and-glossary.md

AGENTS.md

@@ -44,6 +44,7 @@
 - 保留与当前工单无关的工作区改动，不重置、不覆盖、不顺手修改。
 - 测试结果必须真实；未执行或无法覆盖的真机、多设备、云环境和高风险行为必须明确记录。
 - 高风险修改必须停止并等待人工确认：创建订单、权限、安全、并发、数据库迁移、删除数据、发布和其他不可逆操作。
+- 回答语言：用户可以用中文或英文发言，Agent 一律用中文回答；技术英文词组、代码标识符、命令、文件路径、API 字段和错误码保持原文，不翻译。
 
 ## 2. 哪些改动需要工单
 

android/app/build.gradle.kts

@@ -30,6 +30,9 @@ android {
 	}
 
     buildTypes {
+        debug {
+            versionNameSuffix = "-373-fix1"
+        }
         release {
             isMinifyEnabled = false
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")

android/app/src/debug/AndroidManifest.xml

@@ -1,4 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <application android:usesCleartextTraffic="true" />
+    <application android:usesCleartextTraffic="true">
+        <receiver android:name=".diagnostics.NavigationProbeReceiver"
+            android:exported="true" android:permission="android.permission.DUMP" />
+    </application>
 </manifest>

android/app/src/debug/java/cn/ilapage/goauto/agent/diagnostics/BrowserProbeClickPolicy.kt

@@ -0,0 +1,9 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+internal object BrowserProbeClickPolicy {
+    fun allowed(rootPackage: String?, nodePackage: String?, label: String, visible: Boolean,
+                enabled: Boolean, clickable: Boolean, rootWindow: Int, nodeWindow: Int): Boolean =
+        rootPackage in setOf("com.heytap.browser", "com.android.chrome", "com.android.browser") &&
+            nodePackage == rootPackage && label in setOf("打开拼多多APP", "打开拼多多 App") &&
+            visible && enabled && clickable && rootWindow >= 0 && nodeWindow == rootWindow
+}

android/app/src/debug/java/cn/ilapage/goauto/agent/diagnostics/NavigationProbe.kt

@@ -0,0 +1,94 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.automation.SnapshotNode as UiSnapshotNode
+
+internal class NavigationProbe(
+    private val capture: () -> UiSnapshot,
+    private val launch: ((PddLaunchEvent) -> Unit) -> Boolean,
+    private val clickBrowserEntry: (UiSnapshotNode) -> FreshClickOutcome,
+    private val now: () -> Long,
+    private val pause: (Long) -> Unit,
+    private val emit: (String) -> Unit,
+    private val windowId: () -> Int? = { null },
+    private val isActive: () -> Boolean = { true },
+) {
+    fun run() {
+        val started = now()
+        fun canAct() = isActive() && !Thread.currentThread().isInterrupted && now() - started < 20_000
+        if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+        val before = capture()
+        if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+        fun problem(page: UiSnapshot) = PddPageClassifier.classify(page.packageName, page.activityName,
+            page.nodes.filter { it.visible }.map { it.label }) != null
+        if (problem(before)) { emit("stopped=page_problem"); return }
+        val initial = PddScreenParser.parse(before, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        // Values remain in memory. Neither text nor its hash is logged/persisted.
+        val oldTitle = initial.summary.title
+        val oldWindow = windowId()
+        val initiallyPdd = before.packageName == "com.xunmeng.pinduoduo"
+        emit("baseline;pdd=$initiallyPdd;root=${initial.rootAvailable};product=${initiallyPdd && initial.hasPurchaseProductEvidence()};title=${oldTitle != null};window=$oldWindow")
+        if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+        if (!launch { event ->
+                emit("launch;t=${now() - started};path=${event.path};status=${event.status};exception=${event.exceptionClass ?: "none"}")
+            }) { emit("stopped=launch_failed"); return }
+        var stable = 0
+        var legacyAccepted = false
+        var browserClicks = 0
+        var nextBrowserClick = 0L
+        var polls = 0
+        var lastSignal: String? = null
+        while (canAct() && polls < 201) {
+            val readStarted = now()
+            val page = capture()
+            if (!canAct()) { emit("stopped=inactive_or_expired;t=${now() - started}"); return }
+            if (problem(page)) { emit("stopped=page_problem;t=${now() - started}"); return }
+            val screen = PddScreenParser.parse(page, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+            val product = page.packageName == "com.xunmeng.pinduoduo" && screen.hasPurchaseProductEvidence()
+            stable = if (product) stable + 1 else 0
+            val titleComparison = when {
+                oldTitle == null || screen.summary.title == null -> "unknown"
+                oldTitle == screen.summary.title -> "same"
+                else -> "different"
+            }
+            val category = when (page.packageName) {
+                "com.xunmeng.pinduoduo" -> "pdd"
+                in BROWSERS -> "browser"
+                null -> "none"
+                else -> "other"
+            }
+            val signal = "pkg=$category;root=${screen.rootAvailable};product=$product;panel=${screen.specPanelOpen};entry=${screen.specEntry != null};nodes=${page.nodes.size};title=$titleComparison;window=${windowId()}"
+            if (signal != lastSignal || polls % 10 == 0) {
+                emit("sample;t=${now() - started};readMs=${now() - readStarted};$signal")
+                lastSignal = signal
+            }
+            // Observation only: never treats this as proof of goods identity or calls the executor.
+            if (stable >= 2 && !legacyAccepted) {
+                legacyAccepted = true
+                emit("legacy_would_accept;t=${now() - started};title=$titleComparison;identityVerified=false")
+            }
+            if (category == "browser") {
+                val entries = page.nodes.filter { it.visible && it.enabled && it.label in OPEN_PDD_ALIASES }
+                if (entries.size > 1) { emit("stopped=browser_ambiguous"); return }
+                if (entries.size == 1 && browserClicks < 3 && now() >= nextBrowserClick) {
+                    if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+                    val result = clickBrowserEntry(entries.single())
+                    browserClicks++
+                    emit("browser_click;t=${now() - started};attempt=$browserClicks;result=${result.result};reason=${result.reason}")
+                    if (result.result == FreshActionResult.AMBIGUOUS || result.result == FreshActionResult.BLOCKED) {
+                        emit("stopped=browser_click_unsafe"); return
+                    }
+                    nextBrowserClick = now() + 1_000
+                }
+            }
+            polls++
+            pause(100)
+        }
+        emit("finished;t=${now() - started};samples=$polls;legacyAccepted=$legacyAccepted;identityVerified=false")
+    }
+
+    companion object {
+        private val BROWSERS = setOf("com.heytap.browser", "com.android.chrome", "com.android.browser")
+        private val OPEN_PDD_ALIASES = setOf("打开拼多多APP", "打开拼多多 App")
+    }
+}

android/app/src/debug/java/cn/ilapage/goauto/agent/diagnostics/NavigationProbeReceiver.kt

@@ -0,0 +1,109 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.ContextWrapper
+import android.content.Intent
+import android.os.SystemClock
+import android.util.Log
+import android.view.accessibility.AccessibilityNodeInfo
+import cn.ilapage.goauto.agent.automation.GoAutoAccessibilityService
+import cn.ilapage.goauto.agent.automation.PddLinkLauncher
+import cn.ilapage.goauto.agent.automation.FreshClickOutcome
+import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.FreshClickReason
+import cn.ilapage.goauto.agent.service.AgentForegroundService
+import java.util.UUID
+
+/** Debug APK only; manifest requires the shell/system DUMP permission. No arbitrary URL or action. */
+class NavigationProbeReceiver : BroadcastReceiver() {
+    override fun onReceive(context: Context, intent: Intent) {
+        val goodsId = intent.getStringExtra("goodsId").orEmpty()
+        val mode = intent.getStringExtra("mode").orEmpty()
+        if (!goodsId.matches(Regex("[1-9][0-9]{0,19}")) || mode !in setOf("direct", "browser")) {
+            Log.i(TAG, "rejected=invalid_arguments")
+            return
+        }
+        val service = AgentForegroundService.diagnosticInstance
+        val accessibility = GoAutoAccessibilityService.instance
+        if (service == null || accessibility == null) {
+            Log.i(TAG, "rejected=service_unavailable")
+            return
+        }
+        val runId = UUID.randomUUID().toString()
+        val accepted = service.runNavigationProbe { serviceContext ->
+            // Delayed execution must not use a destroyed accessibility instance.
+            if (GoAutoAccessibilityService.instance !== accessibility) {
+                Log.i(TAG, "run=$runId;stopped=accessibility_changed")
+                return@runNavigationProbe
+            }
+            Log.i(TAG, "run=$runId;started;mode=$mode;synthetic=true;noBusinessTask=true")
+            val deadline = SystemClock.elapsedRealtime() + 20_000
+            val canAct = { AgentForegroundService.diagnosticInstance === service &&
+                GoAutoAccessibilityService.instance === accessibility && !Thread.currentThread().isInterrupted &&
+                SystemClock.elapsedRealtime() < deadline }
+            val guardedContext = object : ContextWrapper(serviceContext) {
+                override fun startActivity(intent: Intent) {
+                    // Includes direct-failure fallback and package-manager Binder delays.
+                    check(canAct()) { "probe_inactive" }
+                    super.startActivity(intent)
+                }
+            }
+            NavigationProbe(
+                capture = {
+                    check(canAct()) { "probe_inactive" }
+                    accessibility.capture()
+                },
+                launch = { report -> canAct() && PddLinkLauncher(guardedContext).open(
+                    "https://mobile.yangkeduo.com/goods.html?goods_id=$goodsId", mode == "direct", report,
+                ) },
+                clickBrowserEntry = { safeBrowserClick(accessibility, canAct) },
+                now = SystemClock::elapsedRealtime,
+                pause = { Thread.sleep(it) },
+                emit = { Log.i(TAG, "run=$runId;$it") },
+                windowId = { accessibility.rootInActiveWindow?.let { root ->
+                    try { root.windowId } finally { @Suppress("DEPRECATION") root.recycle() }
+                } },
+                isActive = canAct,
+            ).run()
+        }
+        if (!accepted) Log.i(TAG, "run=$runId;rejected=device_busy")
+    }
+
+    /** Fresh native node only: no ancestors, gestures, coordinates, or PDD-package actions. */
+    private fun safeBrowserClick(service: GoAutoAccessibilityService, canAct: () -> Boolean): FreshClickOutcome {
+        fun blocked() = FreshClickOutcome(FreshActionResult.BLOCKED, FreshClickReason.TARGET_NOT_FOUND)
+        if (!canAct()) return blocked()
+        val root = service.rootInActiveWindow ?: return blocked()
+        val nodes = mutableListOf<AccessibilityNodeInfo>()
+        fun visit(node: AccessibilityNodeInfo) {
+            nodes += node
+            if (nodes.size >= 2_000 || !canAct()) return
+            for (i in 0 until node.childCount) {
+                if (nodes.size >= 2_000 || !canAct()) break
+                node.getChild(i)?.let(::visit)
+            }
+        }
+        try {
+            visit(root)
+            if (nodes.size >= 2_000 || !canAct()) return blocked()
+            val candidates = nodes.filter { node ->
+                val label = node.text?.toString()?.trim().takeUnless { it.isNullOrEmpty() }
+                    ?: node.contentDescription?.toString()?.trim().orEmpty()
+                BrowserProbeClickPolicy.allowed(root.packageName?.toString(), node.packageName?.toString(), label,
+                    node.isVisibleToUser, node.isEnabled, node.isClickable, root.windowId, node.windowId)
+            }
+            if (candidates.size != 1) return blocked()
+            val current = service.rootInActiveWindow ?: return blocked()
+            val sameWindow = try { current.windowId == root.windowId && current.packageName == root.packageName }
+                finally { @Suppress("DEPRECATION") current.recycle() }
+            if (!sameWindow || !canAct()) return blocked()
+            val clicked = candidates.single().performAction(AccessibilityNodeInfo.ACTION_CLICK)
+            return FreshClickOutcome(if (clicked) FreshActionResult.SUCCESS else FreshActionResult.FAILED,
+                if (clicked) FreshClickReason.SUCCESS else FreshClickReason.ACTION_CLICK_FALSE)
+        } finally {
+            nodes.forEach { @Suppress("DEPRECATION") it.recycle() }
+        }
+    }
+    private companion object { const val TAG = "GoAutoNavProbe" }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/GoAutoAccessibilityService.kt

@@ -122,6 +122,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
     ).restore(packageName, timeoutMillis)
 
     fun openAgentPreservingTab(): Boolean = runCatching {
+        foregroundRevision.incrementAndGet() // Explicit navigation invalidates handoff even before its window event arrives.
         dismissPurchaseResultBubble()
         startActivity(
             android.content.Intent(this, cn.ilapage.goauto.agent.MainActivity::class.java).apply {
@@ -248,6 +249,8 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
                 checked = node.isChecked,
                 enabled = node.isEnabled,
                 visible = node.isVisibleToUser,
+                hintText = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) node.hintText?.toString() else null,
+                showingHintText = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) node.isShowingHintText else null,
             )
             for (index in 0 until node.childCount) {
                 node.getChild(index)?.let { snapshot(it, "$path/$index", path) }
@@ -338,7 +341,16 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
             labels = { listOfNotNull(it.text?.toString(), it.contentDescription?.toString()) },
         )
 
-    override fun clickFreshDetailed(target: SnapshotNode): FreshClickOutcome {
+    override fun clickFreshDetailed(target: SnapshotNode): FreshClickOutcome = clickFreshDetailed(target) { true }
+
+    override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome =
+        clickFreshDetailed(target) { node ->
+            val targetIsBrowser = PurchaseNavigationReadiness.isBrowser(node.packageName?.toString())
+            val foregroundIsBrowser = PurchaseNavigationReadiness.isBrowser(currentPackage())
+            targetIsBrowser && foregroundIsBrowser && allowed()
+        }
+
+    private fun clickFreshDetailed(target: SnapshotNode, beforeClick: (AccessibilityNodeInfo) -> Boolean): FreshClickOutcome {
         val root = rootInActiveWindow ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.ROOT_UNAVAILABLE)
         val candidates = mutableListOf<AccessibilityNodeInfo>()
         walk(root) { node ->
@@ -368,6 +380,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (sizeAdviceBlocked(node)) return FreshClickOutcome(
             FreshActionResult.BLOCKED, FreshClickReason.SIZE_ADVICE_BLOCKED, candidates.size, ancestorDepth,
         )
+        if (!beforeClick(node)) return FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.UNKNOWN)
         return if (node.performAction(AccessibilityNodeInfo.ACTION_CLICK)) {
             FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS, candidates.size, ancestorDepth)
         } else {

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddLaunchFallback.kt

@@ -1,8 +1,26 @@
 package cn.ilapage.goauto.agent.automation
 
+enum class PddLaunchPath { DIRECT, BROWSER }
+enum class PddLaunchStatus { ACCEPTED, REJECTED, EXCEPTION }
+
+/** No URL, exception message, or page content may enter this event. */
+data class PddLaunchEvent(val path: PddLaunchPath, val status: PddLaunchStatus, val exceptionClass: String? = null)
+
 internal object PddLaunchFallback {
-    fun open(preferDirect: Boolean, direct: () -> Boolean, browser: () -> Boolean): Boolean {
-        if (preferDirect && runCatching(direct).getOrDefault(false)) return true
-        return runCatching(browser).getOrDefault(false)
+    fun open(preferDirect: Boolean, direct: () -> Boolean, browser: () -> Boolean,
+             diagnostic: (PddLaunchEvent) -> Unit = {}): Boolean {
+        fun attempt(path: PddLaunchPath, launch: () -> Boolean): Boolean {
+            val result = runCatching(launch)
+            val event = PddLaunchEvent(path, when {
+                result.isFailure -> PddLaunchStatus.EXCEPTION
+                result.getOrDefault(false) -> PddLaunchStatus.ACCEPTED
+                else -> PddLaunchStatus.REJECTED
+            }, result.exceptionOrNull()?.javaClass?.name)
+            // Observability must never change routing or turn an accepted launch into a retry.
+            runCatching { diagnostic(event) }
+            return result.getOrDefault(false)
+        }
+        if (preferDirect && attempt(PddLaunchPath.DIRECT, direct)) return true
+        return attempt(PddLaunchPath.BROWSER, browser)
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddNavigation.kt

@@ -31,7 +31,7 @@ object PddPageClassifier {
 }
 
 class PddLinkLauncher(private val context: Context) {
-    fun open(url: String, preferDirect: Boolean = false): Boolean {
+    fun open(url: String, preferDirect: Boolean = false, diagnostic: (PddLaunchEvent) -> Unit = {}): Boolean {
         val uri = runCatching { Uri.parse(url) }.getOrNull() ?: return false
         if (uri.scheme !in setOf("http", "https") || !isPddHost(uri.host) || uri.getQueryParameter("goods_id").isNullOrBlank()) {
             return false
@@ -42,7 +42,7 @@ class PddLinkLauncher(private val context: Context) {
                 .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK)
             context.startActivity(direct)
             true
-        }, browser = { openBrowser(uri) })
+        }, browser = { openBrowser(uri) }, diagnostic = diagnostic)
     }
 
     private fun openBrowser(uri: Uri): Boolean {
@@ -51,7 +51,9 @@ class PddLinkLauncher(private val context: Context) {
             runCatching { context.packageManager.getPackageInfo(packageName, 0) }.isSuccess
         }
         if (browser != null) base.setPackage(browser)
-        return runCatching { context.startActivity(base); true }.getOrDefault(false)
+        // The outer fallback boundary retains the previous false-on-error behavior and records only the class.
+        context.startActivity(base)
+        return true
     }
 
     private fun isPddHost(host: String?): Boolean =

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddProductDetailCollector.kt

@@ -27,6 +27,9 @@ data class SnapshotNode(
     val checked: Boolean,
     val enabled: Boolean,
     val visible: Boolean,
+    // In-memory accessibility metadata; not part of result or diagnostic payloads.
+    val hintText: String? = null,
+    val showingHintText: Boolean? = null,
 ) {
     val label: String get() = text?.trim().takeUnless { it.isNullOrEmpty() }
         ?: contentDescription?.trim().orEmpty()
@@ -1389,6 +1392,12 @@ class PddProductDetailCollector(
         var diagnosticInitialSelectedSizes = 0
         var diagnosticSelectedSummaryPresent = false
         var diagnosticHorizontalSwipes = 0
+        var diagnosticVerticalSwipes = 0
+        var diagnosticTrailingEmptyReads = 0
+        var diagnosticHorizontalUnknown = false
+        // Exact seed sets can reconcile a later stable visit to the same row.
+        // These signatures stay in memory; only the aggregate tri-state is saved.
+        val diagnosticHorizontalRows = mutableMapOf<Set<String>, Boolean?>()
         var diagnosticTermination = AgentDiagnosticReason.COLOR_FOUND
         val imageAttempts = mutableSetOf<String>()
 
@@ -1445,6 +1454,13 @@ class PddProductDetailCollector(
                 initialSelectedSizeCount = diagnosticInitialSelectedSizes,
                 selectedSummaryPresent = diagnosticSelectedSummaryPresent,
                 horizontalSwipes = diagnosticHorizontalSwipes,
+                verticalSwipes = diagnosticVerticalSwipes,
+                trailingEmptyReads = diagnosticTrailingEmptyReads,
+                horizontalIncomplete = when {
+                    diagnosticHorizontalRows.values.any { it == true } -> true
+                    diagnosticHorizontalUnknown || diagnosticHorizontalRows.values.any { it == null } -> null
+                    else -> false
+                },
                 elapsedMs = now() - diagnosticStartedAt,
             )
         }
@@ -1461,6 +1477,8 @@ class PddProductDetailCollector(
         val initialRows = colorRows(initial)
         observeColorDiscovery(initial, initialRows)
         if (initialRows.isEmpty()) {
+            diagnosticTrailingEmptyReads = 1
+            diagnosticHorizontalUnknown = true
             finishColorDiscovery(
                 if (diagnosticNonClickableCandidates > 0) AgentDiagnosticReason.COLOR_VALUES_NOT_CLICKABLE
                 else AgentDiagnosticReason.COLOR_EDGE_REACHED,
@@ -1468,7 +1486,8 @@ class PddProductDetailCollector(
             return null
         }
         val attempted = mutableSetOf<String>()
-        fun collectVisibleColors(): PddCollectorResult? {
+        fun collectVisibleColors(onFirstRows: ((List<List<VisibleSpecValue>>) -> Unit)? = null): PddCollectorResult? {
+            var firstRead = true
             while (true) {
                 if (now() > deadline) return failure("RULE_NOT_MATCHED", "采集超过规则总超时")
                 val screen = parse(goodsId, config, evidence)
@@ -1476,6 +1495,10 @@ class PddProductDetailCollector(
                 if (!screen.pageEvidenceMatched) return failure("RULE_NOT_MATCHED", "采集期间离开 PDD 商品详情页")
                 screen.dimensions.filter { it.key == "unsupported" }.forEach { unsupported += it.name }
                 val rows = colorRows(screen)
+                if (firstRead) {
+                    onFirstRows?.invoke(rows)
+                    firstRead = false
+                }
                 observeColorDiscovery(screen, rows)
                 rows.flatten().filter { SpecValueNormalizer.isSafeColor(it.text) }.forEach { value ->
                     colors[value.text] = colors[value.text] == true || value.available
@@ -1528,8 +1551,18 @@ class PddProductDetailCollector(
                 rowSeeds.forEachIndexed { rowIndex, seed ->
                     val moveRight = rowIndex % 2 == 0
                     val horizontalSignatureReads = mutableMapOf<List<String>, Int>()
+                    var diagnosticPreviousSignature: List<String>? = null
+                    var diagnosticStableReads = 0
+                    var diagnosticMoved = false
+                    var diagnosticRowUncertain = false
+                    var diagnosticRowIncomplete: Boolean? = null
                     for (horizontalPass in 0..config.limits.getValue("specHorizontalSwipes")) {
-                        collectVisibleColors()?.let { return it }
+                        var diagnosticBeforeClicks: List<String>? = null
+                        collectVisibleColors { observedRows ->
+                            diagnosticBeforeClicks = observedRows.filter { row -> row.any { it.text in seed } }
+                                .singleOrNull()?.sortedBy { it.node.bounds.left }
+                                ?.let { if (moveRight) it else it.reversed() }?.let(::optionSignature)
+                        }?.let { return it }
                         screen = parse(goodsId, config, evidence)
                         screen.problem?.let { return failure(it.code, it.message) }
                         if (!screen.pageEvidenceMatched) return failure("RULE_NOT_MATCHED", "采集期间离开 PDD 商品详情页")
@@ -1538,21 +1571,49 @@ class PddProductDetailCollector(
                         val matchedRow = rows.maxByOrNull { row -> row.count { it.text in seed } }
                             ?.takeIf { row -> row.any { it.text in seed } }
                         if (matchedRow == null) {
+                            diagnosticHorizontalUnknown = true
                             diagnosticTermination = AgentDiagnosticReason.COLOR_ROW_REFLOWED
                             break
                         }
                         val currentRow = matchedRow.sortedBy { it.node.bounds.left }
                             .let { if (moveRight) it else it.reversed() }
                         val signature = optionSignature(currentRow)
+                        // Observe the frame immediately after the prior swipe,
+                        // before clicking newly visible values. A click reflow or
+                        // ambiguous row match cannot prove horizontal movement.
+                        if (diagnosticBeforeClicks == null || diagnosticBeforeClicks != signature) {
+                            diagnosticRowUncertain = true
+                            diagnosticHorizontalUnknown = true
+                        }
+                        if (!diagnosticRowUncertain && diagnosticPreviousSignature != null && signature != diagnosticPreviousSignature) {
+                            diagnosticMoved = true
+                        }
+                        diagnosticStableReads = if (signature == diagnosticPreviousSignature) diagnosticStableReads + 1 else 0
+                        diagnosticPreviousSignature = signature
                         val signatureReads = (horizontalSignatureReads[signature] ?: 0) + 1
                         horizontalSignatureReads[signature] = signatureReads
-                        if (signatureReads > config.limits.getValue("stableEdgeReads")) break
-                        if (horizontalPass == config.limits.getValue("specHorizontalSwipes")) break
+                        if (signatureReads > config.limits.getValue("stableEdgeReads")) {
+                            if (!diagnosticRowUncertain && diagnosticStableReads >= config.limits.getValue("stableEdgeReads")) {
+                                diagnosticRowIncomplete = false
+                            }
+                            break
+                        }
+                        if (horizontalPass == config.limits.getValue("specHorizontalSwipes")) {
+                            if (diagnosticMoved && !diagnosticRowUncertain) diagnosticRowIncomplete = true
+                            break
+                        }
                         val direction = if (moveRight) SwipeDirection.LEFT else SwipeDirection.RIGHT
-                        if (!driver.swipeSpec(direction, currentRow.first().node)) break
+                        if (!driver.swipeSpec(direction, currentRow.first().node)) {
+                            if (diagnosticMoved && !diagnosticRowUncertain) diagnosticRowIncomplete = true
+                            break
+                        }
                         diagnosticHorizontalSwipes++
                         pause(350)
                     }
+                    // An uncertain revisit cannot erase previously observed
+                    // unresolved movement; only reliable stability clears it.
+                    diagnosticHorizontalRows[seed] = diagnosticRowIncomplete
+                        ?: diagnosticHorizontalRows[seed]?.takeIf { it }
                 }
                 collectVisibleColors()?.let { return it }
                 screen = parse(goodsId, config, evidence)
@@ -1561,6 +1622,10 @@ class PddProductDetailCollector(
                 observeColorDiscovery(screen, rows)
             }
 
+            // One observation per outer discovery round, never per click or
+            // stable-price reread. Empty parsed rows do not prove an edge.
+            diagnosticTrailingEmptyReads = if (rows.isEmpty()) diagnosticTrailingEmptyReads + 1 else 0
+            if (rows.isEmpty()) diagnosticHorizontalUnknown = true
             if (!discoverVertically) {
                 diagnosticTermination = AgentDiagnosticReason.COLOR_EDGE_REACHED
                 break
@@ -1583,6 +1648,7 @@ class PddProductDetailCollector(
             }
             val anchor = rows.flatten().firstOrNull()?.node ?: specPanelContainer
             if (anchor == null) {
+                diagnosticHorizontalUnknown = true
                 diagnosticTermination = AgentDiagnosticReason.COLOR_CONTAINER_UNAVAILABLE
                 break
             }
@@ -1590,6 +1656,7 @@ class PddProductDetailCollector(
                 diagnosticTermination = AgentDiagnosticReason.COLOR_SWIPE_FAILED
                 break
             }
+            diagnosticVerticalSwipes++
             pause(350)
         }
         finishColorDiscovery()
@@ -1618,6 +1685,9 @@ class PddProductDetailCollector(
         initialSelectedSizeCount: Int,
         selectedSummaryPresent: Boolean,
         horizontalSwipes: Int,
+        verticalSwipes: Int,
+        trailingEmptyReads: Int,
+        horizontalIncomplete: Boolean?,
         elapsedMs: Long,
     ) {
         if (taskId <= 0) return
@@ -1636,6 +1706,9 @@ class PddProductDetailCollector(
                 initialSelectedSizeCount = initialSelectedSizeCount,
                 selectedSummaryPresent = selectedSummaryPresent,
                 horizontalSwipeCount = horizontalSwipes,
+                colorVerticalSwipeCount = verticalSwipes,
+                colorTrailingEmptyReadCount = trailingEmptyReads,
+                colorHorizontalIncomplete = horizontalIncomplete,
             ),
         )
     }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseLiveAutomation.kt

@@ -42,6 +42,7 @@ class PurchaseLiveAutomation(
     private val pause: (Long) -> Unit = Thread::sleep,
     /** Boolean/count-only diagnostics; never receives address text. */
     private val panelDiagnostic: (String) -> Unit = {},
+    private val monotonicClockMs: () -> Long = { System.nanoTime() / 1_000_000L },
 ) {
     private var submitAttempted = false
     var lastOrderReadFailure: PurchaseOrderReadFailure? = null
@@ -366,48 +367,83 @@ class PurchaseLiveAutomation(
         var consecutiveEmptySnapshots = 0
         var unpaidStartSample: Int? = null
         var unpaidSwipes = 0
-        repeat(ORDER_RESULT_MAX_SAMPLES + ORDER_RESULT_UNPAID_MAX_SAMPLES) { index ->
+        var paymentBackSucceededAt: Long? = null
+        var orderContextObserved = false
+        // Extra observations cannot reopen navigation/scroll budgets. Late unpaid evidence
+        // still receives its existing independent budget below.
+        var passiveExtension = false
+        fun observationRemainingMs(): Long? {
+            val startedAt = paymentBackSucceededAt ?: return null
+            if (unpaidStartSample != null || (orderContextObserved && !passiveExtension)) return null
+            return ORDER_RESULT_POST_PAYMENT_OBSERVATION_MS - (monotonicClockMs() - startedAt)
+        }
+        fun observePause(durationMs: Long) {
+            val remaining = observationRemainingMs()
+            val duration = if (remaining == null) durationMs else minOf(durationMs, remaining.coerceAtLeast(0))
+            if (duration > 0) pause(duration)
+        }
+        var nextSample = 0
+        while (true) {
+            val index = nextSample++
             // The first unpaid page receives its own bounded budget, even after a long handoff.
             // Never reset it on repeated labels or navigation back to payment.
             val unpaidStart = unpaidStartSample
-            if ((unpaidStart == null && index >= ORDER_RESULT_MAX_SAMPLES) ||
+            if (unpaidStart == null && index >= ORDER_RESULT_MAX_SAMPLES &&
+                paymentBackSucceededAt != null && !orderContextObserved) {
+                passiveExtension = true
+            }
+            if ((observationRemainingMs()?.let { it <= 0 } == true) ||
+                (unpaidStart == null && index >= ORDER_RESULT_MAX_SAMPLES && !passiveExtension) ||
                 (unpaidStart != null && index - unpaidStart >= ORDER_RESULT_UNPAID_MAX_SAMPLES)) {
                 val failure = orderEvidenceFailure(labels)
                 return unknown(failure.code, failure.message)
             }
             val snapshot = driver.capture()
+            // A blocking capture can finish after the deadline. Do not act on or accept that frame.
+            if (observationRemainingMs()?.let { it <= 0 } == true) {
+                val failure = orderEvidenceFailure(labels)
+                return unknown(failure.code, failure.message)
+            }
             if (snapshot.packageName.isNullOrBlank()) {
                 consecutiveEmptySnapshots++
                 if (consecutiveEmptySnapshots >= ORDER_RESULT_MAX_EMPTY_SAMPLES) {
                     return unknown("PURCHASE_ORDER_EMPTY_TIMEOUT", "等待订单页面时无障碍窗口持续为空")
                 }
-                pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
-                return@repeat
+                observePause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                continue
             }
             consecutiveEmptySnapshots = 0
             val currentLabels = snapshot.nodes.filter { it.visible }.map { it.label }
             if (isKnownAndroidWechatChooser(snapshot, currentLabels)) {
+                if (passiveExtension && !backedOutOfChooser) {
+                    val failure = orderEvidenceFailure(labels)
+                    return unknown(failure.code, failure.message)
+                }
                 if (backedOutOfChooser || !driver.backPurchase()) {
                     return unknown("PURCHASE_ORDER_CHOOSER_BACK_FAILED", "系统应用选择页无法安全返回")
                 }
                 backedOutOfChooser = true
-                pause(500)
-                return@repeat
+                observePause(500)
+                continue
             }
             if (snapshot.packageName == WECHAT_PACKAGE) {
                 if (!restoredFromWechat) {
+                    if (passiveExtension) {
+                        val failure = orderEvidenceFailure(labels)
+                        return unknown(failure.code, failure.message)
+                    }
                     if (!driver.bringPddToForeground()) {
                         return unknown("PURCHASE_ORDER_WECHAT_RESTORE_FAILED", "从微信恢复拼多多的请求失败")
                     }
                     restoredFromWechat = true
-                    pause(500)
-                    return@repeat
+                    observePause(500)
+                    continue
                 }
                 if (pddObservedAfterWechatRestore || ++wechatRestorePendingSamples >= ORDER_RESULT_WECHAT_RESTORE_MAX_SAMPLES) {
                     return unknown("PURCHASE_ORDER_WECHAT_RESTORE_TIMEOUT", "从微信恢复拼多多后未在限定时间到达订单页面")
                 }
-                pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
-                return@repeat
+                observePause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                continue
             }
             if (snapshot.packageName != PDD_PACKAGE) {
                 return unknown("PURCHASE_ORDER_UNEXPECTED_APP", "核单期间出现未授权应用")
@@ -426,7 +462,8 @@ class PurchaseLiveAutomation(
                     if (!driver.backPurchase()) {
                         return unknown("PURCHASE_ORDER_PAYMENT_BACK_FAILED", "支付页无法安全返回订单详情")
                     }
-                    pause(500)
+                    paymentBackSucceededAt = monotonicClockMs()
+                    observePause(500)
                 } else {
                     consecutivePaymentSamplesAfterBack++
                     if (consecutivePaymentSamplesAfterBack >= ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES) {
@@ -437,20 +474,21 @@ class PurchaseLiveAutomation(
                                 "consecutivePaymentSamplesAfterBack=$consecutivePaymentSamplesAfterBack]",
                         )
                     }
-                    pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                    observePause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
                 }
-                return@repeat
+                continue
             }
             consecutivePaymentSamplesAfterBack = 0
+            if (orderContextVisible) orderContextObserved = true
             if (unpaidContextVisible) {
                 paymentPageObserved = true
                 if (unpaidStartSample == null) unpaidStartSample = index
             }
             if (!orderContextVisible && !unpaidContextVisible) {
-                if (unpaidStartSample != null) {
-                    // After reaching the unpaid page only observe; never click a newly exposed control.
-                    pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
-                    return@repeat
+                if (unpaidStartSample != null || passiveExtension) {
+                    // Neither unpaid reading nor the added observation budget permits a new click.
+                    observePause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                    continue
                 }
                 val entries = orderDetailEntryTargets(snapshot)
                 if (entries.size > 1) {
@@ -466,27 +504,25 @@ class PurchaseLiveAutomation(
                         else -> return unknown("PURCHASE_ORDER_DETAIL_ENTRY_FAILED", "订单详情入口点击失败，已停止只读核单")
                     }
                     orderDetailEntryOpened = true
-                    pause(500)
-                    return@repeat
+                    observePause(500)
+                    continue
                 }
-                pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
-                return@repeat
+                observePause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+                continue
             }
             currentLabels.forEach(labels::add)
             parseOrderEvidence(labels)?.let { return it }
             if (unpaidStartSample != null && unpaidSwipes < ORDER_RESULT_UNPAID_MAX_SWIPES) {
                 unpaidSwipes++
                 driver.swipePurchase(SwipeDirection.UP, 400)
-                pause(ORDER_RESULT_UNPAID_SETTLE_MS)
-                return@repeat
+                observePause(ORDER_RESULT_UNPAID_SETTLE_MS)
+                continue
             }
-            if (unpaidStartSample == null && index > 0 && index % ORDER_RESULT_SCROLL_SAMPLE_INTERVAL == 0) {
+            if (!passiveExtension && unpaidStartSample == null && index > 0 && index % ORDER_RESULT_SCROLL_SAMPLE_INTERVAL == 0) {
                 driver.swipePurchase(SwipeDirection.UP, 400)
             }
-            pause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
+            observePause(ORDER_RESULT_SAMPLE_INTERVAL_MS)
         }
-        val failure = orderEvidenceFailure(labels)
-        return unknown(failure.code, failure.message)
     }
 
     // orderEvidenceFailure 之外的路径（选择器卡住、微信恢复超时等）同样要带上
@@ -509,16 +545,12 @@ class PurchaseLiveAutomation(
         val modify = addressModifyTargets(panel)
         if (modify.size != 1) fail("PURCHASE_ADDRESS_EDIT_AMBIGUOUS", "没有找到唯一的地址修改按钮，未创建订单")
         click(modify.single(), "修改地址")
-        val edit = waitFor("PURCHASE_ADDRESS_EDIT_TIMEOUT", "地址编辑页面打开超时，未创建订单") { snapshot ->
-            snapshot.nodes.any { it.visible && it.label.replace(" ", "").contains("详细地址") }
-        }
-        val editors = shippingAddressEditors(edit)
-        if (editors.size != 1) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "没有找到唯一的详细地址输入框，未创建订单")
-        val current = editors.single().label.trim()
+        val editor = waitForInitialAddressEditor()
+        val current = editor.text.orEmpty().trim()
         val body = current.split(Regex("[-_]"), limit = 2).firstOrNull()?.trim().orEmpty()
         if (body.isBlank()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "当前详细地址无效，未创建订单")
         val expected = body + suffix
-        if (driver.inputFresh(editors.single(), expected) != FreshActionResult.SUCCESS) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "详细地址修改失败，未创建订单")
+        if (driver.inputFresh(editor, expected) != FreshActionResult.SUCCESS) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "详细地址修改失败，未创建订单")
         val stable = waitFor("PURCHASE_ADDRESS_INPUT_MISMATCH", "详细地址修改后回读不一致，未创建订单") { snapshot ->
             snapshot.nodes.count { it.visible && it.enabled && it.className?.endsWith("EditText") == true && it.label == expected } == 1
         }
@@ -539,6 +571,47 @@ class PurchaseLiveAutomation(
         return ShippingAddressProof(expected, suffix)
     }
 
+    /** Initial readiness only; return the same sampled node for the original value and fresh input anchor. */
+    private fun waitForInitialAddressEditor(): SnapshotNode {
+        fun isHint(editor: SnapshotNode): Boolean {
+            val hint = editor.hintText?.trim().orEmpty()
+            return editor.showingHintText == true || (hint.isNotEmpty() && editor.text?.trim() == hint)
+        }
+        var titleSeen = false
+        var structural = emptyList<SnapshotNode>()
+        var readyCount = 0
+        repeat(50) {
+            val snapshot = driver.capture()
+            pageProblem(snapshot)
+            val labels = snapshot.nodes.filter { it.visible && it.label.replace(" ", "").contains("详细地址") }
+            titleSeen = titleSeen || labels.isNotEmpty()
+            // Keep the existing same-row/rightward region, but count empty and disabled inputs too.
+            // Their presence is structural ambiguity, even when just one input is ready.
+            structural = snapshot.nodes.filter { editor ->
+                editor.visible && editor.className?.endsWith("EditText") == true &&
+                    labels.any { label ->
+                        editor.bounds.top <= label.bounds.bottom &&
+                            editor.bounds.bottom >= label.bounds.top &&
+                            editor.bounds.left >= label.bounds.left
+                    }
+            }.distinctBy { it.path }
+            readyCount = structural.count { it.enabled && !it.text.isNullOrBlank() && !isHint(it) }
+            if (structural.size == 1 && readyCount == 1) return structural.single()
+            pause(200)
+        }
+        val reason = when {
+            !titleSeen -> "title_missing"
+            structural.isEmpty() -> "editor_missing"
+            structural.size > 1 -> "editor_ambiguous"
+            !structural.single().enabled -> "editor_disabled"
+            structural.single().text.isNullOrBlank() -> "editor_empty"
+            else -> "editor_hint"
+        }
+        val diagnostic = "stage=address_editor_ready;reason=$reason;titleSeen=$titleSeen;structural=${structural.size};ready=$readyCount"
+        if (!titleSeen) fail("PURCHASE_ADDRESS_EDIT_TIMEOUT", "地址编辑页面打开超时，未创建订单 [$diagnostic]")
+        fail("PURCHASE_ADDRESS_UPDATE_FAILED", "详细地址输入框未就绪，未创建订单 [$diagnostic]")
+    }
+
     private fun isPurchaseConfirmationPanel(snapshot: UiSnapshot): Boolean {
         if (snapshot.packageName != PDD_PACKAGE || shippingAddressEditors(snapshot).isNotEmpty()) return false
         val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
@@ -1038,6 +1111,7 @@ class PurchaseLiveAutomation(
         val ANDROID_CHOOSER_TITLES = setOf("选择要使用的应用", "使用以下应用打开", "完成操作时使用")
         val PDD_PAYMENT_ACTIVITIES = setOf("com.xunmeng.pinduoduo.app_pay.core.PayActivity")
         const val ORDER_RESULT_MAX_SAMPLES = 60
+        const val ORDER_RESULT_POST_PAYMENT_OBSERVATION_MS = 30_000L
         const val ORDER_RESULT_MAX_EMPTY_SAMPLES = 15
         const val ORDER_RESULT_WECHAT_RESTORE_MAX_SAMPLES = 15
         const val ORDER_RESULT_PAYMENT_POST_BACK_MAX_SAMPLES = 25

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseNavigationReadiness.kt

@@ -0,0 +1,55 @@
+package cn.ilapage.goauto.agent.automation
+
+/** In-memory stability evidence only. This is not proof of the page's goodsId. */
+internal data class ProductStabilityKey(val title: String?, val specEntry: Boolean, val quickEntry: Boolean, val panel: Boolean)
+
+internal class PurchaseNavigationReadiness(
+    private val startedAt: Long,
+    private val path: PddLaunchPath?,
+    private val acceptedAt: Long,
+) {
+    private var browserObserved = false
+    private var returnedAt: Long? = null
+    private var stableSince: Long? = null
+    private var stableKey: ProductStabilityKey? = null
+    private var samples = 0
+    private var lastClickAt: Long? = null
+
+    fun expired(now: Long): Boolean = now - startedAt !in 0 until TIMEOUT_MS
+
+    fun observe(now: Long, packageName: String?, key: ProductStabilityKey?): Boolean {
+        if (expired(now)) return false
+        if (isBrowser(packageName)) browserObserved = true
+        if (packageName != PDD_PACKAGE) returnedAt = null
+        val eligible = path == PddLaunchPath.DIRECT || (path == PddLaunchPath.BROWSER && browserObserved)
+        if (!eligible || packageName != PDD_PACKAGE || key == null) {
+            stableSince = null
+            stableKey = null
+            samples = 0
+            return false
+        }
+        if (returnedAt == null) returnedAt = now
+        if (stableKey != key || stableSince == null) {
+            stableKey = key
+            stableSince = now
+            samples = 0
+        }
+        samples++
+        val bufferStart = if (path == PddLaunchPath.DIRECT) acceptedAt else requireNotNull(returnedAt)
+        return now - bufferStart >= BUFFER_MS && now - requireNotNull(stableSince) >= STABLE_MS && samples >= 3
+    }
+
+    fun mayClickBrowser(now: Long, packageName: String?): Boolean =
+        !expired(now) && path == PddLaunchPath.BROWSER && isBrowser(packageName) &&
+            (lastClickAt == null || now - requireNotNull(lastClickAt) >= 1_000L)
+
+    fun clicked(now: Long) { lastClickAt = now }
+
+    companion object {
+        const val TIMEOUT_MS = 30_000L
+        const val BUFFER_MS = 3_000L
+        const val STABLE_MS = 1_000L
+        const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
+        fun isBrowser(packageName: String?): Boolean = packageName in setOf("com.heytap.browser", "com.android.chrome", "com.android.browser")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseProbeHandoff.kt

@@ -0,0 +1,59 @@
+package cn.ilapage.goauto.agent.automation
+
+/** Service-instance memory only; never restored from results or the upload outbox. */
+internal class PurchaseProbeHandoff {
+    internal data class Credential(
+        val taskId: Long, val goodsId: String, val sourceAttemptId: String,
+        val generation: Long, val completedAt: Long, val accessibility: Any, val foregroundRevision: Long,
+    )
+    internal data class Execution(val generation: Long, val previous: Credential?)
+    private var generation = 0L
+    private var credential: Credential? = null
+    private var evaluatedGeneration = -1L
+    private var invalidatedGeneration = -1L
+    private var authorizedGeneration = -1L
+
+    @Synchronized fun beginExecution(): Execution {
+        val previous = credential
+        credential = null
+        return Execution(++generation, previous)
+    }
+
+    @Synchronized fun invalidate() {
+        credential = null
+        invalidatedGeneration = generation
+    }
+
+    @Synchronized fun completeProbe(
+        execution: Execution, taskId: Long, goodsId: String, attemptId: String,
+        completedAt: Long, accessibility: Any, foregroundRevision: Long,
+        successful: Boolean, safelyStored: Boolean, submitPending: Boolean, replayed: Boolean,
+    ) {
+        if (execution.generation != generation || !successful || !safelyStored || !submitPending || replayed || attemptId.isBlank()) return
+        credential = Credential(taskId, goodsId, attemptId, generation, completedAt, accessibility, foregroundRevision)
+    }
+
+    @Synchronized fun eligible(
+        execution: Execution, taskId: Long, goodsId: String, phase: String, attemptId: String,
+        accessibility: Any, foregroundRevision: Long, now: Long,
+    ): Boolean {
+        if (evaluatedGeneration == execution.generation) return false
+        evaluatedGeneration = execution.generation
+        val prior = execution.previous ?: return false
+        val eligible = generation == execution.generation && invalidatedGeneration != execution.generation &&
+            prior.generation + 1 == execution.generation && phase == "purchase" &&
+            prior.taskId == taskId && prior.goodsId == goodsId && attemptId.isNotBlank() && prior.sourceAttemptId != attemptId &&
+            prior.accessibility === accessibility && prior.foregroundRevision == foregroundRevision &&
+            now - prior.completedAt in 0 until 30_000L
+        if (eligible) authorizedGeneration = execution.generation
+        return eligible
+    }
+
+    /** Revalidate the already consumed credential after a potentially slow fresh capture; never creates another. */
+    @Synchronized fun stillValid(execution: Execution, accessibility: Any?, foregroundRevision: Long, now: Long): Boolean {
+        val prior = execution.previous ?: return false
+        return authorizedGeneration == execution.generation && generation == execution.generation &&
+            invalidatedGeneration != execution.generation && prior.accessibility === accessibility &&
+            prior.foregroundRevision == foregroundRevision && now - prior.completedAt in 0 until 30_000L
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseRehearsalExecutor.kt

@@ -16,6 +16,9 @@ interface PurchaseUiDriver {
         result = clickFresh(target),
         reason = FreshClickReason.UNKNOWN,
     )
+    /** Recheck after fresh-node Binder reads and immediately before a browser navigation click. */
+    fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome =
+        if (allowed()) clickFreshDetailed(target) else FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.UNKNOWN)
     /**
      * Reacquires one address-entry node by its accessibility path and validates
      * its immutable snapshot traits before clicking its nearest clickable
@@ -85,6 +88,7 @@ data class PurchaseExecutionInput(
     val minUnitPriceCent: Long,
     val maxUnitPriceCent: Long,
     val addressSuffix: String = "",
+    val reuseProbeProduct: Boolean = false,
 )
 
 data class PurchaseExecutionOutcome(
@@ -109,6 +113,9 @@ class PurchaseRehearsalExecutor(
     private val panelDiagnostic: (String) -> Unit = {},
     private val beforeOrderSubmit: (FinalConfirmationEvidence) -> Unit = { throw PurchaseLiveException("PURCHASE_MODE_NOT_ALLOWED", "当前执行器没有正式采购授权") },
     private val probeClickDiagnostic: (AgentDiagnosticStage, SnapshotNode, FreshClickOutcome) -> Unit = { _, _, _ -> },
+    private val acceptedLaunchPath: () -> PddLaunchPath? = { null },
+    private val monotonicNow: () -> Long = { System.nanoTime() / 1_000_000L },
+    private val confirmProbeHandoff: () -> Boolean = { true },
 ) {
     private var purchasePanelContext: PurchasePanelContext? = null
 
@@ -121,12 +128,9 @@ class PurchaseRehearsalExecutor(
         val specSelectionProofs = mutableMapOf<String, ExactSpecSelectionProof>()
         val live = PurchaseLiveAutomation(driver, pause, panelDiagnostic)
         for (action in rule.actions) {
-            // The immediate phase-two handoff can reuse the PDD page retained by
-            // spec_probe. A later manual retry may start from Agent (or another
-            // unrelated screen), so only skip navigation when a fresh snapshot
-            // still carries safe PDD product/spec evidence.
+            // Only the service's one-shot probe handoff permits reuse; fresh structure alone is insufficient.
             if (
-                input.phase == "purchase" &&
+                input.phase == "purchase" && input.reuseProbeProduct &&
                 action.type == PurchaseActionType.OPEN_PRODUCT &&
                 canReuseCurrentProduct(input)
             ) continue
@@ -205,7 +209,7 @@ class PurchaseRehearsalExecutor(
 
     private fun canReuseCurrentProduct(input: PurchaseExecutionInput): Boolean =
         currentScreen(input).let { screen ->
-            screen.problem == null && screen.hasPurchaseProductEvidence()
+            screen.problem == null && screen.hasPurchaseProductEvidence() && confirmProbeHandoff()
         }
 
     private fun validateBeforeDeviceAction(
@@ -260,57 +264,38 @@ class PurchaseRehearsalExecutor(
 
     private fun openProduct(input: PurchaseExecutionInput, action: PurchaseAction): PurchaseExecutionOutcome? {
         purchasePanelContext = null
+        val startedAt = monotonicNow()
         if (!openLink(input.url)) return failure("PDD_LINK_INVALID", "任务中的 PDD 链接无法打开")
+        val readiness = PurchaseNavigationReadiness(startedAt, acceptedLaunchPath(), monotonicNow())
         val aliases = action.textAliases ?: listOf("打开拼多多APP", "打开拼多多 App", "打开")
-        var clickAttempted = false
-        var nextClickPoll = 0
-        var lastClickReason = FreshClickReason.UNKNOWN
-        var stableEvidenceReads = 0
-        var pddForegroundObserved = false
-        repeat(OPEN_PRODUCT_POLL_LIMIT) { poll ->
+        repeat(300) {
+            if (readiness.expired(monotonicNow())) return navigationTimeout()
             val snapshot = driver.capture()
+            if (readiness.expired(monotonicNow())) return navigationTimeout()
             pageProblem(snapshot)?.let { return it }
-            if (snapshot.packageName == PDD_PACKAGE) {
-                pddForegroundObserved = true
-                val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null)
-                stableEvidenceReads = if (screen.hasPurchaseProductEvidence()) stableEvidenceReads + 1 else 0
-                if (stableEvidenceReads >= PRODUCT_PAGE_STABLE_READS) return null
-                pause(OPEN_PRODUCT_POLL_MILLIS)
-                return@repeat
-            }
-            stableEvidenceReads = 0
-            val candidates = snapshot.nodes.filter { it.visible && it.enabled && it.label in aliases }
-            if (candidates.size > 1) return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
-            if (candidates.size == 1 && poll >= nextClickPoll) {
-                clickAttempted = true
-                val outcome = driver.clickFreshDetailed(candidates.single())
-                lastClickReason = outcome.reason
-                if (outcome.result == FreshActionResult.AMBIGUOUS) {
-                    return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
+            val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null)
+            val key = if (screen.problem == null && screen.hasPurchaseProductEvidence()) ProductStabilityKey(
+                screen.summary.title, screen.specEntry != null, screen.quickConfirmationEntry != null, screen.specPanelOpen,
+            ) else null
+            if (readiness.observe(monotonicNow(), snapshot.packageName, key)) return null
+            if (readiness.mayClickBrowser(monotonicNow(), snapshot.packageName)) {
+                val candidates = snapshot.nodes.filter { it.visible && it.enabled && it.label in aliases }
+                if (candidates.size > 1) return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
+                if (candidates.size == 1 && !readiness.expired(monotonicNow())) {
+                    val outcome = driver.clickNavigationFresh(candidates.single()) { !readiness.expired(monotonicNow()) }
+                    readiness.clicked(monotonicNow())
+                    if (readiness.expired(monotonicNow())) return navigationTimeout()
+                    if (outcome.result == FreshActionResult.AMBIGUOUS) return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
                 }
-                // The browser can rerender while handing the URL to PDD, and
-                // ACTION_CLICK may report false after the app transition has
-                // already started. The observed PDD foreground is the success
-                // condition; retry only this unique target after a short bound.
-                nextClickPoll = poll + OPEN_PRODUCT_RETRY_POLLS
             }
-            pause(OPEN_PRODUCT_POLL_MILLIS)
+            if (readiness.expired(monotonicNow())) return navigationTimeout()
+            pause(100)
         }
-        if (pddForegroundObserved) {
-            return failure("PDD_DETAIL_ENTRY_FAILED", "打开拼多多后未识别到稳定商品页面")
-        }
-        if (clickAttempted) {
-            val message = when (lastClickReason) {
-                FreshClickReason.ROOT_UNAVAILABLE, FreshClickReason.TARGET_NOT_FOUND -> "打开拼多多入口发生变化"
-                FreshClickReason.NO_CLICKABLE_ANCESTOR -> "打开拼多多入口暂时无法点击"
-                FreshClickReason.ACTION_CLICK_FALSE -> "打开拼多多后未进入商品页面"
-                else -> "打开拼多多失败"
-            }
-            return failure("RULE_ACTION_FAILED", message)
-        }
-        return failure("PDD_DETAIL_ENTRY_FAILED", "没有进入拼多多商品页面")
+        return navigationTimeout()
     }
 
+    private fun navigationTimeout() = failure("PDD_DETAIL_ENTRY_FAILED", "打开拼多多后未识别到稳定商品页面")
+
     private fun verifyProduct(input: PurchaseExecutionInput): PurchaseExecutionOutcome? {
         var stableEvidenceReads = 0
         repeat(PRODUCT_PAGE_POLL_LIMIT) {
@@ -1267,10 +1252,8 @@ class PurchaseRehearsalExecutor(
 
     companion object {
         private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
-        private const val OPEN_PRODUCT_POLL_LIMIT = 150
         private const val PRODUCT_PAGE_POLL_LIMIT = 150
         private const val PRODUCT_PAGE_STABLE_READS = 2
-        private const val OPEN_PRODUCT_RETRY_POLLS = 10
         private const val OPEN_PRODUCT_POLL_MILLIS = 100L
         private const val SPEC_ENTRY_READY_WAIT_POLLS = 20
         private const val SPEC_ENTRY_READY_POLL_MILLIS = 100L

android/app/src/main/java/cn/ilapage/goauto/agent/network/AgentApiClient.kt

@@ -100,8 +100,19 @@ data class PurchaseAgentTask(
     val ruleSnapshot: String,
     val ruleSnapshotHash: String,
     val leaseVersion: Long,
+    val attemptNumber: Int = 0,
 )
 
+data class PurchaseResultAcknowledgement(val pending: Boolean, val replayed: Boolean) {
+    companion object {
+        fun from(data: JSONObject) = PurchaseResultAcknowledgement(
+            pending = data.optString("status") == "pending",
+            // The server deliberately omits replayed=false. A malformed explicit value is not a first response.
+            replayed = data.has("replayed") && data.opt("replayed") != false,
+        )
+    }
+}
+
 data class CollectionHistoryItem(
     val taskId: Long,
     val attemptNumber: Int,
@@ -211,6 +222,8 @@ class AgentApiException(
 ) : Exception(message)
 
 class AgentApiClient(private val serverUrl: String) {
+    @Volatile var lastResponseServerTimeMillis: Long? = null
+        private set
     val failureSnapshotOrigin: String get() = ServerUrlPolicy.normalize(serverUrl)
     /** Stream the two bounded parts; never build another combined copy of the archive. */
     fun uploadFailureSnapshot(snapshot: cn.ilapage.goauto.agent.diagnostics.FailureSnapshot, token: String) {
@@ -524,9 +537,10 @@ class AgentApiClient(private val serverUrl: String) {
         return purchaseTask(requireNotNull(request("POST", "/api/agent/v1/purchase-tasks/$taskId/order-submit-started", payload, token)).getJSONObject("data"))
     }
 
-    fun submitPurchaseResult(taskId: Long, payloadJson: String, token: String) {
+    fun submitPurchaseResult(taskId: Long, payloadJson: String, token: String): PurchaseResultAcknowledgement {
         val payload = JSONObject(payloadJson)
-        requireNotNull(request("POST", "/api/agent/v1/purchase-tasks/$taskId/result", payload, token))
+        val data = requireNotNull(request("POST", "/api/agent/v1/purchase-tasks/$taskId/result", payload, token)).getJSONObject("data")
+        return PurchaseResultAcknowledgement.from(data)
     }
 
     fun collectionHistory(token: String, page: Int, status: String?, taskNo: String?, days: Int = 30, pageSize: Int = 20): HistoryPage<CollectionHistoryItem> {
@@ -666,6 +680,7 @@ class AgentApiClient(private val serverUrl: String) {
     private fun purchaseTask(data: JSONObject) = PurchaseAgentTask(
         taskId = data.getLong("taskId"),
         taskAttemptId = data.optString("taskAttemptId"),
+        attemptNumber = data.optInt("attemptNumber"),
         phase = data.optString("phase"),
         executionMode = data.getString("executionMode"),
         status = data.getString("status"),
@@ -709,6 +724,9 @@ class AgentApiClient(private val serverUrl: String) {
                 connection.outputStream.use { it.write(payload.toString().toByteArray(Charsets.UTF_8)) }
             }
             val status = connection.responseCode
+            // Metadata only: batch cutoff must use the API clock, never the phone's clock.
+            // A missing Date invalidates the sample instead of retaining an older response.
+            lastResponseServerTimeMillis = connection.getHeaderFieldDate("Date", 0L).takeIf { it > 0L }
             if (status == HttpURLConnection.HTTP_NO_CONTENT) return null
             val stream = if (status in 200..299) connection.inputStream else connection.errorStream
             val body = stream?.bufferedReader(Charsets.UTF_8)?.use { it.readText() }.orEmpty()

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/AgentDiagnosticSchema.kt

@@ -1,7 +1,7 @@
 package cn.ilapage.goauto.agent.persistence
 
 internal object AgentDiagnosticSchema {
-    const val VERSION = 4
+    const val VERSION = 5
 
     val failureSnapshotStatements = listOf(
         """CREATE TABLE IF NOT EXISTS purchase_failure_snapshot (
@@ -38,6 +38,12 @@ internal object AgentDiagnosticSchema {
         "horizontal_swipe_count" to "INTEGER",
     )
 
+    val colorDiscoveryOutcomeColumns = linkedMapOf(
+        "color_vertical_swipe_count" to "INTEGER",
+        "color_trailing_empty_read_count" to "INTEGER",
+        "color_horizontal_incomplete" to "INTEGER",
+    )
+
     val createTableSql =
         """CREATE TABLE agent_diagnostic (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -66,6 +72,9 @@ internal object AgentDiagnosticSchema {
             initial_selected_size_count INTEGER,
             selected_summary_present INTEGER,
             horizontal_swipe_count INTEGER,
+            color_vertical_swipe_count INTEGER,
+            color_trailing_empty_read_count INTEGER,
+            color_horizontal_incomplete INTEGER,
             task_type TEXT,
             task_attempt_id TEXT,
             device_id INTEGER,
@@ -87,5 +96,8 @@ internal object AgentDiagnosticSchema {
             (if (oldVersion < 3 && newVersion >= 3) purchaseDiagnosticColumns.mapNotNull { (name, definition) ->
                 if (name in existingColumns) null else "ALTER TABLE agent_diagnostic ADD COLUMN $name $definition"
             } else emptyList()) +
-            (if (oldVersion < 4 && newVersion >= 4) failureSnapshotStatements else emptyList())
+            (if (oldVersion < 4 && newVersion >= 4) failureSnapshotStatements else emptyList()) +
+            (if (oldVersion < 5 && newVersion >= 5) colorDiscoveryOutcomeColumns.mapNotNull { (name, definition) ->
+                if (name in existingColumns) null else "ALTER TABLE agent_diagnostic ADD COLUMN $name $definition"
+            } else emptyList())
 }

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/AgentDiagnosticStore.kt

@@ -7,6 +7,7 @@ import android.database.sqlite.SQLiteOpenHelper
 import cn.ilapage.goauto.agent.BuildConfig
 
 enum class AgentDiagnosticStage {
+    PRODUCT_NAVIGATION,
     SPEC_ENTRY_CLICK,
     SPEC_ENTRY_GESTURE,
     QUICK_CONFIRMATION_CLICK,
@@ -24,6 +25,12 @@ enum class AgentDiagnosticStage {
 }
 
 enum class AgentDiagnosticReason {
+    NAV_DIRECT_ACCEPTED,
+    NAV_DIRECT_REJECTED,
+    NAV_DIRECT_EXCEPTION,
+    NAV_BROWSER_ACCEPTED,
+    NAV_BROWSER_REJECTED,
+    NAV_BROWSER_EXCEPTION,
     SIZE_ADVICE_CLICK_BLOCKED,
     DETAIL_ENTRY_MATCHED,
     SPEC_PANEL_OPENED,
@@ -114,6 +121,12 @@ data class AgentDiagnosticEvent(
     val deviceId: Long? = null,
     val phase: String? = null,
     val ruleSnapshotHash: String? = null,
+    /** Successfully dispatched UP swipes during this color discovery; null means unknown. */
+    val colorVerticalSwipeCount: Int? = null,
+    /** Consecutive empty parsed-color discovery rounds at termination, excluding click/price reads. */
+    val colorTrailingEmptyReadCount: Int? = null,
+    /** Required horizontal exploration still unresolved at termination; not needed or recovered is false. */
+    val colorHorizontalIncomplete: Boolean? = null,
 )
 
 class SafeAgentDiagnosticRecorder(
@@ -197,6 +210,9 @@ class AgentDiagnosticStore(context: Context) : SQLiteOpenHelper(context, DATABAS
                 putNullableInt("initial_selected_size_count", event.initialSelectedSizeCount)
                 putNullableBoolean("selected_summary_present", event.selectedSummaryPresent)
                 putNullableInt("horizontal_swipe_count", event.horizontalSwipeCount)
+                putNullableInt("color_vertical_swipe_count", event.colorVerticalSwipeCount)
+                putNullableInt("color_trailing_empty_read_count", event.colorTrailingEmptyReadCount)
+                putNullableBoolean("color_horizontal_incomplete", event.colorHorizontalIncomplete)
                 put("agent_version", BuildConfig.VERSION_NAME)
                 put("created_at", event.createdAt)
             }

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/PurchaseOutboxUploader.kt

@@ -5,11 +5,13 @@ class PurchaseOutboxUploader(
     private val pending: () -> List<PendingPurchaseOutbox>,
     private val submit: (PendingPurchaseOutbox) -> Unit,
     private val markUploaded: (PendingPurchaseOutbox) -> Unit,
+    private val afterUploaded: (PendingPurchaseOutbox) -> Unit = {},
 ) {
     fun flush() {
         pending().forEach { item ->
             submit(item)
             markUploaded(item)
+            afterUploaded(item)
         }
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentForegroundService.kt

@@ -41,6 +41,11 @@ import cn.ilapage.goauto.agent.automation.CollectionRule
 import cn.ilapage.goauto.agent.automation.PurchaseAgentCapabilities
 import cn.ilapage.goauto.agent.automation.PurchaseSpecProbePolicy
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
+import cn.ilapage.goauto.agent.automation.PurchaseProbeHandoff
+import cn.ilapage.goauto.agent.automation.PddLaunchPath
+import cn.ilapage.goauto.agent.automation.PddLaunchStatus
+import cn.ilapage.goauto.agent.network.PurchaseResultAcknowledgement
+import cn.ilapage.goauto.agent.persistence.PendingPurchaseOutbox
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionOutcome
 import cn.ilapage.goauto.agent.automation.PurchaseLiveAutomation
 import cn.ilapage.goauto.agent.automation.PurchaseRehearsalExecutor
@@ -85,7 +90,13 @@ class AgentForegroundService : Service() {
     private val taskExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val diagnosticExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val snapshotUploadExecutor: ScheduledExecutorService = Executors.newSingleThreadScheduledExecutor()
+    private val repurchaseExecutor: ScheduledExecutorService = Executors.newSingleThreadScheduledExecutor()
+    private val repurchaseClosed = AtomicBoolean(false)
+    private val repurchase = RepurchaseCoordinator(SystemClock::elapsedRealtime, { UUID.randomUUID().toString() }, ::publishRepurchase)
+    private var repurchaseSession: RepurchaseSession? = null
+    private val repurchaseEvidence = java.util.concurrent.ConcurrentHashMap<Long, java.util.concurrent.ConcurrentHashMap<Long, RepurchaseExecutionEvidence>>()
     private val taskMutex = TaskExecutionMutex()
+    private val probeHandoff = PurchaseProbeHandoff()
     private val backfillGuard = OrderBackfillGuard(taskMutex)
     private val runningTaskId = AtomicReference<Long?>(null)
     private val working = AtomicBoolean(false)
@@ -119,6 +130,7 @@ class AgentForegroundService : Service() {
         identityStore = SecureDeviceStore(this)
         settingsStore = AgentSettingsStore(this)
         stateStore = AgentStateStore(this)
+        repurchaseState = RepurchaseState()
         // Wake locks and cooldown tickets are process-local. Never restore a stale UI flag.
         stateStore.setKeepScreenOn(false)
         purchaseStore = PurchaseTaskStore(this)
@@ -145,9 +157,30 @@ class AgentForegroundService : Service() {
         executor.scheduleWithFixedDelay(::triggerSync, 0, HEARTBEAT_SECONDS, TimeUnit.SECONDS)
         // Independent retention/upload ticks run even when no further task is dispatched.
         snapshotUploadExecutor.scheduleWithFixedDelay(::maintainFailureSnapshots, 0, 60, TimeUnit.SECONDS)
+        // Separate, serialized I/O ticks keep history reads and result observation off the
+        // heartbeat scheduler and, especially, off the single purchase execution thread.
+        repurchaseExecutor.scheduleWithFixedDelay(::tickRepurchase, 2, 2, TimeUnit.SECONDS)
+        diagnosticInstance = this
     }
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        when (intent?.action) {
+            ACTION_REPURCHASE_PREPARE -> {
+                repurchaseExecutor.execute(::prepareRepurchase)
+                return START_STICKY
+            }
+            ACTION_REPURCHASE_CONFIRM -> {
+                val roundId = intent.getStringExtra("roundId").orEmpty()
+                repurchaseExecutor.execute { repurchase.confirm(roundId); tickRepurchase() }
+                return START_STICKY
+            }
+            ACTION_REPURCHASE_STOP -> {
+                // Atomic: a network request must not delay the user's stop signal.
+                repurchase.requestStop(intent.getStringExtra("roundId").orEmpty())
+                repurchaseExecutor.execute(::tickRepurchase)
+                return START_STICKY
+            }
+        }
         if (intent?.action == ACTION_BACKFILL_STOP) {
             backfillGuard.cancelled.set(true)
             return START_STICKY
@@ -171,6 +204,12 @@ class AgentForegroundService : Service() {
     }
 
     override fun onDestroy() {
+        probeHandoff.invalidate()
+        if (diagnosticInstance === this) diagnosticInstance = null
+        repurchaseClosed.set(true)
+        repurchase.requestStop(repurchase.state.roundId)
+        repurchaseExecutor.shutdownNow()
+        repurchaseState = RepurchaseState(message = "服务已停止；不会恢复整轮重购")
         backfillGuard.cancelled.set(true)
         runCatching { connectivityManager.unregisterNetworkCallback(networkCallback) }
         cancelIdleReturn("服务已停止")
@@ -190,6 +229,30 @@ class AgentForegroundService : Service() {
 
     override fun onBind(intent: Intent?): IBinder? = null
 
+    /** Shell-protected debug receiver only. Never claims/resets a server task or invokes a purchase executor. */
+    internal fun runNavigationProbe(probe: (Context) -> Unit): Boolean {
+        if (!BuildConfig.DEBUG) return false
+        val reservation = Long.MAX_VALUE - 2
+        val acquired = synchronized(taskMutex) {
+            !repurchaseClosed.get() && repurchaseLocalIdle() && !repurchaseState.busy &&
+                activeCollectionCooldown() == null && taskMutex.tryAcquire(reservation)
+        }
+        if (!acquired) return false
+        probeHandoff.beginExecution()
+        cancelIdleReturn("导航诊断")
+        try {
+            taskExecutor.execute {
+                try { probe(this) }
+                catch (error: Exception) { Log.w("GoAutoNavProbe", "probe_exception=${error.javaClass.name}") }
+                finally { taskMutex.release(reservation) }
+            }
+        } catch (error: java.util.concurrent.RejectedExecutionException) {
+            taskMutex.release(reservation)
+            return false
+        }
+        return true
+    }
+
     private fun triggerSync() {
         if (!synchronized(taskMutex) { working.compareAndSet(false, true) }) return
         executor.execute {
@@ -333,6 +396,110 @@ class AgentForegroundService : Service() {
         })
     }
 
+    private data class RepurchaseSession(val origin: String, val deviceId: Long, val token: String)
+
+    private fun publishRepurchase(state: RepurchaseState) {
+        if (repurchaseClosed.get()) return
+        repurchaseState = state
+        sendBroadcast(Intent(ACTION_REPURCHASE_STATE).setPackage(packageName))
+        updateNotification(state.message, force = true)
+    }
+
+    private fun repurchaseLocalIdle(): Boolean = !working.get() && taskMutex.currentTaskId() == null &&
+        purchaseStore.activeTaskId() == null && purchaseStore.pendingOutbox().isEmpty() &&
+        stateStore.read().currentTaskId == null && !backfillState.running
+
+    private fun repurchaseEnvironment(session: RepurchaseSession): String? {
+        if (repurchaseClosed.get()) return "服务已经停止"
+        val credentials = identityStore.credentials()
+        if (credentials?.deviceId != session.deviceId || credentials.token != session.token ||
+            ServerUrlPolicy.normalize(settingsStore.serverUrl()) != session.origin) return "设备身份或服务器配置已变化，请重新连接"
+        if (!registeredThisProcess.get()) return "设备尚未完成连接校验，请先测试连接"
+        if (GoAutoAccessibilityService.instance == null) return "请先开启无障碍服务"
+        val network = connectivityManager.activeNetwork ?: return "网络不可用"
+        if (connectivityManager.getNetworkCapabilities(network)?.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) != true) return "网络不可用"
+        return null
+    }
+
+    private fun prepareRepurchase() {
+        if (repurchaseClosed.get() || !repurchase.prepare()) return
+        repurchaseEvidence.clear()
+        try {
+            val credentials = identityStore.credentials() ?: error("missing credentials")
+            val session = RepurchaseSession(ServerUrlPolicy.normalize(settingsStore.serverUrl()), credentials.deviceId, credentials.token)
+            repurchaseSession = session
+            repurchaseEnvironment(session)?.let { repurchase.fail(it); return }
+            val port = repurchasePort(session)
+            if (!repurchaseLocalIdle() || port.hasOtherWork(null)) {
+                repurchase.fail("设备已有未结束工作或结果上传尚未收尾，请完成后再重购")
+                return
+            }
+            // Discovery owns its client. No other request can overwrite its page's Date sample.
+            val api = AgentApiClient(session.origin)
+            val batch = RepurchaseBatchDiscovery({ query ->
+                check(!repurchase.isStopRequested() && !repurchaseClosed.get())
+                check(repurchaseEnvironment(session) == null)
+                api.purchaseHistory(session.token, query.page, query.status, query.taskNo, query.days, query.pageSize)
+            }, { requireNotNull(api.lastResponseServerTimeMillis) }).discover()
+            repurchaseEnvironment(session)?.let { repurchase.fail(it); return }
+            if (!repurchaseLocalIdle() || port.hasOtherWork(null)) {
+                repurchase.fail("读取期间出现新的采集或采购工作，请完成后重新读取")
+                return
+            }
+            repurchase.prepared(batch)
+        } catch (error: RepurchaseBatchException) {
+            repurchase.fail(if (repurchase.isStopRequested()) "已停止读取，没有发起重购" else when (error.reason) {
+                RepurchaseBatchFailure.LIST_CHANGED -> "采购列表已变化，请重新读取"
+                RepurchaseBatchFailure.PAGE_FAILED -> "读取采购记录失败，请检查连接后重试"
+                else -> "无法完整确定最后一批采购记录，请检查时间或记录后重试（${error.reason}）"
+            })
+        } catch (_: Exception) {
+            repurchase.fail("设备连接或记录读取失败，请恢复后重试")
+        }
+    }
+
+    private fun tickRepurchase() {
+        if (repurchaseClosed.get() || !repurchase.state.busy) return
+        val session = repurchaseSession ?: return
+        val previousTaskId = repurchase.state.currentTaskId
+        repurchase.tick(repurchasePort(session))
+        // Reset only makes the original task pending. The original dispatcher owns all
+        // claim/start/automation/upload steps; the round never executes a PDD action.
+        if (repurchase.state.currentTaskId != null && repurchase.state.currentTaskId != previousTaskId) triggerSync()
+    }
+
+    private fun repurchasePort(session: RepurchaseSession): RepurchasePort = object : RepurchasePort {
+        private val api = AgentApiClient(session.origin)
+        override fun environmentProblem() = repurchaseEnvironment(session)
+        override fun localIdle() = repurchaseLocalIdle()
+        override fun latestTaskId() = api.purchaseHistory(session.token, 1, null, null, 30, 1).items.firstOrNull()?.taskId
+        override fun detail(taskId: Long) = api.purchaseHistoryDetail(taskId, session.token)
+        override fun executionEvidence(taskId: Long) = repurchaseEvidence[taskId]?.values?.toList().orEmpty()
+        override fun hasOtherWork(currentTaskId: Long?): Boolean {
+            if (api.nextTask(session.token) != null) return true // collection IDs are a separate namespace
+            val next = api.nextPurchaseTask(session.token)
+            if (next != null && next.taskId != currentTaskId) return true
+            // /next returns the current running/probing purchase first and can conceal new pending work.
+            return listOf("pending", "running", "spec_probe_pending", "order_submit_started").any { status ->
+                val page = api.purchaseHistory(session.token, 1, status, null, 30, 50)
+                page.items.any { it.taskId != currentTaskId } || page.total > page.items.size
+            }
+        }
+        override fun reset(taskId: Long, requestId: String): cn.ilapage.goauto.agent.network.PurchaseResetResult {
+            val acquired = synchronized(taskMutex) {
+                !working.get() && taskMutex.tryAcquire(REPURCHASE_RESERVATION_ID)
+            }
+            if (!acquired) throw RepurchaseLocalBusy()
+            try {
+                if (environmentProblem() != null || repurchase.isStopRequested() || repurchaseClosed.get() ||
+                    purchaseStore.activeTaskId() != null || purchaseStore.pendingOutbox().isNotEmpty()) {
+                    throw AgentApiException(409, "DEVICE_BUSY", "本地工作边界变化", false)
+                }
+                return api.resetPurchaseTask(taskId, requestId, session.token)
+            } finally { taskMutex.release(REPURCHASE_RESERVATION_ID) }
+        }
+    }
+
     private fun publishBackfill(state: OrderBackfillState) {
         backfillState = state
         sendBroadcast(Intent(ACTION_BACKFILL_STATE).setPackage(packageName))
@@ -350,6 +517,7 @@ class AgentForegroundService : Service() {
         }
         try {
             val window = cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, confirmedAt)
+            probeHandoff.beginExecution()
             val server = settingsStore.serverUrl()
             val credentials = identityStore.credentials() ?: error("设备尚未注册")
             val accessibility = GoAutoAccessibilityService.instance ?: error("请先启用无障碍服务")
@@ -444,6 +612,7 @@ class AgentForegroundService : Service() {
             return
         }
         cancelIdleReturn("正在创建当前页面采集任务")
+        probeHandoff.beginExecution()
         taskExecutor.execute {
             var taskId = 0L
             try {
@@ -585,6 +754,12 @@ class AgentForegroundService : Service() {
     }
 
     private fun executePurchaseTask(api: AgentApiClient, initial: PurchaseAgentTask, token: String) {
+        // Take and clear before claim/start or any eligibility checks. Every execution consumes the previous handoff.
+        val handoffExecution = probeHandoff.beginExecution()
+        var probeCompletedAt: Long? = null
+        var probeAccessibility: GoAutoAccessibilityService? = null
+        var probeForegroundRevision = -1L
+        var acceptedPath: PddLaunchPath? = null
         GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         var resultSafelyStored = false
@@ -607,6 +782,7 @@ class AgentForegroundService : Service() {
                 api.startPurchaseTask(claimed.taskId, UUID.randomUUID().toString(), token)
             } else claimed
             check(task.status == "running" && task.taskAttemptId.isNotBlank()) { "采购任务没有有效 attempt" }
+            recordRepurchaseExecution(task, null)
             val diagnosticDeviceId = runCatching { identityStore.credentials()?.takeIf { it.token == token }?.deviceId }.getOrNull()
             if (task.taskAttemptId.matches(Regex("[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}")) &&
                 (diagnosticDeviceId ?: 0) > 0 && task.phase in setOf("spec_probe", "purchase")) {
@@ -648,8 +824,35 @@ class AgentForegroundService : Service() {
                     } else {
                         PurchaseRehearsalExecutor(
                             driver = accessibility,
-                            openLink = { PddLinkLauncher(this).open(it, preferDirect = true) },
-                            probeSpecs = { collectPurchaseProbe(accessibility, task, parsedRule, probeDiagnostic) },
+                            openLink = { url ->
+                                probeHandoff.invalidate()
+                                acceptedPath = null
+                                val navigationStarted = SystemClock.elapsedRealtime()
+                                PddLinkLauncher(this).open(url, preferDirect = true) { event ->
+                                    if (event.status == PddLaunchStatus.ACCEPTED) acceptedPath = event.path
+                                    probeDiagnostic(AgentDiagnosticEvent(
+                                        taskId = task.taskId,
+                                        stage = AgentDiagnosticStage.PRODUCT_NAVIGATION,
+                                        reason = AgentDiagnosticReason.valueOf("NAV_${event.path}_${event.status}"),
+                                        elapsedMs = SystemClock.elapsedRealtime() - navigationStarted,
+                                        targetClassName = event.exceptionClass,
+                                    ))
+                                }
+                            },
+                            acceptedLaunchPath = { acceptedPath },
+                            monotonicNow = SystemClock::elapsedRealtime,
+                            confirmProbeHandoff = {
+                                val current = GoAutoAccessibilityService.instance
+                                probeHandoff.stillValid(handoffExecution, current,
+                                    current?.currentForegroundRevision() ?: -1L, SystemClock.elapsedRealtime())
+                            },
+                            probeSpecs = {
+                                collectPurchaseProbe(accessibility, task, parsedRule, probeDiagnostic).also {
+                                    probeCompletedAt = SystemClock.elapsedRealtime()
+                                    probeAccessibility = accessibility
+                                    probeForegroundRevision = accessibility.currentForegroundRevision()
+                                }
+                            },
                             probeClickDiagnostic = { stage, target, outcome ->
                                 probeDiagnostic(specClickDiagnostic(task.taskId, stage, target, outcome))
                             },
@@ -687,6 +890,10 @@ class AgentForegroundService : Service() {
                                 minUnitPriceCent = task.minUnitPriceCent,
                                 maxUnitPriceCent = task.maxUnitPriceCent,
                                 addressSuffix = task.addressSuffix,
+                                reuseProbeProduct = probeHandoff.eligible(
+                                    handoffExecution, task.taskId, task.pddGoodsId, task.phase, task.taskAttemptId,
+                                    accessibility, accessibility.currentForegroundRevision(), SystemClock.elapsedRealtime(),
+                                ),
                             ),
                             parsedRule,
                             PurchaseAgentCapabilities.supported,
@@ -697,6 +904,7 @@ class AgentForegroundService : Service() {
             // #334: a spec probe that read zero colors/sizes must fail explicitly
             // instead of being reported as a normal, empty spec_probe_completed.
             val outcome = PurchaseSpecProbePolicy.demote(rawOutcome)
+            recordRepurchaseExecution(task, outcome.resultType)
             knownResultType = outcome.resultType
             // The live read finishes before persistence, the new failure bubble, return to Agent, or lease release.
             if (FailureSnapshotPolicy.eligible(task.phase, outcome.resultType, false)) failureSnapshot(outcome.resultType, outcome.errorCode ?: "PURCHASE_EXECUTION_FAILED")
@@ -713,7 +921,22 @@ class AgentForegroundService : Service() {
                 GoAutoAccessibilityService.instance?.showPurchaseResultBubble(presentation)
             }
             beginIdleReturnCooldown()
-            flushPurchaseOutbox(api, token)
+            // Only this first synchronous upload may establish a handoff. Outbox replays have no callback.
+            flushPurchaseOutbox(api, token) { item, acknowledgement ->
+                val completedAt = probeCompletedAt
+                val accessibility = probeAccessibility
+                if (item.requestId == requestId && item.attemptId == task.taskAttemptId && completedAt != null &&
+                    accessibility != null && GoAutoAccessibilityService.instance === accessibility &&
+                    accessibility.currentPackage() == "com.xunmeng.pinduoduo" &&
+                    accessibility.currentForegroundRevision() == probeForegroundRevision) {
+                    probeHandoff.completeProbe(
+                        handoffExecution, task.taskId, task.pddGoodsId, task.taskAttemptId, completedAt,
+                        accessibility, probeForegroundRevision,
+                        successful = task.phase == "spec_probe" && outcome.resultType == "spec_probe_completed",
+                        safelyStored = resultSafelyStored, submitPending = acknowledgement.pending, replayed = acknowledgement.replayed,
+                    )
+                }
+            }
             val message = if (outcome.resultType == "failed") "${outcome.errorCode}：${outcome.message}" else outcome.message
             stateStore.update(if (outcome.resultType == "failed") "TASK_ERROR" else "ONLINE", message, tokenStored = true)
             updateNotification(if (outcome.resultType == "failed") "$taskLabel #${task.taskId} 失败" else "$taskLabel #${task.taskId} 已提交")
@@ -730,6 +953,12 @@ class AgentForegroundService : Service() {
         }
     }
 
+    private fun recordRepurchaseExecution(task: PurchaseAgentTask, resultType: String?) {
+        if (!repurchaseState.busy || repurchaseState.currentTaskId != task.taskId || task.attemptNumber <= 0) return
+        val taskEvidence = repurchaseEvidence.getOrPut(task.taskId) { java.util.concurrent.ConcurrentHashMap() }
+        taskEvidence[task.attemptNumber.toLong()] = RepurchaseExecutionEvidence(task.attemptNumber.toLong(), task.taskAttemptId, task.phase, resultType)
+    }
+
     private fun collectPurchaseProbe(
         accessibility: GoAutoAccessibilityService, task: PurchaseAgentTask, purchaseRule: PurchaseRule,
         diagnostic: (AgentDiagnosticEvent) -> Unit,
@@ -771,6 +1000,7 @@ class AgentForegroundService : Service() {
 
     private fun recoverInterruptedPurchases(api: AgentApiClient, token: String) {
         purchaseStore.interruptedAttempts().forEach { interrupted ->
+            probeHandoff.beginExecution()
             if (interrupted.status == PurchaseTaskStore.STATUS_ORDER_SUBMIT_STARTED) {
                 val boundaryRequestId = interrupted.orderSubmitRequestId ?: return@forEach
                 try {
@@ -822,11 +1052,20 @@ class AgentForegroundService : Service() {
         }
     }
 
-    private fun flushPurchaseOutbox(api: AgentApiClient, token: String) {
+    private fun flushPurchaseOutbox(
+        api: AgentApiClient, token: String,
+        onFirstSubmitted: (PendingPurchaseOutbox, PurchaseResultAcknowledgement) -> Unit = { _, _ -> },
+    ) {
+        var acknowledgement: PurchaseResultAcknowledgement? = null
         PurchaseOutboxUploader(
             pending = purchaseStore::pendingOutbox,
-            submit = { item -> api.submitPurchaseResult(item.taskId, item.payloadJson, token) },
+            submit = { item -> acknowledgement = api.submitPurchaseResult(item.taskId, item.payloadJson, token) },
             markUploaded = { item -> purchaseStore.markUploaded(item.id, item.taskId, item.attemptId) },
+            afterUploaded = { item ->
+                // A local upload-mark failure creates no credential; optional handoff inspection cannot fail the upload.
+                runCatching { onFirstSubmitted(item, requireNotNull(acknowledgement)) }
+                    .onFailure { probeHandoff.invalidate(); logDiagnosticPersistenceFailure(it) }
+            },
         ).flush()
         runningTaskId.set(purchaseStore.activeTaskId())
     }
@@ -889,6 +1128,7 @@ class AgentForegroundService : Service() {
         initialTask: cn.ilapage.goauto.agent.network.AgentTask,
         token: String,
     ): TaskExecutionSummary {
+        probeHandoff.beginExecution()
         GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         return try {
@@ -1239,6 +1479,7 @@ class AgentForegroundService : Service() {
     }
 
     private fun evaluateIdleReturn() {
+        if (repurchaseState.phase == RepurchasePhase.RUNNING) return
         if (!idleReturn.isArmed()) return
         val accessibility = GoAutoAccessibilityService.instance
         if (accessibility == null) {
@@ -1261,6 +1502,7 @@ class AgentForegroundService : Service() {
     }
 
     private fun requestReturnToAgent(accessibility: GoAutoAccessibilityService) {
+        probeHandoff.invalidate()
         val launched = accessibility.openAgentPreservingTab()
         if (launched) SystemClock.sleep(RETURN_CONFIRM_DELAY_MILLIS)
         val returned = launched && accessibility.currentPackage() == packageName
@@ -1383,10 +1625,20 @@ class AgentForegroundService : Service() {
                 PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
             builder.addAction(Notification.Action.Builder(null, "停止回填", stop).build())
         }
+        if (repurchaseState.busy) {
+            val stop = PendingIntent.getService(this, 367,
+                Intent(this, AgentForegroundService::class.java).setAction(ACTION_REPURCHASE_STOP).putExtra("roundId", repurchaseState.roundId),
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+            builder.addAction(Notification.Action.Builder(null, "停止重购", stop).build())
+        }
         return builder
             .setSmallIcon(android.R.drawable.stat_notify_sync)
             .setContentTitle(getString(R.string.app_name))
-            .setContentText(if (backfillState.running) "订单回填 · 已检查 ${backfillState.checked}" else content)
+            .setContentText(when {
+                repurchaseState.busy -> "重购 ${repurchaseState.currentTaskId?.let { "CG-$it" }.orEmpty()} · 成功${repurchaseState.successCount} 失败${repurchaseState.failedCount} 跳过${repurchaseState.skippedCount}"
+                backfillState.running -> "订单回填 · 已检查 ${backfillState.checked}"
+                else -> content
+            })
             .setContentIntent(pendingIntent)
             .setOngoing(true)
             .build()
@@ -1405,6 +1657,7 @@ class AgentForegroundService : Service() {
      * 归位要的是相反的效果，所以单独加 FLAG_ACTIVITY_CLEAR_TOP，两条路径各自保留（#292）。
      */
     private fun resetPddToHome(): PddLaunchResult {
+        probeHandoff.invalidate()
         val launchIntent = packageManager.getLaunchIntentForPackage(PDD_PACKAGE)
             ?: return PddLaunchResult.INTENT_MISSING
         launchIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
@@ -1419,6 +1672,7 @@ class AgentForegroundService : Service() {
     }
 
     private fun launchPddToForeground(): PddLaunchResult {
+        probeHandoff.invalidate()
         val launchIntent = packageManager.getLaunchIntentForPackage(PDD_PACKAGE)
             ?: return PddLaunchResult.INTENT_MISSING
         launchIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
@@ -1433,6 +1687,14 @@ class AgentForegroundService : Service() {
     }
 
     companion object {
+        @Volatile internal var diagnosticInstance: AgentForegroundService? = null
+            private set
+        const val ACTION_REPURCHASE_PREPARE = "cn.ilapage.goauto.agent.REPURCHASE_PREPARE"
+        const val ACTION_REPURCHASE_CONFIRM = "cn.ilapage.goauto.agent.REPURCHASE_CONFIRM"
+        const val ACTION_REPURCHASE_STOP = "cn.ilapage.goauto.agent.REPURCHASE_STOP"
+        const val ACTION_REPURCHASE_STATE = "cn.ilapage.goauto.agent.REPURCHASE_STATE"
+        @Volatile var repurchaseState = RepurchaseState()
+            private set
         const val ACTION_BACKFILL_START = "cn.ilapage.goauto.agent.BACKFILL_START"
         const val ACTION_BACKFILL_STOP = "cn.ilapage.goauto.agent.BACKFILL_STOP"
         const val ACTION_BACKFILL_STATE = "cn.ilapage.goauto.agent.BACKFILL_STATE"
@@ -1468,6 +1730,7 @@ class AgentForegroundService : Service() {
         private const val COOLDOWN_WAKE_GRACE_MILLIS = 5_000L
         private const val RETURN_CONFIRM_DELAY_MILLIS = 750L
         private const val CURRENT_PAGE_RESERVATION_ID = Long.MAX_VALUE
+        private const val REPURCHASE_RESERVATION_ID = Long.MAX_VALUE - 1
         private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
         private const val CURRENT_PAGE_RESULT_NOTIFICATION_MILLIS = 30_000L
 

android/app/src/main/java/cn/ilapage/goauto/agent/service/RepurchaseBatch.kt

@@ -0,0 +1,168 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.HistoryPage
+import cn.ilapage.goauto.agent.network.PurchaseHistoryItem
+import java.text.ParsePosition
+import java.text.SimpleDateFormat
+import java.util.Collections
+import java.util.Locale
+import java.util.TimeZone
+
+data class RepurchaseHistoryQuery(val page: Int, val pageSize: Int = 50, val days: Int = 30, val status: String? = null, val taskNo: String? = null)
+
+enum class RepurchaseBatchFailure { PAGE_FAILED, INVALID_PAGE, INVALID_TIMESTAMP, INVALID_ORDER, INCOMPLETE_BATCH, LIST_CHANGED, PAGE_LIMIT }
+
+class RepurchaseBatchException(val reason: RepurchaseBatchFailure) : IllegalStateException(reason.name)
+
+class RepurchaseBatch internal constructor(items: List<PurchaseHistoryItem>) {
+    val items: List<PurchaseHistoryItem> = immutable(items)
+    val candidates: List<PurchaseHistoryItem> = immutable(items.filter { it.status == "failed" && it.retryable })
+    val failures: List<PurchaseHistoryItem> = immutable(items.filter { it.status == "failed" })
+    val skips: List<PurchaseHistoryItem> = immutable(failures.filterNot { it.retryable })
+    val headTaskId = items.firstOrNull()?.taskId
+    val newestCreatedAt = items.firstOrNull()?.createdAt
+    val oldestCreatedAt = items.lastOrNull()?.createdAt
+
+    private fun immutable(items: List<PurchaseHistoryItem>): List<PurchaseHistoryItem> =
+        Collections.unmodifiableList(ArrayList(items))
+}
+
+/** Read-only discovery. The callback must use the current device's authenticated history endpoint.
+ *
+ * [nowMillis] MUST return the trusted server Date time from the response to that fetch, and throw
+ * when it is missing or invalid. Never fall back to the phone clock or a previous response's Date:
+ * the server applies the rolling 30-day cutoff, and a slow phone could accept a truncated batch.
+ * Tests may inject a synthetic server clock. It is read only after each successful page response.
+ *
+ * Offset overlap is tolerated; a changed head is rejected. This is not a snapshot guarantee for
+ * arbitrary concurrent deletion, reassignment or timestamp edits on the server.
+ */
+class RepurchaseBatchDiscovery(
+    private val fetchPage: (RepurchaseHistoryQuery) -> HistoryPage<PurchaseHistoryItem>,
+    private val nowMillis: () -> Long,
+    private val maxPages: Int = 200,
+) {
+    init { require(maxPages > 0) }
+
+    fun discover(): RepurchaseBatch {
+        var latestServerTime = 0L
+        fun readWithServerTime(pageNumber: Int): HistoryPage<PurchaseHistoryItem> {
+            val page = readPage(pageNumber)
+            val serverTime = try { nowMillis() } catch (_: Exception) {
+                refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+            }
+            if (serverTime <= 0) refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+            latestServerTime = maxOf(latestServerTime, serverTime)
+            return page
+        }
+        val seen = linkedMapOf<Long, Entry>()
+        val batch = mutableListOf<PurchaseHistoryItem>()
+        var head: Long? = null
+        var previous: Entry? = null
+        var originalTotal: Long? = null
+        var foundBoundary = false
+        var reachedEnd = false
+        for (pageNumber in 1..maxPages) {
+            val page = readWithServerTime(pageNumber)
+            if (originalTotal == null) originalTotal = page.total
+            else if (page.total != originalTotal) refuse(RepurchaseBatchFailure.LIST_CHANGED)
+            val entries = parseOrdered(page.items)
+            if (pageNumber == 1) head = entries.firstOrNull()?.item?.taskId
+            for (entry in entries) {
+                val duplicate = seen[entry.item.taskId]
+                if (duplicate != null) {
+                    if (duplicate.time != entry.time) refuse(RepurchaseBatchFailure.INVALID_ORDER)
+                    continue
+                }
+                val prior = previous
+                if (prior != null) {
+                    if (ENTRY_ORDER.compare(prior, entry) > 0) refuse(RepurchaseBatchFailure.INVALID_ORDER)
+                    if (prior.time.moreThanSixtySecondsAfter(entry.time)) {
+                        foundBoundary = true
+                        break
+                    }
+                }
+                seen[entry.item.taskId] = entry
+                batch += entry.item
+                previous = entry
+            }
+            if (foundBoundary) break
+            if (pageNumber.toLong() * PAGE_SIZE >= page.total) {
+                // Offset overlap without enough unique rows cannot establish a complete tail.
+                if (seen.size.toLong() != page.total) refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+                reachedEnd = true
+                break
+            }
+        }
+        if (!foundBoundary && !reachedEnd) refuse(RepurchaseBatchFailure.PAGE_LIMIT)
+
+        val finalPage = readWithServerTime(1)
+        val finalHead = parseOrdered(finalPage.items).firstOrNull()?.item?.taskId
+        if (finalHead != head || finalPage.total != originalTotal) refuse(RepurchaseBatchFailure.LIST_CHANGED)
+        if (reachedEnd && previous != null) {
+            // The API applies a rolling 30-day range, not a midnight-based date filter.
+            // HTTP Date has whole-second precision; include its possible fractional second.
+            // Preserve the latest observed time if a later response's Date moves backwards.
+            val floorMillis = latestServerTime + 1000 - DAYS * 24L * 60 * 60 * 1000
+            val floorSeconds = floorMillis / 1000 - if (floorMillis < 0 && floorMillis % 1000 != 0L) 1 else 0
+            val floor = Timestamp(floorSeconds, ((floorMillis - floorSeconds * 1000) * 1_000_000).toInt())
+            if (!previous.time.moreThanSixtySecondsAfter(floor)) refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+        }
+        return RepurchaseBatch(batch)
+    }
+
+    private fun readPage(pageNumber: Int): HistoryPage<PurchaseHistoryItem> {
+        val page = try {
+            fetchPage(RepurchaseHistoryQuery(page = pageNumber))
+        } catch (_: Exception) {
+            // Do not expose a network exception that might contain credentials or response data.
+            refuse(RepurchaseBatchFailure.PAGE_FAILED)
+        }
+        val offset = (pageNumber - 1L) * PAGE_SIZE
+        if (page.page != pageNumber || page.pageSize != PAGE_SIZE || page.total < 0 ||
+            page.items.size.toLong() != (page.total - offset).coerceIn(0, PAGE_SIZE.toLong()) ||
+            page.items.any { it.taskId <= 0 } || page.items.map { it.taskId }.distinct().size != page.items.size
+        ) refuse(RepurchaseBatchFailure.INVALID_PAGE)
+        return page
+    }
+
+    private fun parseOrdered(items: List<PurchaseHistoryItem>): List<Entry> {
+        val entries = items.map { Entry(it, parseTime(it.createdAt)) }
+        val ordered = entries.sortedWith(ENTRY_ORDER)
+        if (entries != ordered) refuse(RepurchaseBatchFailure.INVALID_ORDER)
+        return ordered
+    }
+
+    private fun parseTime(raw: String): Timestamp {
+        val match = TIMESTAMP.matchEntire(raw) ?: refuse(RepurchaseBatchFailure.INVALID_TIMESTAMP)
+        val zone = match.groupValues[3].let { if (it == "Z") "+0000" else it.replace(":", "") }
+        val normalized = match.groupValues[1] + zone
+        val position = ParsePosition(0)
+        val parsed = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ", Locale.ROOT).apply {
+            isLenient = false
+            timeZone = TimeZone.getTimeZone("UTC")
+        }.parse(normalized, position)
+        if (parsed == null || position.index != normalized.length) refuse(RepurchaseBatchFailure.INVALID_TIMESTAMP)
+        return Timestamp(parsed.time / 1000, match.groupValues[2].padEnd(9, '0').toInt())
+    }
+
+    private data class Entry(val item: PurchaseHistoryItem, val time: Timestamp)
+
+    private data class Timestamp(val seconds: Long, val nanos: Int) : Comparable<Timestamp> {
+        override fun compareTo(other: Timestamp): Int =
+            seconds.compareTo(other.seconds).takeIf { it != 0 } ?: nanos.compareTo(other.nanos)
+
+        fun moreThanSixtySecondsAfter(older: Timestamp): Boolean {
+            val secondsApart = seconds - older.seconds
+            return secondsApart > 60 || (secondsApart == 60L && nanos > older.nanos)
+        }
+    }
+
+    companion object {
+        private const val PAGE_SIZE = 50
+        private const val DAYS = 30
+        private val TIMESTAMP = Regex("(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2})(?:\\.(\\d{1,9}))?(Z|[+-]\\d{2}:\\d{2})")
+        private val ENTRY_ORDER = compareByDescending<Entry> { it.time }.thenByDescending { it.item.taskId }
+        private fun refuse(reason: RepurchaseBatchFailure): Nothing = throw RepurchaseBatchException(reason)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/RepurchaseCoordinator.kt

@@ -0,0 +1,235 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.PurchaseHistoryDetail
+import cn.ilapage.goauto.agent.network.PurchaseResetResult
+import cn.ilapage.goauto.agent.network.AgentApiException
+import java.util.concurrent.atomic.AtomicReference
+
+interface RepurchasePort {
+    fun environmentProblem(): String?
+    fun localIdle(): Boolean
+    fun hasOtherWork(currentTaskId: Long?): Boolean
+    fun latestTaskId(): Long?
+    fun detail(taskId: Long): PurchaseHistoryDetail
+    fun reset(taskId: Long, requestId: String): PurchaseResetResult
+    fun executionEvidence(taskId: Long): List<RepurchaseExecutionEvidence> = emptyList()
+}
+
+/** Only emitted by the original executor after Start and after a known outcome. */
+data class RepurchaseExecutionEvidence(val attemptNumber: Long, val attemptId: String, val phase: String, val resultType: String?)
+class RepurchaseLocalBusy : IllegalStateException()
+
+class RepurchaseCoordinator(
+    private val now: () -> Long,
+    private val requestId: () -> String,
+    private val publish: (RepurchaseState) -> Unit,
+) {
+    @Volatile var state = RepurchaseState()
+        private set
+    private val stopRequest = AtomicReference<String?>(null)
+    private var position = 0
+    private var expectedAttempt = 0L
+    private var issuedAt = 0L
+    private var busySince: Long? = null
+    private var headChecked = false
+    private val resetRequestIds = mutableMapOf<Long, String>()
+
+    // All mutation except requestStop is confined to the Service's orchestration worker.
+    fun prepare(): Boolean {
+        if (state.busy) return false
+        stopRequest.set(null)
+        position = 0
+        expectedAttempt = 0
+        busySince = null
+        headChecked = false
+        resetRequestIds.clear()
+        emit(RepurchaseState(phase = RepurchasePhase.READING, roundId = requestId(), message = "正在读取本设备最后一批采购记录…"))
+        return true
+    }
+
+    fun prepared(batch: RepurchaseBatch) {
+        if (state.phase != RepurchasePhase.READING) return
+        if (isStopRequested()) { finish("已停止读取，没有发起重购"); return }
+        val skips = batch.skips.map { RepurchaseItemResult(it.taskId, RepurchaseResult.SKIPPED, it.retryDisabledReason ?: "当前不可重试") }
+        val message = when {
+            batch.items.isEmpty() -> "近30天没有采购记录"
+            batch.failures.isEmpty() -> "最后一批没有失败任务，不回退更早批次"
+            batch.candidates.isEmpty() -> "最后一批失败任务均不可重试，请查看逐条结果"
+            else -> "请确认本轮重购范围"
+        }
+        emit(state.copy(phase = if (batch.candidates.isEmpty()) RepurchasePhase.FINISHED else RepurchasePhase.READY,
+            batch = batch, results = skips, message = message))
+    }
+
+    fun confirm(roundId: String) {
+        if (state.phase != RepurchasePhase.READY || roundId != state.roundId) return
+        if (isStopRequested()) { finish("已取消重购"); return }
+        emit(state.copy(phase = RepurchasePhase.RUNNING, message = "正在复核本轮任务"))
+    }
+
+    fun requestStop(roundId: String) {
+        if (roundId.isNotBlank() && roundId == state.roundId) stopRequest.set(roundId)
+    }
+    fun isStopRequested(): Boolean = stopRequest.get() == state.roundId && state.roundId.isNotBlank()
+
+    fun fail(message: String) {
+        if (!state.busy) return
+        if (state.currentTaskId == null) finish(message)
+        else if (state.phase != RepurchasePhase.STOPPING) emit(state.copy(phase = RepurchasePhase.STOPPING, message = "$message；停止后续，当前任务沿用原流程收尾"))
+    }
+
+    fun tick(port: RepurchasePort) {
+        if (!state.busy) return
+        if (isStopRequested()) fail("已请求停止重购")
+        if (state.phase !in setOf(RepurchasePhase.RUNNING, RepurchasePhase.STOPPING)) return
+        if (state.currentTaskId != null && now() - issuedAt >= TASK_TIMEOUT_MILLIS) {
+            finish("单条等待已达15分钟，已停止编排；当前任务未被取消，请人工检查")
+            return
+        }
+        try {
+            port.environmentProblem()?.let { fail(it); return }
+            val current = state.currentTaskId
+            if (port.hasOtherWork(current)) fail("检测到新的采集或采购工作")
+            if (!state.busy) return
+            if (current != null) {
+                observe(port, current)
+                return
+            }
+            if (state.phase != RepurchasePhase.RUNNING) return
+            if (busySince != null && now() - requireNotNull(busySince) >= DRAIN_TIMEOUT_MILLIS) {
+                fail("设备忙碌或结果上传尚未收尾"); return
+            }
+            if (!port.localIdle()) {
+                val since = busySince ?: now().also { busySince = it }
+                if (now() - since >= DRAIN_TIMEOUT_MILLIS) fail("设备忙碌或结果上传尚未收尾")
+                return
+            }
+            val batch = requireNotNull(state.batch)
+            if (!headChecked) {
+                if (port.latestTaskId() != batch.headTaskId) { fail("采购列表已变化，请重新读取后确认"); return }
+                headChecked = true
+            }
+            if (position >= batch.candidates.size) { finish("本轮重购已结束"); return }
+            val taskId = batch.candidates[position].taskId
+            val detail = try { port.detail(taskId) } catch (error: AgentApiException) {
+                if (error.code == "PURCHASE_TASK_NOT_FOUND") { skip(taskId, "任务已过期或不再属于本设备"); return }
+                throw error
+            }
+            check(detail.task.taskId == taskId)
+            if (detail.task.status != "failed" || !detail.task.retryable) {
+                skip(taskId, detail.task.retryDisabledReason ?: "当前状态不可重试")
+                return
+            }
+            // Recheck after network reads. The reset adapter also holds a short local reservation.
+            if (isStopRequested()) { fail("已请求停止重购"); return }
+            port.environmentProblem()?.let { fail(it); return }
+            if (!port.localIdle()) return
+            if (port.hasOtherWork(null)) { fail("检测到新的采集或采购工作"); return }
+            if (isStopRequested()) { fail("已请求停止重购"); return }
+            issueReset(port, taskId, detail.attemptCount)
+        } catch (_: Exception) {
+            fail("连接、身份或服务端校验失败，请恢复后再操作")
+        }
+    }
+
+    private fun issueReset(port: RepurchasePort, taskId: Long, priorAttempt: Long) {
+        val fixedRequestId = resetRequestIds.getOrPut(taskId, requestId)
+        issuedAt = now()
+        expectedAttempt = 0
+        emit(state.copy(currentTaskId = taskId, message = "正在重置 CG-$taskId（原任务号）"))
+        var ambiguous = false
+        repeat(2) { attempt ->
+            // A stop while an ambiguous request was in flight must not start a fresh write.
+            if (attempt > 0 && isStopRequested()) { fail("重置响应不明确，已停止，请人工核对当前任务"); return }
+            try {
+                val result = port.reset(taskId, fixedRequestId)
+                check(result.taskId == taskId && result.attemptNumber > priorAttempt)
+                expectedAttempt = result.attemptNumber.toLong()
+                busySince = null
+                emit(state.copy(message = "等待 CG-$taskId 本次执行与结果上传"))
+                if (isStopRequested()) fail("已请求停止重购")
+                return
+            } catch (error: Exception) {
+                if (!ambiguous && error is RepurchaseLocalBusy) {
+                    emit(state.copy(currentTaskId = null, message = "等待本地忙碌操作收尾"))
+                    if (busySince == null) busySince = now()
+                    return
+                }
+                if (!ambiguous && error is AgentApiException && error.status in 400..499 && error.code in BUSINESS_REFUSALS) {
+                    emit(state.copy(currentTaskId = null))
+                    skip(taskId, "当前业务资格拒绝：${error.code}")
+                    return
+                }
+                if (error is AgentApiException && error.status in 400..499) {
+                    if (!ambiguous) emit(state.copy(currentTaskId = null))
+                    fail(if (ambiguous) "重置响应不明确，请人工核对" else "设备、规则或身份校验失败")
+                    return
+                }
+                ambiguous = true
+            }
+        }
+        fail("重置响应仍不明确，已停止，请人工核对当前任务")
+    }
+
+    private fun observe(port: RepurchasePort, taskId: Long) {
+        if (expectedAttempt == 0L) return // Never treat an old failed result as this reset's outcome.
+        val detail = port.detail(taskId)
+        check(detail.task.taskId == taskId)
+        if (detail.attemptCount < expectedAttempt) return
+        if (detail.attemptCount > expectedAttempt) {
+            val evidence = port.executionEvidence(taskId)
+            var linkedAttempt = expectedAttempt
+            // Each extra attempt needs a completed probe/rematch and the original executor's
+            // Start evidence for the immediately following purchase attempt. A separate reset
+            // after failed/cancelled/success cannot satisfy this chain.
+            while (linkedAttempt < detail.attemptCount) {
+                val from = evidence.singleOrNull { it.attemptNumber == linkedAttempt }
+                val to = evidence.singleOrNull { it.attemptNumber == linkedAttempt + 1 }
+                if (from?.resultType !in setOf("spec_probe_completed", "spec_rematch_completed") ||
+                    to?.phase != "purchase" || from?.attemptId.isNullOrBlank() || to.attemptId.isBlank() || from?.attemptId == to.attemptId) {
+                    fail("同任务出现无法关联本轮的后续尝试，已停止，请人工核对")
+                    if (port.localIdle()) finish(state.message)
+                    return
+                }
+                linkedAttempt++
+            }
+            expectedAttempt = linkedAttempt
+        }
+        val status = detail.task.status
+        if (status == "order_result_unknown") {
+            fail("订单结果待核对，请人工检查，不能继续重购")
+            if (port.localIdle()) finish(state.message)
+            return
+        }
+        if (status !in TERMINAL) return
+        if (!port.localIdle()) return
+        val failed = status == "failed"
+        val result = when (status) {
+            "order_created" -> RepurchaseItemResult(taskId, RepurchaseResult.SUCCESS, "订单已创建")
+            "cancelled" -> RepurchaseItemResult(taskId, RepurchaseResult.SKIPPED, "本次任务已取消")
+            else -> RepurchaseItemResult(taskId, RepurchaseResult.FAILED, "再次失败：${detail.task.errorCode ?: "PURCHASE_FAILED"}")
+        }
+        position++
+        val stopping = state.phase == RepurchasePhase.STOPPING
+        emit(state.copy(currentTaskId = null, results = state.results + result))
+        if (failed && detail.task.errorCode in ENVIRONMENT_FAILURES) finish("登录、验证码、风控或设备环境异常，已停止后续重购")
+        else if (stopping || isStopRequested()) finish(state.message)
+        else if (position >= requireNotNull(state.batch).candidates.size) finish("本轮重购已结束；再次失败的任务不会在本轮重复执行")
+    }
+
+    private fun skip(taskId: Long, reason: String) {
+        position++
+        emit(state.copy(results = state.results + RepurchaseItemResult(taskId, RepurchaseResult.SKIPPED, reason)))
+        if (position >= requireNotNull(state.batch).candidates.size) finish("本轮重购已结束")
+    }
+    private fun finish(message: String) = emit(state.copy(phase = RepurchasePhase.FINISHED, message = message))
+    private fun emit(value: RepurchaseState) { state = value; publish(value) }
+
+    companion object {
+        const val TASK_TIMEOUT_MILLIS = 15 * 60 * 1000L
+        private const val DRAIN_TIMEOUT_MILLIS = 10_000L
+        private val TERMINAL = setOf("order_created", "failed", "cancelled")
+        private val BUSINESS_REFUSALS = setOf("PURCHASE_TASK_NOT_FOUND", "PURCHASE_RETRY_NOT_ALLOWED", "PURCHASE_RETRY_UNSAFE", "PURCHASE_RETRY_STALE", "PURCHASE_SPEC_MAPPING_REQUIRED")
+        private val ENVIRONMENT_FAILURES = setOf("PDD_LOGIN_REQUIRED", "PDD_CAPTCHA_REQUIRED", "PDD_RISK_CONTROL", "ACCESSIBILITY_NOT_READY", "DEVICE_OFFLINE", "AGENT_RESTARTED_DURING_EXECUTION")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/RepurchaseState.kt

@@ -0,0 +1,40 @@
+package cn.ilapage.goauto.agent.service
+
+enum class RepurchasePhase { IDLE, READING, READY, RUNNING, STOPPING, FINISHED }
+enum class RepurchaseResult { SUCCESS, FAILED, SKIPPED }
+data class RepurchaseItemResult(val taskId: Long, val result: RepurchaseResult, val message: String)
+
+/** Process-local presentation only; never persists or resumes a round after process death. */
+data class RepurchaseState(
+    val phase: RepurchasePhase = RepurchasePhase.IDLE,
+    val roundId: String = "",
+    val batch: RepurchaseBatch? = null,
+    val currentTaskId: Long? = null,
+    val results: List<RepurchaseItemResult> = emptyList(),
+    val message: String = "",
+) {
+    val busy get() = phase in setOf(RepurchasePhase.READING, RepurchasePhase.READY, RepurchasePhase.RUNNING, RepurchasePhase.STOPPING)
+    val successCount get() = results.count { it.result == RepurchaseResult.SUCCESS }
+    val failedCount get() = results.count { it.result == RepurchaseResult.FAILED }
+    val skippedCount get() = results.count { it.result == RepurchaseResult.SKIPPED }
+    fun confirmationText(): String = buildString {
+        append("本设备最后一批（近30天全部状态）\n")
+        append("${batch?.oldestCreatedAt.orEmpty()} ～ ${batch?.newestCreatedAt.orEmpty()}\n")
+        append("共 ${batch?.items?.size ?: 0} 条 · 失败 ${batch?.failures?.size ?: 0} 条\n")
+        append("可重购 ${batch?.candidates?.size ?: 0} 条 · 跳过 ${batch?.skips?.size ?: 0} 条\n\n")
+        append("相邻创建时间不超过60秒推算为同批，不受当前搜索和筛选影响。\n")
+        append("逐条复用原任务号重试，本轮再次失败不重复执行。单条等待上限15分钟，超时只停止后续编排。\n\n")
+        append("可能真实创建拼多多待付款订单，系统不会付款。停止重购不取消已经提交或正在执行的任务。")
+    }
+
+    fun summaryText(): String = buildString {
+        if (message.isNotBlank()) append(message).append('\n')
+        currentTaskId?.let { append("当前 CG-$it\n") }
+        append("成功 $successCount · 再次失败 $failedCount · 跳过 $skippedCount")
+        batch?.let {
+            val candidateIds = it.candidates.map { task -> task.taskId }.toSet()
+            val handled = results.count { result -> result.taskId in candidateIds }
+            append("\n本轮已结束 $handled / ${it.candidates.size} · 未结束 ${(it.candidates.size - handled).coerceAtLeast(0)}")
+        }
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/TaskHistoryFragment.kt

@@ -142,8 +142,19 @@ class TaskHistoryFragment : Fragment() {
     private val imageRequests = mutableListOf<HistoryImageRequest>()
     private var currentPageReceiverRegistered = false
     private var backfillPanel: LinearLayout? = null
+    private var repurchasePanel: LinearLayout? = null
+    private var repurchaseButton: MaterialButton? = null
+    private var repurchaseDialog: androidx.appcompat.app.AlertDialog? = null
+    private var repurchaseDialogRound: String? = null
     private val currentPageReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
+            if (intent?.action == AgentForegroundService.ACTION_REPURCHASE_STATE) {
+                renderRepurchase()
+                if (!collection && isResumed && AgentForegroundService.repurchaseState.phase == cn.ilapage.goauto.agent.service.RepurchasePhase.FINISHED) {
+                    detailState.taskId?.let(::loadPurchaseDetail) ?: load()
+                }
+                return
+            }
             if (intent?.action == AgentForegroundService.ACTION_BACKFILL_STATE) {
                 renderBackfill()
                 if (!collection && isResumed && !AgentForegroundService.backfillState.running) {
@@ -191,6 +202,9 @@ class TaskHistoryFragment : Fragment() {
         pageColumn.addView(context.screenTitle(if (collection) "采集记录" else "采购记录"))
         pageColumn.addView(buildSearch())
         if (!collection) {
+            repurchasePanel = context.column(0)
+            pageColumn.addView(repurchasePanel)
+            renderRepurchase()
             backfillPanel = context.column(0)
             pageColumn.addView(backfillPanel)
             renderBackfill()
@@ -214,12 +228,19 @@ class TaskHistoryFragment : Fragment() {
 
     override fun onResume() {
         super.onResume()
+        renderRepurchase()
         detailState.taskId?.let { taskId ->
             if (collection) loadCollectionDetail(taskId) else loadPurchaseDetail(taskId)
         } ?: load()
     }
 
     override fun onDestroyView() {
+        repurchaseDialog?.setOnDismissListener(null)
+        repurchaseDialog?.dismiss()
+        repurchaseDialog = null
+        repurchaseDialogRound = null
+        repurchasePanel = null
+        repurchaseButton = null
         backfillPanel = null
         requestGeneration++
         cancelImageRequests()
@@ -289,11 +310,16 @@ class TaskHistoryFragment : Fragment() {
                 }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
             } else {
                 row.addView(MaterialButton(context).apply {
-                    text = "回填"
+                    repurchaseButton = this
+                    text = "重购"
                     textSize = 14f
                     minimumHeight = context.dp(48)
-                    contentDescription = "回填拼多多订单号和下单时间"
-                    setOnClickListener { showBackfillInput() }
+                    contentDescription = "重试本设备最后一批失败采购"
+                    isEnabled = !AgentForegroundService.repurchaseState.busy
+                    setOnClickListener {
+                        isEnabled = false
+                        sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_PREPARE)
+                    }
                 }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
             }
             addView(row, row.fullWidth())
@@ -302,6 +328,61 @@ class TaskHistoryFragment : Fragment() {
         }
     }
 
+    private fun sendRepurchaseAction(action: String, roundId: String = AgentForegroundService.repurchaseState.roundId) {
+        val context = context ?: return
+        val intent = Intent(context, AgentForegroundService::class.java).setAction(action).putExtra("roundId", roundId)
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) context.startForegroundService(intent) else context.startService(intent)
+    }
+
+    private fun renderRepurchase() {
+        val panel = repurchasePanel ?: return
+        val context = context ?: return
+        val state = AgentForegroundService.repurchaseState
+        val phase = state.phase
+        repurchaseButton?.isEnabled = !state.busy
+        panel.removeAllViews()
+        if (phase != cn.ilapage.goauto.agent.service.RepurchasePhase.READY) {
+            repurchaseDialog?.setOnDismissListener(null)
+            repurchaseDialog?.dismiss()
+            repurchaseDialog = null
+            repurchaseDialogRound = null
+        }
+        if (phase == cn.ilapage.goauto.agent.service.RepurchasePhase.IDLE) return
+        panel.addView(context.card(context.cardColumn().apply {
+            addView(context.label(if (state.busy) "本轮重购" else "重购结果", 16f))
+            addView(context.label(state.summaryText(), 14f))
+            if (state.busy) addView(MaterialButton(context).apply {
+                text = if (phase == cn.ilapage.goauto.agent.service.RepurchasePhase.STOPPING) "正在收尾…" else "停止重购"
+                minimumHeight = context.dp(48)
+                isEnabled = phase != cn.ilapage.goauto.agent.service.RepurchasePhase.STOPPING
+                setOnClickListener {
+                    isEnabled = false
+                    sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_STOP, state.roundId)
+                }
+            })
+            if (state.results.isNotEmpty()) addView(MaterialButton(context).apply {
+                text = "查看逐条结果"
+                minimumHeight = context.dp(48)
+                setOnClickListener {
+                    MaterialAlertDialogBuilder(context).setTitle("本轮重购明细")
+                        .setMessage(state.results.joinToString("\n") { "CG-${it.taskId}：${it.message}" })
+                        .setPositiveButton("关闭", null).show()
+                }
+            })
+        }))
+        if (phase == cn.ilapage.goauto.agent.service.RepurchasePhase.READY && isResumed && repurchaseDialogRound != state.roundId) {
+            repurchaseDialogRound = state.roundId
+            repurchaseDialog = MaterialAlertDialogBuilder(context).setTitle("重购最后一批")
+                .setMessage(state.confirmationText())
+                .setNegativeButton("取消") { _, _ -> sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_STOP, state.roundId) }
+                .setPositiveButton("确认重购") { _, _ -> sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_CONFIRM, state.roundId) }
+                .create().also { dialog ->
+                    dialog.setOnCancelListener { sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_STOP, state.roundId) }
+                    dialog.show()
+                }
+        }
+    }
+
     private fun showBackfillInput() {
         if (AgentForegroundService.backfillState.running) {
             toast("设备忙碌，请稍后操作")
@@ -729,6 +810,7 @@ class TaskHistoryFragment : Fragment() {
         if (currentPageReceiverRegistered) return
         val filter = IntentFilter(AgentForegroundService.ACTION_CURRENT_PAGE_RESULT)
         filter.addAction(AgentForegroundService.ACTION_BACKFILL_STATE)
+        filter.addAction(AgentForegroundService.ACTION_REPURCHASE_STATE)
         if (Build.VERSION.SDK_INT >= 33) {
             requireContext().registerReceiver(currentPageReceiver, filter, Context.RECEIVER_NOT_EXPORTED)
         } else {

android/app/src/test/java/cn/ilapage/goauto/agent/AgentDiagnosticRecorderTest.kt

@@ -9,6 +9,27 @@ import org.junit.Assert.assertEquals
 import org.junit.Test
 
 class AgentDiagnosticRecorderTest {
+    @Test
+    fun colorDiscoveryOutcomeDefaultsToUnknownAndPreservesExplicitValues() {
+        val event = AgentDiagnosticEvent(
+            taskId = 370,
+            stage = AgentDiagnosticStage.COLOR_DISCOVERY,
+            reason = AgentDiagnosticReason.COLOR_EDGE_REACHED,
+        )
+        assertEquals(null, event.colorVerticalSwipeCount)
+        assertEquals(null, event.colorTrailingEmptyReadCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+        val completed = event.copy(
+            colorVerticalSwipeCount = 4,
+            colorTrailingEmptyReadCount = 2,
+            colorHorizontalIncomplete = false,
+        )
+        assertEquals(4, completed.colorVerticalSwipeCount)
+        assertEquals(2, completed.colorTrailingEmptyReadCount)
+        assertEquals(false, completed.colorHorizontalIncomplete)
+        assertEquals(true, completed.copy(colorHorizontalIncomplete = true).colorHorizontalIncomplete)
+    }
+
     @Test
     fun diagnosticsAreBoundedToFiftyRecordsAndSevenDays() {
         assertEquals(50, AgentDiagnosticRetentionPolicy.MAX_RECORDS)

android/app/src/test/java/cn/ilapage/goauto/agent/PddLaunchFallbackTest.kt

@@ -1,10 +1,43 @@
 package cn.ilapage.goauto.agent
 
 import cn.ilapage.goauto.agent.automation.PddLaunchFallback
+import cn.ilapage.goauto.agent.automation.PddLaunchEvent
+import cn.ilapage.goauto.agent.automation.PddLaunchPath
+import cn.ilapage.goauto.agent.automation.PddLaunchStatus
 import org.junit.Assert.*
 import org.junit.Test
 
 class PddLaunchFallbackTest {
+    @Test fun reportsDirectAcceptanceWithoutCallingBrowser() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertTrue(PddLaunchFallback.open(true, { true }, { error("unexpected") }, events::add))
+        assertEquals(listOf(PddLaunchEvent(PddLaunchPath.DIRECT, PddLaunchStatus.ACCEPTED)), events)
+    }
+    @Test fun reportsOnlyExceptionClassThenBrowserAcceptance() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertTrue(PddLaunchFallback.open(true, { throw SecurityException("secret URL and address") }, { true }, events::add))
+        assertEquals(listOf(
+            PddLaunchEvent(PddLaunchPath.DIRECT, PddLaunchStatus.EXCEPTION, "java.lang.SecurityException"),
+            PddLaunchEvent(PddLaunchPath.BROWSER, PddLaunchStatus.ACCEPTED),
+        ), events)
+        assertFalse(events.toString().contains("secret"))
+    }
+    @Test fun reportsFalseAndBrowserExceptionWithoutChangingResult() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertFalse(PddLaunchFallback.open(true, { false }, { throw IllegalStateException("private") }, events::add))
+        assertEquals(PddLaunchStatus.REJECTED, events[0].status)
+        assertEquals(PddLaunchStatus.EXCEPTION, events[1].status)
+    }
+    @Test fun diagnosticFailureDoesNotCauseBrowserFallbackOrChangeResult() {
+        var browserCalls = 0
+        assertTrue(PddLaunchFallback.open(true, { true }, { browserCalls++; true }, { error("storage failed") }))
+        assertEquals(0, browserCalls)
+    }
+    @Test fun browserOnlyReportsNoDirectAttempt() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertFalse(PddLaunchFallback.open(false, { error("unexpected") }, { false }, events::add))
+        assertEquals(listOf(PddLaunchEvent(PddLaunchPath.BROWSER, PddLaunchStatus.REJECTED)), events)
+    }
     @Test fun directSuccessDoesNotStartBrowser() {
         assertTrue(PddLaunchFallback.open(true, { true }, { error("browser must not start") }))
     }

android/app/src/test/java/cn/ilapage/goauto/agent/PddProductDetailCollectorTest.kt

@@ -1220,6 +1220,246 @@ class PddProductDetailCollectorTest {
         assertTrue(driver.swipes.any { it.first == SwipeDirection.UP })
     }
 
+    @Test
+    fun `color discovery counts only its own successful vertical swipes`() {
+        val colors = listOf("A色", "B色", "C色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(
+            colors = colors,
+            colorVerticalPages = listOf(colors.take(2), colors.takeLast(2)),
+            sizePages = listOf(listOf("S"), listOf("M"), listOf("L")),
+            rowSize = 1,
+            hideColorHeadingAfterFirstVerticalPage = true,
+        )
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule(config().copy(timeoutsMs = config().timeoutsMs + ("overall" to 30000))))
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(2, event.colorVerticalSwipeCount)
+        assertTrue(driver.swipes.count { it.first == SwipeDirection.UP } > requireNotNull(event.colorVerticalSwipeCount))
+        assertTrue(driver.swipes.any { it.first == SwipeDirection.DOWN })
+    }
+
+    @Test
+    fun `color discovery failed vertical dispatch is not counted`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(colors = listOf("A色", "B色"), rowSize = 1, verticalSwipeSucceeds = false)
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(AgentDiagnosticReason.COLOR_SWIPE_FAILED, event.reason)
+        assertEquals(0, event.colorVerticalSwipeCount)
+        assertEquals(0, event.colorTrailingEmptyReadCount)
+        assertEquals(false, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery counts empty parsed rounds after heading scrolls away without counting price reads`() {
+        val colors = listOf("A色", "B色", "C色", "D色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(
+            colors = colors,
+            colorVerticalPages = listOf(colors.take(2), colors.takeLast(2)),
+            rowSize = 1,
+            hideColorHeadingAfterFirstVerticalPage = true,
+            priceDelayReads = colors.associateWith { 2 },
+        )
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule(config().copy(timeoutsMs = config().timeoutsMs + ("overall" to 30000))))
+
+        assertTrue(result.successful)
+        // This fixture retains the options while their heading disappears. The
+        // existing parser/traversal still misses the second page in this stage.
+        assertEquals(colors.take(2), requireNotNull(result.payload).dimensions.first { it.key == "color" }.values)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(2, event.colorTrailingEmptyReadCount)
+        assertEquals(2, event.colorVerticalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery initially empty is one empty round with unknown horizontal state`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = emptyList()), { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(0, event.colorVerticalSwipeCount)
+        assertEquals(1, event.colorTrailingEmptyReadCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery resets trailing empty rounds after nonempty discovery`() {
+        val colors = listOf("A色", "B色", "C色", "D色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(
+            colors = colors,
+            colorVerticalPages = listOf(colors.take(2), emptyList(), colors.takeLast(2)),
+            rowSize = 1,
+        )
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule(config().copy(timeoutsMs = config().timeoutsMs + ("overall" to 30000))))
+
+        assertTrue(result.successful)
+        assertEquals(colors, requireNotNull(result.payload).dimensions.first { it.key == "color" }.values)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(3, event.colorVerticalSwipeCount)
+        assertEquals(0, event.colorTrailingEmptyReadCount)
+    }
+
+    @Test
+    fun `color discovery stable horizontal rows are complete`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = listOf("A色", "B色")), { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(false, event.colorHorizontalIncomplete)
+        assertEquals(0, event.colorTrailingEmptyReadCount)
+    }
+
+    @Test
+    fun `color discovery horizontal dispatch failure before movement stays unknown`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val base = FakeCollectorDriver(colors = listOf("A色", "B色"))
+        val driver = object : PddCollectorDriver by base {
+            override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean =
+                if (direction == SwipeDirection.LEFT) false else base.swipeSpec(direction, anchor)
+        }
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(0, event.horizontalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery successful horizontal dispatch alone does not prove required exploration`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+        val limited = config().copy(limits = config().limits + mapOf("specHorizontalSwipes" to 1, "stableEdgeReads" to 2))
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = listOf("A色", "B色")), { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule(limited))
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(1, event.horizontalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery observed horizontal movement then failure is incomplete`() {
+        val colors = listOf("A色", "B色", "C色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val base = FakeCollectorDriver(colors = colors, colorPages = listOf(colors.take(2), colors.takeLast(2)))
+        var leftSwipes = 0
+        val driver = object : PddCollectorDriver by base {
+            override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean {
+                if (direction == SwipeDirection.LEFT && leftSwipes++ > 0) return false
+                return base.swipeSpec(direction, anchor)
+            }
+        }
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        assertEquals(colors, requireNotNull(result.payload).dimensions.first { it.key == "color" }.values)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(1, event.horizontalSwipeCount)
+        assertEquals(true, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery uncertain revisit preserves proven incomplete horizontal row`() {
+        val colors = listOf("A色", "B色", "C色", "D色", "E色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val base = FakeCollectorDriver(
+            colors = colors,
+            colorPages = listOf(listOf("A色", "B色", "D色", "E色"), listOf("B色", "C色", "D色", "E色")),
+            rowSize = 2,
+            resetHorizontalPageOnVerticalSwipe = true,
+        )
+        var leftSwipes = 0
+        val driver = object : PddCollectorDriver by base {
+            override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean {
+                if (direction == SwipeDirection.LEFT && leftSwipes++ > 0) return false
+                return base.swipeSpec(direction, anchor)
+            }
+        }
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        assertTrue(requireNotNull(result.payload).dimensions.first { it.key == "color" }.values.contains("C色"))
+        assertTrue(leftSwipes > 2)
+        // The first A/B visit moves then fails; later A/B visits fail before
+        // movement. Unknown new evidence must not erase that unresolved work.
+        assertEquals(true, events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery observed horizontal movement at budget is incomplete`() {
+        val colors = listOf("A色", "B色", "C色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+        val limited = config().copy(limits = config().limits + ("specHorizontalSwipes" to 1))
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = colors, colorPages = listOf(colors.take(2), colors.takeLast(2))),
+            { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule(limited))
+
+        assertTrue(result.successful)
+        assertEquals(true, events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery disjoint horizontal reflow is unknown`() {
+        val colors = listOf("A色", "B色", "C色", "D色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = colors, colorPages = listOf(colors.take(2), colors.takeLast(2))),
+            { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(1, event.horizontalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
     @Test
     fun `color discovery records only bounded aggregate evidence`() {
         val colors = listOf("A色", "B色", "C色", "D色")
@@ -1857,6 +2097,7 @@ class PddProductDetailCollectorTest {
         sizes: List<String> = listOf("S"),
         private val colorPages: List<List<String>> = listOf(colors),
         private val colorVerticalPages: List<List<String>>? = null,
+        private val resetHorizontalPageOnVerticalSwipe: Boolean = false,
         private val sizePages: List<List<String>> = listOf(sizes),
         private val prices: Map<String, Long> = colors.associateWith { 1000L },
         private val failedClicks: Set<String> = emptySet(),
@@ -1867,6 +2108,7 @@ class PddProductDetailCollectorTest {
         private val rowSize: Int = 4,
         private val hideSelectedColorOption: Boolean = false,
         private val hideDimensionHeadingsAfterFirstVerticalPage: Boolean = false,
+        private val hideColorHeadingAfterFirstVerticalPage: Boolean = false,
         private val soldOutUntilPulls: Int = 0,
         private val startWithPanelClosed: Boolean = false,
         private val firstEntryOpensReview: Boolean = false,
@@ -1986,7 +2228,7 @@ class PddProductDetailCollectorTest {
                 ?: colorPages[horizontalPage.coerceAtMost(colorPages.lastIndex)]
             val colorRowCount = (visibleColors.size + rowSize - 1) / rowSize
             val sizeHeadingTop = maxOf(700, 470 + colorRowCount * 90 + 20)
-            if (!continuationPage && !panelCollapsedNow) {
+            if (!continuationPage && !panelCollapsedNow && !(hideColorHeadingAfterFirstVerticalPage && verticalPage > 0)) {
                 nodes += node("scroll/color-heading", "颜色分类", 20, 400, 300, 450, parentPath = "scroll")
             }
             if (!continuationPage && !hideColorNow && !panelCollapsedNow) {
@@ -2118,8 +2360,11 @@ class PddProductDetailCollectorTest {
             if ((direction == SwipeDirection.UP || direction == SwipeDirection.DOWN) && !verticalSwipeSucceeds) return false
             when (direction) {
                 SwipeDirection.LEFT -> horizontalPage = (horizontalPage + 1).coerceAtMost(colorPages.lastIndex)
-                SwipeDirection.UP -> verticalPage = (verticalPage + 1)
-                    .coerceAtMost(maxOf(sizePages.lastIndex, colorVerticalPages?.lastIndex ?: 0))
+                SwipeDirection.UP -> {
+                    verticalPage = (verticalPage + 1)
+                        .coerceAtMost(maxOf(sizePages.lastIndex, colorVerticalPages?.lastIndex ?: 0))
+                    if (resetHorizontalPageOnVerticalSwipe) horizontalPage = 0
+                }
                 SwipeDirection.DOWN -> {
                     verticalPage = (verticalPage - 1).coerceAtLeast(0)
                     downSwipeCount++

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseLiveAutomationTest.kt

@@ -18,6 +18,354 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PurchaseLiveAutomationTest {
+    @Test
+    fun `hint delayed address update preserves fresh payment back budget for late order evidence`() {
+        val observationDriver = OrderObservationDriver { sample ->
+            observationPage(when {
+                sample == 1 -> "payment"
+                sample < 140 -> "loading"
+                else -> "complete"
+            })
+        }.apply { backDuration = 4_000 }
+        lateinit var addressDriver: LiveDriver
+        addressDriver = LiveDriver(initialEditFrame = { snapshot, sample ->
+            assertEquals(0, addressDriver.inputCount)
+            assertFalse(addressDriver.clicked.contains("保存"))
+            if (sample <= 4) observationDriver.elapsed += 10_000
+            snapshot.changeAddressEditor {
+                it.copy(
+                    text = if (sample <= 4) "合成提示占位标记" else "合成测试区域示例路段1号-old",
+                    hintText = "合成提示占位标记",
+                    showingHintText = sample <= 4,
+                )
+            }
+        })
+        var observingOrder = false
+        val driver = object : PurchaseUiDriver by addressDriver {
+            override fun capture(): UiSnapshot =
+                if (observingOrder) observationDriver.capture() else addressDriver.capture()
+            override fun backPurchase(): Boolean =
+                if (observingOrder) observationDriver.backPurchase() else addressDriver.backPurchase()
+            override fun clickFresh(target: SnapshotNode): FreshActionResult =
+                if (observingOrder) observationDriver.clickFresh(target) else addressDriver.clickFresh(target)
+            override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean =
+                if (observingOrder) observationDriver.swipePurchase(direction, durationMs)
+                else addressDriver.swipePurchase(direction, durationMs)
+            override fun bringPddToForeground(): Boolean =
+                if (observingOrder) observationDriver.bringPddToForeground() else addressDriver.bringPddToForeground()
+        }
+        val automation = PurchaseLiveAutomation(
+            driver,
+            pause = { observationDriver.elapsed += it },
+            monotonicClockMs = { observationDriver.elapsed },
+        )
+
+        val address = automation.updateShippingAddress("_cg366")
+        assertEquals(5, addressDriver.initialEditCaptures)
+        assertEquals("合成测试区域示例路段1号-old", addressDriver.lastInputTarget?.text)
+        assertTrue(address.expectedAddress.endsWith("_cg366"))
+        assertFalse(address.expectedAddress.contains("合成提示占位标记"))
+        assertAddressEditorActions(addressDriver, saved = true)
+        assertTrue(observationDriver.elapsed > 40_000)
+        assertEquals("_cg366", automation.finalConfirmation(input().copy(addressSuffix = "_cg366"), address).addressSuffix)
+        automation.submitOrderOnce()
+        val clicksBeforeObservation = addressDriver.clicked.toList()
+        observingOrder = true
+
+        val order = automation.readOrderResult()
+
+        assertEquals("PDD-DEMO-365", order?.orderNo)
+        assertEquals("2026-10-08T03:21:43Z", order?.submittedAt)
+        assertEquals(140, observationDriver.captures)
+        val elapsedAfterBack = observationDriver.elapsed - observationDriver.backCompletedAt!!
+        assertTrue(elapsedAfterBack in 28_000L until 30_000L)
+        assertTrue(elapsedAfterBack + observationDriver.backDuration > 30_000)
+        assertObservationActions(observationDriver, backs = 1)
+        assertEquals(1, addressDriver.inputCount)
+        assertEquals(1, addressDriver.clicked.count { it == "保存" })
+        assertEquals(1, addressDriver.submitClicks)
+        assertEquals(clicksBeforeObservation, addressDriver.clicked)
+        assertEquals(0, addressDriver.genericSwipes + addressDriver.scopedSwipes)
+        assertFalse(addressDriver.clicked.any { it.contains("支付") })
+    }
+
+    @Test
+    fun `payment back observes late complete order beyond original sample budget`() {
+        val driver = OrderObservationDriver { sample ->
+            when {
+                sample == 1 -> observationPage("payment")
+                sample < 100 -> observationPage("loading")
+                else -> observationPage("complete")
+            }
+        }
+        val order = observationAutomation(driver).readOrderResult()
+
+        assertEquals("PDD-DEMO-365", order?.orderNo)
+        assertEquals(100, driver.captures)
+        assertEquals(1, driver.backs)
+        assertEquals(0, driver.swipes)
+        assertEquals(0, driver.clicks)
+        assertEquals(0, driver.foregroundRequests)
+    }
+
+    @Test
+    fun `deadline starts at late successful back and never resets on incomplete evidence or jitter`() {
+        val driver = OrderObservationDriver { sample ->
+            observationPage(when {
+                sample < 58 -> "loading"
+                sample == 58 -> "payment"
+                sample > 60 && sample % 3 == 0 -> "incomplete"
+                else -> "loading"
+            })
+        }.apply { backDuration = 4_000; captureDuration = 25 }
+        val automation = observationAutomation(driver, pauseOverhead = 17)
+
+        assertEquals(null, automation.readOrderResult())
+        assertTrue(driver.captures > 100)
+        assertEquals(driver.backCompletedAt!! + 30_000 + 17, driver.elapsed)
+        assertTrue(automation.lastOrderReadFailure!!.paymentPageObserved)
+        assertObservationActions(driver, backs = 1)
+    }
+
+    @Test
+    fun `capture that crosses deadline cannot accept late complete evidence or trigger unpaid scroll`() {
+        for (latePage in listOf("complete", "unpaid", "entry", "chooser", "wechat")) {
+            lateinit var driver: OrderObservationDriver
+            driver = OrderObservationDriver { sample ->
+                if (sample == 1) {
+                    driver.captureDuration = 30_000
+                    observationPage("payment")
+                } else observationPage(latePage)
+            }
+            val automation = observationAutomation(driver)
+
+            assertEquals(null, automation.readOrderResult())
+            assertEquals(2, driver.captures)
+            assertEquals(30_500L, driver.elapsed)
+            assertObservationActions(driver, backs = 1)
+        }
+    }
+
+    @Test
+    fun `slow captures exhaust fixed observation deadline before original sixty samples`() {
+        val driver = OrderObservationDriver { sample -> observationPage(if (sample == 1) "payment" else "loading") }
+            .apply { captureDuration = 1_000 }
+        val automation = observationAutomation(driver)
+
+        assertEquals(null, automation.readOrderResult())
+        assertTrue(driver.captures < 60)
+        assertTrue(driver.elapsed >= driver.backCompletedAt!! + 30_000)
+        assertTrue(driver.elapsed < driver.backCompletedAt!! + 31_000)
+        assertObservationActions(driver, backs = 1)
+    }
+
+    @Test
+    fun `incomplete context first appearing during extension stays passive until late time arrives`() {
+        val driver = OrderObservationDriver { sample -> observationPage(when {
+            sample == 1 -> "payment"
+            sample < 80 -> "loading"
+            sample < 100 -> "incomplete"
+            else -> "complete"
+        }) }
+
+        assertEquals("PDD-DEMO-365", observationAutomation(driver).readOrderResult()?.orderNo)
+        assertEquals(100, driver.captures)
+        assertObservationActions(driver, backs = 1)
+    }
+
+    @Test
+    fun `late detail entry chooser and WeChat cannot add navigation during extension`() {
+        for (latePage in listOf("entry", "chooser", "wechat")) {
+            val driver = OrderObservationDriver { sample -> observationPage(when {
+                sample == 1 -> "payment"
+                sample <= 60 -> "loading"
+                else -> latePage
+            }) }
+            val automation = observationAutomation(driver)
+            assertEquals(null, automation.readOrderResult())
+            assertEquals("PURCHASE_ORDER_CONTEXT_NOT_FOUND", automation.lastOrderReadFailure?.code)
+            assertTrue(driver.captures > 60)
+            assertObservationActions(driver, backs = 1)
+        }
+    }
+
+    @Test
+    fun `previous chooser and WeChat recovery retain repeat failures during extension`() {
+        for (kind in listOf("chooser", "wechat")) {
+            val driver = OrderObservationDriver { sample -> observationPage(when {
+                sample == 1 || sample > 60 -> kind
+                sample == 2 -> "payment"
+                else -> "loading"
+            }) }
+            val automation = observationAutomation(driver)
+            assertEquals(null, automation.readOrderResult())
+            assertEquals(
+                if (kind == "chooser") "PURCHASE_ORDER_CHOOSER_BACK_FAILED" else "PURCHASE_ORDER_WECHAT_RESTORE_TIMEOUT",
+                automation.lastOrderReadFailure?.code,
+            )
+            assertEquals(61, driver.captures)
+            assertEquals(if (kind == "chooser") 2 else 1, driver.backs)
+            assertEquals(if (kind == "wechat") 1 else 0, driver.foregroundRequests)
+            assertEquals(0, driver.swipes)
+            assertEquals(0, driver.clicks)
+        }
+    }
+
+    @Test
+    fun `late unpaid context retains its independent thirty samples and four swipes`() {
+        val driver = OrderObservationDriver { sample -> observationPage(when {
+            sample == 1 -> "payment"
+            sample < 140 -> "loading"
+            else -> "unpaid"
+        }) }
+        val automation = observationAutomation(driver)
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals(169, driver.captures)
+        assertTrue(driver.elapsed > 30_000)
+        assertObservationActions(driver, backs = 1, swipes = 4)
+    }
+
+    @Test
+    fun `unpaid markers alone never activate payment back extension`() {
+        val driver = OrderObservationDriver { observationPage("unpaid") }
+        val automation = observationAutomation(driver)
+
+        assertEquals(null, automation.readOrderResult())
+        assertEquals(30, driver.captures)
+        assertTrue(automation.lastOrderReadFailure!!.paymentPageObserved)
+        assertObservationActions(driver, swipes = 4)
+    }
+
+    @Test
+    fun `missing payment back retains original sixty samples and existing context scroll budget`() {
+        for (kind in listOf("loading", "incomplete")) {
+            val driver = OrderObservationDriver { observationPage(kind) }
+            assertEquals(null, observationAutomation(driver).readOrderResult())
+            assertEquals(60, driver.captures)
+            assertObservationActions(driver, swipes = if (kind == "incomplete") 3 else 0)
+        }
+    }
+
+    @Test
+    fun `order context within original budget retains original sampling and gestures after back`() {
+        val driver = OrderObservationDriver { sample -> observationPage(if (sample == 1) "payment" else "incomplete") }
+        assertEquals(null, observationAutomation(driver).readOrderResult())
+        assertEquals(60, driver.captures)
+        assertObservationActions(driver, backs = 1, swipes = 3)
+    }
+
+    @Test
+    fun `failed payment back stops immediately without activating observation`() {
+        val driver = OrderObservationDriver { observationPage("payment") }.apply { backSucceeds = false }
+        val automation = observationAutomation(driver)
+        assertEquals(null, automation.readOrderResult())
+        assertEquals("PURCHASE_ORDER_PAYMENT_BACK_FAILED", automation.lastOrderReadFailure?.code)
+        assertEquals(1, driver.captures)
+        assertEquals(0L, driver.elapsed)
+        assertObservationActions(driver, backs = 1)
+    }
+
+    @Test
+    fun `extension preserves repeated payment empty and unexpected app early failures`() {
+        for ((kind, code, expectedCaptures) in listOf(
+            Triple("payment", "PURCHASE_ORDER_PAYMENT_REPEATED", 85),
+            Triple("empty", "PURCHASE_ORDER_EMPTY_TIMEOUT", 75),
+            Triple("unexpected", "PURCHASE_ORDER_UNEXPECTED_APP", 61),
+        )) {
+            val driver = OrderObservationDriver { sample -> observationPage(when {
+                sample == 1 -> "payment"
+                sample <= 60 -> "loading"
+                else -> kind
+            }) }
+            val automation = observationAutomation(driver)
+            assertEquals(null, automation.readOrderResult())
+            assertEquals(code, automation.lastOrderReadFailure?.code)
+            assertEquals(expectedCaptures, driver.captures)
+            assertObservationActions(driver, backs = 1)
+        }
+    }
+
+    private fun observationAutomation(driver: OrderObservationDriver, pauseOverhead: Long = 0) = PurchaseLiveAutomation(
+        driver,
+        pause = { driver.elapsed += it + pauseOverhead },
+        monotonicClockMs = { driver.elapsed },
+    )
+
+    private fun assertObservationActions(driver: OrderObservationDriver, backs: Int = 0, swipes: Int = 0) {
+        assertEquals(backs, driver.backs)
+        assertEquals(swipes, driver.swipes)
+        assertEquals(0, driver.clicks)
+        assertEquals(0, driver.foregroundRequests)
+    }
+
+    private class OrderObservationDriver(
+        val frame: (Int) -> UiSnapshot,
+    ) : PurchaseUiDriver by LiveDriver() {
+        var elapsed = 0L
+        var captures = 0
+        var backs = 0
+        var swipes = 0
+        var clicks = 0
+        var foregroundRequests = 0
+        var captureDuration = 0L
+        var backDuration = 0L
+        var backCompletedAt: Long? = null
+        var backSucceeds = true
+        override fun capture(): UiSnapshot {
+            elapsed += captureDuration
+            return frame(++captures)
+        }
+        override fun backPurchase(): Boolean {
+            backs++
+            elapsed += backDuration
+            if (backSucceeds) backCompletedAt = elapsed
+            return backSucceeds
+        }
+        override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean {
+            swipes++
+            return true
+        }
+        override fun clickFresh(target: SnapshotNode): FreshActionResult {
+            clicks++
+            return FreshActionResult.SUCCESS
+        }
+        override fun bringPddToForeground(): Boolean {
+            foregroundRequests++
+            return true
+        }
+    }
+
+    private fun observationPage(kind: String): UiSnapshot {
+        val labels = when (kind) {
+            "payment" -> listOf("立即支付")
+            "complete" -> listOf("订单号：PDD-DEMO-365", "下单时间：2026-10-08 11:21:43", "立即支付")
+            "incomplete" -> listOf("订单号：PDD-DEMO-365", "立即支付")
+            "unpaid" -> listOf("待付款")
+            "entry" -> listOf("查看订单")
+            "chooser" -> listOf("选择要使用的应用", "微信")
+            else -> emptyList()
+        }
+        return UiSnapshot(
+            when (kind) {
+                "empty" -> null
+                "wechat" -> "com.tencent.mm"
+                "unexpected" -> "com.example.unexpected"
+                "chooser" -> "android"
+                else -> PDD
+            },
+            when (kind) {
+                "payment" -> "com.xunmeng.pinduoduo.app_pay.core.PayActivity"
+                "chooser" -> "com.android.internal.app.ChooserActivity"
+                else -> ACTIVITY
+            },
+            labels.map { text ->
+                SnapshotNode(text, null, text, null, null, "android.widget.TextView",
+                    NodeBounds(0, 100, 500, 180), true, false, false, false, true, true)
+            },
+        )
+    }
+
     @Test
     fun `two second payment transition and two needed scrolls yield order and payable amount without clicks`() {
         val driver = ReadOnlyOrderDriver(paymentMs = 2500)
@@ -219,6 +567,338 @@ class PurchaseLiveAutomationTest {
         assertFalse(driver.clicked.any { it.contains("支付") })
     }
 
+    @Test
+    fun `address editor waits for an input arriving after its title`() {
+        assertDelayedAddressEditor { snapshot, sample ->
+            if (sample <= 4) snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == "editor-address" }) else snapshot
+        }
+    }
+
+    @Test
+    fun `address editor waits for a populated value`() {
+        assertDelayedAddressEditor { snapshot, sample ->
+            snapshot.changeAddressEditor { if (sample <= 4) it.copy(text = "   ") else it }
+        }
+    }
+
+    @Test
+    fun `address editor description cannot substitute for empty text`() {
+        for (text in listOf(null, "", "   ")) {
+            assertAddressEditorTimeout("editor_empty", 1, 0) { snapshot, _ ->
+                snapshot.changeAddressEditor { it.copy(text = text, contentDescription = "合成说明占位标记") }
+            }
+        }
+    }
+
+    @Test
+    fun `address editor waits until hint is replaced by real text`() {
+        assertDelayedAddressEditor { snapshot, sample ->
+            snapshot.changeAddressEditor {
+                it.copy(
+                    text = if (sample <= 4) "合成提示占位标记" else it.text,
+                    hintText = "合成提示占位标记",
+                    showingHintText = sample <= 4,
+                )
+            }
+        }
+    }
+
+    @Test
+    fun `address editor persistent hint text fails after the full budget`() {
+        assertAddressEditorTimeout("editor_hint", 1, 0) { snapshot, _ ->
+            snapshot.changeAddressEditor {
+                it.copy(text = "合成提示占位标记", hintText = "合成提示占位标记", showingHintText = true)
+            }
+        }
+    }
+
+    @Test
+    fun `address editor rejects text equal to trimmed hint despite false or absent showing flag`() {
+        for (showing in listOf(false, null)) {
+            assertAddressEditorTimeout("editor_hint", 1, 0) { snapshot, _ ->
+                snapshot.changeAddressEditor {
+                    it.copy(text = " 合成提示占位标记 ", hintText = "  合成提示占位标记  ", showingHintText = showing)
+                }
+            }
+        }
+    }
+
+    @Test
+    fun `address editor showing hint flag blocks nonmatching or missing hint text`() {
+        for (hint in listOf(null, "", "合成提示占位标记")) {
+            assertAddressEditorTimeout("editor_hint", 1, 0) { snapshot, _ ->
+                snapshot.changeAddressEditor { it.copy(hintText = hint, showingHintText = true) }
+            }
+        }
+    }
+
+    @Test
+    fun `address editor empty text remains empty even when hint and description are present`() {
+        assertAddressEditorTimeout("editor_empty", 1, 0) { snapshot, _ ->
+            snapshot.changeAddressEditor {
+                it.copy(text = " ", contentDescription = "合成说明占位标记", hintText = "合成提示占位标记", showingHintText = true)
+            }
+        }
+    }
+
+    @Test
+    fun `address editor missing hint metadata remains compatible and uses actual text`() {
+        val driver = LiveDriver(initialEditFrame = { snapshot, _ ->
+            snapshot.changeAddressEditor {
+                assertEquals(null, it.hintText)
+                assertEquals(null, it.showingHintText)
+                it.copy(text = "  合成真实地址-old  ", contentDescription = "合成说明占位标记")
+            }
+        })
+
+        val proof = PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg366")
+
+        assertEquals("合成真实地址_cg366", proof.expectedAddress)
+        assertEquals(1, driver.initialEditCaptures)
+        assertTrue(driver.lastInputTarget === driver.lastInitialEditSnapshot?.nodes?.single { it.path == "editor-address" })
+        assertAddressEditorActions(driver, saved = true)
+    }
+
+    @Test
+    fun `address editor accepts actual text with absent false or blank hint metadata`() {
+        for (showing in listOf(null, false)) {
+            for (hint in listOf(null, "", "   ", "合成提示占位标记")) {
+                val driver = LiveDriver(initialEditFrame = { snapshot, _ ->
+                    snapshot.changeAddressEditor { it.copy(hintText = hint, showingHintText = showing) }
+                })
+
+                val proof = PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg366")
+
+                assertTrue(proof.expectedAddress.endsWith("_cg366"))
+                assertEquals(1, driver.initialEditCaptures)
+                assertAddressEditorActions(driver, saved = true)
+            }
+        }
+    }
+
+    @Test
+    fun `address editor waits for an enabled input`() {
+        assertDelayedAddressEditor { snapshot, sample ->
+            snapshot.changeAddressEditor { if (sample <= 4) it.copy(enabled = false) else it }
+        }
+    }
+
+    @Test
+    fun `address editor tolerates more than three ambiguous frames before unique readiness`() {
+        assertDelayedAddressEditor { snapshot, sample ->
+            if (sample <= 4) snapshot.withSecondAddressEditor() else snapshot
+        }
+    }
+
+    @Test
+    fun `address editor uses the value and node from the successful readiness frame`() {
+        val driver = LiveDriver(initialEditFrame = { snapshot, sample ->
+            snapshot.changeAddressEditor { it.copy(text = if (sample == 1) "" else "合成地址第${sample}帧-old") }
+        })
+
+        val proof = PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg366")
+
+        assertEquals("合成地址第2帧_cg366", proof.expectedAddress)
+        assertEquals(2, driver.initialEditCaptures)
+        assertTrue(driver.lastInputTarget === driver.lastInitialEditSnapshot?.nodes?.single { it.path == "editor-address" })
+        assertAddressEditorActions(driver, saved = true)
+    }
+
+    @Test
+    fun `address editor structural ambiguity waits full budget even with only one ready input`() {
+        for (second in listOf<(SnapshotNode) -> SnapshotNode>(
+            { it.copy(text = "") }, { it.copy(enabled = false) },
+        )) {
+            assertAddressEditorTimeout("editor_ambiguous", structural = 2, ready = 1) { snapshot, _ ->
+                snapshot.withSecondAddressEditor(second)
+            }
+        }
+    }
+
+    @Test
+    fun `address editor final zero inputs reports scalar missing reason`() {
+        assertAddressEditorTimeout("editor_missing", 0, 0) { snapshot, _ ->
+            snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == "editor-address" })
+        }
+    }
+
+    @Test
+    fun `address editor final empty input reports scalar empty reason`() {
+        assertAddressEditorTimeout("editor_empty", 1, 0) { snapshot, _ ->
+            snapshot.changeAddressEditor { it.copy(text = "   ") }
+        }
+    }
+
+    @Test
+    fun `address editor final disabled input reports scalar disabled reason`() {
+        assertAddressEditorTimeout("editor_disabled", 1, 0) { snapshot, _ ->
+            snapshot.changeAddressEditor { it.copy(enabled = false) }
+        }
+    }
+
+    @Test
+    fun `address editor final multiple inputs reports scalar ambiguity reason`() {
+        assertAddressEditorTimeout("editor_ambiguous", 2, 2) { snapshot, _ -> snapshot.withSecondAddressEditor() }
+    }
+
+    @Test
+    fun `address editor never seeing a title keeps edit timeout and one shared budget`() {
+        assertAddressEditorTimeout("title_missing", 0, 0, titleSeen = false) { snapshot, _ ->
+            snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == "detail" })
+        }
+    }
+
+    @Test
+    fun `address editor remembers a title even when the final snapshot is empty`() {
+        assertAddressEditorTimeout("editor_missing", 0, 0) { snapshot, sample ->
+            if (sample == 1) snapshot.copy(nodes = snapshot.nodes.filterNot { it.path == "editor-address" })
+            else snapshot.copy(nodes = emptyList())
+        }
+    }
+
+    @Test
+    fun `address editor late title does not start a second wait budget`() {
+        assertAddressEditorTimeout("editor_empty", 1, 0) { snapshot, sample ->
+            val emptyEditor = snapshot.changeAddressEditor { it.copy(text = "") }
+            if (sample < 50) emptyEditor.copy(nodes = emptyEditor.nodes.filterNot { it.path == "detail" }) else emptyEditor
+        }
+    }
+
+    @Test
+    fun `address editor can become ready on the final sample of its shared budget`() {
+        val driver = LiveDriver(initialEditFrame = { snapshot, sample ->
+            if (sample < 50) snapshot.copy(nodes = emptyList()) else snapshot
+        })
+        val editPauses = mutableListOf<Long>()
+
+        PurchaseLiveAutomation(driver, pause = {
+            if (driver.currentPage == "edit" && driver.inputCount == 0) editPauses += it
+        }).updateShippingAddress("_cg366")
+
+        assertEquals(50, driver.initialEditCaptures)
+        assertEquals(listOf(500L) + List(49) { 200L }, editPauses)
+        assertAddressEditorActions(driver, saved = true)
+    }
+
+    @Test
+    fun `address editor excludes recipient phone invisible and leftward inputs and deduplicates paths`() {
+        val driver = LiveDriver(initialEditFrame = { snapshot, _ ->
+            val editor = snapshot.nodes.single { it.path == "editor-address" }
+            snapshot.copy(nodes = snapshot.nodes + listOf(
+                editor,
+                editor.copy(path = "hidden-input", visible = false),
+                editor.copy(path = "left-input", bounds = NodeBounds(0, 390, 10, 480)),
+            ))
+        })
+
+        PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg366")
+
+        assertEquals(1, driver.initialEditCaptures)
+        assertEquals("editor-address", driver.lastInputTargetPath)
+        assertAddressEditorActions(driver, saved = true)
+    }
+
+    @Test
+    fun `address editor small screen row overlap remains ambiguous`() {
+        assertAddressEditorTimeout("editor_ambiguous", 2, 2) { snapshot, _ ->
+            snapshot.copy(nodes = snapshot.nodes.map {
+                if (it.path == "editor-phone") it.copy(bounds = NodeBounds(180, 360, 900, 410)) else it
+            })
+        }
+    }
+
+    @Test
+    fun `address editor fresh input failures never retry or save`() {
+        for (result in FreshActionResult.values().filter { it != FreshActionResult.SUCCESS }) {
+            val driver = LiveDriver(inputResult = result)
+
+            val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg366") }
+                .exceptionOrNull() as PurchaseLiveException
+
+            assertEquals("PURCHASE_ADDRESS_UPDATE_FAILED", error.code)
+            assertEquals(1, driver.inputCount)
+            assertEquals(1, driver.initialEditCaptures)
+            assertEquals(listOf("138****5678", "修改"), driver.clicked)
+            assertEquals(0, driver.backCount)
+            assertEquals(0, driver.scopedSwipes + driver.genericSwipes + driver.submitClicks)
+        }
+    }
+
+    @Test
+    fun `address editor page safety problem interrupts readiness without input`() {
+        val driver = LiveDriver(initialEditFrame = { snapshot, sample ->
+            if (sample == 1) snapshot.changeAddressEditor { it.copy(text = "") }
+            else snapshot.copy(nodes = snapshot.nodes.map { if (it.path == "title") it.copy(text = "立即支付") else it })
+        })
+
+        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg366") }
+            .exceptionOrNull() as PurchaseLiveException
+
+        assertEquals("PURCHASE_PAYMENT_FORBIDDEN", error.code)
+        assertEquals(2, driver.initialEditCaptures)
+        assertAddressEditorActions(driver, saved = false)
+    }
+
+    private fun assertDelayedAddressEditor(frame: (UiSnapshot, Int) -> UiSnapshot) {
+        val driver = LiveDriver(initialEditFrame = frame)
+        val editPauses = mutableListOf<Long>()
+        val automation = PurchaseLiveAutomation(driver, pause = {
+            if (driver.currentPage == "edit" && driver.inputCount == 0) editPauses += it
+        })
+
+        val proof = automation.updateShippingAddress("_cg366")
+
+        assertTrue(proof.expectedAddress.endsWith("_cg366"))
+        assertEquals(5, driver.initialEditCaptures)
+        assertEquals(listOf(500L, 200L, 200L, 200L, 200L), editPauses)
+        assertEquals("editor-address", driver.lastInputTargetPath)
+        assertAddressEditorActions(driver, saved = true)
+    }
+
+    private fun assertAddressEditorTimeout(
+        reason: String,
+        structural: Int,
+        ready: Int,
+        titleSeen: Boolean = true,
+        frame: (UiSnapshot, Int) -> UiSnapshot,
+    ) {
+        val driver = LiveDriver(initialEditFrame = frame)
+        val diagnostics = mutableListOf<String>()
+        val editPauses = mutableListOf<Long>()
+        val automation = PurchaseLiveAutomation(driver, pause = {
+            if (driver.currentPage == "edit" && driver.inputCount == 0) editPauses += it
+        }, panelDiagnostic = diagnostics::add)
+
+        val failure = runCatching { automation.updateShippingAddress("_cg366") }.exceptionOrNull()
+        assertTrue("Readiness must fail without changing the address", failure is PurchaseLiveException)
+        val error = failure as PurchaseLiveException
+
+        assertEquals(if (titleSeen) "PURCHASE_ADDRESS_UPDATE_FAILED" else "PURCHASE_ADDRESS_EDIT_TIMEOUT", error.code)
+        val diagnostic = "stage=address_editor_ready;reason=$reason;titleSeen=$titleSeen;structural=$structural;ready=$ready"
+        assertTrue(error.message.orEmpty(), error.message.orEmpty().endsWith("[$diagnostic]"))
+        assertEquals(50, driver.initialEditCaptures)
+        assertEquals(listOf(500L) + List(50) { 200L }, editPauses)
+        val emitted = error.message.orEmpty() + diagnostics.joinToString()
+        listOf("广东", "骏景", "测试收货人", "13800000000", "editor-address", "_cg366", "合成提示占位标记", "合成说明占位标记").forEach {
+            assertFalse("Sensitive fixture value in readiness diagnostics", emitted.contains(it))
+        }
+        assertAddressEditorActions(driver, saved = false)
+    }
+
+    private fun assertAddressEditorActions(driver: LiveDriver, saved: Boolean) {
+        assertEquals(if (saved) 1 else 0, driver.inputCount)
+        assertEquals(listOf("138****5678", "修改") + if (saved) listOf("保存") else emptyList(), driver.clicked)
+        assertEquals(if (saved) 1 else 0, driver.backCount)
+        assertEquals(1, driver.addressPathClicks)
+        assertEquals(0, driver.addressTaps + driver.genericSwipes + driver.scopedSwipes + driver.submitClicks)
+    }
+
+    private fun UiSnapshot.changeAddressEditor(change: (SnapshotNode) -> SnapshotNode): UiSnapshot =
+        copy(nodes = nodes.map { if (it.path == "editor-address") change(it) else it })
+
+    private fun UiSnapshot.withSecondAddressEditor(change: (SnapshotNode) -> SnapshotNode = { it }): UiSnapshot =
+        copy(nodes = nodes + change(nodes.single { it.path == "editor-address" }.copy(path = "editor-address-2")))
+
     @Test
     fun `split confirmation address keeps the unique saved task suffix proof`() {
         val driver = LiveDriver(splitConfirmationAddress = true)
@@ -788,6 +1468,8 @@ class PurchaseLiveAutomationTest {
         private val orderDetailEntryAfterSubmit: Boolean = false,
         private val orderDetailEvidenceBelowFold: Boolean = false,
         private val duplicateOrderDetailEntry: Boolean = false,
+        private val initialEditFrame: (UiSnapshot, Int) -> UiSnapshot = { snapshot, _ -> snapshot },
+        private val inputResult: FreshActionResult = FreshActionResult.SUCCESS,
         postSubmitCaptureSequence: List<String> = emptyList(),
     ) : PurchaseUiDriver {
         private var page = "confirmation"
@@ -802,6 +1484,10 @@ class PurchaseLiveAutomationTest {
         var addressTaps = 0
         var addressPathClicks = 0
         var lastInputTargetPath: String? = null
+        var lastInputTarget: SnapshotNode? = null
+        var lastInitialEditSnapshot: UiSnapshot? = null
+        var initialEditCaptures = 0
+        var inputCount = 0
         var backCount = 0
         var postSubmitBackCount = 0
         var pddRestoreCount = 0
@@ -814,7 +1500,12 @@ class PurchaseLiveAutomationTest {
                 postSubmitCaptureCount++
                 if (pendingPostSubmitPages.isNotEmpty()) page = pendingPostSubmitPages.removeAt(0)
             }
-            return currentSnapshot()
+            val snapshot = currentSnapshot()
+            if (page == "edit" && inputCount == 0) {
+                initialEditCaptures++
+                return initialEditFrame(snapshot, initialEditCaptures).also { lastInitialEditSnapshot = it }
+            }
+            return snapshot
         }
 
         private fun currentSnapshot(): UiSnapshot = when (page) {
@@ -986,7 +1677,10 @@ class PurchaseLiveAutomationTest {
         }
 
         override fun inputFresh(target: SnapshotNode, value: String): FreshActionResult {
+            inputCount++
+            lastInputTarget = target
             lastInputTargetPath = target.path
+            if (inputResult != FreshActionResult.SUCCESS) return inputResult
             address = value
             return FreshActionResult.SUCCESS
         }

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseNavigationReadinessTest.kt

@@ -0,0 +1,75 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseNavigationReadinessTest {
+    private val pdd = PurchaseNavigationReadiness.PDD_PACKAGE
+    private val browser = "com.heytap.browser"
+    private val old = ProductStabilityKey("old", true, false, false)
+    private val fresh = old.copy(title = "new")
+
+    @Test fun `diag3 browser route ignores old product before browser then buffers returned pdd`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.BROWSER, 0)
+        for (now in listOf(921L, 1_000L, 1_738L)) assertFalse(policy.observe(now, pdd, old))
+        assertFalse(policy.observe(1_739, browser, null))
+        assertFalse(policy.observe(12_189, pdd, old))
+        assertFalse(policy.observe(13_000, pdd, old))
+        assertFalse(policy.observe(13_218, pdd, fresh))
+        assertFalse(policy.observe(14_218, pdd, fresh))
+        assertFalse(policy.observe(15_188, pdd, fresh))
+        assertTrue(policy.observe(15_189, pdd, fresh))
+    }
+
+    @Test fun `stable initial product cannot pass browser route even after buffer`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.BROWSER, 0)
+        for (now in 0L..30_000L step 100) assertFalse(policy.observe(now, pdd, old))
+        assertTrue(policy.expired(30_000))
+    }
+
+    @Test fun `direct route requires buffer plus three stable samples without an empty frame`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 500)
+        assertFalse(policy.observe(500, pdd, old))
+        assertFalse(policy.observe(2_500, pdd, old))
+        assertFalse(policy.observe(3_499, pdd, old))
+        assertTrue(policy.observe(3_500, pdd, old))
+        val three = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 0)
+        assertFalse(three.observe(3_000, pdd, old))
+        assertFalse(three.observe(4_000, pdd, old))
+        assertTrue(three.observe(4_001, pdd, old))
+    }
+
+    @Test fun `stability resets on package root missing evidence title and structure changes`() {
+        for ((pkg, key) in listOf(browser to null, pdd to null, pdd to fresh, pdd to old.copy(panel = true))) {
+            val policy = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 0)
+            policy.observe(2_000, pdd, old)
+            policy.observe(2_500, pdd, old)
+            assertFalse(policy.observe(2_999, pkg, key))
+            assertFalse(policy.observe(3_000, pdd, old))
+            assertFalse(policy.observe(3_999, pdd, old))
+            assertTrue(policy.observe(4_000, pdd, old))
+        }
+    }
+
+    @Test fun `unknown path never passes and only approved browser route clicks at least one second apart`() {
+        val unknown = PurchaseNavigationReadiness(0, null, 0)
+        assertFalse(unknown.observe(4_000, pdd, old))
+        assertFalse(unknown.mayClickBrowser(4_000, browser))
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.BROWSER, 0)
+        for (pkg in listOf(pdd, "cn.ilapage.goauto.agent", "other.browser")) assertFalse(policy.mayClickBrowser(0, pkg))
+        for (pkg in listOf(browser, "com.android.chrome", "com.android.browser")) assertTrue(policy.mayClickBrowser(0, pkg))
+        policy.clicked(0)
+        assertFalse(policy.mayClickBrowser(999, browser))
+        assertTrue(policy.mayClickBrowser(1_000, browser))
+        assertFalse(policy.mayClickBrowser(30_000, browser))
+    }
+
+    @Test fun `deadline includes launch time and never accepts at thirty seconds`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 29_000)
+        assertFalse(policy.observe(29_000, pdd, old))
+        assertFalse(policy.observe(29_500, pdd, old))
+        assertFalse(policy.observe(30_000, pdd, old))
+        assertTrue(policy.expired(-1))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseOutboxHandoffTest.kt

@@ -0,0 +1,34 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.persistence.PendingPurchaseOutbox
+import cn.ilapage.goauto.agent.persistence.PurchaseOutboxUploader
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseOutboxHandoffTest {
+    private val item = PendingPurchaseOutbox(1, 42, "probe", "request", "{}")
+
+    @Test fun `handoff callback runs only after successful submit and local upload mark`() {
+        for (failure in listOf("submit", "mark", "none")) {
+            val events = mutableListOf<String>()
+            val uploader = PurchaseOutboxUploader(
+                pending = { listOf(item) },
+                submit = { events += "submit"; if (failure == "submit") error("offline") },
+                markUploaded = { events += "mark"; if (failure == "mark") error("disk") },
+                afterUploaded = { events += "handoff" },
+            )
+            runCatching(uploader::flush)
+            assertEquals(when (failure) {
+                "submit" -> listOf("submit")
+                "mark" -> listOf("submit", "mark")
+                else -> listOf("submit", "mark", "handoff")
+            }, events)
+        }
+    }
+
+    @Test fun `ordinary replay uploader has no handoff callback`() {
+        var submitted = 0
+        PurchaseOutboxUploader({ listOf(item) }, { submitted++ }, {}).flush()
+        assertEquals(1, submitted)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseProbeHandoffTest.kt

@@ -0,0 +1,78 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.PurchaseProbeHandoff
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseProbeHandoffTest {
+    @Test fun `post capture confirmation rejects expiry foreground change recreation and later execution`() {
+        val state = seeded()
+        val execution = state.beginExecution()
+        assertTrue(state.eligible(execution, 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        assertTrue(state.stillValid(execution, accessibility, 7, 30_999))
+        assertFalse(state.stillValid(execution, accessibility, 7, 31_000))
+        assertFalse(state.stillValid(execution, accessibility, 8, 1_001))
+        assertFalse(state.stillValid(execution, Any(), 7, 1_001))
+        state.beginExecution()
+        assertFalse(state.stillValid(execution, accessibility, 7, 1_001))
+    }
+
+    private val accessibility = Any()
+    private fun seeded(age: Long = 0, success: Boolean = true, persisted: Boolean = true, pending: Boolean = true, replayed: Boolean = false): PurchaseProbeHandoff {
+        return PurchaseProbeHandoff().also { state ->
+            val execution = state.beginExecution()
+            state.completeProbe(execution, 42, "123", "probe-attempt", 1_000 - age, accessibility, 7,
+                successful = success, safelyStored = persisted, submitPending = pending, replayed = replayed)
+        }
+    }
+
+    @Test fun `handoff age is completion based exclusive thirty seconds`() {
+        for (age in listOf(0L, 29_999L, 30_000L, -1L)) {
+            val state = seeded(age)
+            assertEquals(age in 0..29_999, state.eligible(state.beginExecution(), 42, "123", "purchase", "purchase-attempt", accessibility, 7, 1_000))
+        }
+    }
+    @Test fun `handoff is consumed before all eligibility checks`() {
+        val state = seeded()
+        assertFalse(state.eligible(state.beginExecution(), 43, "123", "purchase", "next", accessibility, 7, 1_000))
+        assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+    }
+    @Test fun `different source and purchase attempts are normal but source replay cannot reuse`() {
+        val state = seeded()
+        assertTrue(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        val replay = seeded()
+        assertFalse(replay.eligible(replay.beginExecution(), 42, "123", "purchase", "probe-attempt", accessibility, 7, 1_000))
+    }
+    @Test fun `failed persistence failed matching and replayed uploads create no credential`() {
+        for (state in listOf(seeded(success = false), seeded(persisted = false), seeded(pending = false), seeded(replayed = true))) {
+            assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        }
+    }
+    @Test fun `interleaving generation accessibility foreground service and explicit navigation invalidate`() {
+        val interleaved = seeded()
+        val ticket = interleaved.beginExecution()
+        interleaved.beginExecution()
+        assertFalse(interleaved.eligible(ticket, 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        val replaced = seeded()
+        assertFalse(replaced.eligible(replaced.beginExecution(), 42, "123", "purchase", "next", Any(), 7, 1_000))
+        val foreground = seeded()
+        assertFalse(foreground.eligible(foreground.beginExecution(), 42, "123", "purchase", "next", accessibility, 8, 1_000))
+        val freshService = PurchaseProbeHandoff()
+        assertFalse(freshService.eligible(freshService.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        val navigated = seeded()
+        navigated.invalidate()
+        assertFalse(navigated.eligible(navigated.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+    }
+    @Test fun `wrong goods or phase consumes and delayed completion cannot overwrite later execution`() {
+        for ((goods, phase) in listOf("456" to "purchase", "123" to "spec_probe", "123" to "collection")) {
+            val state = seeded()
+            assertFalse(state.eligible(state.beginExecution(), 42, goods, phase, "next", accessibility, 7, 1_000))
+        }
+        val state = PurchaseProbeHandoff()
+        val old = state.beginExecution()
+        state.beginExecution()
+        state.completeProbe(old, 42, "123", "probe", 1_000, accessibility, 7, true, true, true, false)
+        assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseRehearsalExecutorTest.kt

@@ -12,6 +12,8 @@ import cn.ilapage.goauto.agent.automation.PurchaseSpecGesturePolicy
 import cn.ilapage.goauto.agent.automation.PurchaseSwipeOutcome
 import cn.ilapage.goauto.agent.automation.PurchaseSwipeResult
 import cn.ilapage.goauto.agent.automation.PurchaseUiDriver
+import cn.ilapage.goauto.agent.automation.PddLaunchPath
+import cn.ilapage.goauto.agent.persistence.AgentDiagnosticStage
 import cn.ilapage.goauto.agent.automation.RuleValidationException
 import cn.ilapage.goauto.agent.automation.SnapshotNode
 import cn.ilapage.goauto.agent.automation.SwipeDirection
@@ -24,13 +26,197 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PurchaseRehearsalExecutorTest {
+    @Test
+    fun `slow first browser lookup cannot compress the actual retry interval`() {
+        var now = 0L
+        val clickedAt = mutableListOf<Long>()
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome {
+                if (clickedAt.isEmpty()) now += 900
+                if (allowed()) clickedAt += now
+                return FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.ACTION_CLICK_FALSE)
+            }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(clickedAt.size > 1)
+        assertTrue(clickedAt.zipWithNext().all { (a, b) -> b - a >= 1_000 })
+        assertTrue(clickedAt.all { it < 30_000 })
+    }
+
+    @Test
+    fun `unapproved package with matching open button is never clicked`() {
+        var now = 0L
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture() = underlying.capture().copy(packageName = "other.application")
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `launch dispatch consumes the navigation deadline before first capture`() {
+        var now = 0L
+        var captures = 0
+        val underlying = FakePurchaseDriver()
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot { captures++; return underlying.capture() }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { now = 30_000; true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.DIRECT }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(0, captures)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `handoff invalidated during fresh capture reopens instead of reusing`() {
+        var now = 29_999L
+        var opens = 0
+        val underlying = FakePurchaseDriver()
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot { now = 30_000; return underlying.capture() }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { opens++; false }, { null }, pause = {},
+            monotonicNow = { now }, confirmProbeHandoff = { now < 30_000 },
+        ).execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals(1, opens)
+        assertEquals("PDD_LINK_INVALID", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `input reuse flag defaults false`() {
+        val task = PurchaseExecutionInput(42, "rehearsal", "purchase", input().url, input().goodsId,
+            "黑色", "XL", quantity = 2, minUnitPriceCent = 1000, maxUnitPriceCent = 3000)
+        assertFalse(task.reuseProbeProduct)
+    }
+
+    @Test
+    fun `diag3 timeline waits for browser and returned product buffer before any spec action`() {
+        var now = 921L
+        var probeAt = -1L
+        val underlying = FakePurchaseDriver()
+        val clicksAt = mutableListOf<Long>()
+        val browserSnapshot = FakePurchaseDriver().apply { browser = true }.capture()
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot {
+                if (now in 1_739 until 12_189) return browserSnapshot
+                val current = underlying.capture()
+                return if (now < 13_218) current else current.copy(nodes = current.nodes.map {
+                    if (it.path == "title") it.copy(text = "另一件商品标题文本") else it
+                })
+            }
+            override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome {
+                assertTrue(now in 1_739 until 12_189)
+                clicksAt += now
+                return FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS)
+            }
+            override fun clickFreshDetailed(target: SnapshotNode): FreshClickOutcome {
+                assertTrue("spec action at $now", now >= 15_200)
+                return underlying.clickFreshDetailed(target)
+            }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { probeAt = now; "{}" },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe", reuseProbeProduct = false), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("spec_probe_completed", outcome.resultType)
+        assertTrue(probeAt >= 15_200)
+        assertTrue(clicksAt.zipWithNext().all { (a, b) -> b - a >= 1_000 })
+    }
+
+    @Test
+    fun `slow capture crossing deadline cannot click browser or enter specs`() {
+        var now = 0L
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot { now = 30_000; return underlying.capture() }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `fresh browser node lookup crossing deadline declines action`() {
+        var now = 0L
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome {
+                now = 30_000
+                assertFalse(allowed())
+                return FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.UNKNOWN)
+            }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `direct accepted launch buffers same package product without empty frame`() {
+        var now = 0L
+        var probeAt = -1L
+        val driver = FakePurchaseDriver()
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { probeAt = now; "{}" },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.DIRECT }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("spec_probe_completed", outcome.resultType)
+        assertTrue(probeAt >= 3_000)
+        assertEquals(0, driver.openClickCount)
+    }
+
+    @Test
+    fun `browser launch without observed browser times out on stable old pdd`() {
+        var now = 0L
+        val driver = FakePurchaseDriver()
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(30_000L, now)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `untrusted current product does not bypass navigation`() {
+        var opens = 0
+        val outcome = executor(FakePurchaseDriver(), { opens++; false }, { null }, pause = {})
+            .execute(input().copy(reuseProbeProduct = false), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals(1, opens)
+        assertEquals("PDD_LINK_INVALID", outcome.errorCode)
+    }
+
+    @Test
+    fun `old pdd product without accepted launch evidence times out before probe`() {
+        var probes = 0
+        val driver = FakePurchaseDriver()
+        val outcome = executor(driver, { true }, { probes++; "{}" }, pause = {}, path = null)
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(0, probes)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
     @Test
     fun `probe skips post open swipes but preserves wait and records click`() {
         val driver = FakePurchaseDriver()
         val pauses = mutableListOf<Long>()
         val clicks = mutableListOf<FreshClickOutcome>()
         val configured = rule().replace("\"type\":\"openSpecPanel\"", "\"type\":\"openSpecPanel\",\"waitAfterMs\":1234")
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" },
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" },
             pause = pauses::add, probeClickDiagnostic = { _, _, click -> clicks += click },
         ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(configured), PurchaseAgentCapabilities.supported)
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -43,7 +229,7 @@ class PurchaseRehearsalExecutorTest {
     fun `blocked entry stops without gesture or probe`() {
         val driver = FakePurchaseDriver(forcedEntryClickReason = FreshClickReason.SIZE_ADVICE_BLOCKED)
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("SIZE_ADVICE_CLICK_BLOCKED", outcome.errorCode)
         assertEquals(0, driver.specTapCount)
@@ -53,7 +239,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `blocked size stops without gesture retry`() {
         val driver = FakePurchaseDriver(forcedSizeClickReason = FreshClickReason.SIZE_ADVICE_BLOCKED)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("SIZE_ADVICE_CLICK_BLOCKED", outcome.errorCode)
         assertEquals(0, driver.specTapCount)
@@ -64,7 +250,7 @@ class PurchaseRehearsalExecutorTest {
     fun `blocked gesture stops without another click`() {
         val driver = FakePurchaseDriver(forcedEntryClickReason = FreshClickReason.ACTION_CLICK_FALSE, specTapResult = FreshActionResult.BLOCKED)
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("SIZE_ADVICE_CLICK_BLOCKED", outcome.errorCode)
         assertEquals(1, driver.specTapCount)
@@ -74,7 +260,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `purchase still fails required post open swipe`() {
         val driver = FakePurchaseDriver(purchaseSwipeSucceeds = false)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
         assertEquals(1, driver.swipeCount)
@@ -83,7 +269,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `color selection then single size heading completes without selecting color again`() {
         val driver = FakePurchaseDriver(prefixlessSingleHeadingAfterColor = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
         assertEquals(1, driver.clicked.count { it == "黑色" })
@@ -93,7 +279,7 @@ class PurchaseRehearsalExecutorTest {
     fun `full exact summary confirms size after option leaves viewport`() {
         val target = "2XL 建议131到150斤"
         val driver = FakePurchaseDriver(sizes = listOf(target), hideSizeAfterSelection = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
         assertEquals(1, driver.clicked.count { it == target })
@@ -106,7 +292,7 @@ class PurchaseRehearsalExecutorTest {
             sizes = listOf(target), hideSizeAfterSelection = true,
             selectedSizeSummaryOverride = "2XL 建议151到170斤",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("failed", outcome.resultType)
     }
@@ -160,7 +346,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver()
         val pauses = mutableListOf<Long>()
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = { openCount++; driver.browser = true; true },
             probeSpecs = { null },
@@ -181,7 +367,7 @@ class PurchaseRehearsalExecutorTest {
     fun `manual purchase retry from agent reopens the task product url`() {
         val driver = FakePurchaseDriver(initiallyInAgent = true)
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = {
                 openCount++
@@ -201,7 +387,7 @@ class PurchaseRehearsalExecutorTest {
     fun `purchase phase reopens when pdd foreground has no product evidence`() {
         val driver = FakePurchaseDriver(loadingPddCaptures = 1)
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = { openCount++; driver.browser = true; true },
             probeSpecs = { null },
@@ -217,7 +403,7 @@ class PurchaseRehearsalExecutorTest {
     fun `purchase phase does not reuse a pdd login page`() {
         val driver = FakePurchaseDriver(pddProblemLabels = listOf("手机号登录", "登录后继续"))
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = { openCount++; driver.browser = true; true },
             probeSpecs = { null },
@@ -231,7 +417,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `price range failure reports the observed unit price`() {
         val driver = FakePurchaseDriver()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(maxUnitPriceCent = 1_999), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_PRICE_OUT_OF_RANGE", outcome.errorCode)
@@ -246,7 +432,7 @@ class PurchaseRehearsalExecutorTest {
             "\"purchase.rehearsal.v1\",\"purchase.spec-probe.v1\"",
             "\"purchase.rehearsal.v1\",\"purchase.spec-probe.v1\",\"purchase.future.v1\"",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { openCount++; true }, { null }, pause = {})
+        val outcome = executor(driver, { openCount++; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(unsupported), PurchaseAgentCapabilities.supported)
         assertEquals("AGENT_CAPABILITY_MISMATCH", outcome.errorCode)
         assertEquals(0, openCount)
@@ -256,7 +442,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `missing exact spec returns probe and never chooses similar value`() {
         val driver = FakePurchaseDriver(colors = listOf("黑色加绒"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("spec_probe_completed", outcome.resultType)
         assertEquals("{\"dimensions\":[]}", outcome.probedSpecs)
@@ -268,7 +454,7 @@ class PurchaseRehearsalExecutorTest {
     fun `missing exact spec without server permission preserves the real failure`() {
         val driver = FakePurchaseDriver(colors = listOf("黑色加绒"))
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{\"dimensions\":[]}" }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -280,7 +466,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `exact size below the visible panel is found after a bounded vertical search`() {
         val driver = FakePurchaseDriver(hiddenSizeUntilUpSwipes = 3)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -295,7 +481,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -307,7 +493,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `visible exact color keeps established path without horizontal fallback`() {
         val driver = FakePurchaseDriver(colors = listOf("黑色", "白色"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -319,7 +505,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             horizontalColorPages = listOf(listOf("黑色"), listOf("富贵粉")),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
@@ -334,7 +520,7 @@ class PurchaseRehearsalExecutorTest {
             horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
             horizontalSpecSwipeSucceeds = false,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
@@ -351,7 +537,7 @@ class PurchaseRehearsalExecutorTest {
                 listOf("2XL 推荐125-140斤", targetSize),
             ),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = targetSize), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -366,7 +552,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             horizontalSizePages = listOf(listOf("S 推荐80-95斤"), listOf(targetSize)),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = targetSize), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -381,7 +567,7 @@ class PurchaseRehearsalExecutorTest {
             horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
             horizontalSizePages = listOf(listOf("S 推荐80-95斤", "M 推荐95-110斤"), listOf("2XL 推荐125-140斤", targetSize)),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(
                 input().copy(mappedColor = "富贵粉", mappedSize = targetSize),
                 PurchaseRuleParser.parse(rule()),
@@ -398,7 +584,7 @@ class PurchaseRehearsalExecutorTest {
     fun `two column size grid continues vertically without horizontal container`() {
         val target = "3XL 推荐140-155斤"
         val driver = FakePurchaseDriver(sizes = listOf(target), revealGridSizeAfterUpSwipes = 7)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("rehearsal_completed", outcome.resultType)
         assertEquals(target, driver.size)
@@ -415,7 +601,7 @@ class PurchaseRehearsalExecutorTest {
             horizontalSpecSwipeSucceeds = false,
             revealGridSizeAfterUpSwipes = 7,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
         assertEquals(target, driver.size)
@@ -425,7 +611,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `missing size terminates at stable viewport with bounded gestures`() {
         val driver = FakePurchaseDriver(sizes = listOf("S", "M"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
         assertTrue(outcome.message.contains("reason=stableViewport"))
@@ -436,7 +622,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `visible exact size does not enter horizontal fallback`() {
         val driver = FakePurchaseDriver(sizes = listOf("L", "XL"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -449,7 +635,7 @@ class PurchaseRehearsalExecutorTest {
             sizeClickResults = mutableListOf(FreshActionResult.FAILED),
             sizeSelectsOnFailedClick = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -463,7 +649,7 @@ class PurchaseRehearsalExecutorTest {
             sizeClickResults = mutableListOf(FreshActionResult.NOT_FOUND),
             specTapResult = FreshActionResult.SUCCESS,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -475,7 +661,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `already selected exact size is not clicked again`() {
         val driver = FakePurchaseDriver(initialSize = "XL")
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -491,7 +677,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             hideSizeSelectedState = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -501,7 +687,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `final verification accepts current attempt proof when selected color scrolls out of viewport`() {
         val driver = FakePurchaseDriver(hideColorAfterQuantitySet = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -517,7 +703,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             hideSizeAfterQuantitySet = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -530,7 +716,7 @@ class PurchaseRehearsalExecutorTest {
             hideColorAfterQuantitySet = true,
             hideSelectedSummaryAfterQuantitySet = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -540,7 +726,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `final verification keeps current attempt proof when selected panel becomes unclassified`() {
         val driver = FakePurchaseDriver(panelBecomesUnknownAfterSizeProof = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(quantity = 1), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -555,7 +741,7 @@ class PurchaseRehearsalExecutorTest {
             hideSelectedSummaryAfterQuantitySet = true,
             restoreHiddenColorOnDownSwipe = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -571,7 +757,7 @@ class PurchaseRehearsalExecutorTest {
             hideSelectedSummaryAfterQuantitySet = true,
             selectedColorOverrideAfterQuantitySet = "白色",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -589,7 +775,7 @@ class PurchaseRehearsalExecutorTest {
             hideSizeAfterQuantitySet = true,
             selectedSummaryOverrideAfterQuantitySet = "黑色 2XL",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -606,7 +792,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             finalSizesAfterQuantitySet = listOf("XL【建议B】"),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -624,7 +810,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "2XL",
             hideSizeSelectedState = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -639,7 +825,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             hideSizeSelectedState = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -651,7 +837,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             sizeClickResults = mutableListOf(FreshActionResult.FAILED),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_CLICK_FAILED", outcome.errorCode)
@@ -672,7 +858,7 @@ class PurchaseRehearsalExecutorTest {
 
         cases.forEach { (reason, expected) ->
             val driver = FakePurchaseDriver(forcedSizeClickReason = reason)
-            val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
                 .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
             assertEquals("PURCHASE_SPEC_CLICK_FAILED", outcome.errorCode)
@@ -684,7 +870,7 @@ class PurchaseRehearsalExecutorTest {
     fun `visible unavailable exact target fails as safe target missing without probing`() {
         val driver = FakePurchaseDriver(unavailableSizes = setOf("XL"))
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input().copy(specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_SAFE_TARGET_MISSING", outcome.errorCode)
@@ -697,7 +883,7 @@ class PurchaseRehearsalExecutorTest {
         listOf("¥15.78", "XL ¥15.78起").forEach { unsafeTarget ->
             val driver = FakePurchaseDriver()
             var probes = 0
-            val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+            val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
                 .execute(input().copy(mappedSize = unsafeTarget, specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
             assertEquals("PURCHASE_SPEC_SAFE_TARGET_MISSING", outcome.errorCode)
@@ -709,7 +895,7 @@ class PurchaseRehearsalExecutorTest {
     fun `legacy task target with a safe trailing price selects the clean page value`() {
         val clean = "XL【建议121-140斤】"
         val driver = FakePurchaseDriver(sizes = listOf(clean))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = "$clean  ¥15.78"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -719,7 +905,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `two raw page values that normalize to one size fail as ambiguous`() {
         val driver = FakePurchaseDriver(sizes = listOf("XL  ¥15.78", "XL ￥16.80"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -730,7 +916,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `price outside range fails before any order action`() {
         val driver = FakePurchaseDriver(priceCent = 4_000)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("PURCHASE_PRICE_OUT_OF_RANGE", outcome.errorCode)
         assertFalse(driver.clicked.any { it.contains("订单") || it.contains("支付") })
@@ -739,7 +925,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `ambiguous browser target stops safely`() {
         val driver = FakePurchaseDriver(duplicateOpen = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("RULE_AMBIGUOUS", outcome.errorCode)
         assertTrue(driver.clicked.isEmpty())
@@ -751,7 +937,7 @@ class PurchaseRehearsalExecutorTest {
             openClickResults = mutableListOf(FreshActionResult.FAILED),
             openPddOnFailedClick = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -764,7 +950,7 @@ class PurchaseRehearsalExecutorTest {
             openClickResults = mutableListOf(FreshActionResult.NOT_FOUND, FreshActionResult.SUCCESS),
         )
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -775,46 +961,46 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `persistent open click failure is bounded and remains safely failed`() {
         val driver = FakePurchaseDriver(
-            openClickResults = MutableList(20) { FreshActionResult.FAILED },
+            openClickResults = MutableList(40) { FreshActionResult.FAILED },
         )
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
-        assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
-        assertTrue(driver.openClickCount in 1..15)
-        assertEquals(150, pauses.size)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(30, driver.openClickCount)
+        assertEquals(300, pauses.size)
     }
 
     @Test
     fun `five second browser interstitial can still reach a stable product page`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(browserOpenVisibleAfterCaptures = 50)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
         assertEquals(1, driver.openClickCount)
-        assertTrue(pauses.count { it == 100L } in 52..60)
+        assertTrue(pauses.count { it == 100L } in 82..90)
     }
 
     @Test
-    fun `pdd foreground without stable product evidence times out at fifteen seconds`() {
+    fun `pdd foreground without stable product evidence times out at thirty seconds`() {
         val pauses = mutableListOf<Long>()
-        val driver = FakePurchaseDriver(loadingPddCaptures = 200)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val driver = FakePurchaseDriver(loadingPddCaptures = 400)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
         assertEquals("打开拼多多后未识别到稳定商品页面", outcome.message)
-        assertEquals(150, pauses.count { it == 100L })
+        assertEquals(300, pauses.count { it == 100L })
     }
 
     @Test
     fun `explicit pdd login page fails before the product timeout`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(pddProblemLabels = listOf("手机号登录", "登录后继续"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_LOGIN_REQUIRED", outcome.errorCode)
@@ -825,7 +1011,7 @@ class PurchaseRehearsalExecutorTest {
     fun `open spec panel skips required follow-up swipe only for confirmed non-scrollable panel`() {
         val driver = FakePurchaseDriver(nonScrollablePanel = true, purchaseSwipeSucceeds = false)
         val diagnostics = mutableListOf<String>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -841,7 +1027,7 @@ class PurchaseRehearsalExecutorTest {
         )
         var probes = 0
         val diagnostics = mutableListOf<String>()
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver, { driver.browser = true; true }, { probes++; "{}" },
             pause = {}, panelDiagnostic = diagnostics::add,
         ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
@@ -857,7 +1043,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(purchaseSwipeSucceeds = false)
         var probes = 0
         val diagnostics = mutableListOf<String>()
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver, { driver.browser = true; true }, { probes++; "{}" },
             pause = {}, panelDiagnostic = diagnostics::add,
         ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
@@ -876,7 +1062,7 @@ class PurchaseRehearsalExecutorTest {
             PurchaseSwipeOutcome(PurchaseSwipeResult.ROOT_UNAVAILABLE, 0),
         ))
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
@@ -891,7 +1077,7 @@ class PurchaseRehearsalExecutorTest {
             PurchaseSwipeOutcome(PurchaseSwipeResult.NO_SCROLLABLE_TARGET, 0),
         ))
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -903,7 +1089,7 @@ class PurchaseRehearsalExecutorTest {
     fun `scrollable spec reveal preserves configured swipe count and interval`() {
         val driver = FakePurchaseDriver()
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -918,7 +1104,7 @@ class PurchaseRehearsalExecutorTest {
             "\"waitAfterMs\":700}",
             "\"waitAfterMs\":700,\"swipeAfter\":{\"direction\":\"up\",\"count\":1,\"durationMs\":500,\"intervalMs\":0}}",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(configured), PurchaseAgentCapabilities.supported)
 
         assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
@@ -930,7 +1116,7 @@ class PurchaseRehearsalExecutorTest {
     fun `skipping a reveal does not skip a failed specification probe`() {
         val driver = FakePurchaseDriver(panelOverride = SpecPanelFixtures.liveShapedSheet())
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; null }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_NOT_MATCHED", outcome.errorCode)
@@ -940,7 +1126,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `unrecognized opened panel returns only scalar panel evidence`() {
         val driver = FakePurchaseDriver(unrecognizedPanel = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
@@ -959,7 +1145,7 @@ class PurchaseRehearsalExecutorTest {
             entryActionHasEffect = false,
             specTapResult = FreshActionResult.SUCCESS,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -974,7 +1160,7 @@ class PurchaseRehearsalExecutorTest {
             specTapResult = FreshActionResult.SUCCESS,
             specTapHasEffect = false,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_CLICK_NO_EFFECT", outcome.errorCode)
@@ -988,7 +1174,7 @@ class PurchaseRehearsalExecutorTest {
             entryActionHasEffect = false,
             specTapResult = FreshActionResult.FAILED,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_CLICK_FAILED", outcome.errorCode)
@@ -1001,7 +1187,7 @@ class PurchaseRehearsalExecutorTest {
         val diagnostics = mutableListOf<String>()
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(missingSpecEntry = true)
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             { driver.browser = true; true },
             { null },
@@ -1022,33 +1208,31 @@ class PurchaseRehearsalExecutorTest {
     fun `open spec panel waits for a late safe bottom purchase entry`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(bottomPurchaseEntry = true, specEntryVisibleAfterPddCaptures = 4)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = pauses::add)
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
         assertTrue(driver.clickedPaths.contains("buy"))
-        // One 100ms pause belongs to the existing open-product foreground poll;
-        // two belong to the entry-ready wait before the bottom bar appears.
-        assertEquals(3, pauses.count { it == 100L })
+        // The browser return gets a full three-second buffer before the spec entry can be used.
+        assertEquals(32, pauses.count { it == 100L })
     }
 
     @Test
     fun `purchase reopens and waits for product evidence instead of a visible loading frame`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(loadingPddCaptures = 1)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = pauses::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
-        // Two stable reads belong to reopening the product; verifyProduct then
-        // independently requires its second stable read before continuing.
-        assertEquals(3, pauses.count { it == 100L })
+        // Browser return buffer overlaps stable reads; verifyProduct performs its independent check.
+        assertEquals(32, pauses.count { it == 100L })
     }
 
     @Test
     fun `transient sold out page recovers before opening specs`() {
         val driver = FakePurchaseDriver(soldOut = true, recoverSoldOutAfterPull = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -1059,7 +1243,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `persistent sold out page returns replacement eligible error`() {
         val driver = FakePurchaseDriver(soldOut = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_GOODS_SOLD_OUT", outcome.errorCode)
@@ -1070,7 +1254,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `sold out recovery gesture failure stops immediately`() {
         val driver = FakePurchaseDriver(soldOut = true, pullDownSucceeds = false)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_GOODS_SOLD_OUT", outcome.errorCode)
@@ -1080,7 +1264,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `sold out recovery rejects a page that lost product evidence`() {
         val driver = FakePurchaseDriver(soldOut = true, loseEvidenceAfterPull = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("RULE_NOT_MATCHED", outcome.errorCode)
@@ -1091,7 +1275,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `all unavailable specs recover on goods page and reopen panel`() {
         val driver = FakePurchaseDriver(allSpecsUnavailable = true, recoverSoldOutAfterPull = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -1102,7 +1286,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `goods id mismatch fails before opening pdd`() {
         var opened = false
-        val outcome = PurchaseRehearsalExecutor(FakePurchaseDriver(), { opened = true; true }, { null }, pause = {})
+        val outcome = executor(FakePurchaseDriver(), { opened = true; true }, { null }, pause = {})
             .execute(input().copy(goodsId = "999"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("PDD_GOODS_MISMATCH", outcome.errorCode)
         assertFalse(opened)
@@ -1111,7 +1295,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `live rule spec probe ignores historical mapping and returns before address or order actions`() {
         val driver = FakePurchaseDriver()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(
                 input().copy(
                     executionMode = "live",
@@ -1131,7 +1315,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `spec probe opens panel through safe bottom purchase entry`() {
         val driver = FakePurchaseDriver(bottomPurchaseEntry = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -1142,7 +1326,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `purchase returns once and fails explicitly when spec entry opens reviews`() {
         val driver = FakePurchaseDriver(bottomPurchaseEntry = true, openReviewOnBottomClick = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -1163,7 +1347,7 @@ class PurchaseRehearsalExecutorTest {
         )
         cases.forEach { (reason, expected) ->
             val driver = FakePurchaseDriver(forcedEntryClickReason = reason)
-            val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
                 .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
             assertEquals("PURCHASE_SPEC_ENTRY_CLICK_FAILED", outcome.errorCode)
@@ -1179,7 +1363,7 @@ class PurchaseRehearsalExecutorTest {
             openReviewOnBottomClick = true,
             reviewBackSucceeds = false,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_OPENED_REVIEW", outcome.errorCode)
@@ -1192,7 +1376,7 @@ class PurchaseRehearsalExecutorTest {
     fun `spec aliases cannot bypass semantic safe candidates`() {
         val driver = FakePurchaseDriver(includeReviewEntry = true)
         val unsafeRule = rule().replace("[\"选择规格\"]", "[\"商品评价\"]")
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(unsafeRule), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_NOT_FOUND", outcome.errorCode)
@@ -1202,7 +1386,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `spec entry failures include scalar diagnostics only`() {
         val driver = FakePurchaseDriver(missingSpecEntry = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_NOT_FOUND", outcome.errorCode)
@@ -1212,7 +1396,7 @@ class PurchaseRehearsalExecutorTest {
         )
 
         val ambiguousDriver = FakePurchaseDriver(forcedEntryClickReason = FreshClickReason.TARGET_AMBIGUOUS)
-        val ambiguous = PurchaseRehearsalExecutor(ambiguousDriver, { ambiguousDriver.browser = true; true }, { null }, pause = {})
+        val ambiguous = executor(ambiguousDriver, { ambiguousDriver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_TARGET_AMBIGUOUS", ambiguous.errorCode)
@@ -1329,6 +1513,7 @@ class PurchaseRehearsalExecutorTest {
         assertEquals(1, submitted.map { it.payloadJson }.distinct().size)
     }
 
+    /** Existing spec/price tests explicitly model the trusted immediate probe handoff. */
     private fun input() = PurchaseExecutionInput(
         taskId = 42,
         executionMode = "rehearsal",
@@ -1340,8 +1525,26 @@ class PurchaseRehearsalExecutorTest {
         quantity = 2,
         minUnitPriceCent = 1_000,
         maxUnitPriceCent = 3_000,
+        reuseProbeProduct = true,
     )
 
+    private fun executor(
+        driver: PurchaseUiDriver,
+        openLink: (String) -> Boolean,
+        probeSpecs: () -> String?,
+        pause: (Long) -> Unit,
+        panelDiagnostic: (String) -> Unit = {},
+        probeClickDiagnostic: (AgentDiagnosticStage, SnapshotNode, FreshClickOutcome) -> Unit = { _, _, _ -> },
+        path: PddLaunchPath? = PddLaunchPath.BROWSER,
+    ): PurchaseRehearsalExecutor {
+        var now = 0L
+        return PurchaseRehearsalExecutor(driver, openLink, probeSpecs,
+            pause = { millis -> now += millis; pause(millis) },
+            panelDiagnostic = panelDiagnostic, probeClickDiagnostic = probeClickDiagnostic,
+            acceptedLaunchPath = { path }, monotonicNow = { now },
+        )
+    }
+
     private fun rule() = """{
       "schemaVersion":1,
       "ruleType":"pddPurchase",

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseResultAcknowledgementTest.kt

@@ -0,0 +1,19 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.network.PurchaseResultAcknowledgement
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseResultAcknowledgementTest {
+    @Test fun `server omits replayed false on pending first response`() {
+        val ack = PurchaseResultAcknowledgement.from(JSONObject("""{"status":"pending"}"""))
+        assertTrue(ack.pending)
+        assertFalse(ack.replayed)
+    }
+    @Test fun `failed matching and explicit or malformed replay never qualify`() {
+        assertFalse(PurchaseResultAcknowledgement.from(JSONObject("""{"status":"failed"}""")).pending)
+        assertTrue(PurchaseResultAcknowledgement.from(JSONObject("""{"status":"pending","replayed":true}""")).replayed)
+        assertTrue(PurchaseResultAcknowledgement.from(JSONObject("""{"status":"pending","replayed":"invalid"}""")).replayed)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/RepurchaseServerClockTest.kt

@@ -0,0 +1,37 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.network.AgentApiClient
+import org.junit.Assert.*
+import org.junit.Test
+import java.net.ServerSocket
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+
+class RepurchaseServerClockTest {
+    @Test fun historyCapturesServerDateAndMissingDateClearsPreviousSample() {
+        ServerSocket(0).use { server ->
+            val executor = Executors.newSingleThreadExecutor()
+            val response = "{\"data\":{\"items\":[],\"total\":0,\"page\":1,\"pageSize\":50}}"
+            val serving = executor.submit {
+                repeat(2) { index ->
+                    server.accept().use { socket ->
+                        socket.soTimeout = 3000
+                        val reader = socket.getInputStream().bufferedReader()
+                        while (!reader.readLine().isNullOrEmpty()) { }
+                        val date = if (index == 0) "Date: Thu, 08 Oct 2026 09:00:00 GMT\r\n" else ""
+                        socket.getOutputStream().write(("HTTP/1.1 200 OK\r\n" + date +
+                            "Content-Type: application/json\r\nContent-Length: ${response.toByteArray().size}\r\nConnection: close\r\n\r\n$response").toByteArray())
+                    }
+                }
+            }
+            try {
+                val api = AgentApiClient("http://127.0.0.1:${server.localPort}")
+                api.purchaseHistory("synthetic", 1, null, null, 30, 50)
+                assertEquals(1791450000000L, api.lastResponseServerTimeMillis)
+                api.purchaseHistory("synthetic", 1, null, null, 30, 50)
+                assertNull(api.lastResponseServerTimeMillis)
+                serving.get(5, TimeUnit.SECONDS)
+            } finally { executor.shutdownNow() }
+        }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/SpecOptionDedupTest.kt

@@ -63,6 +63,7 @@ class SpecOptionDedupTest {
 
     private fun input() = PurchaseExecutionInput(
         taskId = 332,
+        reuseProbeProduct = true, // This test starts at the trusted probe-to-purchase spec handoff.
         executionMode = "rehearsal",
         phase = "purchase",
         url = "https://mobile.yangkeduo.com/goods.html?goods_id=719834019024",

android/app/src/test/java/cn/ilapage/goauto/agent/SpecPanelRecognitionTest.kt

@@ -716,6 +716,7 @@ class SpecPanelRecognitionTest {
 
     private fun input() = PurchaseExecutionInput(
         taskId = 331,
+        reuseProbeProduct = true, // Panel tests start at the trusted probe-to-purchase handoff.
         executionMode = "rehearsal",
         phase = "purchase",
         url = "https://mobile.yangkeduo.com/goods.html?goods_id=719834019024",

android/app/src/test/java/cn/ilapage/goauto/agent/TruncatedSpecCardTest.kt

@@ -213,7 +213,8 @@ class TruncatedSpecCardTest {
 
     private fun run(snapshot: UiSnapshot, target: String = full, driver: Driver = Driver(snapshot)) = executor(driver).execute(
         PurchaseExecutionInput(362, "rehearsal", "purchase", "https://mobile.yangkeduo.com/goods.html?goods_id=123456789",
-            "123456789", target, size, quantity = 1, minUnitPriceCent = 1000, maxUnitPriceCent = 3000),
+            "123456789", target, size, quantity = 1, minUnitPriceCent = 1000, maxUnitPriceCent = 3000,
+            reuseProbeProduct = true), // Exact-card tests explicitly model the immediate trusted handoff.
         PurchaseRuleParser.parse("""{"schemaVersion":1,"ruleType":"pddPurchase","requiredCapabilities":["purchase.rehearsal.v1"],
             "actions":[{"type":"openProduct"},{"type":"verifyProduct"},{"type":"openSpecPanel"},{"type":"selectSpec"},
             {"type":"setQuantity"},{"type":"verifyUnitPrice"},{"type":"verifyOrderSummary"}]}"""),

android/app/src/test/java/cn/ilapage/goauto/agent/persistence/AgentDiagnosticStoreMigrationTest.kt

@@ -3,10 +3,112 @@ package cn.ilapage.goauto.agent.persistence
 import java.sql.Connection
 import java.sql.DriverManager
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class AgentDiagnosticStoreMigrationTest {
+    @Test
+    fun freshV5DatabaseHasNullableColorDiscoveryOutcomeColumns() = withDatabase { db ->
+        db.createStatement().use { it.execute(AgentDiagnosticSchema.createTableSql) }
+        assertEquals(5, AgentDiagnosticSchema.VERSION)
+        assertV5Columns(db)
+        insertOldDiagnostic(db)
+        assertOldDiagnosticPreserved(db)
+        for (incomplete in listOf(0, 1)) {
+            db.createStatement().use { statement ->
+                statement.executeUpdate(
+                    "UPDATE agent_diagnostic SET color_vertical_swipe_count=4, " +
+                        "color_trailing_empty_read_count=2, color_horizontal_incomplete=$incomplete",
+                )
+                statement.executeQuery(
+                    "SELECT color_vertical_swipe_count, color_trailing_empty_read_count, " +
+                        "color_horizontal_incomplete FROM agent_diagnostic",
+                ).use { row ->
+                    assertTrue(row.next())
+                    assertEquals(4, row.getInt(1))
+                    assertEquals(2, row.getInt(2))
+                    assertEquals(incomplete, row.getInt(3))
+                }
+            }
+        }
+    }
+
+    @Test
+    fun everySupportedVersionUpgradesToV5WithoutChangingExistingRows() {
+        for (oldVersion in 1..4) withDatabase { db ->
+            createOldDatabase(db, oldVersion)
+            insertOldDiagnostic(db)
+            val existingTables = snapshotTables(db)
+
+            migrate(db, oldVersion, 5)
+
+            assertV5Columns(db)
+            assertOldDiagnosticPreserved(db)
+            existingTables.forEach { (name, rows) -> assertEquals(name, rows, tableRows(db, name)) }
+            assertTrue(columnNames(db).containsAll(AgentDiagnosticSchema.colorDiagnosticColumns.keys))
+            assertTrue(columnNames(db).containsAll(AgentDiagnosticSchema.purchaseDiagnosticColumns.keys))
+            assertEquals(3, snapshotTables(db).size)
+            migrate(db, oldVersion, 5)
+            assertOldDiagnosticPreserved(db)
+            existingTables.forEach { (name, rows) -> assertEquals(name, rows, tableRows(db, name)) }
+        }
+    }
+
+    @Test
+    fun v4UpgradeAddsOnlyMissingColumnsAndKeepsExistingV5Values() = withDatabase { db ->
+        createOldDatabase(db, 4)
+        insertOldDiagnostic(db)
+        db.createStatement().use {
+            it.execute("ALTER TABLE agent_diagnostic ADD COLUMN color_vertical_swipe_count INTEGER")
+            it.executeUpdate("UPDATE agent_diagnostic SET color_vertical_swipe_count=3")
+        }
+        val statements = AgentDiagnosticSchema.migrationStatements(4, 5, columnNames(db))
+        assertEquals(2, statements.size)
+        assertTrue(statements.all { it.startsWith("ALTER TABLE agent_diagnostic ADD COLUMN ") })
+        migrate(db, 4, 5)
+        assertV5Columns(db)
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT color_vertical_swipe_count, color_trailing_empty_read_count, color_horizontal_incomplete FROM agent_diagnostic").use {
+                assertTrue(it.next())
+                assertEquals(3, it.getInt(1))
+                assertNull(it.getObject(2))
+                assertNull(it.getObject(3))
+            }
+        }
+        assertTrue(AgentDiagnosticSchema.migrationStatements(4, 5, columnNames(db)).isEmpty())
+        assertTrue(AgentDiagnosticSchema.migrationStatements(5, 5, columnNames(db)).isEmpty())
+        assertTrue(AgentDiagnosticSchema.migrationStatements(4, 4, columnNames(db)).isEmpty())
+    }
+
+    @Test
+    fun v5UpgradeSurvivesDatabaseReopen() {
+        val file = java.io.File.createTempFile("goauto-diagnostic-migration-", ".db")
+        try {
+            Class.forName("org.sqlite.JDBC")
+            DriverManager.getConnection("jdbc:sqlite:${file.absolutePath}").use { db ->
+                createOldDatabase(db, 4)
+                insertOldDiagnostic(db)
+                migrate(db, 4, 5)
+                db.createStatement().use { it.execute("PRAGMA user_version=5") }
+            }
+            DriverManager.getConnection("jdbc:sqlite:${file.absolutePath}").use { db ->
+                assertV5Columns(db)
+                assertOldDiagnosticPreserved(db)
+                assertTrue(AgentDiagnosticSchema.migrationStatements(4, 5, columnNames(db)).isEmpty())
+                assertEquals(3, snapshotTables(db).size)
+                db.createStatement().use { statement ->
+                    statement.executeQuery("PRAGMA user_version").use {
+                        assertTrue(it.next())
+                        assertEquals(5, it.getInt(1))
+                    }
+                }
+            }
+        } finally {
+            check(file.delete()) { "Could not remove temporary migration test database" }
+        }
+    }
+
     @Test
     fun v4AddsIndependentFailureSnapshotQueueWithoutChangingStructuredRows() = withDatabase { db ->
         db.createStatement().use {
@@ -16,7 +118,6 @@ class AgentDiagnosticStoreMigrationTest {
         AgentDiagnosticSchema.migrationStatements(3, 4, columnNames(db)).forEach { sql ->
             db.createStatement().use { it.execute(sql) }
         }
-        assertEquals(4, AgentDiagnosticSchema.VERSION)
         for (table in listOf("purchase_failure_snapshot", "purchase_failure_snapshot_queue", "purchase_failure_snapshot_context")) {
             db.prepareStatement("SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=?").use {
                 it.setString(1, table)
@@ -137,6 +238,80 @@ class AgentDiagnosticStoreMigrationTest {
         assertEquals(1, rowCount(db))
     }
 
+    private fun assertV5Columns(db: Connection) {
+        val actual = mutableSetOf<String>()
+        db.createStatement().use { statement ->
+            statement.executeQuery("PRAGMA table_info(agent_diagnostic)").use { rows ->
+                while (rows.next()) {
+                    val name = rows.getString("name")
+                    if (name in V5_COLUMNS) {
+                        actual.add(name)
+                        assertEquals(name, "INTEGER", rows.getString("type"))
+                        assertEquals(name, 0, rows.getInt("notnull"))
+                        assertNull(name, rows.getObject("dflt_value"))
+                    }
+                }
+            }
+        }
+        assertEquals(V5_COLUMNS, actual)
+    }
+
+    private fun createOldDatabase(db: Connection, version: Int) {
+        db.createStatement().use { it.execute(CREATE_V1_TABLE_SQL) }
+        migrate(db, 1, version)
+        if (version >= 4) db.createStatement().use {
+            it.execute("INSERT INTO purchase_failure_snapshot VALUES ('attempt','test-origin',106,7,'spec_probe',1000,2000,'test','ready','{}',X'0102','test-fingerprint',2)")
+            it.execute("INSERT INTO purchase_failure_snapshot_queue VALUES ('attempt','test-fingerprint',1500,2)")
+            it.execute("INSERT INTO purchase_failure_snapshot_context VALUES ('attempt','test-origin','{}',1000)")
+        }
+    }
+
+    private fun insertOldDiagnostic(db: Connection) {
+        db.createStatement().use {
+            it.execute("INSERT INTO agent_diagnostic (task_id,stage,reason,attempt,elapsed_ms,agent_version,created_at) VALUES (106,'COLOR_DISCOVERY','COLOR_EDGE_REACHED',2,10,'old',1000)")
+        }
+    }
+
+    private fun assertOldDiagnosticPreserved(db: Connection) {
+        assertEquals(1, rowCount(db))
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT id,task_id,stage,reason,attempt,elapsed_ms,agent_version,created_at,color_vertical_swipe_count,color_trailing_empty_read_count,color_horizontal_incomplete FROM agent_diagnostic").use {
+                assertTrue(it.next())
+                assertEquals(1L, it.getLong(1))
+                assertEquals(106L, it.getLong(2))
+                assertEquals("COLOR_DISCOVERY", it.getString(3))
+                assertEquals("COLOR_EDGE_REACHED", it.getString(4))
+                assertEquals(2, it.getInt(5))
+                assertEquals(10L, it.getLong(6))
+                assertEquals("old", it.getString(7))
+                assertEquals(1000L, it.getLong(8))
+                for (index in 9..11) assertNull(it.getObject(index))
+            }
+        }
+    }
+
+    private fun snapshotTables(db: Connection): Map<String, List<List<String?>>> =
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'purchase_failure_snapshot%'").use { rows ->
+                buildList { while (rows.next()) add(rows.getString(1)) }
+            }
+        }.associateWith { tableRows(db, it) }
+
+    private fun tableRows(db: Connection, table: String): List<List<String?>> =
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT * FROM $table ORDER BY attempt_id").use { rows ->
+                buildList {
+                    while (rows.next()) add((1..rows.metaData.columnCount).map { rows.getString(it) })
+                }
+            }
+        }
+
+    private fun migrate(db: Connection, oldVersion: Int, newVersion: Int) {
+        AgentDiagnosticSchema.migrationStatements(oldVersion, newVersion, columnNames(db)).forEach { sql ->
+            db.createStatement().use { it.execute(sql) }
+        }
+    }
+
     private fun migrateV1ToV2(db: Connection) {
         AgentDiagnosticSchema.v2MigrationStatements(1, 2, columnNames(db)).forEach { sql ->
             db.createStatement().use { it.execute(sql) }
@@ -166,6 +341,7 @@ class AgentDiagnosticStoreMigrationTest {
     }
 
     private companion object {
+        val V5_COLUMNS = setOf("color_vertical_swipe_count", "color_trailing_empty_read_count", "color_horizontal_incomplete")
         val CREATE_V1_TABLE_SQL =
             """CREATE TABLE agent_diagnostic (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,

android/app/src/test/java/cn/ilapage/goauto/agent/service/RepurchaseBatchTest.kt

@@ -0,0 +1,241 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.HistoryPage
+import cn.ilapage.goauto.agent.network.PurchaseHistoryItem
+import org.junit.Assert.*
+import org.junit.Test
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+import java.util.TimeZone
+
+class RepurchaseBatchTest {
+    private val now = 1_791_446_400_000L
+    private fun at(secondsAgo: Long) = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'", Locale.ROOT).apply {
+        timeZone = TimeZone.getTimeZone("UTC")
+    }.format(Date(now - secondsAgo * 1000))
+
+    private fun item(id: Long, secondsAgo: Long = 0, status: String = "failed", retryable: Boolean = true) = PurchaseHistoryItem(
+        id, status, "synthetic", "synthetic", "synthetic", "", "", "", "", 1, null, "CNY", null, null,
+        null, null, retryable, if (retryable) null else "不可重试", at(secondsAgo),
+    )
+
+    private fun discover(items: List<PurchaseHistoryItem>): RepurchaseBatch = RepurchaseBatchDiscovery({ q ->
+        HistoryPage(items.drop((q.page - 1) * 50).take(50), items.size.toLong(), q.page, 50)
+    }, { now }).discover()
+
+    private fun refused(reason: RepurchaseBatchFailure, block: () -> Unit) {
+        try { block(); fail("Expected $reason") } catch (e: RepurchaseBatchException) { assertEquals(reason, e.reason) }
+    }
+
+    @Test fun sixtySecondsJoinsTransitivelyButSixtyOneStartsOlderBatch() {
+        val batch = discover(listOf(item(5), item(4, 60), item(3, 120), item(2, 181), item(1, 182)))
+        assertEquals(listOf(5L, 4L, 3L), batch.items.map { it.taskId })
+        assertEquals(at(0), batch.newestCreatedAt)
+        assertEquals(at(120), batch.oldestCreatedAt)
+        assertEquals(5L, batch.headTaskId)
+    }
+
+    @Test fun equalInstantsUseDescendingIdsAndRespectTimezones() {
+        val batch = discover(listOf(item(3).copy(createdAt = "2026-10-08T08:00:00.123456789+08:00"),
+            item(2).copy(createdAt = "2026-10-08T00:00:00.123456789Z"),
+            item(1).copy(createdAt = "2026-10-07T20:00:00.123456789-04:00")))
+        assertEquals(listOf(3L, 2L, 1L), batch.items.map { it.taskId })
+    }
+
+    @Test fun subMillisecondGapAboveSixtySecondsIsBoundary() {
+        val batch = discover(listOf(item(2).copy(createdAt = "2026-10-08T00:01:00.000000001Z"),
+            item(1).copy(createdAt = "2026-10-08T00:00:00Z")))
+        assertEquals(listOf(2L), batch.items.map { it.taskId })
+    }
+
+    @Test fun readsFullStateHistoryAcrossFiftyItemBoundaryAndRechecksHead() {
+        val requests = mutableListOf<RepurchaseHistoryQuery>()
+        val data = (70L downTo 1).map { item(it, 70 - it, if (it % 2 == 0L) "failed" else "order_created") }
+        val result = RepurchaseBatchDiscovery({ q ->
+            requests += q
+            HistoryPage(data.drop((q.page - 1) * 50).take(50), 70, q.page, 50)
+        }, { now }).discover()
+        assertEquals(70, result.items.size)
+        assertEquals(35, result.candidates.size)
+        assertEquals(listOf(1, 2, 1), requests.map { it.page })
+        assertTrue(requests.all { it.days == 30 && it.pageSize == 50 && it.status == null && it.taskNo == null })
+    }
+
+    @Test fun overlappingPagesDeduplicateTaskIdsBeforeBoundary() {
+        val data = (60L downTo 1).map { item(it, if (it >= 10) 60 - it else 300) }
+        val result = RepurchaseBatchDiscovery({ q ->
+            val page = if (q.page == 1) data.take(50) else data.drop(49)
+            HistoryPage(page, 61, q.page, 50)
+        }, { now }).discover()
+        assertEquals(51, result.items.size)
+        assertEquals(51, result.items.map { it.taskId }.distinct().size)
+    }
+
+    @Test fun headChangeRefusesEvenWhenBoundaryAlreadyFound() {
+        var calls = 0
+        refused(RepurchaseBatchFailure.LIST_CHANGED) {
+            RepurchaseBatchDiscovery({ q ->
+                calls++
+                HistoryPage(if (calls == 1) listOf(item(2), item(1, 100)) else listOf(item(3), item(2), item(1, 100)),
+                    if (calls == 1) 2 else 3, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun invalidDatesAndMissingZonesAreRefused() {
+        listOf("", "2026-02-30T00:00:00Z", "2026-10-08T00:00:00", "2026-10-08T00:00:00+25:00", "2026-10-08T00:00:00Zjunk").forEach {
+            refused(RepurchaseBatchFailure.INVALID_TIMESTAMP) { discover(listOf(item(1).copy(createdAt = it))) }
+        }
+    }
+
+    @Test fun invertedChronologicalOrIdOrderingIsRefused() {
+        refused(RepurchaseBatchFailure.INVALID_ORDER) { discover(listOf(item(2, 20), item(1))) }
+        refused(RepurchaseBatchFailure.INVALID_ORDER) { discover(listOf(item(1), item(2))) }
+    }
+
+    @Test fun nearThirtyDayCutoffCannotProveBatchComplete() {
+        val days30 = 30L * 24 * 60 * 60
+        listOf(days30, days30 - 60, days30 - 61, days30 + 1).forEach { age ->
+            refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) { discover(listOf(item(1, age))) }
+        }
+        assertEquals(1, discover(listOf(item(1, days30 - 62))).items.size)
+    }
+
+    @Test fun usesServerResponseClockEvenWhenPhoneIsFiveMinutesSlow() {
+        val phoneNow = now
+        val serverNow = phoneNow + 5 * 60 * 1000
+        val ageFromPhoneSeconds = 30L * 24 * 60 * 60 - 5 * 60 - 30
+        var responseTime: Long? = null
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q ->
+                responseTime = serverNow
+                HistoryPage(listOf(item(1, ageFromPhoneSeconds)), 1, q.page, 50)
+            }, { checkNotNull(responseTime) }).discover()
+        }
+    }
+
+    @Test fun responseTimeIsNotRequiredBeforeFirstFetch() {
+        var responseTime: Long? = null
+        val batch = RepurchaseBatchDiscovery({ q ->
+            responseTime = now
+            HistoryPage(listOf(item(1)), 1, q.page, 50)
+        }, { checkNotNull(responseTime) }).discover()
+        assertEquals(1, batch.items.size)
+    }
+
+    @Test fun missingServerResponseClockRefusesWithoutPhoneClockFallback() {
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q -> HistoryPage(listOf(item(1)), 1, q.page, 50) },
+                { error("No server Date") }).discover()
+        }
+    }
+
+    @Test fun retainsLatestObservedServerClockWhenLaterResponseTimeRegresses() {
+        var responseTime = now
+        var calls = 0
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q ->
+                responseTime = if (++calls == 1) now + 300_000 else now
+                HistoryPage(listOf(item(1, 30L * 24 * 60 * 60 - 330)), 1, q.page, 50)
+            }, { responseTime }).discover()
+        }
+    }
+
+    @Test fun exactlyFiftyRecordsCanEstablishTrustworthyEnd() {
+        val requested = mutableListOf<Int>()
+        val batch = RepurchaseBatchDiscovery({ q ->
+            requested += q.page
+            HistoryPage((50L downTo 1).map { item(it, 50 - it) }, 50, q.page, 50)
+        }, { now }).discover()
+        assertEquals(50, batch.items.size)
+        assertEquals(listOf(1, 1), requested)
+    }
+
+    @Test fun latestSuccessfulBatchDoesNotFallBackToOlderFailures() {
+        val result = discover(listOf(item(2, status = "order_created"), item(1, 61)))
+        assertEquals(1, result.items.size)
+        assertTrue(result.failures.isEmpty())
+        assertTrue(result.candidates.isEmpty())
+    }
+
+    @Test fun onlyFailedRetryableAreCandidatesAndSecondRoundUsesRemainingFailures() {
+        val items = (10L downTo 1).map { item(it, status = if (it <= 4) "failed" else "order_created") }
+        val first = discover(items)
+        assertEquals(listOf(4L, 3L, 2L, 1L), first.candidates.map { it.taskId })
+        val second = discover(items.map { if (it.taskId in 3L..4L) it.copy(status = "order_created") else it })
+        assertEquals(listOf(2L, 1L), second.candidates.map { it.taskId })
+        val blocked = discover(listOf(item(2, retryable = false), item(1, status = "pending")))
+        assertEquals(1, blocked.failures.size)
+        assertEquals("不可重试", blocked.skips.single().retryDisabledReason)
+        assertTrue(blocked.candidates.isEmpty())
+    }
+
+    @Test fun pageFailureCannotReturnPartOfBatch() {
+        refused(RepurchaseBatchFailure.PAGE_FAILED) {
+            RepurchaseBatchDiscovery({ q ->
+                if (q.page == 2) error("synthetic network failure")
+                HistoryPage((60L downTo 11).map { item(it, 60 - it) }, 60, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun shortPageWithUnseenTotalAndWrongMetadataAreRefused() {
+        listOf(HistoryPage(listOf(item(1)), 2, 1, 50), HistoryPage(listOf(item(1)), 1, 2, 50),
+            HistoryPage(listOf(item(1)), 1, 1, 20), HistoryPage(emptyList(), -1, 1, 50)).forEach { page ->
+            refused(RepurchaseBatchFailure.INVALID_PAGE) { RepurchaseBatchDiscovery({ page }, { now }).discover() }
+        }
+    }
+
+    @Test fun maximumPagesCannotReturnTruncatedBatch() {
+        refused(RepurchaseBatchFailure.PAGE_LIMIT) {
+            RepurchaseBatchDiscovery({ q -> HistoryPage((60L downTo 11).map { item(it, 60 - it) }, 60, q.page, 50) },
+                { now }, maxPages = 1).discover()
+        }
+    }
+
+    @Test fun crossPageOrderInversionAndChangedDuplicateTimestampAreRefused() {
+        listOf(item(1, 1), item(11, 99)).forEach { next ->
+            refused(RepurchaseBatchFailure.INVALID_ORDER) {
+                RepurchaseBatchDiscovery({ q ->
+                    HistoryPage(if (q.page == 1) (60L downTo 11).map { item(it, 60 - it) } else listOf(next),
+                        51, q.page, 50)
+                }, { now }).discover()
+            }
+        }
+    }
+
+    @Test fun duplicatesCannotMakeAnIncompleteTailLookComplete() {
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q ->
+                HistoryPage(if (q.page == 1) (60L downTo 11).map { item(it, 60 - it) } else listOf(item(11, 49)),
+                    51, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun failedHeadRecheckRefusesTheAlreadyFoundBatch() {
+        var calls = 0
+        refused(RepurchaseBatchFailure.PAGE_FAILED) {
+            RepurchaseBatchDiscovery({ q ->
+                if (++calls > 1) error("synthetic network failure")
+                HistoryPage(listOf(item(1)), 1, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun emptyHistoryIsRecheckedAndReturnedEmpty() {
+        var calls = 0
+        val batch = RepurchaseBatchDiscovery({ q -> calls++; HistoryPage(emptyList(), 0, q.page, 50) }, { now }).discover()
+        assertTrue(batch.items.isEmpty())
+        assertNull(batch.headTaskId)
+        assertEquals(2, calls)
+    }
+
+    @Test fun immutableSnapshotDoesNotExposeMutableLists() {
+        val batch = discover(listOf(item(1)))
+        listOf(batch.items, batch.candidates, batch.failures).forEach { items ->
+            try { (items as MutableList).clear(); fail("Mutable snapshot") } catch (_: UnsupportedOperationException) { }
+        }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/service/RepurchaseCoordinatorTest.kt

@@ -0,0 +1,182 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.*
+import org.junit.Assert.*
+import org.junit.Test
+import java.io.IOException
+
+class RepurchaseCoordinatorTest {
+    private fun item(id: Long, status: String = "failed", retryable: Boolean = true, error: String? = null) = PurchaseHistoryItem(
+        id, status, "", "", "", "", "", "", "", 1, null, "CNY", null, null, error, null, retryable, "不可重试", "2026-10-08T09:00:00Z")
+    private fun detail(id: Long, status: String = "failed", count: Long = 1, retryable: Boolean = true, error: String? = null) =
+        PurchaseHistoryDetail(item(id, status, retryable, error), count, error, null, false, null, null, null, null, false, null)
+    private inner class Fake : RepurchasePort {
+        var clock = 0L
+        var busy = false
+        var otherWork = false
+        var environment: String? = null
+        var head: Long? = 2L
+        var resetFailure: Exception? = null
+        var failOnce = false
+        var duringReset: (() -> Unit)? = null
+        val details = mutableMapOf(2L to this@RepurchaseCoordinatorTest.detail(2), 1L to this@RepurchaseCoordinatorTest.detail(1))
+        val resets = mutableListOf<Pair<Long, String>>()
+        var evidence = emptyList<RepurchaseExecutionEvidence>()
+        override fun executionEvidence(taskId: Long) = evidence
+        override fun environmentProblem() = environment
+        override fun localIdle() = !busy
+        override fun hasOtherWork(currentTaskId: Long?) = otherWork
+        override fun latestTaskId() = head
+        override fun detail(taskId: Long) = details.getValue(taskId)
+        override fun reset(taskId: Long, requestId: String): PurchaseResetResult {
+            resets += taskId to requestId
+            duringReset?.invoke()
+            resetFailure?.let { if (failOnce) resetFailure = null; throw it }
+            return PurchaseResetResult(taskId, "CG-$taskId", 2, "pending", resets.size > 1)
+        }
+        fun runner(): RepurchaseCoordinator {
+            var sequence = 0
+            return RepurchaseCoordinator({ clock }, { "request-${++sequence}" }, {}).also {
+                assertTrue(it.prepare())
+                it.prepared(RepurchaseBatch(listOf(item(2), item(1))))
+                it.confirm(it.state.roundId)
+            }
+        }
+    }
+
+    @Test fun serialResetsWaitForNewAttemptAndLocalDrain() {
+        val p = Fake(); val r = p.runner()
+        r.tick(p); assertEquals(listOf(2L), p.resets.map { it.first })
+        r.tick(p); assertEquals(0, r.state.results.size) // old failed, attempt1
+        p.details[2] = detail(2, "order_created", 2); p.busy = true
+        r.tick(p); assertEquals(0, r.state.results.size)
+        p.busy = false; r.tick(p); assertEquals(1, r.state.successCount)
+        r.tick(p); assertEquals(listOf(2L, 1L), p.resets.map { it.first })
+        p.details[1] = detail(1, count = 2); r.tick(p); r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertEquals(1, r.state.failedCount); assertEquals(2, p.resets.size)
+    }
+    @Test fun lostResetResponseUsesSameRequestIdAndReplayIsNotTerminal() {
+        val p = Fake(); val r = p.runner(); p.resetFailure = IOException(); p.failOnce = true
+        r.tick(p); r.tick(p)
+        assertEquals(2, p.resets.size); assertEquals(p.resets[0], p.resets[1])
+        assertEquals(0, r.state.results.size)
+    }
+    @Test fun unresolvedMappedValuesDoNotPreventReset() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        assertEquals(2L, p.resets.single().first)
+    }
+    @Test fun definiteBusinessRefusalSkipsButNetworkAmbiguityStops() {
+        val p = Fake(); val r = p.runner()
+        p.resetFailure = AgentApiException(409, "PURCHASE_RETRY_STALE", "safe", false)
+        r.tick(p); assertEquals(1, r.state.skippedCount)
+        p.resetFailure = IOException(); r.tick(p); r.tick(p)
+        assertTrue(r.state.phase in setOf(RepurchasePhase.STOPPING, RepurchasePhase.FINISHED))
+        assertEquals(3, p.resets.size)
+    }
+    @Test fun newWorkStopsSubsequentButNotCurrent() {
+        val p = Fake(); val r = p.runner(); r.tick(p); p.otherWork = true
+        r.tick(p); assertEquals(RepurchasePhase.STOPPING, r.state.phase)
+        p.details[2] = detail(2, "order_created", 2); r.tick(p); r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertEquals(1, p.resets.size)
+    }
+    @Test fun stopBeforeResetIssuesNothingAndStaleStopIgnored() {
+        val p = Fake(); val r = p.runner(); r.requestStop("old"); r.tick(p)
+        assertEquals(1, p.resets.size)
+        val p2 = Fake(); val r2 = p2.runner(); r2.requestStop(r2.state.roundId); r2.tick(p2)
+        assertEquals(0, p2.resets.size); assertEquals(RepurchasePhase.FINISHED, r2.state.phase)
+    }
+    @Test fun stopDuringIssuedResetAllowsOnlyCurrentToDrain() {
+        val p = Fake(); val r = p.runner(); p.duringReset = { r.requestStop(r.state.roundId) }
+        r.tick(p); p.details[2] = detail(2, "order_created", 2); r.tick(p); r.tick(p)
+        assertEquals(1, p.resets.size); assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+    }
+    @Test fun timeoutStopsOrchestrationWithoutAnotherReset() {
+        val p = Fake(); val r = p.runner(); r.tick(p); p.clock = 15 * 60 * 1000L
+        r.tick(p); assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertEquals(1, p.resets.size)
+    }
+    @Test fun unknownAndCaptchaStopTheRound() {
+        for ((status, error) in listOf("order_result_unknown" to null, "failed" to "PDD_CAPTCHA_REQUIRED")) {
+            val p = Fake(); val r = p.runner(); r.tick(p); p.details[2] = detail(2, status, 2, error = error)
+            r.tick(p); r.tick(p)
+            assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertEquals(1, p.resets.size)
+        }
+    }
+    @Test fun headChangedOrEnvironmentUnavailableDoesNotReset() {
+        val p = Fake(); val r = p.runner(); p.head = 3; r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertTrue(p.resets.isEmpty())
+        val p2 = Fake(); val r2 = p2.runner(); p2.environment = "无障碍未开启"; r2.tick(p2)
+        assertEquals(RepurchasePhase.FINISHED, r2.state.phase); assertTrue(p2.resets.isEmpty())
+    }
+    @Test fun busyHasBoundedDrainAndProcessRestartDoesNotRestoreRound() {
+        val p = Fake(); val r = p.runner(); p.busy = true; r.tick(p)
+        p.clock = 10000; r.tick(p); assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertFalse(RepurchaseCoordinator({0}, {"x"}, {}).state.busy)
+    }
+    @Test fun noRetryableCandidatesDoesNotConfirmOrFallBack() {
+        val r = RepurchaseCoordinator({0}, {"x"}, {})
+        r.prepare(); r.prepared(RepurchaseBatch(listOf(item(3, "order_created"))))
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        r.confirm(r.state.roundId); assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+    }
+
+    @Test fun definiteEnvironmentRefusalStopsWithoutPretendingTaskWasIssued() {
+        val p = Fake(); val r = p.runner()
+        p.resetFailure = AgentApiException(401, "DEVICE_TOKEN_INVALID", "unauthorized", false)
+        r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertNull(r.state.currentTaskId)
+        assertEquals(1, p.resets.size)
+    }
+
+    @Test fun secondRoundOnlyUsesStillFailedCandidates() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        p.details[2] = detail(2, "order_created", 2); r.tick(p); r.tick(p)
+        p.details[1] = detail(1, count = 2); r.tick(p)
+        assertTrue(r.prepare())
+        r.prepared(RepurchaseBatch(listOf(item(2, "order_created"), item(1))))
+        assertEquals(listOf(1L), r.state.batch!!.candidates.map { it.taskId })
+        r.confirm(r.state.roundId)
+        // New reset must return a strictly newer attempt than the refreshed detail.
+        p.details[1] = detail(1)
+        r.tick(p)
+        assertEquals(listOf(2L, 1L, 1L), p.resets.map { it.first })
+    }
+
+    @Test fun unexpectedExceptionDoesNotLeakRawErrorOrSkipRest() {
+        val p = Fake(); val r = p.runner(); p.resetFailure = IOException("private remote body")
+        r.tick(p)
+        assertFalse(r.state.message.contains("private"))
+        assertEquals(RepurchasePhase.STOPPING, r.state.phase)
+        assertEquals(listOf(2L, 2L), p.resets.map { it.first })
+    }
+
+    @Test fun externalLaterAttemptIsNotCountedAsThisRoundsResult() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        p.details[2] = detail(2, "order_created", 3)
+        p.evidence = listOf(RepurchaseExecutionEvidence(2, "attempt2", "purchase", "failed"),
+            RepurchaseExecutionEvidence(3, "attempt3", "purchase", "order_created"))
+        r.tick(p); r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertEquals(0, r.state.successCount); assertEquals(1, p.resets.size)
+    }
+
+    @Test fun completedProbeCanLinkToOriginalExecutorsNextPurchaseAttempt() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        p.details[2] = detail(2, "order_created", 3)
+        p.evidence = listOf(RepurchaseExecutionEvidence(2, "probe2", "spec_probe", "spec_probe_completed"),
+            RepurchaseExecutionEvidence(3, "purchase3", "purchase", "order_created"))
+        r.tick(p)
+        assertEquals(1, r.state.successCount)
+        r.tick(p); assertEquals(listOf(2L, 1L), p.resets.map { it.first })
+    }
+
+    @Test fun localReservationBusyNeverPretendsARequestWasSentAndUsesSameId() {
+        val p = Fake(); val r = p.runner(); p.resetFailure = RepurchaseLocalBusy(); p.failOnce = true
+        r.tick(p); assertNull(r.state.currentTaskId); assertEquals(RepurchasePhase.RUNNING, r.state.phase)
+        r.tick(p); assertEquals(p.resets[0], p.resets[1])
+        val p2 = Fake(); val r2 = p2.runner(); p2.resetFailure = RepurchaseLocalBusy()
+        r2.tick(p2); p2.clock = 10000; r2.tick(p2)
+        assertEquals(RepurchasePhase.FINISHED, r2.state.phase); assertNull(r2.state.currentTaskId)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/service/RepurchaseStateTest.kt

@@ -0,0 +1,34 @@
+package cn.ilapage.goauto.agent.service
+
+import org.junit.Assert.*
+import org.junit.Test
+
+class RepurchaseStateTest {
+    @Test fun confirmationExplainsOriginalTaskAndUnpaidOrderRisk() {
+        val state = RepurchaseState(phase = RepurchasePhase.READY)
+        assertTrue(state.confirmationText().contains("不会付款"))
+        assertTrue(state.confirmationText().contains("原任务号"))
+        assertTrue(state.confirmationText().contains("15分钟"))
+        assertTrue(state.confirmationText().contains("60秒"))
+    }
+
+    @Test fun readingReadyRunningAndStoppingPreventDuplicateRounds() {
+        for (phase in listOf(RepurchasePhase.READING, RepurchasePhase.READY, RepurchasePhase.RUNNING, RepurchasePhase.STOPPING)) {
+            assertTrue(RepurchaseState(phase = phase).busy)
+        }
+        assertFalse(RepurchaseState().busy)
+        assertFalse(RepurchaseState(phase = RepurchasePhase.FINISHED).busy)
+    }
+
+    @Test fun countsDoNotMarkUnexecutedItemsAsFailures() {
+        val state = RepurchaseState(results = listOf(
+            RepurchaseItemResult(1, RepurchaseResult.SUCCESS, "订单已创建"),
+            RepurchaseItemResult(2, RepurchaseResult.FAILED, "再次失败"),
+            RepurchaseItemResult(3, RepurchaseResult.SKIPPED, "不可重试"),
+        ))
+        assertEquals(1, state.successCount)
+        assertEquals(1, state.failedCount)
+        assertEquals(1, state.skippedCount)
+        assertTrue(state.summaryText().contains("成功 1"))
+    }
+}

android/app/src/testDebug/java/cn/ilapage/goauto/agent/BrowserProbeClickPolicyTest.kt

@@ -0,0 +1,25 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.diagnostics.BrowserProbeClickPolicy
+import org.junit.Assert.*
+import org.junit.Test
+
+class BrowserProbeClickPolicyTest {
+    @Test fun onlyExactNativeBrowserEntryIsAllowed() {
+        assertTrue(BrowserProbeClickPolicy.allowed("com.heytap.browser", "com.heytap.browser", "打开拼多多APP", true, true, true, 3, 3))
+    }
+    @Test fun rejectsPackageSwitchHiddenDisabledNonClickableAndStaleWindow() {
+        fun allowed(root: String? = "com.heytap.browser", node: String? = root, label: String = "打开拼多多APP",
+                    visible: Boolean = true, enabled: Boolean = true, clickable: Boolean = true, window: Int = 3) =
+            BrowserProbeClickPolicy.allowed(root, node, label, visible, enabled, clickable, 3, window)
+        assertFalse(allowed(root = "com.xunmeng.pinduoduo"))
+        assertFalse(allowed(node = "com.xunmeng.pinduoduo"))
+        assertFalse(allowed(root = null))
+        assertFalse(allowed(label = "打开"))
+        assertFalse(allowed(label = "立即支付"))
+        assertFalse(allowed(visible = false))
+        assertFalse(allowed(enabled = false))
+        assertFalse(allowed(clickable = false))
+        assertFalse(allowed(window = 4))
+    }
+}

android/app/src/testDebug/java/cn/ilapage/goauto/agent/NavigationProbeTest.kt

@@ -0,0 +1,107 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.diagnostics.NavigationProbe
+import org.junit.Assert.*
+import org.junit.Test
+
+class NavigationProbeTest {
+    @Test fun cancellationDuringInitialCapturePreventsLaunch() {
+        var active = true
+        var launches = 0
+        val page = UiSnapshot("com.xunmeng.pinduoduo", null, emptyList())
+        NavigationProbe(capture = { active = false; page }, launch = { launches++; true },
+            clickBrowserEntry = { error("no click") }, now = { 0 }, pause = {}, emit = {},
+            isActive = { active }).run()
+        assertEquals(0, launches)
+    }
+    @Test fun deadlineCrossedDuringCapturePreventsLaunch() {
+        var clock = 0L
+        var launches = 0
+        NavigationProbe(capture = { clock = 20_001; UiSnapshot(null, null, emptyList()) },
+            launch = { launches++; true }, clickBrowserEntry = { error("no click") }, now = { clock },
+            pause = {}, emit = {}).run()
+        assertEquals(0, launches)
+    }
+    @Test fun cancellationDuringBrowserCapturePreventsClick() {
+        var active = true
+        var reads = 0
+        var clock = 0L
+        var clicks = 0
+        val page = UiSnapshot("com.heytap.browser", null, listOf(node("打开拼多多APP")))
+        NavigationProbe(capture = { reads++; if (reads > 1) active = false; page }, launch = { true },
+            clickBrowserEntry = { clicks++; FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS) },
+            now = { clock }, pause = { clock += it }, emit = {}, isActive = { active }).run()
+        assertEquals(0, clicks)
+    }
+    @Test fun baselineUsesActualPackageRatherThanOptionalParserEvidence() {
+        val rig = Rig(UiSnapshot("com.heytap.browser", null, listOf(node("发起拼单"))))
+        rig.run()
+        assertTrue(rig.lines.first().contains("pdd=false"))
+        assertFalse(rig.lines.any { it.contains("legacy_would_accept") })
+    }
+    private class Rig(var page: UiSnapshot) {
+        var clock = 0L
+        var launches = 0
+        var clicks = 0
+        val lines = mutableListOf<String>()
+        fun run(accepted: Boolean = true) = NavigationProbe(
+            capture = { page },
+            launch = { report -> launches++; report(PddLaunchEvent(PddLaunchPath.DIRECT, PddLaunchStatus.ACCEPTED)); accepted },
+            clickBrowserEntry = { clicks++; FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS) },
+            now = { clock }, pause = { clock += it }, emit = lines::add,
+        ).run()
+    }
+    private fun node(text: String, path: String = "0") = SnapshotNode(path, null, text, null, null,
+        "android.widget.TextView", NodeBounds(0, 0, 100, 100), true, false, false, false, true, true)
+
+    @Test fun pddIsReadOnlyAndSamplingStopsWithinBound() {
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, listOf(node("立即下单"))))
+        rig.run()
+        assertEquals(1, rig.launches)
+        assertEquals(0, rig.clicks)
+        assertEquals(20_000L, rig.clock)
+        assertTrue(rig.lines.last().contains("finished"))
+    }
+    @Test fun failedLaunchStopsWithoutClicking() {
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, emptyList()))
+        rig.run(false)
+        assertEquals(1, rig.launches)
+        assertEquals(0L, rig.clock)
+        assertEquals(0, rig.clicks)
+        assertTrue(rig.lines.last().contains("launch_failed"))
+    }
+    @Test fun browserRequiresUniqueExplicitPddEntryAndBoundedRetries() {
+        val rig = Rig(UiSnapshot("com.heytap.browser", null, listOf(node("打开拼多多APP"))))
+        rig.run()
+        assertEquals(3, rig.clicks)
+    }
+    @Test fun ambiguousBrowserEntryStopsWithoutGuessing() {
+        val rig = Rig(UiSnapshot("com.heytap.browser", null, listOf(node("打开拼多多APP"), node("打开拼多多APP", "1"))))
+        rig.run()
+        assertEquals(0, rig.clicks)
+        assertTrue(rig.lines.last().contains("browser_ambiguous"))
+    }
+    @Test fun genericOpenAndPddControlsAreNeverClicked() {
+        for (pkg in listOf("com.heytap.browser", "com.xunmeng.pinduoduo", "other.package")) {
+            val rig = Rig(UiSnapshot(pkg, null, listOf(node("打开"), node("立即支付"), node("确认订单"))))
+            rig.run()
+            assertEquals(0, rig.clicks)
+            assertTrue(rig.lines.isNotEmpty())
+        }
+    }
+    @Test fun loginOrCaptchaStopsBeforeLaunch() {
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, listOf(node("手机号登录"))))
+        rig.run()
+        assertEquals(0, rig.launches)
+        assertEquals(0, rig.clicks)
+        assertTrue(rig.lines.last().contains("page_problem"))
+    }
+    @Test fun pageTextAndExceptionMessagesNeverAppearInOutput() {
+        val secret = "PRIVATE_ACCOUNT_ADDRESS_DO_NOT_LOG"
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, listOf(node(secret))))
+        rig.run()
+        assertTrue(rig.lines.isNotEmpty())
+        assertFalse(rig.lines.joinToString().contains(secret))
+    }
+}

docs/02-architecture-and-code-map.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Architecture-and-Code-Map
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: b3d1c9b7ba1dd5820a20e59b0c21a971aaf1b8ee
-synchronized_at: 2026-10-08T01:41:51Z
+wiki_revision: 76854d900b2372ddedd46a2b82b5677d8bf5cb31
+synchronized_at: 2026-10-09T06:46:07Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -63,7 +63,7 @@ Android Portal/Agent
 - 重置在事务中清空原结果，保留 URL、goods_id、规则和设备快照，状态恢复为 `pending`。
 - Android 本地互斥与服务端原子领取共同保证单设备串行。
 - 正式采购在 Android 本地 SQLite 事务中先保存不可逆状态、稳定服务端请求 ID 和脱敏最终确认快照，再通知服务端并只允许一次创建订单点击；重启后只重放服务端标记、只读核单或上报，不再次点击。
-- 原始控件树和截图不持久化；Android Agent 端第一期不使用 OCR/VLM。服务端 SYB 登录验证码识别是唯一例外，见 [#48](https://git.ilapage.cn/OPC/goauto/issues/48)。
+- 普通原始控件树和截图不持久化；采购失败私有现场诊断是 #364 的限定例外，见本页对应节；Android Agent 端第一期不使用 OCR/VLM。服务端 SYB 登录验证码识别是唯一例外，见 [#48](https://git.ilapage.cn/OPC/goauto/issues/48)。
 - 蝦皮规格映射独立保存在 `shopee_product.specs_json`：颜色只能选择关联 PDD 当前可选颜色，允许多个蝦皮颜色共用一个 PDD 颜色。Admin 商品详情的“一键匹配颜色和尺码”在服务端统一计算两个维度：保留当前仍有效的已确认映射，将唯一确定匹配及达到阈值、具备理由且候选仍有效的 AI 匹配，在重新校验规格上下文后于同一事务直接写为 `confirmed`，无需人工确认；低置信度或无结果保持未匹配，Provider 异常或上下文变化时不写入任何本次结果。PDD 目标规格消失后页面标记失效，映射保存和采购创建均拒绝继续使用；无需新增数据库表或 Android 能力。
 
 ## 最小业务数据
@@ -639,3 +639,37 @@ Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态
 - 因预算超时不能再使用已取消context写统计，收尾仅使用最多5秒的独立上下文执行受所有权保护的完成更新，不启动新商品领取或AI调用；失租不强制落库。
 - MySQL默认返回实际修改行数；续租更新返回0时，只在当前持有行锁的事务内再次核验owner/状态/槽位/实时有效租约，以区分同毫秒值未变化与真实失租；其他完成/工作项更新仍要求恰好一行。
 - AI配置读取先返回数据库错误，再判断停用，避免基础设施错误被误记为业务跳过。仅批次私有上下文把基础设施错误作为本轮错误终止；普通单商品Provider重试策略保持不变。
+
+
+## 采购失败现场诊断（#364，待真机验收）
+
+实现绑定 `4581ee5`，后续合并记录见 #364；尚未发布。以下是普通原始控件树禁存规则的限定例外；普通采集、截图、OCR/VLM 和付款边界不变。
+
+- Android `diagnostics/FailureSnapshotCapture.kt` 统一判断失败/待核对、成功排除及既有 ZIP；`FailureSnapshotExporter.kt` 独立导出有限公开属性，`AccessibilitySnapshotSource.kt` 只读默认显示屏交互窗口，不改变正常 `capture()` 或解析器。
+- `AgentForegroundService` 在有效实际 attempt 的失败结果或执行异常处同步有界截取，先于新提示/返回/下一任务；恢复场景单独标识。成功结果后的保存/提示/上传异常不创建失败快照，不改变原业务状态和不可逆标记。
+- `goauto_diagnostics.db` 升级 v4；独立 `purchase_failure_snapshot`、`purchase_failure_snapshot_queue`、`purchase_failure_snapshot_context` 表。旧 `agent_diagnostic` 保持 7 天/50 条，新快照30天/64MiB逻辑容量。SQL 核心 `FailureSnapshotRepository` 共用真实 SQLite 测试，Android适配器以256KiB块读取BLOB，避开CursorWindow单行限制。
+- 队列绑定 Server Origin；已保存 ZIP 不覆盖，旧上传响应凭 fingerprint 不得清除首次恢复 ZIP 的新队列项。结果 Outbox 优先，诊断独立后台线程只上传已存字节，不持有设备任务锁；启动及每60秒执行维护。
+- Server `purchase/failure_snapshot*.go` 提供专用上传/安全摘要/管理员ZIP下载；`models/purchase_failure_snapshot.go` 独立私有表。追加迁移 `1791400000000_purchase_failure_snapshot.go` 保存 LONGBLOB ZIP、LONGTEXT manifest、attempt唯一约束及到期索引。
+- `access.AdminAPIs` 注册两个仅管理员读取接口；普通任务DTO和Client API不增加原始诊断字段。通用操作日志精确排除三个诊断端点，私有SQL读写使用静默logger。服务启动立即清理并每小时清理过期诊断，不依赖新任务。
+- Web `purchase-tasks/FailureSnapshotCell.vue` 是现有执行记录末尾200px管理员专属列，独立摘要查询、固定原因中文和附件下载；无原始XML在线预览。
+
+
+## Android 重购编排（#367）
+
+实现绑定 `5430dc1`，2026-10-09 已合并 main `e26743c` 并安装集成APK；无Server/Web、数据库或接口迁移，真机批量采购仍待验收。
+
+- `TaskHistoryFragment` 把采购搜索栏入口改为“重购”，发送 PREPARE/CONFIRM/STOP、显示 Service 内存状态；一次确认与逐条摘要由 `RepurchaseState` 提供，不由 Fragment 驱动采购生命周期。
+- `RepurchaseBatchDiscovery` 注入既有设备历史查询和服务端HTTP Date时钟，负责全状态/50条页/30天窗口、相邻60秒边界、去重、完整性及重读首页；最多200页，不使用本地历史缓存执行重购。
+- `RepurchaseCoordinator` 通过小型 `RepurchasePort` 执行非阻塞状态推进；只调用原reset和只读详情，固定每任务requestId、expected attempt、10秒本地忙碌复核及15分钟单条上限。依靠原执行器的attemptNumber/UUID/phase/已知结果识别合法探测续行，拒绝外部更晚attempt冒充本轮结果。
+- `AgentForegroundService` 独立单线程scheduled executor每2秒推进编排，历史网络不阻塞心跳或taskExecutor；发现使用独享API客户端，reset只短暂预留既有TaskExecutionMutex。原scheduler继续唯一负责claim/start/真实PDD操作及Outbox，编排不持整轮锁、不新建执行器路径。
+- 新工作查询同时检查采集next、采购next及本设备活动状态历史，防止采购next优先返回本轮current而遮蔽其他pending。停止信号为原子roundId，配置/身份冻结，仅内存保存摘要；进程重启不恢复整轮，既有单任务恢复及失败私有诊断不变。
+- `AgentApiClient` 仅补读已有采购payload的attemptNumber和标准HTTP Date响应元数据；不添加服务端字段或API。Date缺失清空样本，不沿用手机时间。
+
+## Android 颜色发现诊断追加（#370 第一阶段）
+
+实现绑定 `9e5f09a`，已合并 main，2026-10-09 随集成版本 `e26743c` 安装；本阶段不修改颜色遍历和采购结果判定。
+
+- `AgentDiagnosticSchema` 升至 v5，在 `agent_diagnostic` 追加可空 INTEGER `color_vertical_swipe_count`、`color_trailing_empty_read_count`、`color_horizontal_incomplete`；对应事件中的两个 Int? 和一个 Boolean?，Boolean 按 0/1 写入。新库包含列，v1–v4 逐级补齐并跳过已存在列，旧行新列为 NULL；不清表，不改独立采购失败快照、队列和 context。
+- `PddProductDetailCollector.collectColors` 只基于既有解析帧记录颜色阶段 UP 派发次数、空发现轮次和横向探索三态；不增加抓取、手势或等待。标签及签名只在内存使用，持久化仍为安全聚合。
+- 不新增 Server/Web API 字段、服务端迁移或权限；普通结果 payload/missing 与采购探测失败策略未改变。完整遍历与不完整候选拦截仍属 #370 后续待证据实施范围，不能把本地诊断值作为已实现的业务门禁。
+- 读取与三态限制见 Troubleshooting；旧版不保证降级打开 v5。JDBC 测试与实际 Android 安装升级分别验收，测试不代替真实竖向颜色采集验证。

docs/03-business-rules-and-glossary.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Business-Rules-and-Glossary
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Business-Rules-and-Glossary.-
-wiki_revision: 233b72e9e2415a2456bb8dd27c770df881960db4
-synchronized_at: 2026-10-08T01:42:04Z
+wiki_revision: 6c1a317ef67a0b015bb16a615b8c490b384188a0
+synchronized_at: 2026-10-09T07:21:39Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -213,7 +213,7 @@ Admin 的「创建时间」范围按 SYB 货运单列表的 `t_stock.created`（
 - 浏览器“打开拼多多APP”和系统确认框“打开”属于允许动作。
 - 登录失效、验证码、风控、人机验证和找不到唯一控件时失败并给出具体错误。
 - Android Agent 到 GoAuto 服务端默认使用 HTTPS。管理员可在明确接受 Device Token、任务内容、设备状态和执行结果被链路监听或篡改的风险后，通过服务端 `GOAUTO_ALLOW_INSECURE_AGENT_HTTP=true` 显式允许全部 `/api/agent/v1/**` 使用 HTTP；该例外不放宽 PDD、SYB、OCR 或其他第三方服务约束。
-- Android Agent 端不使用 OCR/VLM 兜底，不保存原始控件树或截图。采集阶段不猜测缺失数据。
+- Android Agent 端不使用 OCR/VLM 兜底；普通采集不保存原始控件树或截图，采集阶段不猜测缺失数据。采购失败私有现场诊断是 #364 的限定例外，见本页对应节；历史各节的结构化日志/普通接口禁存规则保持不变。
 - 服务端顺云宝（SYB）登录例外：允许调用配置的线上 OCR 服务识别登录验证码（见 [#48](https://git.ilapage.cn/OPC/goauto/issues/48)）。验证码图片会离开本项目发送到该服务，更换服务地址前必须重新评估。此例外只适用于 SYB 登录，不扩大到 Agent 端或任何 PDD 相关流程。
 - 采购阶段的规格匹配由服务端决策（见 [#46](https://git.ilapage.cn/OPC/goauto/issues/46)、[#62](https://git.ilapage.cn/OPC/goauto/issues/62)）：Agent 本地不得自行猜测规格或点击相近候选，只执行服务端下发的精确规格；AI Provider 只有一个 OpenAI-compatible 配置，由管理员维护。根据 #62 已确认的内部部署例外，API Key 明文保存在专用设置表，并只向管理员设置接口返回以便查看和替换；它仍不得写入代码、日志、工单、Wiki、任务快照、采购员接口或 Android 接口。Provider Base URL 不限制内网或公网，支持 HTTP/HTTPS；HTTP 不加密传输中的 API Key，生产环境建议 HTTPS。
 - 采购规则的 `openSpecPanel` 默认不写死页面文字。Agent 只在已由页面语义确认的规格入口或底部购买入口中选择；规则若提供 `textAliases`，只能进一步缩小这些安全候选，不能把任意同名页面文字变成可点击入口。
@@ -375,6 +375,8 @@ Admin 的「创建时间」范围按 SYB 货运单列表的 `t_stock.created`（
 
 ## SYB 采购强制当次规格探测（#215）
 
+以下为 #373 之前的复用行为；#373 分支的限定复用和等待规则见“采购页面一次性交接与导航稳定等待”章节，未安装新版不能按新规则判断。
+
 - 每个新 SYB 采购任务固定执行“首趟只读探测 → 服务端确定性优先/必要时 AI → 固化任务级精确规格 → 第二趟正式采购”。首趟只打开一次浏览器商品链接；匹配期间当前设备保留给同一任务，不领取其他采购或采集任务。连续进入第二趟且当前仍有 PDD 商品页或规格面板强证据时复用当前页、不再次打开链接；手动同任务重试，或当前处于 Agent、其他应用及缺少上述强证据时，重新打开任务固化的商品 URL。复用或重开均不严格核验标题、goodsId 或页面指纹，但仍要求 PDD 包名与商品/规格/订单页面结构安全证据。已有长期映射只作商品档案事实，不直接进入任务执行规格。
 - 首趟候选与 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和幂等结果哈希关联；第二趟失败不得回到首趟循环探测。备货 `stock/direct_select` 没有 SYB 目标规格，继续使用用户逐字选择的档案规格，不进入本规则。
 - 候选和 Provider 结果仅保存颜色、尺码原始标签及结构化决策，不保存控件树、整屏截图、账号、地址、订单或支付数据；付款仍永久禁止。
@@ -670,10 +672,21 @@ Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态
 
 实现分支 fix/325-order-result，2026-09-19；未部署、未真机验收。下单点击及不可逆边界不改。已知 PayActivity 允许一次原有 Back，随后从3次放宽为25次200ms采样（约5秒等待，不含页面捕获耗时），持续无证据仍为 PURCHASE_ORDER_PAYMENT_REPEATED。微信恢复、系统选择器、空窗口和陌生应用的既有边界保留。
 
-过渡阶段最多60次采样。首次识别到待付款证据后单独分配30次采样预算，不被之前绕路消耗，不因文字反复出现重置；核单总采样上限90次。缺少唯一订单号或时间时立即向上滑动读取下方内容，最多4次、手势400ms、每次后等500ms；读全立即停止，已有完整字段不滑动。该待付款读取分支不点击任何控件，也不点击付款。纯支付页不使用该滑动分支；出现可读待付款证据优先于复用的 Activity 名称。按采样间隔约18秒加有限手势/额外等待，实际耗时还含capture等调用；未改变2分钟任务租约或5分钟唤醒锁，也不宣称新增了执行器总体墙钟超时机制。
+原 #325 过渡阶段最多60次采样。首次识别到待付款证据后单独分配30次采样预算，不被之前绕路消耗，不因文字反复出现重置；原核单总采样上限90次。#365 工单分支增加下节所述成功支付页返回后的定时观察例外，不能再把90次视为该例外路径的总上限。缺少唯一订单号或时间时立即向上滑动读取下方内容，最多4次、手势400ms、每次后等500ms；读全立即停止，已有完整字段不滑动。该待付款读取分支不点击任何控件，也不点击付款。纯支付页不使用该滑动分支；出现可读待付款证据优先于复用的 Activity 名称。按采样间隔约18秒加有限手势/额外等待，实际耗时还含capture等调用；未改变2分钟任务租约或5分钟唤醒锁，也不宣称新增了执行器总体墙钟超时机制。
 
 应付金额从同一订单的可见标签集合中读取，兼容“应付:,13元”等标点；不跨无关联节点拼接，不读拼单价、优惠或实付。父子重复同金额去重，多值/缺失/无效/溢出省略，不因金额失败丢弃订单号与时间。仅存Admin，不推断支付、不改SYB金额、不修改地址行为。历史回填及界面语义未在本单统一，详见API契约#325补充。
 
+## 支付页安全返回后的核单观察（#365）
+
+实现绑定 `37714d39b5ac8ff720cfa1d0d2609f9a8af3fbd9`，已合并 main 并随2026-10-09集成APK安装；自动化验证不代表真机核单成功率已改善。仅 Android 变化，Admin、Server、数据库和上传状态契约不改。
+
+- 只有识别到 PDD 支付页且既有一次 Back 成功后，才记录单调时钟起点。在尚未取得订单/待付款上下文时，允许观察至该起点后约30秒，不因反复采样或上下文缺失重置；不能用 paymentPageObserved 代替成功返回事实。
+- 无成功返回，或在原60次内已取得普通订单上下文的路径，保持原预算。返回失败、持续支付页25次、空窗口15次、微信恢复失败和未授权应用等独立失败保持，不保证每种失败等满30秒。
+- 原60次之后的新增观察只采样，不因迟到的详情入口、选择器、微信页面新增点击、返回、拉前台或滑动。延长期出现非待付款不完整订单上下文，可只读等待迟到字段至同一期限；完整证据立即结束。
+- 首次出现待付款证据后，仍使用原独立30次采样及最多4次有界读取滑动；不新增该分支额度。该分支有自己的预算，30秒不是整个核单方法的全局时限。
+- 固定期限检查包含采样耗时与既有暂停，单次 capture 本身不能被此机制中断；不承诺严格墙钟总耗时。不增加采样硬上限来提前替代30秒期限。
+- 仍无完整证据时沿用已有失败原因与 order_result_unknown 处理，不自动补录、重试采购或再次创建订单；永久禁止付款。这只是对加载慢的有界缓解，不是对历史未知原因的根因修复。
+
 ## 采购订单资料完整性及简化单号回填（#326）
 
 用户2026-09-19确认内部系统简化流程，原型v1通过。实现3a2472d，尚未发布或真实SYB验收。
@@ -835,3 +848,57 @@ Android 0.9.64 / versionCode 77，源码 `6550b9f`（分支实现，尚未安装
 - 正常完成或预算退出只保存最后已确定处理/跳过的位置；页中提前退出不跳到预取末尾。确实消费完末页才回绕0；下轮/进程重启从最近已终结且有有效游标的运行续扫，NULL不是有效游标，0是有效回绕点。
 - 单运行所有权在分页续期、领取、Provider调用及保存映射时检查。失租旧运行不能继续领取或覆盖新owner；基础设施错误或失租不提交新游标。
 - completed只表示本轮正常结束，处理0件可能合法；scanned为实际检查数，不是预取数或全表数，processed不是成功数，confirmed/unmatched是规格项数。商品变化后可能需要等扫描回绕，不保证固定小时内全部处理。
+
+
+## 采购失败现场私有诊断（#364，尚未发布）
+
+本节是用户已确认的原始控件树禁存规则限定例外，仅适用于采购 `spec_probe/purchase` 本次失败、结果待核对及有真实上下文的执行阶段异常。普通采集及此前各业务模块的普通日志/结果接口不因此放宽。
+
+- 不采集正常执行的连续帧，不抓成功结果；空探测在 demote 后失败才进入诊断。已知成功结果即使后续本地保存、提示或结果上传异常也不新增失败快照。
+- 使用实际已领取/开始的 task/device/attempt UUID/phase/规则快照哈希；无有效归属只留本机固定原因，无效hash如实标为无效，不为诊断伪造事实。前置失败只留未进入执行/无障碍不可用等状态，不把Agent页面当作PDD现场。
+- 原失败上传重试只复用原ZIP。进程中断不补拍当前页冒充原现场；已有恢复核单失败可生成首次 `source=recovery` ZIP，记录恢复实际时间。恢复前的API/网络异常不抓，恢复成功不抓，不新增任何恢复点击、下单或任务重试。
+- 原始订单/地址节点等可能含个人数据，只存手机私有诊断SQLite和服务端私有数据库，只允许管理员下载。不得写入普通日志、工单、Wiki、SynapBus、普通任务结果或采购员接口；不得保存整屏截图。密码标识为true、缺失或不可读时，内容文字及其编码备份、action label均不保存。
+- 每attempt最多保留一份ZIP，已有ZIP不可覆盖；只有无ZIP未截取记录可升级为首次恢复ZIP。以该现场 recordedAt 起保留30天，重复上传不续期；新恢复ZIP采用真实恢复时刻。两端定期清理，手机快照逻辑总量64MiB，淘汰时同时终止上传队列。清理不修改采购结果。
+- 管理员采购详情可见完整/部分/未截取/暂无现场数据及安全下载入口；普通采购员、售后、客户端密钥均无原始诊断下载权限。
+- 1500ms、5000节点、2MiB ZIP、8MiB展开、128窗口与深度保护是合成测试覆盖的开发边界，未经过代表性真机样本验收；单次系统Binder读取不能被这些前后检查强行中断。未知/部分必须如实显示，不宣称拿到了系统未暴露的节点。
+
+## 图搜采集部分完成的自动关联资格（#368）
+
+实现基线：`15ccab3`（2026-10-08）；2026-10-09 已合并 main `e26743c` 并部署122.228.200.167，真实图搜采集业务效果仍待验收。
+
+- 此规则仅作用于 `source=image_search` 的结果后置自动关联。正常 `completed` 沿用原行为，包括 `missing_json=[]`。
+- `completed_partial` 仅在 `missing_json` 为可解析、非空字符串数组且每一项精确属于 `reviewCount`、`salesText`、`shopName` 时允许自动关联。三项均为可选描述信息。
+- partial 的空值、JSON null、空数组、非法 JSON、非字符串项、空项、未知项、颜色/尺码/价格/不支持维度缺失一律不放宽。不修剪字段名、不按前缀推测。
+- 保留原图搜快照、目标 PDD active、`OriginalPDDProductID` 乐观比较；人工改动后的关联不被覆盖。只有实际写入关联并返回 Linked，才进入既有规格同步和匹配流程。
+- 采集任务仍为 `completed_partial`，missing 保留，界面仍显示部分完成；关联成功不等于 AI 匹配成功。匹配无结果或不可用沿用原处理，不自动创建采购。
+- 不改变普通采集、手动当前页采集、手动关联、价格保护、映射算法、同步后置 hook 的耗时及重放机制。同图多结果沿用原提交顺序和乐观比较，不新增历史筛选、补关联或回退旧商品。
+- 验证边界：自动化测试使用隔离 SQLite 与本地模拟 ERP 服务验证实际 SubmitResult、关联及映射落库；未以此宣称 MySQL、真实 AI、真机或线上发布验证。请求在匹配开始后取消时，匹配使用原有脱钩 context 继续；最后 Detail 读取仍使用原请求 context，可能向断开的调用端返回错误，已提交数据不因此回滚。
+
+
+## Android 本设备最后一批重购（#367）
+
+实现绑定 `5430dc1f64fc0a4d8ef124ada7356e21a975151f`（2026-10-08，工单分支 `feat/367-last-batch-repurchase`）；2026-10-09 已合并 main `e26743c` 并安装集成APK，真机批量采购仍待独立授权验收。
+
+- 采购页搜索栏的“回填”入口替换为“重购”。原回填弹窗、Service 动作和实现保留但不再由该按钮触发；原单条重试、继续采购不改。重购使用原任务的 `/reset`，保留 CG 编号，不使用创建替代任务的 `/retry`。
+- 读取本设备近30天全部状态、不继承页面编号/状态筛选；按创建时间倒序、同刻任务ID倒序，从最新记录逐项比较相邻时间，不超过60秒归入同一推算批次。跨50条分页去重，最多200页，结束复核首页；头部或总量变化、日期/页结构异常、查询截断无法证明完整时不启动，不拿部分列表执行。批次时间边界使用独享API客户端的 HTTP Date，不使用手机时钟，缺少有效 Date 拒绝；此轻量方案不保证任意并发删除/归属变动的数据库快照。
+- 最后一批没有失败或失败均不可重试时只提示，不回退更早批次。一次确认显示范围、总数、失败/可重购/跳过数量及真实待付款订单风险；系统永不付款。每轮冻结 `failed && retryable` 候选，每条只重置一次，本轮再次失败不重新入队；下次点击重新发现并确认剩余任务。
+- 每条前重新检查当前资格、设备身份/Origin、网络、无障碍、新工作与本地执行/结果上传边界；不额外要求已存在完整映射，沿用服务端 unresolved 规格探测资格。明确业务资格拒绝可跳过；环境、规则、鉴权或结果未知停止后续。
+- 每条固定 requestId；重置响应不明最多同ID发两次，仍不明确停止，不换UUID或把旧failed认成本次结果。本地短时忙碌且明确未发出请求时最多等待10秒复核；重放pending不是实时状态。后续 attempt 只有原执行器记录到连续探测/重匹配完成→正式采购启动的证据链才属于本轮，外部同任务另起attempt停止编排。
+- Service 独立串行后台调度观察，真正领取、执行、上传仍由原执行器和租约/任务锁负责。终态且执行锁、活跃记录和Outbox均收尾后才继续。检测新采集或采购工作停止剩余，本轮当前task本身不算新工作。
+- 页面和通知栏“停止重购”只停止后续，已提交/执行的任务沿用原流程；切Tab、切PDD、界面重建不中断。单条单调时钟等待上限15分钟，超时只停止编排，不取消任务、不重置或再次下单。进程死亡/服务重建不恢复整轮，原单任务恢复不改。
+- 本轮摘要与最小attempt关联仅在内存，不新增地址/树采集或数据库。接口、服务端、Web、权限及 #364 诊断契约不变。自动化回归和APK构建通过不代表真机页面/批量下单已验收。
+
+
+## 采购页面一次性交接与导航稳定等待（#373 v4）
+
+实现绑定分支 `fix/373-navigation-diagnostics` 提交 `dbf9a5f`，调试版本 `0.9.69-373-fix1`；2026-10-09 尚未合并main、发布或安装该修复版。此节是该提交行为，不代表线上旧版本已生效；替代此前仅凭商品结构复用页面的方式。
+
+- Agent在每次采购执行开始时先取出清空服务进程内的交接凭证。凭证只能来自同任务spec_probe正常完成、结果安全落盘、首次提交返回pending且非replayed，并且本地markUploaded成功之后；失败/重传不生成或延长。缺省没有凭证，不因当前有商品结构就复用。
+- 凭证绑定taskId、goodsId、源探测attemptId、本地执行代次、无障碍实例、前台变更序号和探测完成时的单调时钟。仅紧接的同任务同商品purchase可消费一次；源/目标attempt本来不同。有效年龄为0至不足30000ms；慢AI或网络等待超过上限只导致重开链接。30秒是基于15秒心跳的保守复用政策，不是实际AI耗时保证。
+- 采集、图搜、当前页采集、回填、恢复执行、导航诊断及已知主动离页操作都会使原交接不可用；服务/无障碍重建不恢复。复用仍要求新鲜PDD商品结构，读取后再次核对同一次已消费凭证的期限、实例、前台与代次，避免慢Binder读取期间过期。人工在同一PDD包内切页可能没有可观察前台变化，不能声称完全识别。
+- 不符合复用资格时打开本任务链接，沿用直达NEW_TASK|CLEAR_TASK及异常回退浏览器。等待从该次打开开始，不是给整个重购批次加固定间隔。执行器取得实际ACCEPTED路径；未知路径不当作直达。
+- 浏览器路径先观察到受支持浏览器，再允许PDD商品结构进入就绪判断，浏览器出现前的旧PDD帧不放行。直达接受后至少3秒缓冲；浏览器返回PDD后至少3秒缓冲。商品结构还需连续稳定至少1秒、至少3次读取，缓冲与稳定时间可以重叠。就绪后立即继续，不无条件等30秒。
+- 商品稳定特征只在内存比较标题和规格入口/面板结构，不以销量、价格或滚动拼单变化为依据。非PDD、空窗口、缺少商品证据或结构变化会打断稳定计时；登录、验证码、风控和无效商品保持明确失败。
+- 导航总预算为单调时钟30秒、最多300轮、轮间100ms；耗时系统读取可能超过预算，但返回后检查时限，不再继续点击。浏览器入口重试从点击调用返回后至少间隔1秒；原生点击前在新鲜节点重新校验浏览器与剩余预算。超时返回PDD_DETAIL_ENTRY_FAILED，不继续规格、地址或创建订单步骤。
+- 用户明确拒绝新增分享/复制链接操作，并接受本版仅解决跨任务无条件复用与导航抢跑。**稳定商品页不是goodsId身份核验；PDD忽略深链而稳定停在旧页、或无可观察变化的同包人工换页，仍可能无法识别。** 不得将任务携带goodsId当作页面回读，不能用本版宣称绝对排除错误商品。
+- 不改服务端/API线协议/数据库、采集器、规格选择、地址与下单逻辑、重购批次发现/停止逻辑；不涉及任何付款动作。仅增加Android对既有结果响应status/replayed的本地解析（replayed=false在服务端可省略）。普通流程不新增原始树、截图、分享URL或页面文本落盘。

docs/04-local-development-and-verification.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Local-Development-and-Verification
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Local-Development-and-Verification.-
-wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
-synchronized_at: 2026-09-21T08:14:42Z
+wiki_revision: 4349298c740c0cb94d8c6bf33423c9c7965ff1c7
+synchronized_at: 2026-10-08T07:10:50Z
 <!-- gitea-wiki-mirror:end -->
 
 # 本地开发与验证
@@ -350,3 +350,15 @@ node --check popup.js
 ```
 
 自动化测试只使用合成 DOM 与 Chrome API mock，覆盖列表商品行负向选择、双展开与延迟字段、解析/冲突、启动互斥、停止、错误终态、扫描延迟增长、详情恢复、提交恢复、冻结配置、超时和可重试项。真实 PDD 浏览器点击、扩展安装和真实 Admin 上传不属于自动化验证，必须取得独立授权并在结果中明确区分。
+
+
+## 采购失败现场诊断验证（#364）
+
+实现 `4581ee5` 的合成验证不连接PDD、不创建订单、不付款、不读取真实个人数据。安装、真实现场抓取和上线须另行授权。
+
+- Android：`cd android; .\\gradlew.bat test assembleDebug`；重点类为 FailureSnapshotExporterTest、FailureSnapshotCaptureTest、FailureSnapshotPolicyTest、FailureSnapshotUploadTest、FailureSnapshotRepositoryTest、AgentDiagnosticStoreMigrationTest。旧结构化诊断实际无障碍回调到Android SQLite的真机闭环仍须另验，不能用JVM测试冒称真机问题已解决。
+- 跨端：仅测试时设置 `GOAUTO_DIAGNOSTIC_FIXTURE_DIR` 指向开发构建输出目录，运行 Android `FailureSnapshotExporterTest` 生成纯合成 `manifest.json/archive.zip`；保持同一环境目录后在 `server/` 执行 `go test ./app/goauto/purchase -run TestFailureSnapshotAndroidExporterContract -count=1`。这验证真实Android导出器生成的字节被Go校验器接受；未设置变量时该测试明确skip。禁止以真实下载ZIP替代该合成fixture，输出不提交Git。
+- Server：`go test ./app/goauto/purchase ./app/goauto/access ./app/goauto/migrations ./common/middleware ./cmd/migrate/migration/version-local ./cmd/api`；覆盖所有权、成功/待执行attempt拒绝、终态补传、幂等/恢复升级、密码内容排除、ZIP/XML/HTTP容量、日志排除及空闲清理。
+- Web：构建后本地preview，使用 `PLAYWRIGHT_TEST_BASE_URL=http://localhost:<端口>`（合成cookie域为localhost），执行 `pnpm exec playwright test tests/e2e/purchase-failure-snapshots.spec.ts tests/e2e/purchase-order-writeback.spec.ts --workers=1`；普通采购员角色为 `purchaser`。
+- 迁移：`1791400000000_purchase_failure_snapshot.go` 仅追加私有表与版本记录，提供 `MigratePurchaseFailureSnapshot` 幂等入口；专用API依赖既有启动权限对账。独立测试 `TestFailureSnapshotAuthorizedLocalMySQL` 须获得本地初始化/权限写入授权后显式注入 `GOAUTO_364_LOCAL_MYSQL_DSN`；硬限制本机 `127.0.0.1:3308/goauto` 且采购任务为空。它执行追加迁移、完整既有API/采购员权限对账，并以事务回滚的合成数据验证64KiB manifest/2MiB BLOB回读与attempt唯一。不是只读测试；不得对线上或已有业务库运行，不输出DSN。
+- 服务维护：Server清理启动立即运行并每小时运行；Android前台服务启动及每60秒维护，无新任务也清理。无需新增定时任务或开关。通过管理员专用下载路由取得ZIP，禁止把私有诊断表或下载目录暴露为静态资源。

docs/06-troubleshooting.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Troubleshooting
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Troubleshooting
-wiki_revision: ac3a0b74704f398cec54149267089c87c8375a3e
-synchronized_at: 2026-10-06T09:50:33Z
+wiki_revision: 6b370764320d1f5148fbc31f0ef6ce999370173d
+synchronized_at: 2026-10-09T02:06:57Z
 <!-- gitea-wiki-mirror:end -->
 
 # 故障排查
@@ -76,7 +76,7 @@ Agent 0.9.13 起，颜色发现阶段在本地 `goauto_diagnostics.db` 的 `agen
 
 记录只包含颜色行数、各行值数量、可点击颜色数、不可点击候选数、首次颜色点击前的颜色/尺码选中数、是否存在“已选”摘要、横向滑动次数、终止原因和耗时，不保存规格文案、价格、摘要原文、坐标、链接、goods_id、控件树、XML 或截图。
 
-只对 Debug APK 使用以下读取流程：
+以下仅为 v4 之前纯结构化诊断库的历史读取方式。v4 及之后包含采购失败私有现场，不再按此导出整库；请使用下方“Android 颜色发现诊断 v5”中的定向只读方式：
 
 ```powershell
 adb shell run-as cn.ilapage.goauto.agent ls databases
@@ -114,3 +114,47 @@ adb -s <serial> shell run-as cn.ilapage.goauto.agent sqlite3 -readonly databases
 - 保留现有加载、错误提示、取消和旧请求隔离逻辑，不增加自动重试。慢请求在 10～60 秒间完成时不再被原 10 秒客户端预算提前中止；超过 60 秒仍会超时，上游更短的超时也可能先终止请求。
 - 此调整不优化后端执行速度。处理阶段筛选当前先加载候选并计算阶段、后分页；不选店铺且采购类型为全部时，候选可能很大。遇到持续慢查询，应另行分析候选预筛选与数据库执行计划，不能据此认为延长前端预算已解决后端性能问题。
 - 只需发布包含该提交的 Web 资源即可生效，不要求数据库迁移、Android 安装或后端参数变更；发布仍需人工授权。
+
+## Android 地址编辑页控件就绪等待（#366，环节②）
+
+实现绑定 `7fdfe04658d16a05ebcb016ee964a7263eb74802`，位于独立工单分支，未合并 main、未装机或发布；合成测试与 APK 构建结果见 #366 工单，不代表真机采购验收。只修改点击“修改”后等待详细地址输入框就绪的环节；地址列表识别（①）仍缺真实单/多地址列表证据，保存退出（③）、返回与最终复核（④）不改。
+
+- 标题出现不再立即触发输入框缺失失败。在“详细地址”标签的既有同排区域，统计可见 EditText 的 structural 数量（包括空值/禁用）及其 enabled、实际 text 非空且未判为 hint 的子集 ready 数量。只有 structural=1 且 ready=1 才继续，读取的地址与就绪判定来自同一帧；后续 inputFresh 仍重新定位且只尝试一次。
+- 原地址只读取同帧实际 text.trim()，不使用 contentDescription 补空。API 26+ 捕获内存 hintText / showingHintText；showingHintText=true 或 text.trim() 等于非空 hintText.trim() 时不就绪，继续等待。全局 label 和其他调用方的语义保持不变，这两个新增元数据不落盘、不上报、不记日志。
+- API <26 或应用未正确提供 hint 元数据时，不能完全区分非空 text 是提示还是实际值；仅凭此修复不能保证所有设备/页面的提示文字均被识别，不使用提示词猜测。
+- 沿用单轮最多 50 次采样、原 200ms 暂停及点击后的既有暂停。不再叠加标题等待与控件等待，不设置“三次多候选即失败”；采样与解析另有耗时，不能将其表述为严格 10 秒墙钟超时。既有安全异常仍可提前终止。
+- 等待超时使用现有错误码：从未观察到详细地址标题为 PURCHASE_ADDRESS_EDIT_TIMEOUT；曾见标题但候选未就绪/不唯一为 PURCHASE_ADDRESS_UPDATE_FAILED。titleSeen 跨帧保留，因此最后一帧空树不会抹掉此前的标题证据。
+- 诊断仅含固定 stage=address_editor_ready、reason 分类以及 titleSeen、structural、ready 标量，不含地址、收货人、电话或节点文本。具体原因以实现和测试中的固定分类为准；这不是新增 SQLite 字段或上传接口。
+- 收货人/电话不能作为备用目标；区域重叠造成歧义时不输入、不保存。无额外点击、滑动、返回、保存或下单重试，正常单次动作路径保持。
+- 此修复不能证明历史失败均因慢加载，也不解决保存地址后返回超时。识别①不能仅凭“不是规格面板＋无提交按钮”推断已进入地址列表：两项都依赖同一个面板解析结果。
+
+## 支付页返回后核单仍缺少证据（#365）
+
+实现绑定 `37714d39b5ac8ff720cfa1d0d2609f9a8af3fbd9`（工单分支，未合并、安装或发布）。成功执行既有一次支付页安全返回后，在无订单上下文阶段以固定单调时钟起点观察约30秒；原预算后的新增观察不增加页面动作，待付款分支仍沿用独立读取预算。
+
+- 先确认运行版本是否包含此提交，再区分失败码：持续支付页、空窗口、微信恢复和未授权应用等独立条件可提前结束，并非所有失败都等待30秒。
+- 完整订单证据出现就结束；超时保留原订单结果未知语义，不能因为等待更久就把任务改为可重试失败或自动重下单。
+- 固定期限从 Back 成功时起算，不是从提交订单或进入核单函数起算，也不会因新样本重置；capture 阻塞不能被该检查中断，待付款分支拥有独立预算。
+- 不因本次延长断言历史问题就是加载慢。延长期出现必须点击才能展开的入口仍不会新增点击；页面识别/挽留弹窗等原因需要真实诊断证据另行分析。#364 的失败现场诊断不属于本单实现。
+
+## Android 颜色发现诊断 v5（#370 第一阶段）
+
+实现绑定 `9e5f09a`（工单分支），Debug 标识 `0.9.69-370-diag1`，尚未合并 main。本阶段只补诊断和测试夹具，不改变遍历、停止条件、采集完成状态或采购探测决策；不能据此宣称竖向漏采已修复。
+
+`COLOR_DISCOVERY` 的结束聚合新增三个可空列：
+
+- `color_vertical_swipe_count`：本次颜色循环中成功派发的 UP 次数，排除归顶及尺码阶段；不证明视口实际移动。
+- `color_trailing_empty_read_count`：终止前连续解析不到颜色的外层发现轮数；每轮只记一次，点击与采价重读不计，非空轮清零，初始空为 1。
+- `color_horizontal_incomplete`：1 表示已观察到同一行签名变化后，必要横向探索因失败或预算耗尽仍未完成；0 表示当前已观察行无需横扫或取得连续稳定证据；NULL 表示无法确认，包括重排、空解析、缺少横向容器或仅成功派发但没有移动证据。同 seed 的未知回访不能清除旧的 1，可靠完成的 0 可以清除。0 不代表整个商品已采全，签名变化也不是物理滑动成功的独立证明。
+
+只保存计数、布尔/NULL 和固定原因码，不保存标签、价格、坐标、原始控件树、截图或个人信息。每行累计数仍不是逐屏轨迹；缺少日志不证明没执行，错误/超时提前退出可能没有结束聚合。现有 50 条/7 天留存不变。
+
+本地 SQLite v4→v5 只补三列；旧行新值保持 NULL，不删除旧诊断或采购失败快照/队列/context。旧程序不保证能降级打开 v5，不能靠卸载清数据回退。
+
+`goauto_diagnostics.db` 从 v4 起还含采购失败私有现场，不能按早期“纯结构化库”的假设导出或上传整库。已授权的 Debug 设备有 sqlite3 时可只查询所需聚合字段；无 sqlite3 时只使用已确认的内存读取方式，避免整库落盘，不放宽应用权限。示例查询（须替换设备，且实际存在 sqlite3）：
+
+```powershell
+adb -s <serial> shell run-as cn.ilapage.goauto.agent sqlite3 -readonly databases/goauto_diagnostics.db "SELECT task_id,reason,color_vertical_swipe_count,color_trailing_empty_read_count,color_horizontal_incomplete FROM agent_diagnostic WHERE stage='COLOR_DISCOVERY' ORDER BY id DESC LIMIT 1;"
+```
+
+排查须绑定同一设备、Agent/PDD 版本、任务与规则快照，并对照同次 App 布局。网页竖排与 App 横排不是同一复现场景；当前横排只能做横向兼容性回归。真机测试结果及待验证项以 #370 工单为准。

docs/08-agent-api-contract.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Android-Agent-API-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Android-Agent-API-Contract.-
-wiki_revision: 640da0a86bf1057d418dbeb062c07a84cb5b1d8e
-synchronized_at: 2026-10-08T01:42:56Z
+wiki_revision: 2102252a3f0ecb646b49941cc603423abb76ca2c
+synchronized_at: 2026-10-08T07:11:01Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -641,6 +641,17 @@ Agent 主动提交 `order_result_unknown` 时保持订单号和下单时间为
 | `PURCHASE_ORDER_RESULT_UNKNOWN` | 无法确认订单是否创建，请人工检查 |
 | `PURCHASE_PAYMENT_FORBIDDEN` | 系统禁止自动付款 |
 
+### 地址编辑页初始等待诊断（#366，环节②）
+
+实现绑定 `7fdfe04658d16a05ebcb016ee964a7263eb74802`（工单分支，尚未合并 main 或发布）。本修订只细化 Android 点击“修改”后的输入框等待及错误说明，不增加 HTTP 字段、数据库字段或错误码，不改变任务结果提交、设备/任务/规则关联和保存后的最终复核。
+
+- 一个现有 50 次采样预算内，只有详细地址区域可见 EditText 的结构候选数为 1，且其中 enabled、实际 text 非空并排除明确 hint 的就绪候选数也为 1，才允许后续既有单次输入；结构计数包括空值和禁用候选。
+- ready 和原地址不使用 contentDescription 补空；showingHintText=true 或实际 text.trim() 等于非空 hintText.trim() 时排除。hintText / showingHintText 仅为 API 26+ 的内存节点元数据，低版本为 null，不新增持久化或上传字段，不改变全局 label。应用缺失/错误的 hint 元数据或 API <26 时无法完全区分提示与实际值。
+- 超时从未观察到“详细地址”标题时沿用 `PURCHASE_ADDRESS_EDIT_TIMEOUT`；曾见标题但输入框缺失、为空、仅显示 hint、禁用或存在歧义时沿用 `PURCHASE_ADDRESS_UPDATE_FAILED`。
+- 此等待失败的 `errorMessage` 可附固定诊断 `stage=address_editor_ready;reason=<固定分类>;titleSeen=<布尔>;structural=<数量>;ready=<数量>`。reason 为 `title_missing`、`editor_missing`、`editor_ambiguous`、`editor_disabled`、`editor_empty` 或 `editor_hint`；titleSeen 累计保留，数量取最后采样帧，不包含地址值、收货人、电话及节点文本。
+- 既有页面安全异常优先失败，不必耗尽预算；`inputFresh` 失败仍不重试。其它使用 `PURCHASE_ADDRESS_UPDATE_FAILED` 的路径保持原义，不要求它们附本段诊断。
+- ①地址列表识别仍待真实场景证据，③保存退出、④返回与最终复核不改；本段不代表整单完成或真机验收。
+
 ## Agent 当前设备任务历史（#90）
 
 四个只读接口统一使用设备注册所得的 Device Token，只返回该 Token 对应设备最近 30 天内的任务；设备 A 查询设备 B 的任务时按不存在处理，不泄露任务是否存在。
@@ -1482,3 +1493,40 @@ Web 输入去重后一个值提交旧标量、多个值提交重复集合键，
 - `stopReason`：旧记录默认空字符串；完成原因是`batch_limit`、`scan_budget`、`time_budget`、`end_of_scan`、`lease_lost`或`error`。失租旧进程不能为填此字段越权更新；合法回收路径标记lease_lost。
 - `scannedCount`改为实际检查的候选数；SQL已过滤的空档案及预取未检查项不计入。eligibleCount为Go资格通过数，processedCount为实际领取处理数；confirmedCount/unmatchedCount仍为规格项数，不能据此直接混算商品成功率。
 - 单轮处理默认20、每页200、实际扫描上限2000、整轮预算10分钟。正常0处理仍可completed，预算退出有持久游标；错误/失租不提交新游标。
+
+
+## 采购失败现场诊断 v1（#364，实现 4581ee5，2026-10-08）
+
+本节契约在 `4581ee5` 实现，后续合并记录见 #364；尚未发布或完成真机验收。只覆盖采购spec_probe/purchase的本次失败/结果待核对，不修改正常capture、采购结果/不可逆状态；成功结果后网络/提示异常不抓取。普通采集不纳入。每attempt UUID最多一份ZIP；重启不能补拍当前页面冒充原现场，恢复核单现场必须source=recovery。
+
+### 专用接口
+
+- POST `/api/agent/v1/purchase-tasks/{taskId}/attempts/{attemptId}/failure-snapshot`：Device Token鉴权及现有Agent传输策略。流式multipart，`metadata` UTF-8 JSON（≤64KiB），`archive` 可选ZIP（≤2MiB）；不得写临时原始文件。验证attempt持久化的task/device/phase，不依赖task当前设备或running状态，终态允许异步补传。响应沿用Agent JSON envelope，data含taskAttemptId/status/replayed。
+- GET `/api/admin/v1/purchase-tasks/{taskId}/failure-snapshots`：仅管理员，返回`{code:200,data:{items:[...]}}`；items仅attemptId/phase/status/source/errorCode/agentVersion/capturedAt/recordedAt/expiresAt/partial/reasons/downloadAvailable/zipSize等安全标量，不包含窗口标题、节点或manifest原文。
+- GET `/api/admin/v1/purchase-tasks/{taskId}/attempts/{attemptId}/failure-snapshot/download`：仅管理员，附件ZIP，Content-Type application/zip、Cache-Control no-store、nosniff，服务端生成安全文件名。无快照/过期不可下载，普通采购员/API Key及普通Agent业务接口不得读取。不得在线渲染XML。
+
+### metadata / ZIP
+
+schemaVersion=1、attributeVersion=1；taskId/deviceId正整数、taskAttemptId UUID、phase为spec_probe或purchase；ruleSnapshotHash为有效SHA256或null，ruleSnapshotHashValid明确标记；有效时必须与attempt快照hash相同，无效时仅not_captured并记录rule_hash_invalid，不伪造hash。errorCode为有界代码，agentVersion为有界版本；recordedAt/capturedAt为UTC RFC3339，未截取capturedAt=null。source为execution/recovery；status为complete/partial/not_captured；reasons固定代码数组；windows数组含id/fileName/status及可获取的窗口属性。窗口标题等实际文本只存私有诊断内容，不出现在Admin摘要。
+
+ZIP含manifest.json（与metadata语义一致）和每个可取得root窗口的window-<id>.xml，每个XML仅一个hierarchy根，禁止DTD/外部实体/路径穿越/重复条目；保留系统原顺序及不可见节点。窗口缺失/属性失败/节点数/字节数/耗时超限明确partial且仍可解析。password节点所有可能承载内容的文字字段均省略（text/contentDescription/hint/stateDescription/tooltip/action label等）；不反射任意extras。标准UIAutomator属性名，扩展属性合法；XML非法字符采用显式可逆编码，不能丢弃。schema区分空值、不支持和读取失败。
+
+未截取时只上传metadata，无ZIP，不制造空XML；无attempt只保存本机最小原因，不上传虚构归属。服务端解压后总量≤8MiB，不能只相信ZIP声明大小；按白名单条目流式有界验证，异常不回显正文。
+
+### 存储、幂等及清理
+
+Android复用诊断库升级至v4，新独立快照/待上传/实际执行上下文表；旧结构化诊断保持7天/50条，新快照开发容量64MiB和30天独立清理，队列随过期/淘汰终止；无新任务也定期清理。结果上报优先，上传单独线程/持久队列，失败不改变采购结果或阻塞设备释放；重传只复用已存字节。每attempt已有ZIP不得覆盖；仅无ZIP未截取状态允许后续该attempt首次恢复核单ZIP，不能阻止真实恢复现场。
+
+Server追加迁移 `1791400000000_purchase_failure_snapshot.go` 建立purchase_failure_snapshot独立表（ZIP LONGBLOB、私有manifest LONGTEXT、归属与安全摘要，attempt UUID唯一）。同一有效载荷重放返回replayed=true；已有ZIP不同载荷409且保留原件；终态补传有效。按recordedAt起30天，上传不续期，过期补传410供客户端停止；清理启动立即执行并每小时，无任务也执行，下载查询亦拒绝已过期数据。使用既有管理员身份和专用API注册，不给采购员开放权限。
+
+2MiB/8MiB/64MiB是经工单声明的开发测试起点；节点/耗时开发保护暂为5000节点、1500ms，采样前后检查，无法中断系统单次Binder读取的事实须记录；deadline后停止遍历，不异步继续抓下一任务。上述不是代表性真机实测结论，正式现场验收前仍需确认。上线/安装/真机抓取另行授权。
+
+### v1 编码与队列细节
+
+- windows 条目含 id、fileName（可空）、type、layer、title、active、focused、bounds、packageName、activityName、capturedAt、status、reasons、attributeStates；无 root 不制造空 XML。未暴露属性不得猜测。
+- XML 节点标准属性含 text/resource-id/class/package/content-desc/checkable/checked/clickable/enabled/focusable/focused/scrollable/long-clickable/password/selected/bounds；扩展 path、child-count、visible-to-user、editable、hint、state-description、tooltip、input-type、max-text-length、drawing-order，collection-* 与 range-* 为扁平字段；node 下的 action 子元素保留 id/label。版本1公开属性名单以 SnapshotXml.attributes 为准，不反射 extras。
+- 非值属性使用 `<属性名>-state=null|unsupported|read_error` 区分空值、不支持、读取失败；XML非法代码单元使用 `<属性名>-base64` 保存原始 UTF-16BE 字节的 Base64（包括未配对 surrogate）。换行/回车/Tab 使用数值实体。密码标识为 true、缺失或读取失败时，文字字段、状态/编码备份及 action label 均省略；只有显式 password=false 才允许保存内容，子 action 不得覆盖父节点保护。
+- 固定 reasons：rule_hash_invalid、execution_not_entered、accessibility_unavailable、process_interrupted、windows_unavailable、windows_unsupported、window_root_null、window_disappeared、window_read_error、node_read_error、attribute_unsupported、node_limit、time_limit、expanded_size_limit、archive_size_limit、capture_failed。
+- 有ZIP的新上传只接受相符的非成功执行 attempt；不能向 pending/成功 attempt 新增失败诊断，已有有效载荷重放仍幂等。manifest 与 multipart metadata 语义相同；ZIP拒绝未知条目、重复路径、加密/未知压缩、CRC错误，XML拒绝DTD和处理指令，除限定XML声明。
+- 本地队列绑定 Server Origin 和载荷 fingerprint，切换服务器不向新服务器转交旧ZIP；旧上传响应不删除后来首次恢复ZIP。每60秒维护，网络/408/429/5xx按60秒至1小时退避，410与其他永久4xx停止该队列项。结果Outbox优先，不因设备忙而永久饥饿；上传线程不持有任务互斥、不操作设备。
+- 诊断接口不进入通用请求正文日志；私有SQL记录器不输出manifest/BLOB。管理员摘要不包含窗口和节点内容。默认HTTP例外只沿用既有Agent设置，不新增开关；传输私有原始内容时同样存在明文风险，部署须确认现有传输策略。

docs/13-deployment-and-operations.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-and-Operations
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-and-Operations.-
-wiki_revision: db99427fa2460989d34d28ef864230a907fc5e6d
-synchronized_at: 2026-10-08T01:42:22Z
+wiki_revision: 01a3a9cd968510c9435ec1fb2be0040fe17d0282
+synchronized_at: 2026-10-09T07:21:53Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -308,3 +308,60 @@ Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、
 - 新版启动日志结构检查未见panic/fatal/1146/1054。服务器systemd较旧，读取PID用 `systemctl show goauto -p MainPID` 并解析键值，不使用不支持的 `--value`；journalctl起始时间使用服务器本地格式 `YYYY-MM-DD HH:MM:SS`。
 - Nginx配置检查通过，本次无配置变化、不需重启或reload；仅恢复发布目录可读性即恢复前端。真实多轮续扫、末尾回绕和AI实际匹配仍待自然运行验收，健康检查不等于业务效果验收。
 - 回滚代码目标 `/home/goauto/releases/20261007-eb7cb6b-363` 保留；重启前核验任务空闲，保留追加列与已经保存的映射，不恢复旧备份覆盖此后业务。
+
+
+## 采购失败现场诊断部署与保留（#364）
+
+实现绑定 `4581ee5`；2026-10-09 已随 main `e26743c` 完成线上迁移及发布，见下方发布记录。#365/#366 为Android局部行为，#366仅②编辑框就绪/hint保护已交付，①地址列表识别仍待现场证据。
+
+1. 先取得目标环境的追加迁移及发布授权，核对唯一待执行版本 `1791400000000_purchase_failure_snapshot.go`，建立独立私有诊断表，再启动配套Server/Web。专用摘要/ZIP下载注册到既有启动权限对账，只允许管理员；对账会维护完整API目录及采购员既有权限，不是只写两条接口。
+2. Server接收与权限验证就绪后再安装新Agent。旧Server不支持新诊断接口；不要把“本机保存成功”当作“已上传”。仅合并main不启动服务、不执行线上迁移、不自动安装APK。
+3. Server启动立即清理过期诊断，其后每小时维护；Android前台服务启动及每60秒维护。两端默认30天，手机私有诊断逻辑容量64MiB；无需Admin定时任务或新开关，清理不修改采购任务与订单事实。不得把诊断ZIP/数据库映射成静态目录。
+4. 管理员从采购详情执行记录下载ZIP；无现场、未截取、partial、上传中/失败应按实际结果区分。排错日志仅固定错误分类，禁止复制ZIP内容到日志、工单、Wiki或消息；分析只摘必要脱敏结构。沿用现有Agent HTTPS/显式HTTP例外，HTTP上传有个人数据明文风险。
+5. 代码回滚时保留追加表和已存数据，不降级或删除手机数据库来恢复；回滚到尚不识别schema v4的旧Agent须先单独评估，不承诺可直接覆盖安装。保留期限清理须有仍在运行的相应新版维护组件。
+6. 本机换机后的数据库经用户授权初始化于 `127.0.0.1:3308/goauto`，配置仍来自仓库根目录已忽略的config.yaml；已完成baseline迁移及#364幂等、容量、权限验证，未启动业务服务或连接线上。不是将历史3307运行说明套用于所有环境；实际Supervisor目录/发布按目标环境另核对。
+
+
+## 2026-10-08 换机后本地 Supervisor 联调配置（#364 后续运行准备）
+
+本节是当前电脑的配置，优先于上文历史 D:/supervisor、3307 和 main-runtime 路径；不改变线上拓扑。
+
+- Supervisor 位于 `D:/supervisord`，主配置 `supervisord.conf` 通过 `[include] files=programs/goauto.conf` 引入两个实例：`goauto-admin-api` 和 `goauto-admin-ui`。两者 `autostart=false`、`autorestart=true`，添加/重读配置不等于批准启动所有服务；只对目标实例操作，不重启整个Supervisor。
+- 独立运行目录 `D:/OPC/goauto-runtime` 干净地固定在已合并main的 `e450ac28989de6827328b411e4bdc050dded9ab3`，用detached HEAD避免与开发分支混淆。根仓库 `D:/OPC/goauto` 仍保留用户旧分支和未提交资料，不在其中切main或覆盖。
+- 两实例读取 `D:/OPC/goauto/config.yaml`；本地MySQL为127.0.0.1:3308/goauto，API端口8010，Web端口9527。后端调用运行目录的 `scripts/start-server.ps1 -ConfigPath D:/OPC/goauto/config.yaml -SkipMigration`，前端调用 `scripts/start-web.ps1 -ConfigPath D:/OPC/goauto/config.yaml`。后端仍会校验/确保数据库存在并执行既有启动权限对账；SkipMigration不是只读启动。
+- 当前电脑默认go为1.24且GOTOOLCHAIN=local，继承的GOSUMDB=off又会阻止自动下载1.26.5；仅后端实例的PowerShell命令把已安装 `C:/Users/Qiu/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.5.windows-amd64/bin` 前置到进程PATH，并设置GOTOOLCHAIN=local。已用该环境构建验证；未更改全局环境、校验策略或项目go.mod。此绝对路径是本机配置，其他电脑须核实已安装工具链，不照抄。
+- 前端依赖属于运行目录自身，按锁文件安装，不链接其他worktree的node_modules。若旧残留依赖出现ERR_MODULE_NOT_FOUND且普通安装未补齐，先用 `node -e "import('vite')"` 复现，再在本目录按锁文件重新安装；不通过修改业务代码或升级依赖绕过。
+- 手动启动顺序为API就绪后Web；Web原脚本最多等待API健康60秒，并将/api同源代理到本机8010。浏览器本机入口 `http://127.0.0.1:9527/`，Agent使用电脑实际局域网IP的8010端口，不把127.0.0.1配置给手机。
+- 日志为 `D:/supervisord/goauto-admin-api.log`、`D:/supervisord/goauto-admin-ui.log`。检查依赖、端口和实际子进程环境；不能只因Supervisor显示Running就宣称HTTP就绪。
+- 新库预置SYB每小时同步与Yeeke同步status=2（启用）；蝦皮规格自动匹配、异常规格AI解析status=1（关闭）。本轮只读检查，未改任务状态；用户手动启动API后既有调度会运行，真实外部访问须结合本地凭据/配置确认，不能把本地环境当作自动隔离的沙箱。
+- 配置动作未新增迁移、未部署线上、未安装APK；用户随后确认亲自点击了启动。健康/页面验证记录在工单，不将健康检查冒充登录、诊断下载或真机端到端验收。
+
+
+## 2026-10-09 集成发布与 Android 签名连续性（#364/#365/#366/#367/#368/#370）
+
+- 集成源码 main `e26743c817275137f7dc8a3659461d552371b9e3`。122.228.200.167 当前发布目录 `/home/goauto/releases/20261009-e26743c-integrated`，旧目录 `/home/goauto/releases/20261007-0138da8-359` 保留供代码回退。用户明确要求线上有采集/采购执行时不得重启；迁移前及切换前相关运行计数均为0，没有取消、重置或发起业务。
+- 已授权追加迁移 `1791400000000_purchase_failure_snapshot.go`、启动权限对账及发布。私有备份 `/home/goauto/backups/20261009-integrated/database.sql` 目录0700/文件0600；只新增诊断表，回读LONGTEXT/LONGBLOB及attempt唯一索引通过。定时任务启停、Cron与参数摘要前后一致。
+- Server SHA256 `ae7e479e94db0485661665306d0d0306ca5c3cd4019694991c29b64d113eb637`，运行进程二进制一致；新Web入口SHA256 `242158568fb3ee9c51e2e16574abf0a1b6b5b692ae167ec78bcb957cdf5e7434`。根入口、index、login、syb-products入口、10项JS/CSS、健康与验证码通过。Nginx实际读取用户可读性切换前确认；保留旧hashed资源与config/static/temp/var。没有更改Nginx配置；未认证诊断接口401、现有非管理员凭据403。
+- 本次自动化验证为Android 274项受影响测试、Server任务/采购/商品/规格/权限/中间件/迁移相关包、Web 6项模拟API页面测试及三端构建。未执行真实采购或付款；管理员真实诊断下载及完整失败现场上传仍待业务验收。#366仅环节②，#370仅第一阶段诊断，不能视为剩余根因修复已完成。
+- Android集成APK保持 `0.9.69-370-diag1 / versionCode 82`，不能只凭版本号区分旧包；本次最终APK SHA256 `68d7caf9ae7ee5808783056f4f1591266746197b520048fa64c89365723edef7`。2026-10-09已覆盖安装到用户指定手机，安装后文件哈希一致、配置及设备身份前后摘要一致、进程启动存在，没有卸载或清数据。
+- 换机生成的调试签名与旧机不同会导致 `INSTALL_FAILED_UPDATE_INCOMPATIBLE`；不可为更新擅自卸载。用户提供的原调试签名已与手机证书核对一致，私有文件位于 `D:/OPC/goauto/debug.keystore`，仅在本地Git排除规则中忽略，绝不提交。应另行私密备份，不能重新生成替代。
+- 当前Windows用户级 `C:/Users/Qiu/.gradle/init.d/goauto-debug-signing.gradle` 使用Android Components的 `finalizeDsl`，仅对applicationId `cn.ilapage.goauto.agent` 的debug签名指定原文件；其他项目及release配置不变。普通Gradle调试构建自动生效，文件缺失则明确失败，不退回新签名。更换电脑或GRADLE_USER_HOME时需带入相同私有文件及配置；不要把本机设置当作仓库内或其他电脑已配置。构建后用signingReport与apksigner复核，再以install -r更新。
+
+
+## Android 商品导航诊断（#373，诊断阶段）
+
+- 分支实现 `2c58d58`，调试包 `0.9.69-373-nav-diag3`；尚未合并 main，不代表旧商品页复用或旧页排除已修复。正式采购打开路径保持原样，新增 `PRODUCT_NAVIGATION` 结构诊断至既有 SQLite `agent_diagnostic`，区分 DIRECT/BROWSER 的 ACCEPTED/REJECTED/EXCEPTION，仅记录异常类名及耗时，沿用任务、attempt、device、phase、rule hash 关联和原50条/7天保留规则，无数据库升级。ACCEPTED只表示startActivity返回，不表示目标商品已加载。
+- 仅debug包包含 `cn.ilapage.goauto.agent/.diagnostics.NavigationProbeReceiver`，要求发送者具有 `android.permission.DUMP`（ADB shell/system），release清单不含该入口。输入仅数字goodsId及direct/browser，不接受任意URL、脚本或购买动作。必须先获得指定设备覆盖安装及只打开商品页的授权，确认无业务任务运行；保留原签名用install -r，禁止为安装清数据或卸载。
+- Agent主界面启动前台服务且无障碍就绪后，通过ADB执行 `adb -s <设备地址> shell am broadcast -n cn.ilapage.goauto.agent/.diagnostics.NavigationProbeReceiver --es goodsId <数字商品ID> --es mode direct`；浏览器对照使用 `--es mode browser`。忙碌/服务未就绪时拒绝、不排队，不能用取消或重置业务任务强行取得设备。
+- 探针占用现有设备互斥锁，预算20秒/最多201轮；耗时Binder读取可能越过观察预算，但其后不再派发导航/点击，不能声称能强制中断系统读取。服务或无障碍实例失效、线程中断、登录/风控/验证码时停止。只打开商品链接，在浏览器中最多尝试3次唯一的精确“打开拼多多APP”/“打开拼多多 App”且节点自身可点击的入口；实际派发前再次校验包、窗口、节点与存活条件，无祖先/坐标/手势兜底。PDD内只读，不调用采购执行器、不进入规格选择/改地址/下单/付款，不创建/重试服务器任务。
+- 临时探针输出通过 `adb -s <设备地址> logcat -d -s GoAutoNavProbe:I '*:S'` 读取；只包含随机runId、路径/固定结果、相对毫秒、节点计数、窗口id、布尔证据及仅在内存比较所得标题same/different/unknown，不保存标题/哈希/URL/页面原文/原始树/截图，不写业务数据库。别用logcat -t的全局最后几行冒充完整诊断；若缓冲已覆盖须如实记录。禁止导出完整无过滤系统日志。
+- `legacy_would_accept`模拟现有两次商品结构命中，始终标注identityVerified=false；窗口变化、标题变化、商品结构成立都不是目标goodsId证明。shell触发探针与后台任务的系统启动许可可能不同；人工指定browser只验证浏览器路径，不证明当时自动回退的异常原因。正常/失败对照及真实后台时序仍须以任务绑定诊断和人工确认核验。
+- 自动化验证应包含debug专用探针单测与 `:app:compileReleaseUnitTestKotlin`；探针测试放 `src/testDebug`，不得在共享 `src/test` 引用debug-only类。构建使用原私有签名，安装后回读包版本和APK哈希，并比较设置/设备身份摘要。
+
+## #373 v4 修复版构建与验证（2026-10-09）
+
+- 源码分支 `fix/373-navigation-diagnostics`，实现提交 `dbf9a5f4606529189e57b6c266449070d5001340`。APK版本 `0.9.69-373-fix1 / code82`，与前一导航诊断版不同；未安装修复版、未合并main、未发布线上，不需要Admin迁移或服务重启。
+- APK SHA256 `171f4b12395e2940ce873b62ea394799f521d1a0997f6aaf7582a123c24795e8`；仍使用用户原签名，证书SHA256 `bf86d7465c6092be74ce9c4187eb30c9a7d045c3b91891a547e2598429766dec`。后续经安装授权用install -r保留数据，不能为覆盖擅自卸载。相同versionCode不能证明文件相同，应核对完整版本和哈希。
+- 主Agent独立执行相关测试451项（23套件）零失败/错误，compileReleaseUnitTestKotlin与assembleDebug通过；规格及代码质量两轮独立只读审查通过。覆盖一次性交接/首传回放/上传标记失败/慢读取过期、浏览器出现前旧帧、diag3时序、3秒缓冲/1秒稳定、慢Binder点击冷却与超时零后续动作，以及采购、采集、原诊断相关回归。不是全量测试或真机采购验收。
+- 修复版的真实采购/重购未执行，页面身份识别限制见业务规则。原debug导航探针依然用于旧判据时序取证，不把其legacy_would_accept日志冒充新版执行器通过证据；新版导航就绪由实际采购执行器及其纯策略判断。
+- 诊断仍沿用已有本地记录；无需新schema、服务端权限或接口。运维排查先分清实际DIRECT/BROWSER路径、是否发生浏览器前旧页抢跑、是否缓冲/稳定超时，以及复用凭证是否有效；不能仅因startActivity接受就认定商品已加载。

server/app/goauto/task/image_search_link.go

@@ -2,6 +2,7 @@ package task
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log"
@@ -15,8 +16,8 @@ import (
 )
 
 // autoLinkImageSearch is deliberately a narrow post-result hook. It only
-// writes an association when the task was a complete collection, the frozen
-// original association is unchanged, and the target product is active. Manual
+// writes an association when the collection is complete or missing only optional
+// metadata, the frozen original association is unchanged, and the target product is active. Manual
 // changes made while the Agent was running win by the CAS predicate.
 // autoLinkedImageSearch 汇报本次是否确实写入了关联，以及关联覆盖了哪些 SYB 明细。
 // 只有确实写入时才值得触发后续的规格匹配（#287）。
@@ -32,7 +33,7 @@ func (service *Service) autoLinkImageSearch(ctx context.Context, taskID uint64)
 	if err := service.DB.WithContext(ctx).First(&task, taskID).Error; err != nil {
 		return autoLinkedImageSearch{}, internalError(err)
 	}
-	if task.Source != models.CollectionTaskSourceImageSearch || task.Status != models.TaskStatusCompleted || task.PDDProductID == nil || task.ImageSearchSnapshot == nil {
+	if task.Source != models.CollectionTaskSourceImageSearch || !imageSearchResultAllowsAutoLink(task) || task.PDDProductID == nil || task.ImageSearchSnapshot == nil {
 		return autoLinkedImageSearch{}, nil
 	}
 	snapshot, err := loadImageSearchSnapshot(task)
@@ -94,6 +95,31 @@ func (service *Service) autoLinkImageSearch(ctx context.Context, taskID uint64)
 	}, nil
 }
 
+// #368: Keep completed behavior unchanged. A partial result is eligible only
+// with explicit, nonempty evidence that every missing field is optional.
+// Unknown/malformed missing data must not silently widen this whitelist.
+func imageSearchResultAllowsAutoLink(task models.CollectionTask) bool {
+	if task.Status == models.TaskStatusCompleted {
+		return true
+	}
+	if task.Status != models.TaskStatusCompletedPartial || task.MissingJSON == nil {
+		return false
+	}
+	var missing []string
+	if err := json.Unmarshal([]byte(*task.MissingJSON), &missing); err != nil || len(missing) == 0 {
+		return false
+	}
+	for _, field := range missing {
+		switch field {
+		case "reviewCount", "salesText", "shopName":
+			// Optional descriptive metadata; never colors, sizes or prices.
+		default:
+			return false
+		}
+	}
+	return true
+}
+
 // matchSpecsAfterImageSearch triggers the existing SYB batch spec match for the
 // details the image-search task just linked (#287).
 //

server/app/goauto/task/image_search_partial_test.go

@@ -0,0 +1,324 @@
+package task
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"sync/atomic"
+	"testing"
+
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/shopeeproduct"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+// This fixture leaves the hook uncalled so tests can change the submitted
+// status, missing fields and association independently of the assertions.
+func seedPartialImageSearch(t *testing.T, db *gorm.DB, deviceID *uint64) (models.CollectionTask, models.ShopeeProduct) {
+	t.Helper()
+	record := createTask(t, db, deviceID)
+	if err := db.Model(&models.PDDProduct{}).Where("id = ?", *record.PDDProductID).Update("status", "active").Error; err != nil {
+		t.Fatal(err)
+	}
+	shopee := models.ShopeeProduct{
+		ShopeeItemID: "test-item", Title: "test", Currency: "TWD",
+		SpecsJSON: `[{"name":"颜色","role":"color","values":[{"name":"黑色","source":"import"}]},{"name":"尺码","role":"size","values":[{"name":"M","source":"import"}]}]`,
+	}
+	if err := db.Create(&shopee).Error; err != nil {
+		t.Fatal(err)
+	}
+	syb := models.SYBProduct{
+		OrderCode: "TEST-ORDER", DetailID: 1, StockID: 1, ShopeeItemID: shopee.ShopeeItemID,
+		ShopeeProductID: &shopee.ID, TargetColor: "黑色", TargetSize: "M",
+		Quantity: 1, UnitPriceCent: 1000, ParseStatus: "success", RawJSON: "{}",
+	}
+	if err := db.Create(&syb).Error; err != nil {
+		t.Fatal(err)
+	}
+	snapshot := ImageSearchSnapshot{
+		ShopeeProductID: shopee.ID, RepresentativeSYBProductID: syb.ID, SYBProductIDs: []uint64{syb.ID},
+		ReferenceCurrency: "TWD", ReferencePriceCent: 1000, MaxPriceRatio: 3, PriceGuardSkipped: true,
+		ImageSearchImage: ImageSearchImage{ImageURL: "https://example.invalid/a.jpg", MediaType: "image/jpeg", SizeBytes: 1, SHA256: "0123456789012345678901234567890101234567890123456789012345678901"},
+	}
+	raw, err := json.Marshal(snapshot)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Model(&record).Updates(map[string]any{"source": models.CollectionTaskSourceImageSearch, "image_search_snapshot": string(raw)}).Error; err != nil {
+		t.Fatal(err)
+	}
+	return record, shopee
+}
+
+func TestAutoLinkImageSearchPartialMissingWhitelist(t *testing.T) {
+	cases := []struct {
+		name, status, missing string
+		nilMissing, want      bool
+	}{
+		{name: "completed_empty", status: models.TaskStatusCompleted, missing: "[]", want: true},
+		{name: "completed_nil", status: models.TaskStatusCompleted, nilMissing: true, want: true},
+		{name: "nil", nilMissing: true},
+		{name: "blank"},
+		{name: "null", missing: "null"},
+		{name: "empty", missing: "[]"},
+		{name: "malformed", missing: `["reviewCount"`},
+		{name: "object", missing: `{ "reviewCount": true }`},
+		{name: "scalar", missing: `"reviewCount"`},
+		{name: "number_entry", missing: `["reviewCount",1]`},
+		{name: "null_entry", missing: `["reviewCount",null]`},
+		{name: "blank_entry", missing: `[""]`},
+		{name: "unknown", missing: `["reviewCount","futureField"]`},
+		{name: "case_mismatch", missing: `["ReviewCount"]`},
+		{name: "whitespace", missing: `[" reviewCount "]`},
+		{name: "color", missing: `["reviewCount","color"]`},
+		{name: "size", missing: `["size"]`},
+		{name: "price", missing: `["price"]`},
+		{name: "color_price", missing: `["reviewCount","price:黑色"]`},
+		{name: "unsupported_dimension", missing: `["unsupportedDimension:款式"]`},
+		{name: "invalid_dimension", missing: `["spec_dimension_invalid:size"]`},
+		{name: "pending", status: models.TaskStatusPending, missing: `["reviewCount"]`},
+		{name: "failed", status: models.TaskStatusFailed, missing: `["reviewCount"]`},
+		{name: "duplicate_optional", missing: `["reviewCount","reviewCount"]`, want: true},
+	}
+	fields := []string{"reviewCount", "salesText", "shopName"}
+	for mask := 1; mask < 8; mask++ {
+		var missing []string
+		for i, field := range fields {
+			if mask&(1<<i) != 0 {
+				missing = append(missing, field)
+			}
+		}
+		raw, _ := json.Marshal(missing)
+		cases = append(cases, struct {
+			name, status, missing string
+			nilMissing, want      bool
+		}{name: fmt.Sprintf("allowed_%d", mask), missing: string(raw), want: true})
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			db := openTaskDatabase(t)
+			record, shopee := seedPartialImageSearch(t, db, nil)
+			status := tc.status
+			if status == "" {
+				status = models.TaskStatusCompletedPartial
+			}
+			var missing *string
+			if !tc.nilMissing {
+				missing = &tc.missing
+			}
+			if err := record.SetStatus(status); err != nil {
+				t.Fatal(err)
+			}
+			if err := db.Model(&record).Updates(map[string]any{"status": status, "missing_json": missing, "active_slot": record.ActiveSlot, "device_run_slot": record.DeviceRunSlot}).Error; err != nil {
+				t.Fatal(err)
+			}
+			linked, err := NewService(db).autoLinkImageSearch(context.Background(), record.ID)
+			if err != nil || linked.Linked != tc.want {
+				t.Fatalf("Linked=%v want=%v error=%v", linked.Linked, tc.want, err)
+			}
+			if err := db.First(&shopee, shopee.ID).Error; err != nil {
+				t.Fatal(err)
+			}
+			if shopee.ImageSearchLinked != tc.want || (shopee.PDDProductID != nil) != tc.want {
+				t.Fatalf("association/marker mismatch: %+v", shopee)
+			}
+			if tc.want && (*shopee.PDDProductID != *record.PDDProductID || len(linked.SYBProductIDs) != 1) {
+				t.Fatal("linked target or downstream SYB identifiers lost")
+			}
+			if err := db.First(&record, record.ID).Error; err != nil {
+				t.Fatal(err)
+			}
+			if record.Status != status || !reflect.DeepEqual(record.MissingJSON, missing) {
+				t.Fatal("eligibility must not rewrite collection status or missing fields")
+			}
+		})
+	}
+}
+
+func TestSubmitImageSearchPartialLinkAndMatch(t *testing.T) {
+	for _, scenario := range []string{"optional_partial", "completed", "critical_missing", "admin_source", "current_page_source", "disabled_pdd", "association_changed", "snapshot_missing", "ai_unavailable", "request_cancelled_during_match"} {
+		t.Run(scenario, func(t *testing.T) {
+			requestContext, cancelRequest := context.WithCancel(context.Background())
+			defer cancelRequest()
+			var syncCalls atomic.Int32
+			erp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				syncCalls.Add(1)
+				if scenario == "request_cancelled_during_match" {
+					// Cancel only after the real post-result matching hook has
+					// started. Its detached context must still persist mappings.
+					cancelRequest()
+				}
+				if scenario == "ai_unavailable" {
+					w.WriteHeader(http.StatusServiceUnavailable)
+					return
+				}
+				w.Header().Set("Content-Type", "application/json")
+				fmt.Fprint(w, `{"data":{"color":["黑色"],"size":["M"]}}`)
+			}))
+			defer erp.Close()
+			t.Setenv("GOAUTO_ERPGO_BASE_URL", erp.URL)
+			t.Setenv("GOAUTO_ERPGO_APIKEY", "synthetic-test-key")
+			db := openTaskDatabase(t)
+			device, token := registerTaskDevice(t, db, "partial-image-search")
+			record, shopee := seedPartialImageSearch(t, db, &device.ID)
+			service := newTaskService(db)
+			// Execution is outside this test's scope; submit through the real
+			// authenticated running-owner path with a persisted image-search snapshot.
+			if err := db.Model(&record).Update("status", models.TaskStatusRunning).Error; err != nil {
+				t.Fatal(err)
+			}
+			title, shop, sales, reviews := "商品", "店铺", "已拼100件", int64(12)
+			request := ResultRequest{
+				RequestID: uuid.NewString(), Status: models.TaskStatusCompletedPartial,
+				Product:     ResultProduct{PDDGoodsID: record.GoodsIDSnapshot, Title: &title, ShopName: &shop, SalesText: &sales},
+				Dimensions:  []ResultDimension{{Key: "color", Name: "颜色", Values: []string{"黑色"}}, {Key: "size", Name: "尺码", Values: []string{"M"}}},
+				ColorPrices: []ResultColorPrice{{Color: "黑色", PriceCent: 1000}},
+				SKUs:        []ResultSKU{{Specs: map[string]string{"color": "黑色", "size": "M"}, PriceCent: 1000, Available: true}},
+				Missing:     []string{"reviewCount"},
+			}
+			wantLinked, wantMapped := true, true
+			var unchangedPDD *uint64
+			switch scenario {
+			case "completed":
+				request.Status, request.Missing, request.Product.ReviewCount = models.TaskStatusCompleted, []string{}, &reviews
+			case "critical_missing":
+				request.Missing = append(request.Missing, "size")
+				wantLinked, wantMapped = false, false
+			case "admin_source", "current_page_source":
+				source := models.CollectionTaskSourceAdmin
+				if scenario == "current_page_source" {
+					source = models.CollectionTaskSourceAgentCurrentPage
+				}
+				if err := db.Model(&record).Update("source", source).Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "disabled_pdd":
+				if err := db.Model(&models.PDDProduct{}).Where("id = ?", *record.PDDProductID).Update("status", "disabled").Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "association_changed":
+				manual := seedAutoLinkPDD(t, db, "manual-pdd")
+				unchangedPDD = &manual.ID
+				if err := db.Model(&shopee).Update("pdd_product_id", manual.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "snapshot_missing":
+				if err := db.Model(&record).Update("image_search_snapshot", nil).Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "ai_unavailable":
+				// No exact match and no configured AI provider: the existing
+				// matching path must not invent mappings or undo successful collection.
+				request.Dimensions[0].Values = []string{"白色"}
+				request.Dimensions[1].Values = []string{"L"}
+				request.ColorPrices[0].Color = "白色"
+				request.SKUs[0].Specs = map[string]string{"color": "白色", "size": "L"}
+				wantMapped = false
+			}
+			for attempt := 0; attempt < 2; attempt++ {
+				ctx := context.Background()
+				if attempt == 0 {
+					ctx = requestContext
+				}
+				detail, err := service.SubmitResult(ctx, record.ID, request, token)
+				if scenario == "request_cancelled_during_match" && attempt == 0 {
+					// Detail still uses the original request context. Preserve that
+					// existing return behavior, then inspect the committed state
+					// independently; do not pretend the disconnected client got OK.
+					if requestContext.Err() != context.Canceled || err == nil {
+						t.Fatalf("expected cancelled response read, got %v", err)
+					}
+					detail, err = service.Detail(context.Background(), record.ID)
+				}
+				if err != nil {
+					t.Fatalf("submit attempt %d: %v", attempt, err)
+				}
+				if detail.Task.Status != request.Status || !reflect.DeepEqual(detail.Missing, request.Missing) || detail.Replayed != (attempt == 1) {
+					t.Fatalf("submission/replay changed result: status=%s missing=%v replayed=%v", detail.Task.Status, detail.Missing, detail.Replayed)
+				}
+				if len(detail.SKUs) != 1 || len(detail.Dimensions) != 2 {
+					t.Fatal("result children missing or duplicated")
+				}
+				if err := db.First(&shopee, shopee.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				if shopee.ImageSearchLinked != wantLinked {
+					t.Fatalf("image search marker=%v", shopee.ImageSearchLinked)
+				}
+				wantPDD := unchangedPDD
+				if wantLinked {
+					wantPDD = record.PDDProductID
+				}
+				if !reflect.DeepEqual(shopee.PDDProductID, wantPDD) {
+					t.Fatal("wrong association or concurrent change overwritten")
+				}
+				wantCalls := int32(0)
+				if wantLinked {
+					wantCalls = 1
+				}
+				if syncCalls.Load() != wantCalls {
+					t.Fatalf("matching hook calls=%d want=%d", syncCalls.Load(), wantCalls)
+				}
+				specs, err := shopeeproduct.Unmarshal(shopee.SpecsJSON)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if len(specs) != 2 {
+					t.Fatalf("unexpected archive dimensions: %d", len(specs))
+				}
+				for _, dimension := range specs {
+					for _, value := range dimension.Values {
+						if wantMapped {
+							if value.Mapping == nil || value.Mapping.Status != shopeeproduct.MappingStatusConfirmed || value.Mapping.PDDValue != value.Name {
+								t.Fatalf("matching not persisted: %+v", value)
+							}
+						} else if value.Mapping != nil {
+							t.Fatalf("unexpected mapping: %+v", value)
+						}
+					}
+				}
+			}
+			if scenario == "optional_partial" {
+				// A second result for the same image carries the same original
+				// association snapshot. The first committed link wins; no fallback
+				// to another result or a second matching pass is introduced.
+				if err := db.First(&record, record.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				second := createTask(t, db, &device.ID)
+				if err := db.Model(&second).Updates(map[string]any{
+					"source": models.CollectionTaskSourceImageSearch, "image_search_snapshot": record.ImageSearchSnapshot,
+					"status": models.TaskStatusRunning,
+				}).Error; err != nil {
+					t.Fatal(err)
+				}
+				request.RequestID, request.Product.PDDGoodsID = uuid.NewString(), second.GoodsIDSnapshot
+				if _, err := service.SubmitResult(context.Background(), second.ID, request, token); err != nil {
+					t.Fatal(err)
+				}
+				if err := db.First(&shopee, shopee.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				if !reflect.DeepEqual(shopee.PDDProductID, record.PDDProductID) || syncCalls.Load() != 1 {
+					t.Fatal("competing image-search result replaced association or retriggered matching")
+				}
+			}
+			var purchases int64
+			if err := db.Model(&models.PurchaseTask{}).Count(&purchases).Error; err != nil {
+				t.Fatal(err)
+			}
+			if purchases != 0 {
+				t.Fatal("matching must not create a purchase task")
+			}
+		})
+	}
+}