docs: sync agent backfill scanning rules for #242

线上 Wiki Business-Rules-and-Glossary 已更新并回读，revision
1eb380d07183157a8430c7ced868479e72fbdfe3。镜像由 harness.py sync
从线上重建，sync --check 通过，未反向覆盖 Wiki。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NTDbDcwbDw1TSAcE6wfh2F

android/app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "cn.ilapage.goauto.agent"
         minSdk = 23
         targetSdk = 34
-        versionCode = 77
-        versionName = "0.9.64"
+        versionCode = 72
+        versionName = "0.9.59"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

android/app/src/main/java/cn/ilapage/goauto/agent/automation/GoAutoAccessibilityService.kt

@@ -194,6 +194,39 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         return swipeNode(node, direction)
     }
 
+    /** Backfill never uses ancestor clicks or coordinate/gesture fallbacks. */
+    fun clickBackfill(target: SnapshotNode): Boolean {
+        val page = capture()
+        BackfillPagePolicy.validate(page)
+        val fresh = page.nodes.singleOrNull { it.path == target.path && it.label == target.label &&
+            it.bounds == target.bounds && it.className == target.className } ?: return false
+        val allowed = BackfillPagePolicy.cards(page).any { it.path == fresh.path } ||
+            BackfillPagePolicy.expansion(page)?.path == fresh.path ||
+            (fresh.label == "全部" && page.nodes.any { it.label in setOf("我的订单", "全部订单") })
+        if (!allowed || !BackfillPagePolicy.safe(page, fresh)) return false
+        val root = rootInActiveWindow ?: return false
+        if (root.packageName?.toString() != BackfillPagePolicy.PDD) return false
+        var node = root
+        for (index in fresh.path.split('/').drop(1)) node = node.getChild(index.toInt()) ?: return false
+        val bounds = Rect().also(node::getBoundsInScreen)
+        if (!node.isClickable || !node.isEnabled || !node.isVisibleToUser ||
+            NodeBounds(bounds.left, bounds.top, bounds.right, bounds.bottom) != fresh.bounds ||
+            (node.text?.toString()?.trim().takeUnless { it.isNullOrEmpty() } ?: node.contentDescription?.toString()?.trim().orEmpty()) != fresh.label) return false
+        return node.performAction(AccessibilityNodeInfo.ACTION_CLICK)
+    }
+
+    fun scrollBackfill(): Boolean {
+        BackfillPagePolicy.validate(capture())
+        val root = rootInActiveWindow ?: return false
+        val candidates = mutableListOf<AccessibilityNodeInfo>()
+        walk(root) { if (it.isScrollable && it.isVisibleToUser && it.isEnabled) candidates += it }
+        // Prefer the unique largest vertical viewport. Ambiguous panes fail closed.
+        val areas = candidates.map { it to Rect().also(it::getBoundsInScreen) }
+        val maxArea = areas.maxOfOrNull { it.second.width().toLong() * it.second.height() } ?: return false
+        val target = areas.filter { it.second.width().toLong() * it.second.height() == maxArea }.singleOrNull() ?: return false
+        return target.first.performAction(AccessibilityNodeInfo.ACTION_SCROLL_FORWARD)
+    }
+
     override fun capture(): UiSnapshot {
         val root = rootInActiveWindow ?: return UiSnapshot(null, null, emptyList())
         val rootPackage = root.packageName?.toString()
@@ -434,16 +467,8 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         } else FreshActionResult.FAILED
     }
 
-    private var lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.UNKNOWN
-
-    override fun purchaseSwipeFailureReason(): PurchaseSwipeFailureReason = lastPurchaseSwipeFailure
-
     override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean {
-        lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.UNKNOWN
-        val root = rootInActiveWindow ?: run {
-            lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.ROOT_UNAVAILABLE
-            return false
-        }
+        val root = rootInActiveWindow ?: return false
         val candidates = mutableListOf<AccessibilityNodeInfo>()
         walk(root) { node -> if (node.isVisibleToUser && node.isScrollable) candidates += node }
         val horizontal = direction == SwipeDirection.LEFT || direction == SwipeDirection.RIGHT
@@ -452,12 +477,8 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         }
         val target = (directional.ifEmpty { candidates }).maxByOrNull { candidate ->
             Rect().also(candidate::getBoundsInScreen).let { it.width().toLong() * it.height() }
-        } ?: run {
-            lastPurchaseSwipeFailure = PurchaseSwipeFailureReason.NO_SCROLLABLE
-            return false
-        }
-        return swipeNode(target, direction, durationMs, preferScrollAction = false,
-            onFailure = { lastPurchaseSwipeFailure = it })
+        } ?: return false
+        return swipeNode(target, direction, durationMs, preferScrollAction = false)
     }
 
     override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
@@ -658,21 +679,16 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         preferScrollAction: Boolean = true,
         downStartPercent: Int = 25,
         downEndPercent: Int = 75,
-        onFailure: (PurchaseSwipeFailureReason) -> Unit = {},
     ): Boolean {
-        fun failed(reason: PurchaseSwipeFailureReason): Boolean {
-            onFailure(reason)
-            return false
-        }
         val bounds = Rect().also(node::getBoundsInScreen)
-        if (bounds.width() < 2 || bounds.height() < 2) return failed(PurchaseSwipeFailureReason.INVALID_BOUNDS)
+        if (bounds.width() < 2 || bounds.height() < 2) return false
         val scrollAction = if (direction == SwipeDirection.UP || direction == SwipeDirection.LEFT) {
             AccessibilityNodeInfo.ACTION_SCROLL_FORWARD
         } else {
             AccessibilityNodeInfo.ACTION_SCROLL_BACKWARD
         }
         if (preferScrollAction && node.performAction(scrollAction)) return true
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) return failed(PurchaseSwipeFailureReason.GESTURE_UNSUPPORTED)
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.N) return false
         val left = bounds.left + bounds.width() * 25 / 100
         val right = bounds.left + bounds.width() * 75 / 100
         val top = bounds.top + bounds.height() * 25 / 100
@@ -710,9 +726,8 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
             },
             null,
         )
-        if (!queued) return failed(PurchaseSwipeFailureReason.GESTURE_REJECTED)
-        if (!latch.await(1500, TimeUnit.MILLISECONDS)) return failed(PurchaseSwipeFailureReason.GESTURE_TIMEOUT)
-        return completed.get() || failed(PurchaseSwipeFailureReason.GESTURE_CANCELLED)
+        if (!queued) return false
+        return latch.await(1500, TimeUnit.MILLISECONDS) && completed.get()
     }
 
     private fun dispatchCenterTap(bounds: Rect): Boolean {

android/app/src/main/java/cn/ilapage/goauto/agent/automation/OrderBackfillPolicy.kt

@@ -0,0 +1,87 @@
+package cn.ilapage.goauto.agent.automation
+
+import java.math.BigInteger
+import java.text.SimpleDateFormat
+import java.util.Locale
+import java.util.TimeZone
+
+/** Runtime evidence only: a sorted prefix cannot prove the unvisited tail is sorted. */
+class OrderBackfillWindow(days: String, val confirmedAt: Long) {
+    val cutoff: Long
+    var checked = 0
+        private set
+    var nonDescending = false
+        private set
+    private var previous: Long? = null
+    private var missingTime = false
+    private var timed = 0
+
+    init {
+        require(days.matches(Regex("[0-9]+")) && BigInteger(days) > BigInteger.ZERO)
+        cutoff = BigInteger.valueOf(confirmedAt).subtract(BigInteger(days).multiply(BigInteger.valueOf(86_400_000)))
+            .max(BigInteger.valueOf(Long.MIN_VALUE)).toLong()
+    }
+
+    fun observe(time: Long?): Boolean {
+        checked++
+        if (time == null) missingTime = true else {
+            if (previous != null && time > previous!!) nonDescending = true
+            previous = time
+            timed++
+        }
+        // Check at least five details before using a sampled ordering assumption.
+        return !nonDescending && !missingTime && timed >= ORDERING_SAMPLE && time != null && time < cutoff
+    }
+
+    fun includes(time: Long?): Boolean = time == null || time in cutoff..confirmedAt
+
+    companion object {
+        const val ORDERING_SAMPLE = 5
+        const val MAX_ORDERS = 200
+        const val MAX_DURATION_MS = 10 * 60_000L
+        const val UNORDERED = "列表非严格倒序，已改为有界扫描，可能未覆盖全部"
+    }
+}
+
+data class BackfillItem(val addressSuffix: String, val pddOrderNo: String, val orderSubmittedAt: String?)
+data class BackfillDetail(val item: BackfillItem?, val timeMillis: Long?)
+
+/** Per-detail accumulator. Never retains raw text, addresses, names or phone numbers. */
+class BackfillDetailReader(private val zone: TimeZone = TimeZone.getDefault()) {
+    private val suffixes = mutableSetOf<String>()
+    private val orders = mutableSetOf<String>()
+    private val times = mutableSetOf<Long>()
+
+    fun accept(text: String) {
+        SUFFIX.findAll(text).forEach { suffixes += it.value }
+        ORDER_NO.findAll(text).forEach { orders += it.groupValues[1] }
+        ORDER_TIME.findAll(text).forEach { match -> parseTime(match.groupValues[1])?.let(times::add) }
+    }
+
+    fun finish(): BackfillDetail {
+        val time = times.singleOrNull()
+        val item = if (suffixes.size == 1 && orders.size == 1 && times.size <= 1) {
+            BackfillItem(suffixes.single(), orders.single(), time?.let {
+                SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssXXX", Locale.ROOT).apply { timeZone = zone }.format(it)
+            })
+        } else null
+        suffixes.clear()
+        orders.clear()
+        times.clear()
+        return BackfillDetail(item, time)
+    }
+
+    private fun parseTime(raw: String): Long? {
+        val normalized = raw.replace('年', '-').replace('月', '-').replace("日", "").replace('/', '-').replace('.', '-')
+        val pattern = if (normalized.count { it == ':' } == 2) "yyyy-M-d H:mm:ss" else "yyyy-M-d H:mm"
+        val position = java.text.ParsePosition(0)
+        val date = SimpleDateFormat(pattern, Locale.ROOT).apply { isLenient = false; timeZone = zone }.parse(normalized, position)
+        return date?.time?.takeIf { position.index == normalized.length }
+    }
+
+    companion object {
+        val ORDER_NO = Regex("(?:订单编号|订单号)\\s*[:：]?\\s*([A-Za-z0-9-]{6,64})")
+        val ORDER_TIME = Regex("(?:下单时间|创建时间)\\s*[:：]?\\s*(20\\d{2}[-/.年]\\d{1,2}[-/.月]\\d{1,2}日?\\s+\\d{1,2}:\\d{2}(?::\\d{2})?)")
+        private val SUFFIX = Regex("_cg[1-9][0-9]*(?![0-9A-Za-z_０-９])")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/OrderBackfillScanner.kt

@@ -0,0 +1,140 @@
+package cn.ilapage.goauto.agent.automation
+
+import java.security.MessageDigest
+
+object BackfillPagePolicy {
+    const val PDD = "com.xunmeng.pinduoduo"
+    val forbidden = listOf("确认收货", "申请退款", "催发货", "去支付", "立即支付", "提交订单", "付款", "退款", "取消订单", "再次购买", "删除订单")
+    private val risk = listOf("验证码", "安全验证", "人机验证", "登录", "账号异常", "风险验证", "拖动滑块")
+    fun validate(page: UiSnapshot) {
+        require(page.packageName == PDD && page.activityName?.startsWith(PDD) == true) { "PDD 页面身份不符" }
+        require(page.nodes.none { it.visible && risk.any { word -> it.label.contains(word) } }) { "遇到登录或安全验证，已停止" }
+    }
+    private fun subtree(page: UiSnapshot, node: SnapshotNode) = page.nodes.filter { it.path == node.path || it.path.startsWith(node.path + "/") }
+    fun safe(page: UiSnapshot, node: SnapshotNode): Boolean = node.visible && node.enabled && node.clickable &&
+        node.bounds.width > 0 && node.bounds.height > 0 &&
+        subtree(page, node).none { child -> forbidden.any { child.label.contains(it) } } &&
+        page.nodes.none { other -> other.visible && forbidden.any { other.label.contains(it) } &&
+            other.bounds.left < node.bounds.right && other.bounds.right > node.bounds.left &&
+            other.bounds.top < node.bounds.bottom && other.bounds.bottom > node.bounds.top }
+
+    fun list(page: UiSnapshot): Boolean = page.nodes.any { it.visible && it.label == "全部" && it.selected } &&
+        page.nodes.any { it.visible && it.label in setOf("我的订单", "全部订单") }
+    fun detail(page: UiSnapshot): Boolean = page.nodes.any { it.visible && (it.label == "订单详情" || it.label.contains("订单编号")) }
+    fun expansion(page: UiSnapshot): SnapshotNode? {
+        if (!detail(page) || page.nodes.none { it.visible && it.label.contains("订单编号") }) return null
+        val order = page.nodes.first { it.visible && it.label.contains("订单编号") }
+        val snapshot = page.nodes.filter { it.visible && it.label == "商品快照" }.singleOrNull() ?: return null
+        return page.nodes.filter { it.label == "展开" && safe(page, it) && it.bounds.top >= order.bounds.top &&
+            it.bounds.top < snapshot.bounds.bottom && it.bounds.bottom > snapshot.bounds.top }.singleOrNull()
+    }
+    fun cards(page: UiSnapshot): List<SnapshotNode> {
+        if (!list(page)) return emptyList()
+        return page.nodes.filter { node ->
+            if (!safe(page, node)) return@filter false
+            if (node.label in setOf("订单详情", "查看详情")) return@filter true
+            val children = subtree(page, node)
+            val product = children.any { it.className?.endsWith("ImageView") == true } && children.any { it.label.length >= 4 }
+            val parent = page.nodes.firstOrNull { it.path == node.parentPath } ?: return@filter false
+            val context = subtree(page, parent)
+            product && context.any { it.label in setOf("查看物流", "确认收货", "去支付", "待发货", "待收货", "交易成功", "再次购买") }
+        }.sortedBy { it.bounds.top }.let { candidates ->
+            candidates.filter { node -> candidates.none { it !== node && it.path.startsWith(node.path + "/") } }
+        }
+    }
+    fun fingerprint(page: UiSnapshot, card: SnapshotNode): String {
+        val labels = subtree(page, card).joinToString("|") { it.label }
+        return MessageDigest.getInstance("SHA-256").digest(labels.toByteArray()).joinToString("") { "%02x".format(it) }
+    }
+}
+
+interface BackfillDriver {
+    fun openOrders()
+    fun capture(): UiSnapshot
+    fun click(node: SnapshotNode): Boolean
+    fun scroll(): Boolean
+    fun back(): Boolean
+    fun pause()
+}
+
+class OrderBackfillScanner(
+    private val driver: BackfillDriver,
+    private val window: OrderBackfillWindow,
+    private val checkActive: () -> Unit,
+    private val submit: (BackfillItem) -> Unit,
+    private val progress: (Int) -> Unit,
+) {
+    fun scan(): String {
+        checkActive()
+        driver.openOrders()
+        driver.pause()
+        var page = read()
+        if (!BackfillPagePolicy.list(page)) {
+            val tab = page.nodes.filter { it.label == "全部" && BackfillPagePolicy.safe(page, it) }.singleOrNull()
+            check(page.nodes.any { it.label in setOf("我的订单", "全部订单") } && tab != null) { "未识别我的订单-全部" }
+            act { driver.click(tab) }
+            page = read()
+            check(BackfillPagePolicy.list(page)) { "无法确认全部订单标签" }
+        }
+        if (page.nodes.any { it.visible && it.label == "暂无订单" }) return "扫描完成，未发现订单"
+        val seenCards = mutableSetOf<String>()
+        val seenOrders = mutableSetOf<String>()
+        var noProgress = 0
+        while (window.checked < OrderBackfillWindow.MAX_ORDERS) {
+            checkActive()
+            check(BackfillPagePolicy.list(page)) { "返回后未识别全部订单列表" }
+            val card = BackfillPagePolicy.cards(page).firstOrNull { BackfillPagePolicy.fingerprint(page, it) !in seenCards }
+            if (card == null) {
+                if (++noProgress >= 3) return finish("列表无进展或卡片无法安全识别，未完整扫描")
+                checkActive()
+                if (!driver.scroll()) return finish("列表滚动结束或不可滚动，未完整扫描")
+                driver.pause()
+                page = read()
+                continue
+            }
+            noProgress = 0
+            seenCards += BackfillPagePolicy.fingerprint(page, card)
+            act { driver.click(card) }
+            var detail = read()
+            check(BackfillPagePolicy.detail(detail)) { "点击后未识别订单详情" }
+            val reader = BackfillDetailReader()
+            var expanded = false
+            // Limited detail scrolling; only this accumulator associates fields across these frames.
+            for (step in 0 until 6) {
+                reader.accept(detail.nodes.filter { it.visible }.joinToString("\n") { it.label })
+                val expand = if (expanded) null else BackfillPagePolicy.expansion(detail)
+                if (expand != null) {
+                    act { driver.click(expand) }
+                    expanded = true
+                } else {
+                    checkActive()
+                    if (!driver.scroll()) break
+                    driver.pause()
+                }
+                detail = read()
+                check(BackfillPagePolicy.detail(detail)) { "滚动后无法确认订单详情，未完整扫描" }
+            }
+            reader.accept(detail.nodes.filter { it.visible }.joinToString("\n") { it.label })
+            val found = reader.finish()
+            val stopForTime = window.observe(found.timeMillis)
+            progress(window.checked)
+            found.item?.takeIf { window.includes(found.timeMillis) && seenOrders.add(it.pddOrderNo) }?.let(submit)
+            if (stopForTime) return "已达指定天数（已读序列倒序）；未完整扫描，后续列表时序未经验证"
+            act { driver.back() }
+            page = read()
+        }
+        return finish("达到 200 单内部上限，未完整扫描")
+    }
+
+    private fun finish(reason: String): String = reason + if (window.nonDescending) "\n${OrderBackfillWindow.UNORDERED}" else ""
+
+    private fun read(): UiSnapshot {
+        checkActive()
+        return driver.capture().also(BackfillPagePolicy::validate)
+    }
+    private fun act(action: () -> Boolean) {
+        checkActive()
+        check(action()) { "安全页面操作失败，未完整扫描" }
+        driver.pause()
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseLiveAutomation.kt

@@ -491,11 +491,8 @@ class PurchaseLiveAutomation(
                 restoreFinalEvidenceInCurrentPanel(savedEvidence, expected, suffix)
             } else {
                 if (!driver.backPurchase()) fail("PURCHASE_ADDRESS_UPDATE_FAILED", "地址保存后无法返回订单页面，未创建订单")
-                val returned = waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
-                    hasFinalSavedAddressEvidence(it, expected, suffix) || isPurchaseConfirmationPanel(it)
-                }
-                if (!hasFinalSavedAddressEvidence(returned, expected, suffix)) {
-                    restoreFinalEvidenceInCurrentPanel(returned, expected, suffix)
+                waitFor("PURCHASE_ADDRESS_SAVE_TIMEOUT", "地址保存后无法返回订单页面，未创建订单") {
+                    hasFinalSavedAddressEvidence(it, expected, suffix)
                 }
             }
         }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseRehearsalExecutor.kt

@@ -3,11 +3,6 @@ package cn.ilapage.goauto.agent.automation
 import java.net.URI
 import java.net.URLDecoder
 
-enum class PurchaseSwipeFailureReason {
-    UNKNOWN, ROOT_UNAVAILABLE, NO_SCROLLABLE, INVALID_BOUNDS, GESTURE_UNSUPPORTED,
-    GESTURE_REJECTED, GESTURE_CANCELLED, GESTURE_TIMEOUT,
-}
-
 interface PurchaseUiDriver {
     fun capture(): UiSnapshot
     fun clickFresh(target: SnapshotNode): FreshActionResult
@@ -37,7 +32,6 @@ interface PurchaseUiDriver {
     fun specRowSwipeFailureReason(): String = "gestureFailed"
     fun inputFresh(target: SnapshotNode, value: String): FreshActionResult
     fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean
-    fun purchaseSwipeFailureReason(): PurchaseSwipeFailureReason = PurchaseSwipeFailureReason.UNKNOWN
     fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean
     fun pullDownGoodsPage(): Boolean = swipePurchase(SwipeDirection.DOWN, 550)
     fun backPurchase(): Boolean
@@ -95,8 +89,6 @@ class PurchaseRehearsalExecutor(
     private val beforeOrderSubmit: (FinalConfirmationEvidence) -> Unit = { throw PurchaseLiveException("PURCHASE_MODE_NOT_ALLOWED", "当前执行器没有正式采购授权") },
 ) {
     private var purchasePanelContext: PurchasePanelContext? = null
-    private var pageIdentity: Pair<String?, String?> = null to null
-    private var entryRecoveryReason = "not_checked"
 
     fun execute(input: PurchaseExecutionInput, rule: PurchaseRule, supportedCapabilities: Set<String>): PurchaseExecutionOutcome {
         purchasePanelContext = null
@@ -378,9 +370,7 @@ class PurchaseRehearsalExecutor(
             screen = currentScreen(input)
         }
         val beforeSignature = specActionSignature(screen)
-        val beforeIdentity = pageIdentity
         val click = driver.clickFreshDetailed(requireNotNull(target))
-        panelDiagnostic("entrySource=${screen.specEntrySource ?: "unknown"};entryClick=${click.result};entryReason=${click.reason}")
         when (click.result) {
             // The parser already narrowed to a single semantic candidate; the
             // ambiguity here comes from the live tree matching that target more
@@ -395,22 +385,14 @@ class PurchaseRehearsalExecutor(
         var wait = waitForSpecPanel(input, beforeSignature)
         wait.failure?.let { return it }
         if (wait.opened) return null
-        val refreshed = currentScreen(input)
-        refreshed.problem?.let { return failure(it.code, it.message) }
-        if (refreshed.reviewPageOpen) return leaveUnexpectedReviewPage(input)
-        if (refreshed.specPanelOpen) return null
-        val recoveryTarget = recoverableSpecEntry(screen, refreshed, action, beforeIdentity)
-        if (recoveryTarget == null) {
-            panelDiagnostic("entryRecovery=rejected;reason=$entryRecoveryReason;pageChanged=${wait.changed};${panelEvidence(refreshed)}")
+        if (wait.changed) {
             return failure(
                 SPEC_PANEL_EVIDENCE_NOT_MATCHED,
                 "规格入口点击后页面已变化，但规格面板强证据不足 [${panelEvidence(wait.screen)}]",
             )
         }
 
-        val gesture = driver.tapSpecFresh(requireNotNull(recoveryTarget))
-        panelDiagnostic("entryRecovery=attempted;gesture=$gesture;pageChanged=${wait.changed}")
-        when (gesture) {
+        when (driver.tapSpecFresh(requireNotNull(target))) {
             FreshActionResult.AMBIGUOUS -> return failure(
                 SPEC_ENTRY_TARGET_AMBIGUOUS,
                 "规格入口手势目标不唯一 [${specEntryEvidence(screen, 1, entryReadyWaitPolls)}]",
@@ -424,7 +406,7 @@ class PurchaseRehearsalExecutor(
         wait = waitForSpecPanel(input, specActionSignature(wait.screen))
         wait.failure?.let { return it }
         if (wait.opened) return null
-        if (wait.changed && recoverableSpecEntry(screen, wait.screen, action, beforeIdentity) == null) {
+        if (wait.changed) {
             return failure(
                 SPEC_PANEL_EVIDENCE_NOT_MATCHED,
                 "规格入口手势后页面已变化，但规格面板强证据不足 [${panelEvidence(wait.screen)}]",
@@ -436,48 +418,6 @@ class PurchaseRehearsalExecutor(
         )
     }
 
-    // Whole-page animations are not proof of navigation. Recover only a freshly
-    // parsed, unchanged semantic product entry; never reuse the old node/coordinates.
-    private fun recoverableSpecEntry(
-        before: ParsedPddScreen,
-        after: ParsedPddScreen,
-        action: PurchaseAction,
-        identity: Pair<String?, String?>,
-    ): SnapshotNode? {
-        entryRecoveryReason = when {
-            identity.first == null || identity.second == null -> "identity_missing"
-            identity != pageIdentity -> "identity_changed"
-            !after.isPddPackage || !after.pageEvidenceMatched -> "product_context_missing"
-            after.problem != null || after.reviewPageOpen -> "page_problem"
-            after.specPanelOpen -> "panel_open"
-            after.hasCloseControl -> "close_control"
-            after.hasPaymentArea -> "payment_area"
-            after.hasOrderSubmitAction -> "order_action"
-            after.hasQuantityControls -> "quantity_controls"
-            after.hasSelectionSummary -> "selection_summary"
-            before.summary.title.isNullOrBlank() -> "title_missing"
-            before.summary.title != after.summary.title -> "title_changed"
-            after.specEntry == null -> "entry_missing"
-            before.specEntrySource == null -> "entry_source_missing"
-            before.specEntrySource != after.specEntrySource -> "entry_source_changed"
-            before.specEntry?.label != after.specEntry.label -> "entry_label_changed"
-            after.explicitSpecEntryCount > 1 || after.nestedSpecEntryCount > 1 -> "entry_ambiguous"
-            else -> "eligible"
-        }
-        if (entryRecoveryReason != "eligible") return null
-        val anchor = after.specEntry ?: return null
-        if (action.textAliases?.let { specEntryMatchesAliases(after, anchor, it) } == false) {
-            entryRecoveryReason = "rule_alias_mismatch"
-            return null
-        }
-        val target = after.specEntryClickTarget ?: anchor
-        if (!target.visible || !target.enabled) {
-            entryRecoveryReason = "entry_unavailable"
-            return null
-        }
-        return target
-    }
-
     private data class SpecPanelWait(
         val screen: ParsedPddScreen,
         val opened: Boolean,
@@ -603,7 +543,6 @@ class PurchaseRehearsalExecutor(
     ): PurchaseExecutionOutcome? {
         val initial = currentScreen(input)
         initial.problem?.let { return failure(it.code, it.message) }
-        unavailableExactSpec(initial, dimension, target)?.let { return it }
         if (rememberExactSelection(initial, dimension, target, selectionProofs)) return null
 
         val lookup = locateExactSpec(input, dimension, target)
@@ -678,9 +617,7 @@ class PurchaseRehearsalExecutor(
 
     private fun isExactSpecSelected(screen: ParsedPddScreen, dimension: String, target: String): Boolean {
         val candidates = screen.dimensions.filter { it.key == dimension }.flatMap { it.values }
-        if (candidates.any { it.text != target && (it.node.selected || it.node.checked) }) {
-            return dimension == "color" && SelectedColorCard.confirms(target, candidates, screen.sourceNodes)
-        }
+        if (candidates.any { it.text != target && (it.node.selected || it.node.checked) }) return false
         if (candidates.any { it.text == target && (it.node.selected || it.node.checked) }) return true
         if (screen.specPanelOpen && fullSummaryTargetMatches(screen.selectedSummary, target)) return true
         return summarySelectionMatches(screen.selectedSummary, dimension, target, candidates)
@@ -854,18 +791,6 @@ class PurchaseRehearsalExecutor(
 
     private data class SpecLookup(val node: SnapshotNode? = null, val failure: PurchaseExecutionOutcome? = null)
 
-    private fun unavailableExactSpec(screen: ParsedPddScreen, dimension: String, target: String): PurchaseExecutionOutcome? {
-        if (!screen.specPanelOpen) return null
-        val exact = screen.dimensions.filter { it.key == dimension }.flatMap { it.values }.filter { it.text == target }
-        return if (exact.size == 1 && !exact.single().available) unavailableSpec(dimension) else null
-    }
-
-    private fun unavailableSpec(dimension: String): PurchaseExecutionOutcome {
-        val role = if (dimension == "color") "颜色" else "尺码"
-        panelDiagnostic("specLookup=unavailable;dimension=$dimension;reason=exact_target_unavailable")
-        return failure(SPEC_SAFE_TARGET_MISSING, "目标${role}已售罄或当前不可选，未创建订单")
-    }
-
     /**
      * Searches only parsed, selectable values in the already-open spec panel.
      * A short downward pass first restores the top when a previous action left
@@ -902,7 +827,7 @@ class PurchaseRehearsalExecutor(
             }
             if (exact.size == 1 && exact.single().available) return Inspection(SpecLookup(node = exact.single().node), "", screen.specPanelContainer)
             if (exact.size == 1) {
-                return Inspection(SpecLookup(failure = unavailableSpec(dimension)), "", screen.specPanelContainer)
+                return Inspection(SpecLookup(failure = failure(SPEC_SAFE_TARGET_MISSING, "精确规格当前不可安全点击")), "", screen.specPanelContainer)
             }
             val signature = screen.dimensions.joinToString("|") { item ->
                 "${item.key}:${item.values.joinToString(",") { value -> "${value.text}:${value.available}" }}"
@@ -967,7 +892,7 @@ class PurchaseRehearsalExecutor(
             val lookup = when {
                 exact.size > 1 -> SpecLookup(failure = failure(SPEC_TARGET_AMBIGUOUS, "精确规格匹配到多个控件"))
                 exact.size == 1 && exact.single().available -> SpecLookup(node = exact.single().node)
-                exact.size == 1 -> SpecLookup(failure = unavailableSpec(dimension))
+                exact.size == 1 -> SpecLookup(failure = failure(SPEC_SAFE_TARGET_MISSING, "精确规格当前不可安全点击"))
                 else -> null
             }
             val rows = specValueRows(values)
@@ -1169,17 +1094,16 @@ class PurchaseRehearsalExecutor(
     private fun applyPostAction(input: PurchaseExecutionInput, action: PurchaseAction): PurchaseExecutionOutcome? {
         if (action.waitAfterMs > 0) pause(action.waitAfterMs)
         action.swipeAfter?.let { swipe ->
-            // Legacy rules prescribe a blind scroll immediately after opening.
-            // Opening has already been verified; probe/select owns any necessary
-            // bounded scrolling. Do not let an unnecessary gesture block either
-            // phase, or move already-visible exact specs out of the viewport.
-            if (action.type == PurchaseActionType.OPEN_SPEC_PANEL) {
-                panelDiagnostic("postSwipe=skipped;action=${action.type.wireName};reason=spec_panel_on_demand;panel=${currentScreen(input).specPanelType.name}")
-                return null
-            }
+            // The stock purchase rule asks to reveal additional selector rows after
+            // opening the sheet.  A fully-evidenced non-scrollable selector has no
+            // scroll target, and treating that absence as an action failure blocks
+            // an otherwise safe exact-spec flow.  Keep all other configured swipes
+            // mandatory; this exception is limited to that confirmed panel state.
+            if (action.type == PurchaseActionType.OPEN_SPEC_PANEL &&
+                currentScreen(input).specPanelType == SpecPanelType.NON_SCROLLABLE_CONFIRMATION
+            ) return null
             repeat(swipe.count) { index ->
                 if (!driver.swipePurchase(swipe.direction, swipe.durationMs)) {
-                    panelDiagnostic("postSwipe=failed;action=${action.type.wireName};direction=${swipe.direction.name};swipeIndex=${index + 1};reason=${driver.purchaseSwipeFailureReason().name.lowercase()}")
                     return failure("RULE_ACTION_FAILED", "规则要求的有限滑动失败")
                 }
                 if (index < swipe.count - 1 && swipe.intervalMs > 0) pause(swipe.intervalMs)
@@ -1203,7 +1127,6 @@ class PurchaseRehearsalExecutor(
 
     private fun currentScreen(input: PurchaseExecutionInput): ParsedPddScreen {
         val snapshot = driver.capture()
-        pageIdentity = snapshot.packageName to snapshot.activityName
         val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null, purchasePanelContext)
         purchasePanelContext = if (screen.isPddPackage && screen.problem == null && screen.specPanelOpen) {
             screen.specPanelContainer?.let {

android/app/src/main/java/cn/ilapage/goauto/agent/automation/SelectedColorCard.kt

@@ -1,43 +0,0 @@
-package cn.ilapage.goauto.agent.automation
-
-/** A narrow exception for one selected text option duplicated by its card/image. */
-internal object SelectedColorCard {
-    fun confirms(target: String, values: List<VisibleSpecValue>, source: List<SnapshotNode>): Boolean {
-        val exact = values.filter { it.text == target }.singleOrNull() ?: return false
-        if (!exact.node.selected && !exact.node.checked) return false
-        val byPath = source.associateBy { it.path }
-        fun contains(outer: NodeBounds, inner: NodeBounds) =
-            inner.width > 0 && inner.height > 0 && inner.left >= outer.left && inner.top >= outer.top &&
-                inner.right <= outer.right && inner.bottom <= outer.bottom
-        fun cardFor(node: SnapshotNode): SnapshotNode? {
-            var current = node
-            val seen = mutableSetOf<String>()
-            while (seen.add(current.path)) {
-                if (current.scrollable || !current.visible || !current.enabled) return null
-                val parent = current.parentPath?.let(byPath::get) ?: return null
-                if (parent.scrollable) {
-                    return current.takeIf {
-                        it.clickable && it.className == "android.view.ViewGroup" &&
-                            contains(parent.bounds, it.bounds) && contains(it.bounds, node.bounds)
-                    }
-                }
-                current = parent
-            }
-            return null
-        }
-        val card = cardFor(exact.node) ?: return false
-        // The parser may have deduplicated identical labels across cards. Check
-        // the source as well before treating a selected duplicate as harmless.
-        if (source.any { node ->
-                node.visible && node.enabled && node.clickable &&
-                    SpecValueNormalizer.normalizeColor(node.label) == target &&
-                    cardFor(node)?.let { it.path != card.path } == true
-            }) return false
-        return values.filter { it.text != target && (it.node.selected || it.node.checked) }.all { other ->
-            val node = other.node
-            // Never merge another textual option, adjacent card, or scroll container.
-            (node.path == card.path || node.className == "android.widget.ImageView") &&
-                cardFor(node)?.path == card.path && contains(card.bounds, node.bounds)
-        }
-    }
-}

android/app/src/main/java/cn/ilapage/goauto/agent/network/AgentApiClient.kt

@@ -203,6 +203,9 @@ class AgentApiException(
 ) : Exception(message)
 
 class AgentApiClient(private val serverUrl: String) {
+    fun backfillOrders(requestId: String, items: List<cn.ilapage.goauto.agent.automation.BackfillItem>, token: String): List<BackfillResult> =
+        parseBackfillResults(post("/api/agent/v1/purchase-tasks/order-backfill", backfillPayload(requestId, items), token))
+
     fun testConnection() {
         requireNotNull(request("GET", "/api/v1/health", null, null))
     }

android/app/src/main/java/cn/ilapage/goauto/agent/network/OrderBackfillUpload.kt

@@ -0,0 +1,92 @@
+package cn.ilapage.goauto.agent.network
+
+import cn.ilapage.goauto.agent.automation.BackfillItem
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.IOException
+import java.util.UUID
+
+data class BackfillResult(
+    val index: Int, val taskId: Long, val result: String, val code: String,
+    val status: String, val statusVersion: Long, val pddOrderNo: String?,
+    val orderSubmittedAt: String?, val timeSource: String,
+) {
+    val success get() = result in setOf("backfilled", "already_backfilled")
+    val needsReview get() = !success && code != "INTERNAL_ERROR" && code != "NETWORK_ERROR"
+    fun display(): String = if (success) {
+        val source = when (timeSource) {
+            "page" -> "页面下单时间"
+            "irreversible_at" -> "估算时间（提交订单时刻）"
+            else -> "已有时间（来源未知）"
+        }
+        "CG-$taskId：${if (result == "already_backfilled") "已回填" else "成功"}；$source ${orderSubmittedAt.orEmpty()}"
+    } else "${if (taskId > 0) "CG-$taskId" else "条目 ${index + 1}"}：${if (needsReview) "需人工检查" else "重试耗尽，未确认"}（$code）"
+}
+
+internal fun backfillPayload(requestId: String, items: List<BackfillItem>): JSONObject {
+    require(items.size in 1..50)
+    return JSONObject().put("requestId", requestId).put("items", JSONArray().apply {
+        items.forEach { item -> put(JSONObject().put("addressSuffix", item.addressSuffix).put("pddOrderNo", item.pddOrderNo).apply {
+            item.orderSubmittedAt?.let { put("orderSubmittedAt", it) }
+        }) }
+    })
+}
+
+internal fun parseBackfillResults(data: JSONObject): List<BackfillResult> {
+    val items = data.getJSONArray("items")
+    return (0 until items.length()).map { index -> items.getJSONObject(index).let {
+        BackfillResult(it.getInt("index"), it.optLong("taskId"), it.getString("result"), it.getString("code"),
+            it.optString("status"), it.optLong("statusVersion"),
+            if (it.isNull("pddOrderNo")) null else it.optString("pddOrderNo"),
+            if (it.isNull("orderSubmittedAt")) null else it.optString("orderSubmittedAt"), it.optString("timeSource"))
+    } }
+}
+
+/** Separate from the purchase outbox: only transport failures / INTERNAL_ERROR retry, three attempts total. */
+class OrderBackfillUpload(
+    private val submit: (String, List<BackfillItem>) -> List<BackfillResult>,
+    private val checkActive: () -> Unit,
+    private val pause: (Long) -> Unit = Thread::sleep,
+) {
+    fun upload(items: List<BackfillItem>, confirmed: (BackfillResult) -> Unit) {
+        var pending = items.mapIndexed { index, item -> index to item }
+        var requestId = UUID.randomUUID().toString()
+        repeat(3) { attempt ->
+            checkActive()
+            val results = try {
+                submit(requestId, pending.map { it.second }).also { values ->
+                    check(values.size == pending.size && values.map { it.index }.toSet() == pending.indices.toSet())
+                    values.filter { it.success }.forEach { value ->
+                        val input = pending[value.index].second
+                        check(value.taskId.toString() == input.addressSuffix.removePrefix("_cg") && value.pddOrderNo == input.pddOrderNo)
+                        check(value.status.isNotBlank())
+                    }
+                }
+            } catch (error: Exception) {
+                val code = when (error) {
+                    is AgentApiException -> error.code
+                    is IOException -> "NETWORK_ERROR"
+                    else -> throw error
+                }
+                if (code in setOf("INTERNAL_ERROR", "NETWORK_ERROR") && attempt < 2) {
+                    pause((attempt + 1) * 1_000L)
+                    return@repeat // same request ID for an unknown transport result
+                }
+                pending.forEach { (index, _) -> confirmed(BackfillResult(index, 0, "failed", code, "", 0, null, null, "")) }
+                return
+            }
+            // A completed HTTP response is evidence, even when cancellation arrived while waiting.
+            val retry = mutableListOf<Pair<Int, BackfillItem>>()
+            results.forEach { result ->
+                val original = pending[result.index]
+                if (!result.success && result.code == "INTERNAL_ERROR" && attempt < 2) retry += original
+                else confirmed(result.copy(index = original.first))
+            }
+            if (retry.isEmpty()) return
+            pending = retry
+            requestId = UUID.randomUUID().toString() // payload changed after partial acknowledgement
+            checkActive()
+            pause((attempt + 1) * 1_000L)
+        }
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/TaskHistoryCache.kt

@@ -11,6 +11,32 @@ import org.json.JSONObject
 class TaskHistoryCache(context: Context) {
     private val preferences = context.getSharedPreferences(PREFERENCES, Context.MODE_PRIVATE)
 
+    /** Only acknowledged server facts may overwrite cached task facts. Never store scanned candidates. */
+    fun applyBackfill(result: cn.ilapage.goauto.agent.network.BackfillResult, environment: String) = synchronized(BACKFILL_LOCK) {
+        if (!result.success) {
+            if (result.needsReview) check(preferences.edit().putString("backfill_review_${result.taskId}_${result.code}",
+                JSONObject().put("taskId", result.taskId).put("code", result.code).put("environment", environment).toString()).commit())
+            return@synchronized
+        }
+        val values = JSONArray(preferences.getString(PURCHASE, "[]"))
+        for (index in 0 until values.length()) {
+            applyBackfillFacts(values.getJSONObject(index), result)
+        }
+        // Also retain the small acknowledged summary when this task is absent from downloaded history.
+        val confirmed = JSONObject().put("taskId", result.taskId).put("status", result.status)
+            .put("statusVersion", result.statusVersion).putNullable("pddOrderNo", result.pddOrderNo)
+            .putNullable("orderSubmittedAt", result.orderSubmittedAt).put("timeSource", result.timeSource)
+            .put("environment", environment)
+        check(preferences.edit().putString(PURCHASE, values.toString())
+            .putString("backfill_confirmed_${result.taskId}", confirmed.toString()).commit())
+    }
+
+    fun backfillTimeSource(taskId: Long, environment: String): String? {
+        val raw = preferences.getString("backfill_confirmed_$taskId", null) ?: return null
+        val confirmed = runCatching { JSONObject(raw) }.getOrNull() ?: return null
+        return confirmed.optString("timeSource").takeIf { confirmed.optString("environment") == environment }
+    }
+
     fun saveCollection(days: Int, items: List<CollectionHistoryItem>) = save(COLLECTION, days, JSONArray().apply {
         items.forEach { item -> put(JSONObject()
             .put("taskId", item.taskId).put("attemptNumber", item.attemptNumber).put("status", item.status).put("source", item.source).put("goodsId", item.goodsId)
@@ -90,9 +116,18 @@ class TaskHistoryCache(context: Context) {
     private fun JSONObject.nullableLong(key: String): Long? = if (isNull(key)) null else optLong(key)
 
     private companion object {
+        val BACKFILL_LOCK = Any()
         const val PREFERENCES = "goauto_task_history_cache"
         const val COLLECTION = "collection"
         const val PURCHASE = "purchase"
         const val PAGE_SIZE = 20
     }
 }
+
+internal fun applyBackfillFacts(task: JSONObject, result: cn.ilapage.goauto.agent.network.BackfillResult) {
+    if (!result.success || task.optLong("taskId") != result.taskId) return
+    task.put("status", result.status).put("pddOrderNo", result.pddOrderNo ?: JSONObject.NULL)
+        .put("orderSubmittedAt", result.orderSubmittedAt ?: JSONObject.NULL)
+        .put("errorCode", JSONObject.NULL).put("errorMessage", JSONObject.NULL)
+        .put("retryable", false).put("retryDisabledReason", JSONObject.NULL)
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentForegroundService.kt

@@ -75,6 +75,7 @@ class AgentForegroundService : Service() {
     private val taskExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val diagnosticExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val taskMutex = TaskExecutionMutex()
+    private val backfillGuard = OrderBackfillGuard(taskMutex)
     private val runningTaskId = AtomicReference<Long?>(null)
     private val working = AtomicBoolean(false)
     private val manualCheckRequested = AtomicBoolean(false)
@@ -132,6 +133,14 @@ class AgentForegroundService : Service() {
     }
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent?.action == ACTION_BACKFILL_STOP) {
+            backfillGuard.cancelled.set(true)
+            return START_STICKY
+        }
+        if (intent?.action == ACTION_BACKFILL_START) {
+            requestOrderBackfill(intent.getStringExtra("days").orEmpty(), intent.getLongExtra("confirmedAt", 0))
+            return START_STICKY
+        }
         if (intent?.action == ACTION_RECONNECT) registeredThisProcess.set(false)
         if (intent?.action == ACTION_CHECK_NOW) manualCheckRequested.set(true)
         if (intent?.action == ACTION_CURRENT_PAGE_COLLECTION) {
@@ -147,6 +156,7 @@ class AgentForegroundService : Service() {
     }
 
     override fun onDestroy() {
+        backfillGuard.cancelled.set(true)
         runCatching { connectivityManager.unregisterNetworkCallback(networkCallback) }
         cancelIdleReturn("服务已停止")
         collectionCooldownFuture.getAndSet(null)?.cancel(false)
@@ -165,7 +175,7 @@ class AgentForegroundService : Service() {
     override fun onBind(intent: Intent?): IBinder? = null
 
     private fun triggerSync() {
-        if (!working.compareAndSet(false, true)) return
+        if (!synchronized(taskMutex) { working.compareAndSet(false, true) }) return
         executor.execute {
             val manualCheck = manualCheckRequested.getAndSet(false)
             try {
@@ -307,6 +317,98 @@ class AgentForegroundService : Service() {
         })
     }
 
+    private fun publishBackfill(state: OrderBackfillState) {
+        backfillState = state
+        sendBroadcast(Intent(ACTION_BACKFILL_STATE).setPackage(packageName))
+        updateNotification(if (state.running) "订单回填 · 已检查 ${state.checked}" else "订单回填已停止，请查看采购页结果")
+    }
+
+    private fun requestOrderBackfill(days: String, confirmedAt: Long) {
+        // Refuse while polling/dispatch is in flight too: never queue behind another PDD operation.
+        val acquired = synchronized(taskMutex) {
+            !working.get() && purchaseStore.activeTaskId() == null && backfillGuard.tryAcquire()
+        }
+        if (!acquired) {
+            android.widget.Toast.makeText(this, "设备忙碌，请稍后操作", android.widget.Toast.LENGTH_SHORT).show()
+            return
+        }
+        try {
+            val window = cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, confirmedAt)
+            val server = settingsStore.serverUrl()
+            val credentials = identityStore.credentials() ?: error("设备尚未注册")
+            val accessibility = GoAutoAccessibilityService.instance ?: error("请先启用无障碍服务")
+            val started = SystemClock.elapsedRealtime()
+            cancelIdleReturn("人工订单回填")
+            publishBackfill(OrderBackfillState(running = true, message = "正在检查订单列表时序…"))
+            taskExecutor.execute {
+                var state = backfillState
+                fun checkActive() {
+                    check(!backfillGuard.cancelled.get() && !Thread.currentThread().isInterrupted) { "用户停止，未完整扫描" }
+                    check(SystemClock.elapsedRealtime() - started < cn.ilapage.goauto.agent.automation.OrderBackfillWindow.MAX_DURATION_MS) { "达到 10 分钟内部上限，未完整扫描" }
+                    check(settingsStore.serverUrl() == server && identityStore.credentials() == credentials) { "服务器或设备身份已变化，未完整扫描" }
+                }
+                try {
+                    acquireTaskWakeLock()
+                    val api = AgentApiClient(server)
+                    val uploader = cn.ilapage.goauto.agent.network.OrderBackfillUpload(
+                        submit = { id, items -> api.backfillOrders(id, items, credentials.token) },
+                        checkActive = ::checkActive,
+                    )
+                    val driver = object : cn.ilapage.goauto.agent.automation.BackfillDriver {
+                        override fun openOrders() {
+                            checkActive()
+                            startActivity(Intent(Intent.ACTION_VIEW, android.net.Uri.parse("https://mobile.yangkeduo.com/orders.html"))
+                                .setPackage(cn.ilapage.goauto.agent.automation.BackfillPagePolicy.PDD).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+                        }
+                        override fun capture() = accessibility.capture()
+                        override fun click(node: cn.ilapage.goauto.agent.automation.SnapshotNode): Boolean { checkActive(); return accessibility.clickBackfill(node) }
+                        override fun scroll(): Boolean { checkActive(); return accessibility.scrollBackfill() }
+                        override fun back(): Boolean {
+                            checkActive()
+                            cn.ilapage.goauto.agent.automation.BackfillPagePolicy.validate(capture())
+                            return accessibility.back()
+                        }
+                        override fun pause() { repeat(10) { checkActive(); Thread.sleep(100) } }
+                    }
+                    val reason = cn.ilapage.goauto.agent.automation.OrderBackfillScanner(driver, window, ::checkActive,
+                        submit = { item -> uploader.upload(listOf(item)) { result ->
+                            state = state.copy(success = state.success + if (result.result == "backfilled") 1 else 0,
+                                already = state.already + if (result.result == "already_backfilled") 1 else 0,
+                                failed = state.failed + if (!result.success) 1 else 0,
+                                evidence = state.evidence + result.display())
+                            // The frozen API receives all submissions. Never write an old environment's response into a new cache.
+                            if (settingsStore.serverUrl() == server && identityStore.credentials() == credentials) {
+                                cn.ilapage.goauto.agent.persistence.TaskHistoryCache(this).applyBackfill(result, "$server|${credentials.deviceId}")
+                            }
+                            publishBackfill(state)
+                            check(result.success || result.needsReview) { "网络或服务端瞬时错误重试耗尽，未完整扫描" }
+                        } },
+                        progress = { checked ->
+                            state = state.copy(checked = checked, message = if (window.nonDescending) cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED else "正在扫描（已读 $checked 单）…")
+                            publishBackfill(state)
+                        }).scan()
+                    state = state.copy(message = reason)
+                } catch (error: Exception) {
+                    // Never echo raw page text, HTTP bodies or credentials in UI/logs.
+                    val reason = if (error is IllegalStateException || error is IllegalArgumentException) error.message else null
+                    val message = reason?.takeIf { it.length < 100 } ?: "网络或页面异常"
+                    state = state.copy(message = message + if (message.contains("未完整扫描")) "" else "，未完整扫描")
+                } finally {
+                    val warning = if (window.nonDescending && !state.message.contains(cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED))
+                        "\n${cn.ilapage.goauto.agent.automation.OrderBackfillWindow.UNORDERED}" else ""
+                    try {
+                        publishBackfill(state.copy(running = false, message = state.message + warning))
+                    } finally {
+                        try { releaseTaskWakeLock() } finally { backfillGuard.release() }
+                    }
+                }
+            }
+        } catch (error: Exception) {
+            backfillGuard.release()
+            publishBackfill(OrderBackfillState(message = "回填未启动，请检查天数、设备连接与无障碍服务"))
+        }
+    }
+
     private fun requestCurrentPageCollection(
         requestId: String,
         replacementOriginType: String?,
@@ -478,8 +580,6 @@ class AgentForegroundService : Service() {
                     if (accessibility == null) {
                         PurchaseExecutionOutcome("failed", "ACCESSIBILITY_NOT_READY", "GoAuto 无障碍服务未开启")
                     } else {
-                        val diagnosticDeviceId = runCatching { identityStore.credentials()?.deviceId ?: 0L }.getOrDefault(0L)
-                        val diagnosticAttempt = task.taskAttemptId.takeIf { it.matches(Regex("^[a-zA-Z0-9-]{1,80}$")) } ?: "invalid"
                         PurchaseRehearsalExecutor(
                             driver = accessibility,
                             openLink = { PddLinkLauncher(this).open(it, preferDirect = true) },
@@ -488,9 +588,7 @@ class AgentForegroundService : Service() {
                                 lastStep.set(step)
                                 purchaseStore.updateStep(task.taskId, task.taskAttemptId, step)
                             },
-                            panelDiagnostic = { evidence ->
-                                Log.i("GoAutoPurchasePanel", "task=${task.taskId};attempt=$diagnosticAttempt;device=$diagnosticDeviceId;rule=$snapshotHash;$evidence")
-                            },
+                            panelDiagnostic = { evidence -> Log.i("GoAutoPurchasePanel", "task=${task.taskId};$evidence") },
                             beforeOrderSubmit = { evidence ->
                                 val boundaryRequestId = UUID.randomUUID().toString()
                                 val finalEvidence = JSONObject()
@@ -1042,10 +1140,15 @@ class AgentForegroundService : Service() {
             @Suppress("DEPRECATION")
             Notification.Builder(this)
         }
+        if (backfillState.running) {
+            val stop = PendingIntent.getService(this, 242, Intent(this, AgentForegroundService::class.java).setAction(ACTION_BACKFILL_STOP),
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+            builder.addAction(Notification.Action.Builder(null, "停止回填", stop).build())
+        }
         return builder
             .setSmallIcon(android.R.drawable.stat_notify_sync)
             .setContentTitle(getString(R.string.app_name))
-            .setContentText(content)
+            .setContentText(if (backfillState.running) "订单回填 · 已检查 ${backfillState.checked}" else content)
             .setContentIntent(pendingIntent)
             .setOngoing(true)
             .build()
@@ -1071,6 +1174,11 @@ class AgentForegroundService : Service() {
     }
 
     companion object {
+        const val ACTION_BACKFILL_START = "cn.ilapage.goauto.agent.BACKFILL_START"
+        const val ACTION_BACKFILL_STOP = "cn.ilapage.goauto.agent.BACKFILL_STOP"
+        const val ACTION_BACKFILL_STATE = "cn.ilapage.goauto.agent.BACKFILL_STATE"
+        @Volatile var backfillState = OrderBackfillState()
+            private set
         const val ACTION_RECONNECT = "cn.ilapage.goauto.agent.RECONNECT"
         const val ACTION_CHECK_NOW = "cn.ilapage.goauto.agent.CHECK_NOW"
         const val ACTION_CHECK_RESULT = "cn.ilapage.goauto.agent.CHECK_RESULT"

android/app/src/main/java/cn/ilapage/goauto/agent/service/OrderBackfillGuard.kt

@@ -0,0 +1,22 @@
+package cn.ilapage.goauto.agent.service
+
+import java.util.concurrent.atomic.AtomicBoolean
+
+class OrderBackfillGuard(private val mutex: TaskExecutionMutex) {
+    private val active = AtomicBoolean(false)
+    val cancelled = AtomicBoolean(false)
+    fun tryAcquire(): Boolean {
+        if (!active.compareAndSet(false, true)) return false
+        if (!mutex.tryAcquire(RESERVATION)) {
+            active.set(false)
+            return false
+        }
+        cancelled.set(false)
+        return true
+    }
+    fun release() {
+        mutex.release(RESERVATION)
+        active.set(false)
+    }
+    companion object { const val RESERVATION = Long.MAX_VALUE - 1 }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/OrderBackfillState.kt

@@ -0,0 +1,14 @@
+package cn.ilapage.goauto.agent.service
+
+data class OrderBackfillState(
+    val running: Boolean = false,
+    val checked: Int = 0,
+    val success: Int = 0,
+    val already: Int = 0,
+    val failed: Int = 0,
+    val message: String = "",
+    val evidence: List<String> = emptyList(),
+) {
+    fun text(): String = "已检查 $checked · 成功 $success · 已回填 $already · 冲突/失败 $failed\n$message" +
+        if (evidence.isEmpty()) "" else "\n" + evidence.joinToString("\n")
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/TaskHistoryFragment.kt

@@ -141,8 +141,16 @@ class TaskHistoryFragment : Fragment() {
     private val imageLoader = HistoryImageLoader()
     private val imageRequests = mutableListOf<HistoryImageRequest>()
     private var currentPageReceiverRegistered = false
+    private var backfillPanel: LinearLayout? = null
     private val currentPageReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
+            if (intent?.action == AgentForegroundService.ACTION_BACKFILL_STATE) {
+                renderBackfill()
+                if (!collection && isResumed && !AgentForegroundService.backfillState.running) {
+                    detailState.taskId?.let(::loadPurchaseDetail) ?: load()
+                }
+                return
+            }
             if (intent?.action != AgentForegroundService.ACTION_CURRENT_PAGE_RESULT) return
             val message = intent.getStringExtra(AgentForegroundService.EXTRA_CURRENT_PAGE_MESSAGE).orEmpty()
             val taskId = intent.getLongExtra(AgentForegroundService.EXTRA_CURRENT_PAGE_TASK_ID, 0L)
@@ -182,6 +190,11 @@ class TaskHistoryFragment : Fragment() {
         pageColumn = context.column()
         pageColumn.addView(context.screenTitle(if (collection) "采集记录" else "采购记录"))
         pageColumn.addView(buildSearch())
+        if (!collection) {
+            backfillPanel = context.column(0)
+            pageColumn.addView(backfillPanel)
+            renderBackfill()
+        }
         pageColumn.addView(buildFilters())
         resultColumn = context.column(0).apply { setPadding(0, context.dp(12), 0, 0) }
         pageColumn.addView(resultColumn, resultColumn.fullWidth())
@@ -207,6 +220,7 @@ class TaskHistoryFragment : Fragment() {
     }
 
     override fun onDestroyView() {
+        backfillPanel = null
         requestGeneration++
         cancelImageRequests()
         super.onDestroyView()
@@ -273,6 +287,14 @@ class TaskHistoryFragment : Fragment() {
                     contentDescription = "采集当前拼多多商品"
                     setOnClickListener { confirmCurrentPageCollection() }
                 }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
+            } else {
+                row.addView(MaterialButton(context).apply {
+                    text = "回填"
+                    textSize = 14f
+                    minimumHeight = context.dp(48)
+                    contentDescription = "回填拼多多订单号和下单时间"
+                    setOnClickListener { showBackfillInput() }
+                }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
             }
             addView(row, row.fullWidth())
         }).apply {
@@ -280,6 +302,75 @@ class TaskHistoryFragment : Fragment() {
         }
     }
 
+    private fun showBackfillInput() {
+        if (AgentForegroundService.backfillState.running) {
+            toast("设备忙碌，请稍后操作")
+            return
+        }
+        val context = requireContext()
+        val input = TextInputEditText(context).apply {
+            setText("2")
+            inputType = android.text.InputType.TYPE_CLASS_NUMBER
+            minimumHeight = context.dp(48)
+            contentDescription = "回填天数"
+            selectAll()
+        }
+        val field = TextInputLayout(context).apply {
+            hint = "天数"
+            helperText = "从确认时刻往前 N×24 小时"
+            addView(input)
+        }
+        val dialog = MaterialAlertDialogBuilder(context).setTitle("回填订单")
+            .setView(context.cardColumn().apply { addView(field) })
+            .setNegativeButton("取消", null).setPositiveButton("确认", null).create()
+        dialog.setOnShowListener {
+            dialog.getButton(androidx.appcompat.app.AlertDialog.BUTTON_POSITIVE).setOnClickListener {
+                val days = input.text.toString().trim()
+                val now = System.currentTimeMillis()
+                if (runCatching { cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, now) }.isFailure) {
+                    field.error = "请输入正整数天数"
+                    return@setOnClickListener
+                }
+                val intent = Intent(context, AgentForegroundService::class.java)
+                    .setAction(AgentForegroundService.ACTION_BACKFILL_START).putExtra("days", days).putExtra("confirmedAt", now)
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) context.startForegroundService(intent) else context.startService(intent)
+                dialog.dismiss()
+            }
+        }
+        dialog.show()
+    }
+
+    private fun renderBackfill() {
+        val panel = backfillPanel ?: return
+        val context = context ?: return
+        val state = AgentForegroundService.backfillState
+        panel.removeAllViews()
+        if (state.message.isBlank()) return
+        panel.addView(context.card(context.cardColumn().apply {
+            addView(context.label(if (state.running) "正在回填订单" else "回填结果", 16f))
+            addView(context.label(state.copy(evidence = emptyList()).text(), 14f))
+            if (state.running) {
+                addView(MaterialButton(context).apply {
+                    text = "停止"
+                    minimumHeight = context.dp(48)
+                    setOnClickListener {
+                        context.startService(Intent(context, AgentForegroundService::class.java).setAction(AgentForegroundService.ACTION_BACKFILL_STOP))
+                        isEnabled = false
+                        text = "正在停止…"
+                    }
+                })
+            }
+            if (state.evidence.isNotEmpty()) addView(MaterialButton(context).apply {
+                text = "查看逐条结果"
+                minimumHeight = context.dp(48)
+                setOnClickListener {
+                    MaterialAlertDialogBuilder(context).setTitle("回填明细")
+                        .setMessage(state.evidence.joinToString("\n")).setPositiveButton("关闭", null).show()
+                }
+            })
+        }))
+    }
+
     private fun buildFilters(): View {
         val context = requireContext()
         val statuses = if (collection) {
@@ -632,6 +723,7 @@ class TaskHistoryFragment : Fragment() {
     private fun registerCurrentPageReceiver() {
         if (currentPageReceiverRegistered) return
         val filter = IntentFilter(AgentForegroundService.ACTION_CURRENT_PAGE_RESULT)
+        filter.addAction(AgentForegroundService.ACTION_BACKFILL_STATE)
         if (Build.VERSION.SDK_INT >= 33) {
             requireContext().registerReceiver(currentPageReceiver, filter, Context.RECEIVER_NOT_EXPORTED)
         } else {
@@ -724,6 +816,12 @@ class TaskHistoryFragment : Fragment() {
             append("实际单价：${money(task.actualUnitPriceCent, task.currency)}\n")
             append("PDD 订单号：${task.pddOrderNo ?: "—"}\n")
             append("下单时间：${task.orderSubmittedAt?.let(::formatTime) ?: "—"}")
+            val environment = "${AgentSettingsStore(context).serverUrl()}|${runCatching { SecureDeviceStore(context).credentials()?.deviceId }.getOrNull()}"
+            when (TaskHistoryCache(context).backfillTimeSource(task.taskId, environment)) {
+                "page" -> append("（页面读取）")
+                "irreversible_at" -> append("（估算：提交订单时刻）")
+                "existing_unknown" -> append("（已有值，来源未知）")
+            }
         }
         resultColumn.addView(context.card(context.cardColumn().apply {
             addView(context.label("CG-${task.taskId}", 20f, context.getColor(R.color.agent_text), true))

android/app/src/test/java/cn/ilapage/goauto/agent/OrderBackfillTest.kt

@@ -0,0 +1,245 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.network.*
+import cn.ilapage.goauto.agent.service.*
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+import java.io.IOException
+import java.util.TimeZone
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.Executors
+import java.util.concurrent.atomic.AtomicInteger
+
+class OrderBackfillTest {
+    private val zone = TimeZone.getTimeZone("Asia/Shanghai")
+    private fun time(raw: String): Long = BackfillDetailReader(zone).apply { accept("下单时间：$raw") }.finish().timeMillis!!
+    private val now = time("2026-09-08 12:00:00")
+
+    @Test fun `expanded detail reads order time not group time across frames`() {
+        val reader = BackfillDetailReader(zone)
+        reader.accept("测试地址_cg7\n订单编号：TEST-000007\n展开")
+        reader.accept("下单时间：2026-09-08 10:50:29\n拼单时间：2026-09-08 11:20:35")
+        val detail = reader.finish()
+        assertEquals("2026-09-08T10:50:29+08:00", detail.item!!.orderSubmittedAt)
+        assertEquals("_cg7", detail.item!!.addressSuffix)
+        assertNull(reader.finish().item)
+    }
+
+    @Test fun `untagged order never becomes retained or uploaded candidate`() {
+        val reader = BackfillDetailReader(zone)
+        reader.accept("个人订单\n订单编号：PERSONAL-1\n下单时间：2026-09-08 10:00:00")
+        assertNull(reader.finish().item)
+        reader.accept("测试地址_cg7")
+        assertNull(reader.finish().item) // previous order number has been cleared
+        val uploaded = mutableListOf<BackfillItem>()
+        scanner(FakeDriver(tagged = false), uploaded).scan()
+        assertTrue(uploaded.isEmpty())
+    }
+
+    @Test fun `ambiguous and noncanonical suffixes are skipped and missing time remains optional`() {
+        for (suffix in listOf("_cg07", "_cg+7", "_cg７", "_cg7abc", "_cg7 _cg8")) {
+            assertNull(BackfillDetailReader(zone).apply { accept("$suffix\n订单号：TEST-000007") }.finish().item)
+        }
+        assertNull(BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n订单号：TEST-000008") }.finish().item)
+        val missing = BackfillDetailReader(zone).apply { accept("_cg7\n订单号：TEST-000007\n拼单时间：2026-09-08 10:00:00") }.finish()
+        assertNotNull(missing.item)
+        assertNull(missing.item!!.orderSubmittedAt)
+    }
+
+    @Test fun `rolling hours boundary and sampled descending cutoff`() {
+        val window = OrderBackfillWindow("2", now)
+        assertEquals(now - 48 * 3_600_000L, window.cutoff)
+        assertTrue(window.includes(window.cutoff))
+        assertFalse(window.includes(window.cutoff - 1))
+        repeat(4) { assertFalse(window.observe(window.cutoff + 10 - it)) }
+        assertTrue(window.observe(window.cutoff - 1))
+        assertEquals(Long.MIN_VALUE, OrderBackfillWindow("99999999999999999999999999", now).cutoff)
+    }
+
+    @Test fun `time reversal and missing times disable early stop`() {
+        val window = OrderBackfillWindow("2", now)
+        assertFalse(window.observe(now - 100))
+        assertFalse(window.observe(now))
+        repeat(10) { assertFalse(window.observe(window.cutoff - it - 1)) }
+        assertTrue(window.nonDescending)
+        val unknown = OrderBackfillWindow("2", now)
+        unknown.observe(null)
+        repeat(10) { assertFalse(unknown.observe(unknown.cutoff - it - 1)) }
+    }
+
+    @Test fun `scanner expands and stops after validated prefix passes rolling cutoff`() {
+        val driver = FakeDriver()
+        val items = mutableListOf<BackfillItem>()
+        val result = scanner(driver, items).scan()
+        assertEquals(5, driver.opened)
+        assertEquals(5, driver.expansions)
+        assertTrue(result.contains("已达指定天数"))
+        assertTrue(result.contains("未完整扫描"))
+        assertTrue(items.all { !it.orderSubmittedAt.orEmpty().contains("11:20") })
+    }
+
+    @Test fun `unordered list scans to internal cap and reports incomplete`() {
+        val window = OrderBackfillWindow("2", now)
+        val driver = FakeDriver(unordered = true)
+        val result = OrderBackfillScanner(driver, window, {}, {}, {}).scan()
+        assertTrue(window.nonDescending)
+        assertEquals(200, driver.opened)
+        assertTrue(result.contains("未完整扫描"))
+        assertTrue(result.contains(OrderBackfillWindow.UNORDERED))
+    }
+
+    @Test fun `mutex occupied rejects and simultaneous double tap has one winner and finally releases`() {
+        val mutex = TaskExecutionMutex()
+        val guard = OrderBackfillGuard(mutex)
+        mutex.tryAcquire(7)
+        assertFalse(guard.tryAcquire())
+        mutex.release(7)
+        val start = CountDownLatch(1)
+        val complete = CountDownLatch(2)
+        val won = AtomicInteger()
+        val pool = Executors.newFixedThreadPool(2)
+        repeat(2) { pool.execute { start.await(); if (guard.tryAcquire()) won.incrementAndGet(); complete.countDown() } }
+        start.countDown()
+        complete.await()
+        pool.shutdownNow()
+        assertEquals(1, won.get())
+        assertFalse(mutex.tryAcquire(8))
+        try { guard.cancelled.set(true); throw IllegalStateException("cancelled") } catch (_: IllegalStateException) { } finally { guard.release() }
+        assertNull(mutex.currentTaskId())
+        assertTrue(guard.tryAcquire())
+        assertFalse(guard.cancelled.get())
+        guard.release()
+    }
+
+    @Test fun `permanent business errors never retry regardless of server retryable flag`() {
+        val codes = listOf("PURCHASE_BACKFILL_SUFFIX_INVALID", "PURCHASE_TASK_NOT_FOUND", "PURCHASE_BACKFILL_DEVICE_MISMATCH",
+            "PURCHASE_STATE_CONFLICT", "PURCHASE_INVALID_REQUEST", "PURCHASE_ORDER_TIME_INVALID", "PURCHASE_ORDER_TIME_MISSING",
+            "PURCHASE_BACKFILL_ORDER_CONFLICT", "PURCHASE_BACKFILL_BATCH_CONFLICT", "PURCHASE_BACKFILL_ORDER_ALREADY_USED")
+        codes.forEach { code ->
+            var calls = 0
+            val results = mutableListOf<BackfillResult>()
+            OrderBackfillUpload({ _, _ -> calls++; listOf(failure(code)) }, {}, {}).upload(listOf(item), results::add)
+            assertEquals(1, calls)
+            assertTrue(results.single().display().contains("需人工检查"))
+        }
+        var calls = 0
+        OrderBackfillUpload({ _, _ -> calls++; throw AgentApiException(409, codes.first(), "hidden", true) }, {}, {})
+            .upload(listOf(item)) { assertTrue(it.needsReview) }
+        assertEquals(1, calls)
+    }
+
+    @Test fun `network and internal errors retry bounded with stable transport request id`() {
+        val ids = mutableListOf<String>()
+        val results = mutableListOf<BackfillResult>()
+        OrderBackfillUpload({ id, _ -> ids += id; throw IOException("private body") }, {}, {})
+            .upload(listOf(item), results::add)
+        assertEquals(3, ids.size)
+        assertEquals(1, ids.toSet().size)
+        assertFalse(results.single().needsReview)
+        assertFalse(results.single().display().contains("private"))
+        var calls = 0
+        OrderBackfillUpload({ _, _ -> calls++; listOf(failure("INTERNAL_ERROR")) }, {}, {})
+            .upload(listOf(item)) { assertTrue(it.display().contains("重试耗尽")) }
+        assertEquals(3, calls)
+    }
+
+    @Test fun `partial response only retries transient items and preserves acknowledged success`() {
+        val sizes = mutableListOf<Int>()
+        val results = mutableListOf<BackfillResult>()
+        val second = item.copy(addressSuffix = "_cg8", pddOrderNo = "TEST-000008")
+        OrderBackfillUpload({ _, items ->
+            sizes += items.size
+            if (items.size == 2) listOf(success(), failure("INTERNAL_ERROR").copy(index = 1))
+            else listOf(failure("PURCHASE_STATE_CONFLICT"))
+        }, {}, {}).upload(listOf(item, second), results::add)
+        assertEquals(listOf(2, 1), sizes)
+        assertTrue(results.first().success)
+        assertEquals(1, results.last().index)
+    }
+
+    @Test fun `cancellation prevents upload and invalid response cannot confirm cache`() {
+        var calls = 0
+        try {
+            OrderBackfillUpload({ _, _ -> calls++; listOf(success()) }, { error("stopped") }, {}).upload(listOf(item)) { fail() }
+            fail()
+        } catch (_: IllegalStateException) { }
+        assertEquals(0, calls)
+        try {
+            OrderBackfillUpload({ _, _ -> listOf(success().copy(taskId = 99)) }, {}, {}).upload(listOf(item)) { fail() }
+            fail()
+        } catch (_: IllegalStateException) { }
+    }
+
+    @Test fun `payload contains only suffix order and optional RFC3339 time`() {
+        val payload = backfillPayload("test", listOf(item))
+        assertEquals(setOf("requestId", "items"), payload.keySet())
+        assertEquals(setOf("addressSuffix", "pddOrderNo"), payload.getJSONArray("items").getJSONObject(0).keySet())
+        val parsed = parseBackfillResults(JSONObject("""{"items":[{"index":0,"taskId":7,"result":"backfilled","code":"BACKFILLED","status":"order_created","statusVersion":3,"pddOrderNo":"TEST-000007","orderSubmittedAt":"2026-09-08T10:00:00+08:00","timeSource":"irreversible_at","retryable":false}]}"""))
+        assertTrue(parsed.single().display().contains("估算"))
+        assertTrue(parsed.single().copy(timeSource = "page").display().contains("页面下单时间"))
+    }
+
+    @Test fun `cache updates confirmed server facts only and clears old errors`() {
+        val task = JSONObject().put("taskId", 7).put("status", "order_result_unknown").put("errorCode", "OLD").put("errorMessage", "old")
+        cn.ilapage.goauto.agent.persistence.applyBackfillFacts(task, failure("PURCHASE_BACKFILL_ORDER_CONFLICT"))
+        assertEquals("order_result_unknown", task.getString("status"))
+        assertEquals("OLD", task.getString("errorCode"))
+        cn.ilapage.goauto.agent.persistence.applyBackfillFacts(task, success())
+        assertEquals("order_created", task.getString("status"))
+        assertEquals(item.pddOrderNo, task.getString("pddOrderNo"))
+        assertTrue(task.isNull("errorCode"))
+        assertTrue(task.isNull("errorMessage"))
+        assertFalse(task.getBoolean("retryable"))
+    }
+
+    @Test fun `expansion requires order information and product snapshot row`() {
+        val expand = node("0/1", "展开")
+        assertNull(BackfillPagePolicy.expansion(page(node("0/0", "订单编号：TEST-000007"), expand)))
+        assertEquals(expand, BackfillPagePolicy.expansion(page(node("0/0", "订单编号：TEST-000007"), expand, node("0/2", "商品快照"))))
+    }
+
+    @Test fun `dangerous nodes ancestors and overlapping actions never become click targets`() {
+        BackfillPagePolicy.forbidden.forEach { label ->
+            val dangerous = node("0/0", label)
+            assertFalse(BackfillPagePolicy.safe(page(dangerous), dangerous))
+            val parent = node("0", "查看详情")
+            assertFalse(BackfillPagePolicy.safe(page(parent, dangerous), parent))
+            val adjacent = node("0/1", "查看详情")
+            assertFalse(BackfillPagePolicy.safe(page(adjacent, dangerous), adjacent))
+        }
+    }
+
+    private val item = BackfillItem("_cg7", "TEST-000007", null)
+    private fun failure(code: String) = BackfillResult(0, 7, "failed", code, "", 0, null, null, "")
+    private fun success() = BackfillResult(0, 7, "backfilled", "BACKFILLED", "order_created", 3, item.pddOrderNo, null, "page")
+    private fun scanner(driver: FakeDriver, items: MutableList<BackfillItem>) = OrderBackfillScanner(driver, OrderBackfillWindow("2", now), {}, items::add, {})
+    private fun node(path: String, label: String, selected: Boolean = false) = SnapshotNode(path, path.substringBeforeLast('/'), label, null, null, "View",
+        NodeBounds(0, 0, 200, 60), true, false, selected, false, true, true)
+    private fun page(vararg nodes: SnapshotNode) = UiSnapshot(BackfillPagePolicy.PDD, "com.xunmeng.pinduoduo.activity.NewPageActivity", nodes.toList())
+
+    private inner class FakeDriver(val tagged: Boolean = true, val unordered: Boolean = false) : BackfillDriver {
+        var opened = 0
+        var expansions = 0
+        var index = 0
+        var inDetail = false
+        var expanded = false
+        override fun openOrders() = Unit
+        override fun pause() = Unit
+        override fun capture(): UiSnapshot {
+            if (!inDetail) return page(node("0/0", "我的订单"), node("0/1", "全部", true), node("0/2", "查看详情"), node("0/2/0", "合成卡片 $index"))
+            val date = if (unordered && index == 1) "2026-09-08 11:00:00" else if (index < 4) "2026-09-08 10:00:00" else "2026-09-05 10:00:00"
+            return page(node("0/0", "订单详情"), node("0/1", "订单编号：TEST-${100000 + index}"),
+                node("0/2", if (tagged) "合成地址_cg${index + 1}" else "无后缀合成地址"),
+                node("0/4", "商品快照"),
+                node("0/3", if (expanded) "下单时间：$date\n拼单时间：2026-09-08 11:20:00" else "展开"))
+        }
+        override fun click(node: SnapshotNode): Boolean {
+            if (node.label == "展开") { expanded = true; expansions++ } else { inDetail = true; opened++ }
+            return true
+        }
+        override fun scroll() = false
+        override fun back(): Boolean { inDetail = false; expanded = false; index++; return true }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseLiveAutomationTest.kt

@@ -141,34 +141,6 @@ class PurchaseLiveAutomationTest {
         assertEquals(0, driver.submitClicks)
     }
 
-    @Test
-    fun `saved address back into spec panel restores final evidence with one back`() {
-        val driver = LiveDriver(savedTransitionWithoutLegacyContext = true, backReturnsToSpecPanel = true)
-        val automation = PurchaseLiveAutomation(driver, pause = {})
-
-        val address = automation.updateShippingAddress("_cg81")
-        val final = automation.finalConfirmation(input().copy(addressSuffix = "_cg81"), address)
-
-        assertEquals("_cg81", final.addressSuffix)
-        assertEquals(1, driver.backCount)
-        assertEquals(1, driver.scopedSwipes)
-        assertEquals(0, driver.submitClicks)
-    }
-
-    @Test
-    fun `saved address back into stuck spec panel fails without another back or submit`() {
-        val driver = LiveDriver(savedTransitionWithoutLegacyContext = true, backReturnsToSpecPanel = true,
-            savedSpecPanelRecoveryStuck = true)
-
-        val error = runCatching { PurchaseLiveAutomation(driver, pause = {}).updateShippingAddress("_cg81") }
-            .exceptionOrNull() as PurchaseLiveException
-
-        assertEquals("PURCHASE_ADDRESS_SAVE_TIMEOUT", error.code)
-        assertEquals(1, driver.backCount)
-        assertTrue(driver.scopedSwipes in 1..5)
-        assertEquals(0, driver.submitClicks)
-    }
-
     @Test
     fun `saved address returning to spec panel is recovered without pressing back`() {
         val driver = LiveDriver(saveReturnsToSpecPanel = true)
@@ -673,7 +645,6 @@ class PurchaseLiveAutomationTest {
         private val savedTransitionWithoutLegacyContext: Boolean = false,
         private val savedTransitionHidesSuffix: Boolean = false,
         private val saveReturnsToSpecPanel: Boolean = false,
-        private val backReturnsToSpecPanel: Boolean = false,
         private val savedSpecPanelRecoveryStuck: Boolean = false,
         private val duplicatePhoneNodesSameCard: Boolean = false,
         private val duplicateSemanticAddressCards: Boolean = false,
@@ -892,7 +863,6 @@ class PurchaseLiveAutomationTest {
             page = when (page) {
                 "chooser" -> "payment"
                 "payment" -> if (orderEvidenceBelowFold) "order-folded" else "order"
-                "saved-transition" -> if (backReturnsToSpecPanel) "post-save-spec" else "confirmation"
                 else -> "confirmation"
             }
             return true

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseRehearsalExecutorTest.kt

@@ -9,7 +9,6 @@ import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
 import cn.ilapage.goauto.agent.automation.PurchaseRehearsalExecutor
 import cn.ilapage.goauto.agent.automation.PurchaseRuleParser
 import cn.ilapage.goauto.agent.automation.PurchaseSpecGesturePolicy
-import cn.ilapage.goauto.agent.automation.PurchaseSwipeFailureReason
 import cn.ilapage.goauto.agent.automation.PurchaseUiDriver
 import cn.ilapage.goauto.agent.automation.RuleValidationException
 import cn.ilapage.goauto.agent.automation.SnapshotNode
@@ -99,7 +98,7 @@ class PurchaseRehearsalExecutorTest {
     }
 
     @Test
-    fun `rule parameters drive aliases and waits while deprecated panel swipes are ignored`() {
+    fun `rule parameters drive aliases waits and bounded swipes without dangerous clicks`() {
         val driver = FakePurchaseDriver()
         val pauses = mutableListOf<Long>()
         var openCount = 0
@@ -113,7 +112,7 @@ class PurchaseRehearsalExecutorTest {
         assertEquals("rehearsal_completed", outcome.resultType)
         assertEquals(2_000L, outcome.actualUnitPriceCent)
         assertEquals(0, openCount)
-        assertEquals(0, driver.swipeCount)
+        assertEquals(2, driver.swipeCount)
         assertEquals(2L, driver.quantity)
         assertTrue(driver.clicked.containsAll(listOf("选择规格", "黑色", "XL")))
         assertFalse(driver.clicked.any { it.contains("订单") || it.contains("支付") })
@@ -765,7 +764,7 @@ class PurchaseRehearsalExecutorTest {
     }
 
     @Test
-    fun `open spec panel still skips legacy follow-up swipe for confirmed non-scrollable panel`() {
+    fun `open spec panel skips required follow-up swipe only for confirmed non-scrollable panel`() {
         val driver = FakePurchaseDriver(nonScrollablePanel = true, purchaseSwipeSucceeds = false)
         val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
@@ -774,86 +773,6 @@ class PurchaseRehearsalExecutorTest {
         assertEquals(0, driver.swipeCount)
     }
 
-    @Test
-    fun `legacy panel preswipe cannot block visible specs in probe or purchase phase`() {
-        for (nonScrollable in listOf(false, true)) {
-            for (phase in listOf("spec_probe", "purchase")) {
-                val driver = FakePurchaseDriver(nonScrollablePanel = nonScrollable, purchaseSwipeSucceeds = false)
-                val diagnostics = mutableListOf<String>()
-                val pauses = mutableListOf<Long>()
-                var probeCount = 0
-                val raw = rule().replace("\"type\":\"openSpecPanel\"", "\"type\":\"openSpecPanel\",\"waitAfterMs\":321")
-                val outcome = PurchaseRehearsalExecutor(
-                    driver, { true }, { probeCount++; "{}" }, pause = pauses::add,
-                    panelDiagnostic = diagnostics::add,
-                ).execute(input().copy(phase = phase), PurchaseRuleParser.parse(raw), PurchaseAgentCapabilities.supported)
-                assertEquals(outcome.message, if (phase == "spec_probe") "spec_probe_completed" else "rehearsal_completed", outcome.resultType)
-                assertEquals(0, driver.swipeCount)
-                assertTrue(pauses.contains(321L))
-                assertFalse(pauses.contains(1000L))
-                assertTrue(diagnostics.any { it.contains("reason=spec_panel_on_demand") })
-                assertEquals(if (phase == "spec_probe") 1 else 0, probeCount)
-                assertEquals(if (phase == "spec_probe") 0 else 1, driver.clicked.count { it == "黑色" })
-                assertFalse(driver.clicked.any { it.contains("订单") || it.contains("支付") })
-            }
-        }
-    }
-
-    @Test
-    fun `non panel mandatory swipes still execute and fail closed`() {
-        val raw = rule().replace("\"type\":\"selectSpec\"", "\"type\":\"selectSpec\",\"swipeAfter\":{\"direction\":\"up\",\"count\":2,\"durationMs\":500,\"intervalMs\":1000}")
-        for (succeeds in listOf(false, true)) {
-            val driver = FakePurchaseDriver(purchaseSwipeSucceeds = succeeds)
-            val diagnostics = mutableListOf<String>()
-            val pauses = mutableListOf<Long>()
-            val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = pauses::add, panelDiagnostic = diagnostics::add)
-                .execute(input(), PurchaseRuleParser.parse(raw), PurchaseAgentCapabilities.supported)
-            assertEquals(if (succeeds) "rehearsal_completed" else "failed", outcome.resultType)
-            assertEquals(if (succeeds) 2 else 1, driver.swipeCount)
-            assertEquals(succeeds, pauses.contains(1000L))
-            if (!succeeds) {
-                assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
-                assertTrue(diagnostics.any { it.contains("action=selectSpec") && it.contains("reason=unknown") })
-            }
-        }
-    }
-
-    @Test
-    fun `quick and order confirmation selectors also skip legacy panel preswipe`() {
-        for (kind in listOf("QUICK_CONFIRMATION", "ORDER_CONFIRMATION")) {
-            val driver = FakePurchaseDriver(confirmationPanelKind = kind, purchaseSwipeSucceeds = false)
-            val diagnostics = mutableListOf<String>()
-            var probed = false
-            val outcome = PurchaseRehearsalExecutor(
-                driver, { true }, { probed = true; "{}" }, pause = {}, panelDiagnostic = diagnostics::add,
-            ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
-            assertEquals(outcome.message, "spec_probe_completed", outcome.resultType)
-            assertTrue(probed)
-            assertEquals(0, driver.swipeCount)
-            assertTrue(diagnostics.any { it.contains("postSwipe=skipped") && it.contains("panel=$kind") })
-            assertFalse(driver.clicked.any { it.contains("订单") || it.contains("支付") || it == "现在买" })
-        }
-    }
-
-    @Test
-    fun `mandatory swipe diagnostics use fixed reasons without spec text`() {
-        val raw = rule().replace("\"type\":\"selectSpec\"", "\"type\":\"selectSpec\",\"swipeAfter\":{\"direction\":\"up\",\"count\":1,\"durationMs\":500}")
-        for (reason in PurchaseSwipeFailureReason.values()) {
-            val driver = FakePurchaseDriver(purchaseSwipeSucceeds = false, purchaseSwipeFailure = reason)
-            val diagnostics = mutableListOf<String>()
-            val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
-                .execute(input(), PurchaseRuleParser.parse(raw), PurchaseAgentCapabilities.supported)
-            assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
-            assertTrue(diagnostics.contains("postSwipe=failed;action=selectSpec;direction=UP;swipeIndex=1;reason=${reason.name.lowercase()}"))
-            assertFalse(diagnostics.any { it.contains("黑色") || it.contains("XL") })
-        }
-    }
-
-    @Test(expected = RuleValidationException::class)
-    fun `ignored legacy panel swipe still rejects invalid rule parameters`() {
-        PurchaseRuleParser.parse(rule().replace("\"count\":2", "\"count\":0"))
-    }
-
     @Test
     fun `unrecognized opened panel returns only scalar panel evidence`() {
         val driver = FakePurchaseDriver(unrecognizedPanel = true)
@@ -883,84 +802,6 @@ class PurchaseRehearsalExecutorTest {
         assertTrue(driver.panel)
     }
 
-    @Test
-    fun `selected color card duplicate does not trigger another selection tap`() {
-        val driver = FakePurchaseDriver(duplicateColorCardEvidence = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {})
-            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
-        assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
-        assertEquals(0, driver.specTapCount)
-    }
-
-    @Test
-    fun `dynamic product page recovers ineffective and failed entry clicks once`() {
-        for (reason in listOf(null, FreshClickReason.ACTION_CLICK_FALSE, FreshClickReason.TARGET_NOT_FOUND)) {
-            val driver = FakePurchaseDriver(entryActionHasEffect = false, dynamicProduct = true,
-                forcedEntryClickReason = reason, specTapResult = FreshActionResult.SUCCESS)
-            val logs = mutableListOf<String>()
-            val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, panelDiagnostic = logs::add)
-                .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
-            assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
-            assertEquals(1, driver.specTapCount)
-            assertTrue(logs.any { it.contains("entryRecovery=attempted") })
-            assertFalse(logs.any { it.contains("测试商品") || it.contains("选择规格") })
-        }
-    }
-
-    @Test
-    fun `dynamic product page with ineffective gesture reports no effect without second tap`() {
-        val driver = FakePurchaseDriver(entryActionHasEffect = false, dynamicProduct = true,
-            specTapResult = FreshActionResult.SUCCESS, specTapHasEffect = false)
-        val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {})
-            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
-        assertEquals("PURCHASE_SPEC_ENTRY_CLICK_NO_EFFECT", outcome.errorCode)
-        assertEquals(1, driver.specTapCount)
-    }
-
-    @Test
-    fun `dynamic product with close control never receives recovery tap`() {
-        val driver = FakePurchaseDriver(entryActionHasEffect = false, dynamicProduct = true, productOverlay = true,
-            specTapResult = FreshActionResult.SUCCESS)
-        val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {})
-            .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
-        assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
-        assertEquals(0, driver.specTapCount)
-    }
-
-    @Test
-    fun `changed entry identity or unsafe page never receives recovery tap`() {
-        for (mode in listOf("missing", "duplicate", "activity", "payment")) {
-            val diagnostics = mutableListOf<String>()
-            val driver = FakePurchaseDriver(entryActionHasEffect = false, dynamicProduct = true,
-                afterEntryMutation = mode, specTapResult = FreshActionResult.SUCCESS)
-            val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
-                .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
-            assertEquals(mode, "failed", outcome.resultType)
-            assertEquals(mode, 0, driver.specTapCount)
-            val expected = mapOf("missing" to "entry_missing", "duplicate" to "entry_ambiguous",
-                "activity" to "identity_changed", "payment" to "payment_area").getValue(mode)
-            assertTrue(diagnostics.toString(), diagnostics.any { it.contains("entryRecovery=rejected;reason=$expected;") })
-        }
-    }
-
-    @Test
-    fun `unavailable exact color stops without selection click or searching even when selected`() {
-        for (selected in listOf(null, "黑色")) {
-            val driver = FakePurchaseDriver(colors = listOf("黑色", "白色"),
-                unavailableColors = setOf("黑色")).apply { color = selected }
-            val logs = mutableListOf<String>()
-            val outcome = PurchaseRehearsalExecutor(driver, { true }, { null }, pause = {}, panelDiagnostic = logs::add)
-                .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
-            assertEquals("PURCHASE_SPEC_SAFE_TARGET_MISSING", outcome.errorCode)
-            assertEquals("目标颜色已售罄或当前不可选，未创建订单", outcome.message)
-            assertFalse(driver.clicked.contains("黑色"))
-            assertEquals(0, driver.specTapCount)
-            assertEquals(0, driver.swipeCount)
-            assertTrue(logs.any { it == "specLookup=unavailable;dimension=color;reason=exact_target_unavailable" })
-            assertFalse(logs.any { it.contains("黑色") })
-        }
-    }
-
     @Test
     fun `unchanged spec entry after action and gesture returns no effect`() {
         val driver = FakePurchaseDriver(
@@ -1386,10 +1227,6 @@ class PurchaseRehearsalExecutorTest {
         private val forcedEntryClickReason: FreshClickReason? = null,
         private val initialSize: String? = null,
         private val entryActionHasEffect: Boolean = true,
-        private val duplicateColorCardEvidence: Boolean = false,
-        private val dynamicProduct: Boolean = false,
-        private val productOverlay: Boolean = false,
-        private val afterEntryMutation: String = "",
         private val specTapResult: FreshActionResult = FreshActionResult.FAILED,
         private val specTapHasEffect: Boolean = true,
         private val sizeSelectsOnFailedClick: Boolean = false,
@@ -1407,13 +1244,10 @@ class PurchaseRehearsalExecutorTest {
         private val pullDownSucceeds: Boolean = true,
         private val loseEvidenceAfterPull: Boolean = false,
         private val unavailableSizes: Set<String> = emptySet(),
-        private val unavailableColors: Set<String> = emptySet(),
         allSpecsUnavailable: Boolean = false,
         private val nonScrollablePanel: Boolean = false,
-        private val confirmationPanelKind: String? = null,
         private val unrecognizedPanel: Boolean = false,
         private val purchaseSwipeSucceeds: Boolean = true,
-        private val purchaseSwipeFailure: PurchaseSwipeFailureReason = PurchaseSwipeFailureReason.UNKNOWN,
         initiallyInAgent: Boolean = false,
         private val panelBecomesUnknownAfterSizeProof: Boolean = false,
     ) : PurchaseUiDriver {
@@ -1444,7 +1278,6 @@ class PurchaseRehearsalExecutorTest {
         private var horizontalColorPage = 0
         private var horizontalSizePage = 0
         private var capturesAfterSizeSelection = 0
-        private var entryAttempted = false
         val clicked = mutableListOf<String>()
         val clickedPaths = mutableListOf<String>()
 
@@ -1507,8 +1340,6 @@ class PurchaseRehearsalExecutorTest {
                     node("title", "测试商品标题文本", 20, 200, 900, 280, className = "android.widget.ViewPager"),
                 )
                 val specEntryReady = pddCaptureCount > specEntryVisibleAfterPddCaptures
-                if (dynamicProduct) nodes += node("decoration", "", 20, 400 + pddCaptureCount % 3, 100, 460)
-                if (productOverlay) nodes += node("overlay-close", "关闭", 900, 500, 1000, 570, clickable = true)
                 if (bottomPurchaseEntry && specEntryReady) {
                     nodes += node("buy", "", 500, 1800, 1080, 2180, clickable = true)
                     nodes += node("buy/price", "¥20.00", 560, 1840, 760, 1910, parentPath = "buy")
@@ -1517,12 +1348,6 @@ class PurchaseRehearsalExecutorTest {
                     nodes += node("spec", "选择规格", 20, 1000, 900, 1100, clickable = true)
                 }
                 if (includeReviewEntry) nodes += node("review", "商品评价", 20, 1200, 900, 1300, clickable = true)
-                if (entryAttempted) {
-                    if (afterEntryMutation == "missing") nodes.removeAll { it.path == "spec" }
-                    if (afterEntryMutation == "duplicate") nodes += node("spec2", "选择规格", 20, 1120, 900, 1190, clickable = true)
-                    if (afterEntryMutation == "payment") nodes += node("payment", "微信支付", 20, 1800, 900, 1900)
-                    if (afterEntryMutation == "activity") return UiSnapshot(PDD, "OtherActivity", nodes)
-                }
                 return UiSnapshot(PDD, ACTIVITY, nodes)
             }
             if (unrecognizedPanel) {
@@ -1565,16 +1390,6 @@ class PurchaseRehearsalExecutorTest {
                     nodes += node(colorParent, "", 0, 460, 1080, 550, scrollable = true, parentPath = "scroll")
                 }
                 visibleColors.forEachIndexed { index, value ->
-                    if (duplicateColorCardEvidence && selectedColor == value) {
-                        val cardPath = "scroll/card-$index"
-                        nodes += node(cardPath, "$value 199", 20 + index * 220, 460, 200 + index * 220, 550,
-                            clickable = true, selected = true, parentPath = "scroll", className = "android.view.ViewGroup")
-                        nodes += node("$cardPath/image", "$value 199", 20 + index * 220, 460, 200 + index * 220, 500,
-                            clickable = true, selected = true, parentPath = cardPath, className = "android.widget.ImageView")
-                        nodes += node("$cardPath/text", value, 20 + index * 220, 500, 200 + index * 220, 540,
-                            clickable = true, selected = true, parentPath = cardPath, className = "android.widget.TextView")
-                        return@forEachIndexed
-                    }
                     nodes += node(
                         "scroll/color-$index",
                         value,
@@ -1584,7 +1399,7 @@ class PurchaseRehearsalExecutorTest {
                         540,
                         clickable = true,
                         selected = selectedColor == value,
-                        enabled = !allSpecsUnavailable && value !in unavailableColors,
+                        enabled = !allSpecsUnavailable,
                         parentPath = colorParent,
                     )
                 }
@@ -1622,16 +1437,7 @@ class PurchaseRehearsalExecutorTest {
             nodes += if (singleHeading) node("info/quantity", quantity.toString(), 400, 360, 600, 390, className = "android.widget.EditText", parentPath = "info")
                 else node("quantity", quantity.toString(), 400, 800, 600, 870, className = "android.widget.EditText")
             if (!singleHeading) nodes += node("confirm", "确定", 20, 900, 500, 980, clickable = true)
-            if (confirmationPanelKind != null) {
-                nodes += node("close", "关闭", 980, 300, 1060, 350, clickable = true)
-                nodes += node("minus", "减少数量", 300, 800, 380, 870, clickable = true)
-                nodes += node("plus", "增加数量", 620, 800, 700, 870, clickable = true)
-                nodes += node("payment", "微信支付", 600, 1000, 900, 1050)
-                if (confirmationPanelKind == "QUICK_CONFIRMATION") {
-                    nodes += node("quick", "现在买", 520, 2000, 1020, 2080, clickable = true)
-                }
-            }
-            nodes += node("order", "提交订单", 20, if (singleHeading || confirmationPanelKind != null) 2000 else 1100, 500, if (singleHeading || confirmationPanelKind != null) 2080 else 1180, clickable = true)
+            nodes += node("order", "提交订单", 20, if (singleHeading) 2000 else 1100, 500, if (singleHeading) 2080 else 1180, clickable = true)
             nodes += node("pay", "立即支付", 520, 1100, 1020, 1180, clickable = true)
             return UiSnapshot(PDD, ACTIVITY, nodes)
         }
@@ -1672,7 +1478,6 @@ class PurchaseRehearsalExecutorTest {
         }
 
         override fun clickFreshDetailed(target: SnapshotNode): FreshClickOutcome {
-            if (target.path in setOf("spec", "buy")) entryAttempted = true
             if (target.path in setOf("spec", "buy") && forcedEntryClickReason != null) {
                 val result = when (forcedEntryClickReason) {
                     FreshClickReason.ROOT_UNAVAILABLE, FreshClickReason.TARGET_NOT_FOUND -> FreshActionResult.NOT_FOUND
@@ -1726,8 +1531,6 @@ class PurchaseRehearsalExecutorTest {
             return purchaseSwipeSucceeds
         }
 
-        override fun purchaseSwipeFailureReason(): PurchaseSwipeFailureReason = purchaseSwipeFailure
-
         override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean {
             swipeInPaths += target.path
             if (restoreHiddenColorOnDownSwipe && quantity == 2L && direction == SwipeDirection.DOWN) {

android/app/src/test/java/cn/ilapage/goauto/agent/SelectedColorCardTest.kt

@@ -1,47 +0,0 @@
-package cn.ilapage.goauto.agent
-
-import cn.ilapage.goauto.agent.automation.*
-import org.junit.Assert.*
-import org.junit.Test
-
-class SelectedColorCardTest {
-    private val target = "黑色两件套 19"
-    private fun node(path: String, parent: String?, label: String, kind: String, selected: Boolean = true,
-                     scrollable: Boolean = false) = SnapshotNode(path, parent, label, null, null, kind,
-        NodeBounds(0, 0, 300, 400), !scrollable, scrollable, selected, false, true, true)
-    private val scroll = node("s", null, "", "androidx.recyclerview.widget.RecyclerView", false, true)
-    private val card = node("s/c", "s", "黑色两件套 199", "android.view.ViewGroup")
-    private val image = node("s/c/i", "s/c", "黑色两件套 199", "android.widget.ImageView")
-    private val text = node("s/c/t", "s/c", target, "android.widget.TextView")
-    private fun check(nodes: List<SnapshotNode>, candidates: List<SnapshotNode> = nodes.filter { it != scroll }) =
-        SelectedColorCard.confirms(target, candidates.map { VisibleSpecValue(it.label, true, it) }, nodes)
-
-    @Test fun `selected target and own card image duplicates are one selection`() {
-        assertTrue(check(listOf(scroll, card, image, text)))
-    }
-    @Test fun `another selected card remains conflict`() {
-        val other = card.copy(path = "s/other")
-        assertFalse(check(listOf(scroll, card, image, text, other)))
-    }
-    @Test fun `two exact targets are not merged`() {
-        val otherCard = card.copy(path = "s/other", selected = false)
-        val otherText = text.copy(path = "s/other/t", parentPath = otherCard.path)
-        assertFalse(check(listOf(scroll, card, image, text, otherCard, otherText)))
-        assertFalse(check(listOf(scroll, card, image, text, otherCard, otherText), listOf(card, image, text)))
-    }
-    @Test fun `unselected target cannot borrow selection from its container`() {
-        assertFalse(check(listOf(scroll, card, image, text.copy(selected = false))))
-    }
-    @Test fun `scrollable or missing card boundary cannot merge`() {
-        assertFalse(check(listOf(scroll, card.copy(scrollable = true), image, text)))
-        assertFalse(check(listOf(card, image, text)))
-        assertFalse(check(listOf(scroll, card.copy(clickable = false), image, text)))
-    }
-    @Test fun `different text sibling is not treated as image duplicate`() {
-        assertFalse(check(listOf(scroll, card, text, image.copy(className = "android.widget.TextView"))))
-    }
-    @Test fun `out of card bounds and parent cycle are rejected`() {
-        assertFalse(check(listOf(scroll, card, image.copy(bounds = NodeBounds(0, 0, 301, 400)), text)))
-        assertFalse(check(listOf(scroll, card.copy(parentPath = text.path), image, text)))
-    }
-}

docs/02-architecture-and-code-map.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Architecture-and-Code-Map
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: 20a1ca65dccde9ca1ecd93419cc1b164a5717fdf
-synchronized_at: 2026-09-07T13:34:45Z
+wiki_revision: d547c17924ac53422232ad9d6c55a34c8cd8d63c
+synchronized_at: 2026-09-08T07:16:20Z
 <!-- gitea-wiki-mirror:end -->
 
 # 架构与代码地图
@@ -68,6 +68,8 @@ Android Portal/Agent
 | `pdd_account` | 可选的账号调度引用，只保存名称和状态，不保存凭据 |
 | `purchase_task` | 商品外键和不可变快照、执行模式、状态/租约 guard、价格边界、订单、人工支付复核、物流与回填事实 |
 | `purchase_task_attempt` | `task_id + attempt_id` 幂等执行记录、阶段、规则哈希、固化规格决策和结构化错误 |
+
+> #241 新增：`server/app/goauto/purchase/order_backfill.go` 与 `order_backfill_handler.go` 提供 `POST /api/agent/v1/purchase-tasks/order-backfill`（Device Token 鉴权，逐条事务、逐条结果）；`server/app/goauto/models/purchase_order_guard.go` 在 `PurchaseTask.BeforeSave` 上全局强制订单号唯一，以 `purchase_rule_setting` 单例行串行化订单号分配，避免新增唯一索引迁移；`purchasecontract.ParseAddressSuffix` 为 `AddressSuffix` 的反解，通过回比而非负向前瞻实现（Go RE2 不支持前瞻）。
 | `ai_matching_setting` | 唯一单例的启用状态、OpenAI-compatible Base URL、模型、超时、内部部署明文 API Key 和更新人；仅管理员设置接口可以读取该字段 |
 
 `collection_task` 的状态仅为 `pending`、`running`、`completed`、`completed_partial`、`failed`。设备身份和心跳表属于 Agent 领取任务的必要基础，不承载 PDD 业务数据。
@@ -352,3 +354,15 @@ PddProductDetailCollector
 `GoAutoAccessibilityService.swipePurchase` 的失败分类由 `PurchaseSwipeFailureReason` 枚举提供；共享 `swipeNode` 仅增加可选分类回调，不改变手势目标、轨迹、1500ms 回调等待或其他调用者行为。`GoAutoPurchasePanel` 日志经 `AgentForegroundService` 关联 task、attempt、device 与规则快照哈希，新增预滑动跳过/必需滑动失败标量；不记录节点文字、坐标、原始控件树、截图或凭据。
 
 Server/Web、数据库和任务快照不变；旧 APK 仍有预滑动行为，必须更新 Agent 才生效。相关验证在 `PurchaseRehearsalExecutorTest`，Android 全量测试与 APK 构建入口不变。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；代码已实现不代表当前线上已部署。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+入口为 `SyncWithShopSnapshot → loadDailyList → importSyncPage`；`server/app/goauto/sybimport/sync_page.go` 封装页事务和提交后计数；`import_handler.go` 判定终态，`sync_run.go` 保存及筛选，Web 复用 `web/src/views/goauto/syb-sync-runs/index.vue`。

docs/03-business-rules-and-glossary.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Business-Rules-and-Glossary
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Business-Rules-and-Glossary.-
-wiki_revision: fdcce403423aa799d1517ac75fb38da636ef5217
-synchronized_at: 2026-09-09T01:22:58Z
+wiki_revision: 1eb380d07183157a8430c7ced868479e72fbdfe3
+synchronized_at: 2026-09-08T07:49:50Z
 <!-- gitea-wiki-mirror:end -->
 
 # 业务规则与术语
@@ -404,7 +404,7 @@ synchronized_at: 2026-09-09T01:22:58Z
 
 - 规格入口与精确规格选择统一按“重新定位唯一目标 → 执行一次无障碍点击 → 读取新页面验证”执行；不得复用旧无障碍节点，不选择相近规格，也不在多候选时默认点击第一个。
 - 无障碍点击后页面完全无变化时，只允许对解析器已确认的安全规格入口或服务端下发且唯一命中的精确规格执行一次中心手势兜底。目标必须可见、启用、边界有效，手势后仍须以规格面板强证据或精确选中证据确认结果。
-- 页面发生变化但规格面板强证据不足时，默认明确失败；#243 的同商品页安全入口恢复是限定例外：确认包/Activity 未变、商品标题非空且未变、入口来源与语义未变，无面板、关闭、数量、已选、支付、订单或页面异常信号时，重新定位入口并最多执行一次受控手势。整页普通动态节点变化不单独阻断该恢复；入口缺失或显式/嵌套入口歧义仍拒绝。商品标题一致是当前上下文约束，不宣称已从页面核验 goods_id。诊断只记录入口来源、点击结果/原因、恢复结果和面板数量/布尔等无敏感标量。原始控件树、节点文字集合和整屏截图仍不得保存或上传。
+- 页面发生变化但规格面板强证据不足时，不再继续手势或猜测页面，明确失败并只记录面板类型、候选数量和证据布尔值等无敏感标量。原始控件树、节点文字集合和整屏截图仍不得保存或上传。
 - 规格已处于精确选中状态时不得重复点击。规格查找只在解析器唯一识别的规格面板容器内有限滚动，每次滚动后重新定位容器与目标；容器缺失、歧义、到边或验证失败均 fail-closed。
 - 中心手势兜底不得用于修改/保存地址、创建或提交订单、订单详情入口以及任何支付/付款目标；正式创建订单的一次性不可逆门禁与永久禁止支付规则不变。
 ## PDD 商品反向关联与继续订单采购（#161）
@@ -482,22 +482,3 @@ synchronized_at: 2026-09-09T01:22:58Z
 `orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
 
 Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
-
-
-## 商品页动态变化下的采购入口恢复（#243）
-
-实现 ec8b14a，Android 0.9.61/versionCode 74；已构建、未安装或真机验收。规格探测和正式采购共用入口函数，面板已打开时不新增点击；仍在同一商品上下文且安全入口存在时，一次重新定位手势恢复不再依赖整页完全静止。手势后仍未打开则报告入口无效果，不循环点击。恢复不能用于地址、创建订单、支付或未知面板，不修改面板分类器及正式下单边界。CG82/CG85 原首次点击未生效的底层原因尚待新日志和授权真机验证。
-
-
-## 同一颜色卡片重复选中节点（#244）
-
-实现 93aab6a，Android 0.9.62/versionCode 75；已构建并授权覆盖安装，真实采购效果待验收。仅在颜色维度完整精确目标已选中、但存在非目标已选候选时，识别同一卡片重复表达：卡片必须是滚动容器直接子级的可点击非滚动 android.view.ViewGroup，节点父链明确、可见启用且边界包含；其他冲突节点仅可为该卡片自身或其中的 ImageView。另一文字选项、另一张卡片、多个精确目标、目标未选中、父链/边界不明均不适用例外。额外核对内存源节点以拒绝被解析器按同名去重隐藏的跨卡片目标；不保存原始树。
-
-不删除规格数字、不模糊匹配、不改变通用解析器、尺码确认、摘要兜底、入口/滚动/地址/价格/创建订单。没有非目标选中冲突时继续原判断；仅把同卡片容器/图片的重复选中表达从冲突中排除，不新增点击。
-
-
-## 精确规格不可用与入口恢复诊断（#245）
-
-实现 ca815c3，Android 0.9.63/versionCode 76；已通过单元测试并构建，未安装、未进行真实采购验收。入口恢复沿用 #243 条件，拒绝时通过 entryRecovery=rejected;reason=<固定原因码> 区分页面身份、商品上下文、面板/支付区域、数量/摘要、标题、入口来源/文案、歧义、规则别名及可用性；不放宽条件，不新增点击。
-
-在规格面板识别出唯一完整精确候选且 available=false 时，立即返回既有 PURCHASE_SPEC_SAFE_TARGET_MISSING，提示目标颜色/尺码已售罄或当前不可选，未创建订单；已选中目标同样不能绕过不可用检查。只记录 dimension 和 exact_target_unavailable 固定结构证据，不记录规格原文或原始树。原有纵向与横向定位在此条件下本就停止，不能将本改动描述为修复“已识别售罄仍继续搜索”。未识别精确候选时继续既有有界搜索，不推断售罄，不替换规格；解析器、匹配规则、滚动预算、地址与下单流程不变。

docs/08-agent-api-contract.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Android-Agent-API-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Android-Agent-API-Contract.-
-wiki_revision: 49dec4c35da793a32822a82e00f3b657757b6d44
-synchronized_at: 2026-09-07T13:35:25Z
+wiki_revision: 1f5ee1b29c66773fa571d862241b63f02dae283b
+synchronized_at: 2026-09-08T07:09:23Z
 <!-- gitea-wiki-mirror:end -->
 
 # MVP 共享 API 契约
@@ -77,7 +77,7 @@ PATCH /api/admin/v1/syb-products/{productId}/correction
 
 `import` 允许已认证的管理员（admin）和采购员（purchaser）调用（#236），仍须通过 Casbin 权限校验；其他角色返回 403。采购员的 POST 权限由既有启动权限对账写入，不需要新增数据库迁移。操作人取已认证 claims，不接受客户端冒名。请求体提交 `dateFrom`、`dateTo` 后创建持久化后台任务并立即以 `202` 返回 `runId` 和 `status=running`；关闭弹窗、刷新或离开页面不影响任务。没有启用店铺时必须在读取凭据、登录、验证码 OCR 和任意 SYB 网络请求之前返回 `422`。任意时刻只能有一条 `running` 记录，内存锁与数据库唯一执行槽共同阻止单进程和跨进程重复导入；冲突时返回正在执行任务的日期范围。
 
-`sync-runs` 列表支持 `page`、`pageSize`、`status`、`dateFrom`、`dateTo`，详情返回日期范围、状态（`running` / `succeeded` / `failed` / `interrupted`）、处理天数、货运单/明细/新增/覆盖数量、店铺准入与跳过数量、店铺筛选快照哈希、按店铺的 `accepted` / `skipped` 统计、操作人和起止时间。列表和详情对已登录角色只读开放。服务启动时遗留的 `running` 任务改为 `interrupted`；中途失败或中断已经写入的数据保留，重新导入仍按唯一键覆盖。
+`sync-runs` 列表支持 `page`、`pageSize`、`status`、`dateFrom`、`dateTo`，详情返回日期范围、状态（`running` / `succeeded` / `partial_success` / `failed` / `interrupted`）、处理天数、货运单/明细/新增/覆盖数量、店铺准入与跳过数量、店铺筛选快照哈希、按店铺的 `accepted` / `skipped` 统计、操作人和起止时间。列表和详情对已登录角色只读开放。服务启动时遗留的 `running` 任务改为 `interrupted`；中途失败或中断已经写入的数据保留，重新导入仍按唯一键覆盖。
 
 列表返回结构化字段（`orderCode`、`shopeeItemId`、`productTitle`、`targetColor`、`targetSize`、`quantity`、`unitPriceCent`、`imageUrl`、`parseStatus`、`parseNote`、`manuallyConfirmed`），不含原始 JSON；`keyword` 匹配订单号、虾皮商品ID 或商品标题，`parseStatus` 筛选 `success`/`uncertain`/`failed`。详情额外返回 `rawJson`（原始 `details[]` 元素，未做任何改写）。
 
@@ -556,7 +556,9 @@ Android #42/#36 使用本地 SQLite 保存恢复与重传所需的任务、attem
 创建订单前先在本地事务保存 `order_submit_started`、不可逆时间、稳定的 `orderSubmitRequestId` 和脱敏最终确认快照，再调用服务端同名接口；只有两侧标记完成并重新校验商品、规格、数量、单价、地址后缀、PDD 包/Activity 与唯一创建订单按钮后，才点击一次。重启时重放同一标记请求并只读核单；无法取得唯一未付款订单号和 PDD 下单时间时提交 `order_result_unknown`。支付文字仅用于识别未付款/离开支付页，永不点击。服务端数据库仍是最终事实来源；双方均不保存原始控件树、截图、PDD 凭据或完整收货地址。
 
 创建订单后若出现 Android 多微信应用选择器，只读核单器必须同时确认前台包为 `android` / `com.android.intentresolver`、Activity 为白名单 `ChooserActivity` / `ResolverActivity`、页面出现已知系统选择器标题且至少一个候选以“微信”开头，才允许执行一次系统返回；不得点击任何微信候选。若前台已经是精确微信包 `com.tencent.mm`，只读核单器不得点击、输入、登录、支付或强制停止微信，只允许执行一次无参数 PDD 启动 Intent 并等待既有 PDD 任务栈回到前台；`startActivity()` 成功只表示恢复请求已发起。请求后在固定最多 15 次、每次 200ms 的宽限期内允许微信或空窗口短暂残留，不执行点击、返回、输入或滑动；观察到 PDD 后结束宽限，宽限超时、已经观察到 PDD 后再次进入微信或出现稳定未知应用时返回未知结果。随后若前台为 PDD `com.xunmeng.pinduoduo.app_pay.core.PayActivity` 或当前页面出现支付动作文字，最多再返回一次。返回后只读解析唯一订单号和下单时间；选择器或支付页重复出现、白名单不成立、恢复动作重复、无法到达订单详情、结果不唯一或超时均返回未知结果，禁止再次点击创建订单、取消订单或支付。
-`order_result_unknown` 保持订单号和下单时间为空，但允许携带创建订单前已经严格验证的 `actualUnitPriceCent`。Agent 同时提交脱敏稳定失败阶段，服务端只接受白名单并按错误码写入固定提示，不信任或保存页面原文；阶段覆盖空窗口超时、选择器返回失败、微信恢复失败/超时、未知应用、支付页返回失败/重复、订单上下文缺失、订单号缺失/歧义、下单时间缺失/无效和待付款证据缺失。任务与 attempt 保存同一错误阶段，Admin 和 Agent 历史读取数据库最终事实；旧 Agent 未提交阶段时归一为 `PURCHASE_ORDER_RESULT_UNKNOWN`。
+Agent 主动提交 `order_result_unknown` 时保持订单号和下单时间为空，但允许携带创建订单前已经严格验证的 `actualUnitPriceCent`。Agent 同时提交脱敏稳定失败阶段，服务端只接受白名单并按错误码写入固定提示，不信任或保存页面原文；阶段覆盖空窗口超时、选择器返回失败、微信恢复失败/超时、未知应用、支付页返回失败/重复、订单上下文缺失、订单号缺失/歧义、下单时间缺失/无效和待付款证据缺失。任务与 attempt 保存同一错误阶段，Admin 和 Agent 历史读取数据库最终事实；旧 Agent 未提交阶段时归一为 `PURCHASE_ORDER_RESULT_UNKNOWN`。
+
+#241 追加：全局订单号唯一性校验在人工处理结果未知、取消及 lifecycle 保存路径返回 `PURCHASE_ORDER_NUMBER_ALREADY_USED`（HTTP 409、`retryable=false`），提示“订单号已属于任务 CG-任务ID”；批量回填继续使用原有 `PURCHASE_BACKFILL_ORDER_ALREADY_USED`。不可逆边界后的 `order_created` 结果回传为例外：发现该号已属于其他任务时成功受理结果，将 `order_submit_started` 降级为 `order_result_unknown`，不回滚或自动重派。冲突订单号不写入 `pdd_order_no`，而以“读到订单号 X，但该号已属于任务 CG-yy”保存到任务和 attempt 的 `error_message`，两者 `error_code` 均为 `PURCHASE_ORDER_NUMBER_ALREADY_USED`；保留下单时间、不可逆时间及实际单价。attempt 以 failed 结束并保留原始 `order_created` 结果类型、请求 ID 和摘要，重复提交按原幂等协议返回；任务释放租约和运行槽，进入既有人工处理结果未知通道，权限不变。
 
 | 错误码 | 普通提示 |
 |---|---|
@@ -975,3 +977,86 @@ Agent 携带既有 Token（可已失效）及恢复码重新调用注册接口
 
 本地 `GoAutoPurchasePanel` 脱敏结构日志关联 task、attempt、device、rule（规则 SHA-256），不上传原始页面。新增事件：`postSwipe=skipped;action=openSpecPanel;reason=spec_panel_on_demand;panel=<枚举>`；其他必需滑动失败为 `postSwipe=failed;action=<动作枚举>;direction=<方向枚举>;swipeIndex=<本动作内第几次滑动>;reason=<固定分类>`。
 固定失败分类：unknown、root_unavailable、no_scrollable、invalid_bounds、gesture_unsupported、gesture_rejected、gesture_cancelled、gesture_timeout。日志不含规格值、节点文本、坐标、地址、订单、凭据、原始树或截图；结果错误码仍为 RULE_ACTION_FAILED，现有结果提交字段不变。
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；代码已实现不代表当前线上已部署。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。
+
+## Agent 采购订单批量回填（#241）
+
+本节为 #241 服务端实现契约，2026-09-08 按用户授权直接更新本地镜像；线上 Wiki 与其他长期文档由审核阶段同步。本节不表示已经部署或完成真机验收。
+
+`POST /api/agent/v1/purchase-tasks/order-backfill`
+
+使用 `Authorization: Bearer <Device Token>`，沿用 `RequireAgentHTTPS`、`GOAUTO_ALLOW_INSECURE_AGENT_HTTP` 与既有可信转发协议策略。无需 Admin JWT、claim、start 或 attempt。设备号只从认证读取，请求不得指定 deviceId、地址全文、收件人、手机号或原始控件树；未知 JSON 字段拒绝。此接口只记录已观察到的订单事实，不执行设备动作、创建订单或付款。
+
+请求示例（页面时间先按 Asia/Shanghai 理解，再以带时区 RFC3339/RFC3339Nano 发送）：
+
+```json
+{
+  "requestId": "5826cdda-dcd6-442e-90c3-9b75ba6fb8d8",
+  "items": [
+    {"addressSuffix": "_cg7", "pddOrderNo": "EXAMPLE-ORDER-7", "orderSubmittedAt": "2026-09-08T20:30:00+08:00"},
+    {"addressSuffix": "_cg72", "pddOrderNo": "EXAMPLE-ORDER-72"}
+  ]
+}
+```
+
+- requestId 必须为 UUID；items 为 1～50 条，保持输入顺序；请求体上限沿用 1 MiB。
+- addressSuffix 只接受 `AddressSuffix(id)` 生成的完整字符串。任务号为非零 uint64，拒绝前导零、正负号、空格、尾随文本、多个后缀与溢出；`_cg7` 与 `_cg72` 分别定位任务 7 和 72。
+- pddOrderNo 必填，最多 100 个 Unicode 字符，不接受首尾空白、换行或制表符，不自动裁剪后覆盖旧值。
+- orderSubmittedAt 缺失或 null 时回落任务 irreversible_at；空字符串、无时区文本及非法时间是条目错误，不触发回落。存储统一 UTC。页面值与 irreversible_at 都缺失时该条失败。
+
+有效批次返回 HTTP 200，包括全部条目失败的批次；每条独立事务，失败不撤销其他条目已提交的数据。响应包裹为 `data`，并设 `Cache-Control: no-store`：
+
+```json
+{
+  "data": {
+    "requestId": "5826cdda-dcd6-442e-90c3-9b75ba6fb8d8",
+    "items": [
+      {"index": 0, "taskId": 7, "result": "backfilled", "code": "BACKFILLED", "status": "order_created", "statusVersion": 5, "pddOrderNo": "EXAMPLE-ORDER-7", "orderSubmittedAt": "2026-09-08T12:30:00Z", "timeSource": "page", "retryable": false},
+      {"index": 1, "taskId": 72, "result": "backfilled", "code": "BACKFILLED", "status": "order_created", "statusVersion": 4, "pddOrderNo": "EXAMPLE-ORDER-72", "orderSubmittedAt": "2026-09-08T12:31:00Z", "timeSource": "irreversible_at", "retryable": false}
+    ]
+  }
+}
+```
+
+index 从 0 开始；后缀无法解析时不返回 taskId。result 为 `backfilled`、`already_backfilled`、`conflict` 或 `failed`。已认证设备所属任务可返回提交后的状态、版本、已保存订单号及时间；拒绝条目尽可能返回当前已提交事实。跨设备任务和不存在任务不返回这些业务字段，事务回滚后的内存值绝不作为最终事实返回。
+
+timeSource 说明已保存时间的来源：`page` 为页面值，`irreversible_at` 为估算回落，`existing_unknown` 为原先已创建的历史订单且没有可证明的来源。没有已保存时间时省略 timeSource。客户端必须保留估算标记，不得把回落值或 unknown 宣称为页面真实时间。重复回填不会用新页面时间自动校正旧时间。
+
+| 条目 code | result | 含义 |
+|---|---|---|
+| `BACKFILLED` | backfilled | 本条完成回填 |
+| `ALREADY_BACKFILLED` | already_backfilled | 正式任务已为 order_created 且订单号相同，无写入 |
+| `PURCHASE_BACKFILL_SUFFIX_INVALID` | failed | 非法、非规范、零、溢出或歧义后缀 |
+| `PURCHASE_TASK_NOT_FOUND` | failed | 任务不存在 |
+| `PURCHASE_BACKFILL_DEVICE_MISMATCH` | failed | 未绑定设备或不属于认证设备 |
+| `PURCHASE_STATE_CONFLICT` | failed | 非正式采购，或状态不允许回填 |
+| `PURCHASE_INVALID_REQUEST` | failed | 订单号非法 |
+| `PURCHASE_ORDER_TIME_INVALID` | failed | 提供的页面时间无效 |
+| `PURCHASE_ORDER_TIME_MISSING` | failed | 页面时间与 irreversible_at 均无有效值 |
+| `PURCHASE_BACKFILL_ORDER_CONFLICT` | conflict | 任务已有不同订单号 |
+| `PURCHASE_BACKFILL_BATCH_CONFLICT` | conflict | 同批同任务出现多个不同订单号，该任务所有条目均拒绝 |
+| `PURCHASE_BACKFILL_ORDER_ALREADY_USED` | conflict | 同一订单号已对应其他任务 |
+| `INTERNAL_ERROR` | failed | 数据库失败、死锁等，retryable=true，可安全重放 |
+
+批级 JSON/UUID/数量错误为 HTTP 422 `PURCHASE_INVALID_REQUEST`；鉴权、停用设备和 HTTPS 限制复用既有错误（401 `DEVICE_TOKEN_INVALID`、403 `DEVICE_DISABLED`、426 `HTTPS_REQUIRED`）。批级失败使用既有 `{code,message,retryable}` 包裹，未开始条目写入。
+
+### 状态、幂等与并发
+
+新服务在事务中锁定任务并检查来源状态，仅允许当前设备的 `live + order_result_unknown` 首次写入；`live + order_created` 只在订单号相同时返回已回填。其他状态（包括 running、failed、cancelled 与演练）均拒绝。复用 SetStatus 同步占用字段，同一事务递增 statusVersion、设置 statusChangedAt、清空主任务当前错误及租约；原始 attempt、规则快照、支付与物流、SYB 回写字段不变。
+
+requestId 沿用 UUID 约定，不增加批次表或全局幂等缓存。既有 unknown_resolve_request_id 槽存储 `backfill:<page|irreversible_at>:<由 requestId 和后缀派生的 UUID>`（最多 61 字符），用于任务级关联和保留本功能时间来源。相同任务和订单号即使更换 requestId 也无写入；同 requestId 改内容仍重新执行设备、状态和订单冲突检查，不凭 requestId 直接放行。批内不同任务提交同一订单号时，先成功提交者占用，其余条目返回订单已被使用；已存在的历史重复订单号不自动修复。
+
+订单号尚无唯一索引，本实现不迁移数据库。共享模型保存钩子复用 `purchase_rule_setting.id=1` 行作短事务互斥锁，再以锁定读检查订单号归属，覆盖回填、原人工解除和旧结果提交路径；单例缺失时拒绝写入，数据库死锁时回滚失败事务。原 ResolveUnknown 与 Admin 鉴权代码保持不变。禁止通过跳过模型钩子的直接 SQL 写入宣称具备此保证。
+
+新回填路径禁用包含绑定参数的 SQL 日志，不记录请求正文、订单号、地址或原始树；任务号和认证设备号沿既有任务关联不可变 ruleSnapshot。此接口未新增日志载荷或任务/attempt。
+
+本地测试覆盖事务回滚、并发服务调用和旧写入路径，使用 SQLite；MySQL 8.4 多连接/多进程的实际行锁、生产数据和真机端到端回填尚待环境验收，不以单元测试替代。

docs/12-syb-erp-interface.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: SYB-ERP-Interface-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/SYB-ERP-Interface-Contract.-
-wiki_revision: a4f4ab200af052bab7ffbabe267238528bcd7cf9
-synchronized_at: 2026-09-07T07:02:57Z
+wiki_revision: 214485db630141aeb03d4b49b22a65e572fb592a
+synchronized_at: 2026-09-08T02:24:10Z
 <!-- gitea-wiki-mirror:end -->
 
 # 12 顺云宝（SYB）ERP 接口契约
@@ -220,22 +220,13 @@ Admin 默认 `max_matches = 10000`，可以在配置中调整；上限针对整
 有限重试：单次 HTTP 总超时 60 秒，最多执行 3 次，重试前分别等待 1 秒、2 秒，等待须
 响应 context 取消。HTTP 401/403、明确会话失效、业务失败、接口数据完整性错误和本地
 校验失败不得重试；登录、验证码、单件码写入和任何回填请求也不得使用该机制。重试
-耗尽后返回最后一次错误，外层继续保留日期、页码和已获取数量上下文并将同步标为失败。
+耗尽后返回最后一次错误，外层保留日期、页码和已获取数量上下文，按最终已保存成果将同步标为失败或部分成功。
 
-今天的货运单会在同步期间持续新增。只有 UTC+8 下的今天发生上述快照漂移时，
-允许只重试今天的列表分页，最多 3 次；已经完成的历史日期不得重复拉取，每次尝试
-也必须使用独立 ID 集合。第三次仍不稳定时，可以对最后一次取得的合法唯一 ID
-读取完整明细并按既有 upsert 保存，但本次同步仍记为失败、明确提示当天未形成
-稳定快照且不推进游标，下一次继续覆盖今天。任何尝试都不得突破 `max_matches`；
-网络/业务错误、非法 ID 或不完整明细不属于可放宽的快照漂移。
-`[必须，#235]` 当天跨页重复 ID 纳入上述最多 3 次列表快照尝试（含首次），
-不增加另一层重试次数。发现跨页重复后丢弃本次列表，从预检总数和第一页重新开始，
-使用全新 ID 集合；最后一次仍重复时直接失败，不得去重后按成功或降级数据保存。
-已经完成的历史日期保持其已有结果，不重复拉取；历史日期重复不适用此恢复。
-每页先检查非法 ID 和页内重复，再检查跨页重叠；同页同时存在页内重复和跨页重叠时
-仍作为硬错误停止。原有总数漂移/短页的合法唯一列表降级保存条件保持不变。
-重复诊断只记录日期、当天尝试序号、首次/当前页码与行号、start、pageSize、
-expectedTotal 和已获取唯一数量，不记录真实重复 ID、原始响应或个人数据。
+自 #239（实现提交 c6a962d，已于 2026-09-08 随 d403f3b 部署线上）起，改为按页验证和保存：每页先验证条数、合法 ID、页内/跨页重复，再按冻结店铺快照获取并验证全部明细；外部请求完成后才开启页事务。页内任一入库失败回滚整页，已提交的前页保留，计数在事务提交后累计。
+
+当天和历史日期统一处理：分页/明细失败或最终总数漂移时停止该日期并继续后续日期，不在同次运行中重新扫描当天，以避免重复写入和计数。数据库故障、进度持久化失败、明确会话失效、上下文取消或总任务超时停止整个范围。下一次人工或定时同步重新扫描日期，按 (order_code, detail_id) 幂等覆盖并保留人工确认。跨页重复不去重后冒充完整数据；最终日期完整性校验仍覆盖所有店铺。此流程替代此前 #235 的当天三次整日快照重扫。
+
+重复诊断只记录日期、首次/当前页码和行号、start、pageSize、expectedTotal、已获取唯一数量，不记录真实重复 ID、原始响应或个人数据。
 
 ### 4.4 统一日期范围同步与覆盖游标
 
@@ -258,7 +249,7 @@ GoAuto 同步记录页的立即同步允许管理员和采购员（purchaser）
 或超过 `max_matches` 时不推进游标。
 
 `[必须]` 每批明细响应必须与请求的货运单 ID 一一对应。缺失、重复、出现未请求
-ID，或某张货运单返回空商品明细，都视为不完整并停止同步；已经写入的幂等数据
+ID，或某张货运单返回空商品明细，都视为不完整并停止当前日期，继续后续日期；已经写入的幂等数据
 可以保留，但只有所有日期全部成功才推进游标。
 
 `[必须]` 登录和验证码只是同步前置步骤。日期范围经过自动 OCR 降级、手工
@@ -500,9 +491,9 @@ POST /am/stock/detail/updateDetailCode?t=0&id={stockID}&detailId={detailID}&code
 > 以下「店铺准入」已由 GoAuto #49 采纳并实现；店铺规范化还包括全角/半角统一和忽略大小写。
 
 `[必须]` **同步先校验原始全量，再做店铺准入。** 顺序固定为：按日期查询原始总数
-并执行单次容量熔断 → 拉完当天原始列表并核对分页前后总数、页长和唯一 ID → 按
+并执行单次容量熔断 → 逐页核对页长和唯一 ID，整日结束复核总数 → 按
 `shopName` 去除首尾空白后与启用店铺精确匹配 → 只为接受的货运单请求明细和入库。
-不能先过滤再做完整性校验，否则非目标店铺的分页漂移会被掩盖。
+店铺过滤只决定明细获取和入库，不能减少原始列表完整性校验范围；已保存不代表整日完整。
 
 `[必须]` 同步开始时只读取一次启用店铺，整次运行使用同一个快照。列表允许但明细
 响应中的 `shopName` 变为空或非允许店铺时再次拦截。没有启用店铺时在会话/OCR/
@@ -657,3 +648,13 @@ settings:
 - 客户端实现：`server/app/goauto/sybclient/`
 - 落库与解析：`server/app/goauto/sybimport/`
 - 相关工单：[#48 客户端移植](https://git.ilapage.cn/OPC/goauto/issues/48)、[#41 SYB 货运单商品导入](https://git.ilapage.cn/OPC/goauto/issues/41)、[#37 物流调度与货运宝回填](https://git.ilapage.cn/OPC/goauto/issues/37)
+
+## SYB 逐页保存与部分成功（#239）
+
+实现绑定 c6a962d；2026-09-08 已随 d403f3b 部署线上，未手动触发真实同步验收；#240 上游尾页超时尚未修复。每页完整明细在外部请求结束后按页事务保存；页回滚不累计明细/新增/覆盖数，已提交页保留。日期局部读取失败继续下一日期，全局数据库/进度/会话/取消故障停止。当天漂移不在一次运行内重扫；后续运行重新扫描并幂等补齐。
+
+同步状态增加 `partial_success`（部分成功，15 字符，复用现有 varchar(16)，无需迁移）。有错误且 created+updated>0 为部分成功；有错误无已提交明细为 failed；完整且无错误为 succeeded（包括无符合店铺的数据）。中断仍为 interrupted，不把中断追认为成功。所有终态沿用活动槽释放规则。
+
+`orderCount` 是已验证页的原始列表读取数量；`detailCount`、`created`、`updated` 为已提交明细及其新增/覆盖数量；`daysProcessed` 是完整通过的日期数，不是已尝试日期数。失败日期/页码/阶段写入现有脱敏限长 errorMessage。部分成功不刷新店铺的完整同步统计。
+
+Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态、状态筛选及详情支持部分成功，详情保留已保存数量、错误原因与重新同步补齐提示。定时任务日志只表示异步任务受理，不等于最终业务同步成功。

docs/13-deployment-and-operations.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-and-Operations
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-and-Operations.-
-wiki_revision: f951dbc8b6a555cbf8f44cda073910406ba55191
-synchronized_at: 2026-09-07T09:43:56Z
+wiki_revision: df033d06fd94a4b02a447a27ced8d711521342f3
+synchronized_at: 2026-09-08T02:23:08Z
 <!-- gitea-wiki-mirror:end -->
 
 # 部署与运维
@@ -73,10 +73,10 @@ Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、
 
 ## 客户端密钥部署与验证（#237）
 
-实现基线 `71f7751`；2026-09-07 已按用户授权完成本机 MySQL 迁移、管理员菜单写入和 Server/Web 构建重启；管理页面 HTTP 列表与模块加载已验证。线上仍未部署。
+实现基线 `71f7751`；2026-09-07 已按用户授权完成本机 MySQL 迁移、管理员菜单写入和 Server/Web 构建重启；管理页面 HTTP 列表与模块加载已验证。2026-09-08 经用户授权，线上已发布 Server/Web 基线 `d403f3b`，执行迁移 `1788798000000` 并重启 GoAuto/Nginx；迁移记录、两张密钥表、仅管理员菜单关联已回读。HTTP 页面与健康检查通过；未登录管理请求 HTTP 200、业务码 401。真实密钥创建及客户端业务读写闭环尚未验证。
 
 - 发布前须单独授权追加迁移 `server/cmd/migrate/migration/version-local/1788798000000_client_api_key.go`，按既有迁移流程创建 client_api_key、client_api_key_audit 和“采采管理/客户端密钥”管理员菜单。前置父菜单必须存在；不应以赋予普通用户管理员角色代替迁移或权限核验。
-- 用户于 2026-09-07 明确确认默认兼容 HTTP/HTTPS、不设开关并接受明文风险；部署本版本并执行迁移后，现有 `http://185.216.248.75:9527` 可以使用客户端密钥管理及客户端 API。本机已部署验证，不能据此宣称线上已经可用。HTTP 会明文传输密钥和业务数据，仍建议使用 HTTPS。
+- 用户于 2026-09-07 明确确认默认兼容 HTTP/HTTPS、不设开关并接受明文风险；部署本版本并执行迁移后，现有 `http://185.216.248.75:9527` 可以使用客户端密钥管理及客户端 API。2026-09-08 线上部署及未登录拒绝检查已通过，真实密钥读写验收仍待进行。HTTP 会明文传输密钥和业务数据，仍建议使用 HTTPS。
 - 客户端密钥功能不依赖 GOAUTO_TRUST_FORWARDED_PROTO、X-Forwarded-Proto 或 Agent HTTP 例外。既有其他路由的协议和代理配置保持不变；不伪造协议头，不新增明文放行开关。
 - 代理、APM、应用日志均不得记录 Authorization、创建响应 secret 或原始业务载荷。应用对两类客户端密钥路由跳过旧请求/响应正文日志，使用专用元数据审计；实际代理日志脱敏仍须部署验收。
 - 请求审计 status=0 可能表示在途、进程中断或结果审计更新失败；先按请求关联号核对业务结果，不自动重试采购、采集、同步等操作。停用阻止后续认证，不保证取消已开始的业务操作。
@@ -92,4 +92,4 @@ Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、
 - 真实迁移必须单独授权并先确认唯一待执行版本；常驻 API 加 `-SkipMigration`，日常重启不自动执行未来待审核迁移。#237 迁移 `1788798000000_client_api_key.go` 已执行，sys_migration 记录 `1788798000000`、两张密钥表及管理员菜单已回读；其他角色未新增菜单关联。任务启停状态未改。
 - 范围明确的服务控制：`D:/supervisor/supervisord.exe -c D:/supervisor/supervisord.conf ctl status goauto-admin-api goauto-admin-ui`，启动/停止/重启将 status 分别替换为 start/stop/restart。不得为了 GoAuto 重启整个 Supervisor 或其他项目。配置内容变化后需重新读取配置；本次调用 `supervisor.reloadConfig`，再对上述两个程序定向 start，已通过进程命令行核对新目录。
 - 日志：`D:/supervisor/logs/goauto-admin-api.log`、`D:/supervisor/logs/goauto-admin-ui.log`；对外分享只能保留脱敏结构摘要。迁移输出不得暴露凭据或业务原文。
-- 管理员刷新页面后可进入 `http://127.0.0.1:9527/#/client-keys/index`；菜单缓存未更新时重新登录。已验证列表空态、创建弹窗加载 12 模块及 HTTP 风险提示；未实际创建密钥，真实客户端读写及停用闭环仍待范围明确的验证。线上 GoAuto/Nginx 未重启或发布。
+- 管理员刷新页面后可进入 `http://127.0.0.1:9527/#/client-keys/index`；菜单缓存未更新时重新登录。已验证列表空态、创建弹窗加载 12 模块及 HTTP 风险提示；未实际创建密钥，真实客户端读写及停用闭环仍待范围明确的验证。本节为 2026-09-07 本机验证记录；线上已于 2026-09-08 另行授权发布，见上节。

server/app/goauto/models/purchase.go

@@ -202,7 +202,15 @@ func (task *PurchaseTask) BeforeCreate(_ *gorm.DB) error {
 	return task.syncPurchaseGuardSlots()
 }
 
-func (task *PurchaseTask) BeforeSave(_ *gorm.DB) error { return task.syncPurchaseGuardSlots() }
+func (task *PurchaseTask) BeforeSave(tx *gorm.DB) error {
+	if err := task.syncPurchaseGuardSlots(); err != nil {
+		return err
+	}
+	if task.PDDOrderNo != nil && *task.PDDOrderNo != "" {
+		return CheckPurchaseOrderNumber(tx, task.ID, *task.PDDOrderNo)
+	}
+	return nil
+}
 
 func (task *PurchaseTask) SetStatus(status string) error {
 	task.Status = status

server/app/goauto/models/purchase_order_guard.go

@@ -0,0 +1,41 @@
+package models
+
+import (
+	"errors"
+	"fmt"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+var ErrPurchaseOrderNumberUsed = errors.New("purchase order number belongs to another task")
+
+type PurchaseOrderNumberUsedError struct {
+	TaskID uint64
+}
+
+func (e *PurchaseOrderNumberUsedError) Error() string {
+	return fmt.Sprintf("订单号已属于任务 CG-%d", e.TaskID)
+}
+
+func (e *PurchaseOrderNumberUsedError) Unwrap() error { return ErrPurchaseOrderNumberUsed }
+
+// CheckPurchaseOrderNumber must run inside the caller's write transaction.
+// The existing singleton setting row serializes order assignments across
+// processes, including an absent order number, without relying on gap locks or
+// a new schema constraint. Locking reads see the latest committed assignment.
+// A missing singleton fails closed. Deadlocks roll back the losing transaction.
+func CheckPurchaseOrderNumber(tx *gorm.DB, taskID uint64, orderNo string) error {
+	var setting PurchaseRuleSetting
+	if err := tx.Session(&gorm.Session{NewDB: true}).Clauses(clause.Locking{Strength: "UPDATE"}).First(&setting, 1).Error; err != nil {
+		return err
+	}
+	var others []PurchaseTask
+	if err := tx.Session(&gorm.Session{NewDB: true}).Select("id").Clauses(clause.Locking{Strength: "UPDATE"}).Where("pdd_order_no = ? AND id <> ?", orderNo, taskID).Find(&others).Error; err != nil {
+		return err
+	}
+	if len(others) != 0 {
+		return &PurchaseOrderNumberUsedError{TaskID: others[0].ID}
+	}
+	return nil
+}

server/app/goauto/purchase/handler.go

@@ -542,7 +542,7 @@ func writeError(c *gin.Context, err error) {
 		status = http.StatusForbidden
 	case CodeTaskNotFound:
 		status = http.StatusNotFound
-	case CodeStateConflict, CodeCapabilityMismatch, CodeDeviceBusy, CodeTaskClaimed, CodeLeaseExpired, CodeMappingRequired, CodeResultConflict, CodeRePurchaseRequired:
+	case CodeStateConflict, CodeCapabilityMismatch, CodeDeviceBusy, CodeTaskClaimed, CodeLeaseExpired, CodeMappingRequired, CodeResultConflict, CodeRePurchaseRequired, CodeOrderNumberUsed:
 		status = http.StatusConflict
 	}
 	c.JSON(status, gin.H{"code": code, "message": msg, "retryable": retryable})

server/app/goauto/purchase/lifecycle.go

@@ -6,6 +6,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"strings"
 	"time"
 
@@ -378,6 +379,22 @@ func (s *Service) SubmitResult(ctx context.Context, taskID uint64, req ResultReq
 			t.PDDOrderNo = &req.PDDOrderNo
 			t.OrderSubmittedAt = req.OrderSubmittedAt
 			t.ActualUnitPriceCent = req.ActualUnitPriceCent
+			// Keep the assignment lock until commit. A conflicting observation
+			// after the irreversible boundary must reach manual resolution,
+			// not roll back the result or claim another task's order number.
+			if e := models.CheckPurchaseOrderNumber(tx, t.ID, req.PDDOrderNo); e != nil {
+				var conflict *models.PurchaseOrderNumberUsedError
+				if !errors.As(e, &conflict) {
+					return TaskPayload{}, conflictOrInternal(e)
+				}
+				next = models.PurchaseTaskStatusOrderResultUnknown
+				t.PDDOrderNo = nil
+				failureCode := CodeOrderNumberUsed
+				message := fmt.Sprintf("读到订单号 %s，但该号已属于任务 %s", req.PDDOrderNo, taskNumber(conflict.TaskID))
+				t.ErrorCode, t.ErrorMessage = &failureCode, &message
+				a.Status = models.PurchaseAttemptStatusFailed
+				a.ErrorCode, a.ErrorMessage = &failureCode, &message
+			}
 		case "order_result_unknown":
 			if t.ExecutionMode != models.PurchaseExecutionModeLive || t.Status != models.PurchaseTaskStatusOrderSubmitStarted {
 				return TaskPayload{}, fail(CodeStateConflict, "当前任务不能标记订单结果未知")
@@ -525,7 +542,10 @@ func (s *Service) applySpecDecision(ctx context.Context, taskID uint64, req Spec
 		}
 		t.StatusVersion++
 		t.StatusChangedAt = s.Now()
-		return tx.Save(&t).Error
+		if e := tx.Save(&t).Error; e != nil {
+			return conflictOrInternal(e)
+		}
+		return nil
 	})
 	return t, replayed, err
 }
@@ -728,6 +748,10 @@ func purchaseNotFound(err error) error {
 	return internal(err)
 }
 func conflictOrInternal(err error) error {
+	var conflict *models.PurchaseOrderNumberUsedError
+	if errors.As(err, &conflict) {
+		return fail(CodeOrderNumberUsed, conflict.Error())
+	}
 	if isDuplicate(err) {
 		return fail(CodeDeviceBusy, "设备或拼多多账号已有运行任务")
 	}

server/app/goauto/purchase/manual.go

@@ -80,7 +80,10 @@ func (s *Service) SelectWriteback(ctx context.Context, id uint64, req ManualRequ
 		}
 		out.WritebackStatus = models.PurchaseWritebackStatusPending
 		out.WritebackSelectRequestID = &req.RequestID
-		return tx.Save(&out).Error
+		if e := tx.Save(&out).Error; e != nil {
+			return conflictOrInternal(e)
+		}
+		return nil
 	})
 	return out, replayed, err
 }
@@ -166,7 +169,10 @@ func (s *Service) manual(ctx context.Context, id uint64, req ManualRequest, appl
 				return internal(e)
 			}
 		}
-		return tx.Save(&out).Error
+		if e := tx.Save(&out).Error; e != nil {
+			return conflictOrInternal(e)
+		}
+		return nil
 	})
 	return out, replayed, err
 }

server/app/goauto/purchase/order_backfill.go

@@ -0,0 +1,202 @@
+package purchase
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"go-admin/app/goauto/device"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/purchasecontract"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"gorm.io/gorm/logger"
+)
+
+const (
+	MaxOrderBackfillItems     = 50
+	CodeBackfillSuffix        = "PURCHASE_BACKFILL_SUFFIX_INVALID"
+	CodeBackfillDevice        = "PURCHASE_BACKFILL_DEVICE_MISMATCH"
+	CodeBackfillOrderConflict = "PURCHASE_BACKFILL_ORDER_CONFLICT"
+	CodeBackfillBatchConflict = "PURCHASE_BACKFILL_BATCH_CONFLICT"
+	CodeBackfillOrderUsed     = "PURCHASE_BACKFILL_ORDER_ALREADY_USED"
+)
+
+type OrderBackfillRequest struct {
+	RequestID string              `json:"requestId"`
+	Items     []OrderBackfillItem `json:"items"`
+}
+
+type OrderBackfillItem struct {
+	AddressSuffix string `json:"addressSuffix"`
+	PDDOrderNo    string `json:"pddOrderNo"`
+	// A string keeps an invalid page timestamp local to this item.
+	OrderSubmittedAt *string `json:"orderSubmittedAt,omitempty"`
+}
+
+type OrderBackfillResult struct {
+	Index            int        `json:"index"`
+	TaskID           uint64     `json:"taskId,omitempty"`
+	Result           string     `json:"result"`
+	Code             string     `json:"code"`
+	Status           string     `json:"status,omitempty"`
+	StatusVersion    uint64     `json:"statusVersion,omitempty"`
+	PDDOrderNo       *string    `json:"pddOrderNo,omitempty"`
+	OrderSubmittedAt *time.Time `json:"orderSubmittedAt,omitempty"`
+	TimeSource       string     `json:"timeSource,omitempty"`
+	Retryable        bool       `json:"retryable"`
+}
+
+type OrderBackfillResponse struct {
+	RequestID string                `json:"requestId"`
+	Items     []OrderBackfillResult `json:"items"`
+}
+
+func (s *Service) BackfillOrders(ctx context.Context, req OrderBackfillRequest, token string) (OrderBackfillResponse, error) {
+	out := OrderBackfillResponse{RequestID: req.RequestID}
+	d, err := device.NewService(s.DB).Authenticate(ctx, token)
+	if err != nil {
+		return out, err
+	}
+	if _, err := uuid.Parse(req.RequestID); err != nil || len(req.Items) == 0 || len(req.Items) > MaxOrderBackfillItems {
+		return out, fail(CodeInvalidRequest, "requestId 必须为 UUID，items 必须包含 1 到 50 条")
+	}
+	ids := make([]uint64, len(req.Items))
+	orders := make(map[uint64]string)
+	conflicts := make(map[uint64]bool)
+	for i, item := range req.Items {
+		id, err := purchasecontract.ParseAddressSuffix(item.AddressSuffix)
+		if err != nil {
+			continue
+		}
+		ids[i] = id
+		if previous, ok := orders[id]; ok && previous != item.PDDOrderNo {
+			conflicts[id] = true
+		}
+		orders[id] = item.PDDOrderNo
+	}
+	out.Items = make([]OrderBackfillResult, len(req.Items))
+	for i, item := range req.Items {
+		r := OrderBackfillResult{Index: i, TaskID: ids[i], Result: "failed"}
+		if ids[i] == 0 {
+			r.Code = CodeBackfillSuffix
+		} else {
+			r = s.backfillOrder(ctx, d.ID, ids[i], req.RequestID, item, conflicts[ids[i]])
+			r.Index = i
+		}
+		out.Items[i] = r
+	}
+	return out, nil
+}
+
+func (s *Service) backfillOrder(ctx context.Context, deviceID, taskID uint64, requestID string, item OrderBackfillItem, batchConflict bool) OrderBackfillResult {
+	r := OrderBackfillResult{TaskID: taskID, Result: "failed"}
+	var task models.PurchaseTask
+	// SQL errors must not print bound order numbers or the task's address snapshot.
+	db := s.DB.Session(&gorm.Session{Logger: logger.Default.LogMode(logger.Silent)}).WithContext(ctx)
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).First(&task, taskID).Error; err != nil {
+			return purchaseNotFound(err)
+		}
+		if task.DeviceID == nil || *task.DeviceID != deviceID {
+			return fail(CodeBackfillDevice, "任务不属于当前设备")
+		}
+		if batchConflict {
+			return fail(CodeBackfillBatchConflict, "同批任务有不同订单号")
+		}
+		if task.ExecutionMode != models.PurchaseExecutionModeLive || (task.Status != models.PurchaseTaskStatusOrderResultUnknown && task.Status != models.PurchaseTaskStatusOrderCreated) {
+			return fail(CodeStateConflict, "当前任务不允许回填")
+		}
+		if item.PDDOrderNo == "" || strings.TrimSpace(item.PDDOrderNo) != item.PDDOrderNo || utf8.RuneCountInString(item.PDDOrderNo) > 100 || strings.ContainsAny(item.PDDOrderNo, "\r\n\t") {
+			return fail(CodeInvalidRequest, "订单号无效")
+		}
+		if task.PDDOrderNo != nil && *task.PDDOrderNo != "" && *task.PDDOrderNo != item.PDDOrderNo {
+			return fail(CodeBackfillOrderConflict, "已有不同订单号")
+		}
+		// The shared model guard also protects manual resolution and late results.
+		if err := models.CheckPurchaseOrderNumber(tx, taskID, item.PDDOrderNo); err != nil {
+			return err
+		}
+		if task.Status == models.PurchaseTaskStatusOrderCreated {
+			if task.PDDOrderNo == nil || *task.PDDOrderNo != item.PDDOrderNo {
+				return fail(CodeStateConflict, "已创建订单缺少匹配订单号")
+			}
+			r.Result, r.Code = "already_backfilled", "ALREADY_BACKFILLED"
+			return nil
+		}
+		var submitted time.Time
+		source := "page"
+		if item.OrderSubmittedAt != nil {
+			var err error
+			submitted, err = time.Parse(time.RFC3339Nano, *item.OrderSubmittedAt)
+			if err != nil || submitted.IsZero() || submitted.Year() < 1000 || submitted.Year() > 9999 {
+				return fail(CodeOrderTimeInvalid, "下单时间必须为 RFC3339")
+			}
+		} else {
+			if task.IrreversibleAt == nil || task.IrreversibleAt.IsZero() {
+				return fail(CodeOrderTimeMissing, "下单时间和不可逆时间均缺失")
+			}
+			submitted, source = *task.IrreversibleAt, "irreversible_at"
+		}
+		submitted = submitted.UTC()
+		task.PDDOrderNo, task.OrderSubmittedAt = &item.PDDOrderNo, &submitted
+		if err := task.SetStatus(models.PurchaseTaskStatusOrderCreated); err != nil {
+			return internal(err)
+		}
+		task.StatusVersion++
+		task.StatusChangedAt = s.Now()
+		task.ErrorCode, task.ErrorMessage = nil, nil
+		task.LeaseExpiresAt = nil
+		// Reuse the existing resolution request slot. Scope a batch UUID to a
+		// task, and retain provenance without a schema change or replay cache.
+		marker := "backfill:" + source + ":" + uuid.NewSHA1(uuid.NameSpaceOID, []byte(requestID+":"+item.AddressSuffix)).String()
+		task.UnknownResolveRequestID = &marker
+		if err := tx.Save(&task).Error; err != nil {
+			return err
+		}
+		r.Result, r.Code = "backfilled", "BACKFILLED"
+		return nil
+	})
+	if err != nil {
+		r.Result, r.Code = "failed", CodeInternal
+		r.Retryable = true
+		var se *ServiceError
+		if errors.As(err, &se) {
+			r.Code, r.Retryable = se.Code, se.Retryable
+		}
+		if errors.Is(err, models.ErrPurchaseOrderNumberUsed) {
+			r.Code, r.Retryable = CodeBackfillOrderUsed, false
+		}
+		if r.Code == CodeBackfillBatchConflict || r.Code == CodeBackfillOrderConflict || r.Code == CodeBackfillOrderUsed {
+			r.Result = "conflict"
+		}
+	}
+	// Return only this device's committed facts, including on a rejected item.
+	// Never return in-memory changes from a rolled back transaction.
+	saved := task
+	readable := err == nil
+	if !readable {
+		saved = models.PurchaseTask{}
+		readable = db.Where("id = ? AND device_id = ?", taskID, deviceID).First(&saved).Error == nil
+	}
+	if readable {
+		r.Status, r.StatusVersion = saved.Status, saved.StatusVersion
+		r.PDDOrderNo, r.OrderSubmittedAt = saved.PDDOrderNo, saved.OrderSubmittedAt
+		if saved.OrderSubmittedAt != nil {
+			r.TimeSource = "existing_unknown"
+			if saved.UnknownResolveRequestID != nil {
+				if strings.HasPrefix(*saved.UnknownResolveRequestID, "backfill:page:") {
+					r.TimeSource = "page"
+				}
+				if strings.HasPrefix(*saved.UnknownResolveRequestID, "backfill:irreversible_at:") {
+					r.TimeSource = "irreversible_at"
+				}
+			}
+		}
+	}
+	return r
+}

server/app/goauto/purchase/order_backfill_handler.go

@@ -0,0 +1,25 @@
+package purchase
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h Handler) BackfillOrders(c *gin.Context) {
+	var req OrderBackfillRequest
+	if !decode(c, &req) {
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	out, err := s.BackfillOrders(c.Request.Context(), req, bearer(c.GetHeader("Authorization")))
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	c.Header("Cache-Control", "no-store")
+	c.JSON(http.StatusOK, gin.H{"data": out})
+}

server/app/goauto/purchase/order_backfill_test.go

@@ -0,0 +1,498 @@
+package purchase
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"go-admin/app/goauto/device"
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/purchasecontract"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+func backfillTask(t *testing.T, db *gorm.DB, f fixture, status string) models.PurchaseTask {
+	t.Helper()
+	now := testService(db).Now()
+	task := models.PurchaseTask{TaskType: models.PurchaseTaskTypeStock, ExecutionMode: models.PurchaseExecutionModeLive,
+		Status: status, DeviceID: &f.device.ID, PDDProductID: f.pdd.ID, Quantity: 1, Currency: "CNY",
+		CreateRequestID: uuid.NewString(), RuleSnapshot: string(purchasecontract.DefaultLiveRule()),
+		SpecDecisionSnapshot: `{}`, RequiredCapabilitiesJSON: `[]`, IrreversibleAt: &now,
+		ErrorCode: strptr("ORIGINAL_ERROR"), ErrorMessage: strptr("original failure")}
+	if err := db.Create(&task).Error; err != nil {
+		t.Fatal(err)
+	}
+	return task
+}
+
+func strptr(s string) *string { return &s }
+
+func backfillItem(id uint64, order string) OrderBackfillItem {
+	return OrderBackfillItem{AddressSuffix: purchasecontract.AddressSuffix(id), PDDOrderNo: order}
+}
+
+func runBackfill(t *testing.T, s *Service, token, requestID string, items ...OrderBackfillItem) []OrderBackfillResult {
+	t.Helper()
+	out, err := s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: requestID, Items: items}, token)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(out.Items) != len(items) || out.RequestID != requestID {
+		t.Fatalf("bad envelope: %+v", out)
+	}
+	return out.Items
+}
+
+func loadBackfillTask(t *testing.T, db *gorm.DB, id uint64) models.PurchaseTask {
+	t.Helper()
+	var task models.PurchaseTask
+	if err := db.First(&task, id).Error; err != nil {
+		t.Fatal(err)
+	}
+	return task
+}
+
+func TestOrderBackfillMixedBatchAndReplay(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	a.TaskType, a.SYBProductID = models.PurchaseTaskTypeSYBOrder, &f.syb.ID
+	if err := db.Save(&a).Error; err != nil {
+		t.Fatal(err)
+	}
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	c := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	if err := db.Model(&c).Update("irreversible_at", nil).Error; err != nil {
+		t.Fatal(err)
+	}
+	page := backfillItem(b.ID, "ORDER-B")
+	page.OrderSubmittedAt = strptr("2026-09-08T20:30:00+08:00")
+	rid := uuid.NewString()
+	items := []OrderBackfillItem{backfillItem(a.ID, "ORDER-A"), {AddressSuffix: "_cg0", PDDOrderNo: "bad"}, page, backfillItem(c.ID, "ORDER-C"), backfillItem(99999, "missing")}
+	results := runBackfill(t, s, f.token, rid, items...)
+	want := []string{"BACKFILLED", CodeBackfillSuffix, "BACKFILLED", CodeOrderTimeMissing, CodeTaskNotFound}
+	for i, r := range results {
+		if r.Code != want[i] || r.Index != i {
+			t.Fatalf("item %d: %+v", i, r)
+		}
+	}
+	if results[0].TimeSource != "irreversible_at" || !results[0].OrderSubmittedAt.Equal(*a.IrreversibleAt) {
+		t.Fatalf("fallback: %+v", results[0])
+	}
+	if results[2].TimeSource != "page" || results[2].OrderSubmittedAt.Format(time.RFC3339) != "2026-09-08T12:30:00Z" {
+		t.Fatalf("page: %+v", results[2])
+	}
+	saved := loadBackfillTask(t, db, a.ID)
+	if saved.StatusVersion != a.StatusVersion+1 || saved.ErrorCode != nil || saved.ErrorMessage != nil || saved.DeviceRunSlot != nil || saved.AccountRunSlot != nil || saved.ActiveSlot == nil || saved.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatalf("state metadata: %+v", saved)
+	}
+	if saved.PaymentReviewStatus != a.PaymentReviewStatus || saved.LogisticsStatus != a.LogisticsStatus || saved.WritebackStatus != a.WritebackStatus || saved.RuleSnapshot != a.RuleSnapshot {
+		t.Fatal("unrelated business facts changed")
+	}
+	for _, replayID := range []string{rid, uuid.NewString()} {
+		item := items[0]
+		item.OrderSubmittedAt = strptr("2026-09-09T00:00:00Z")
+		r := runBackfill(t, s, f.token, replayID, item)[0]
+		if r.Result != "already_backfilled" || r.TimeSource != "irreversible_at" {
+			t.Fatalf("replay: %+v", r)
+		}
+		if got := loadBackfillTask(t, db, a.ID); !reflect.DeepEqual(saved, got) {
+			t.Fatal("replay changed persisted task")
+		}
+	}
+	if got := loadBackfillTask(t, db, c.ID); got.PDDOrderNo != nil || got.StatusVersion != c.StatusVersion {
+		t.Fatal("missing time wrote data")
+	}
+}
+
+func TestOrderBackfillRejectsOwnershipStatesAndInvalidTime(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	for _, status := range []string{models.PurchaseTaskStatusPending, models.PurchaseTaskStatusRunning, models.PurchaseTaskStatusOrderSubmitStarted, models.PurchaseTaskStatusSpecProbePending, models.PurchaseTaskStatusFailed, models.PurchaseTaskStatusCancelled, models.PurchaseTaskStatusRehearsalCompleted} {
+		task := backfillTask(t, db, f, status)
+		before := loadBackfillTask(t, db, task.ID)
+		r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]
+		if r.Code != CodeStateConflict {
+			t.Fatalf("%s: %+v", status, r)
+		}
+		if got := loadBackfillTask(t, db, task.ID); !reflect.DeepEqual(got, before) {
+			t.Fatal("rejection wrote data")
+		}
+		// Release the fixture's device slot before testing the next running state.
+		if err := task.SetStatus(models.PurchaseTaskStatusCancelled); err != nil {
+			t.Fatal(err)
+		}
+		if err := db.Save(&task).Error; err != nil {
+			t.Fatal(err)
+		}
+	}
+	task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	if err := db.Model(&task).Update("device_id", nil).Error; err != nil {
+		t.Fatal(err)
+	}
+	r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]
+	if r.Code != CodeBackfillDevice || r.Status != "" || r.PDDOrderNo != nil {
+		t.Fatalf("ownership leaked: %+v", r)
+	}
+	other, err := device.NewService(db).Register(context.Background(), device.RegisterRequest{RequestID: uuid.NewString(), InstallID: uuid.NewString(), Name: "Other", Manufacturer: "Test", Model: "Test", AndroidVersion: "15", AgentVersion: "1", PDDVersion: "7", Capabilities: liveCaps()}, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Model(&task).Update("device_id", other.DeviceID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]; r.Code != CodeBackfillDevice {
+		t.Fatalf("cross device: %+v", r)
+	}
+	if err := db.Model(&task).Updates(map[string]any{"device_id": f.device.ID, "execution_mode": models.PurchaseExecutionModeRehearsal}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(task.ID, "ORDER"))[0]; r.Code != CodeStateConflict {
+		t.Fatalf("rehearsal: %+v", r)
+	}
+	if err := db.Model(&task).Update("execution_mode", models.PurchaseExecutionModeLive).Error; err != nil {
+		t.Fatal(err)
+	}
+	for _, raw := range []string{"", "2026-09-08 12:00:00", "0001-01-01T00:00:00Z", "garbage"} {
+		item := backfillItem(task.ID, "ORDER")
+		item.OrderSubmittedAt = &raw
+		if r := runBackfill(t, s, f.token, uuid.NewString(), item)[0]; r.Code != CodeOrderTimeInvalid {
+			t.Fatalf("invalid time: %+v", r)
+		}
+	}
+}
+
+func TestOrderBackfillConflictsNeverOverwrite(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	rid := uuid.NewString()
+	r := runBackfill(t, s, f.token, rid, backfillItem(a.ID, "A"), backfillItem(a.ID, "B"), backfillItem(b.ID, "B"))
+	if r[0].Code != CodeBackfillBatchConflict || r[1].Code != CodeBackfillBatchConflict || r[2].Code != "BACKFILLED" {
+		t.Fatalf("batch: %+v", r)
+	}
+	r = runBackfill(t, s, f.token, rid, backfillItem(a.ID, "B"), backfillItem(b.ID, "C"))
+	if r[0].Code != CodeBackfillOrderUsed || r[1].Code != CodeBackfillOrderConflict {
+		t.Fatalf("changed requestId payload bypassed checks: %+v", r)
+	}
+	if got := loadBackfillTask(t, db, b.ID); *got.PDDOrderNo != "B" || got.StatusVersion != b.StatusVersion+1 {
+		t.Fatal("conflict overwrote")
+	}
+	if got := loadBackfillTask(t, db, a.ID); got.PDDOrderNo != nil {
+		t.Fatal("conflict wrote data")
+	}
+	// Even an unknown task with an existing conflicting value must preserve it.
+	a.PDDOrderNo = strptr("OLD")
+	if err := db.Save(&a).Error; err != nil {
+		t.Fatal(err)
+	}
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(a.ID, "NEW"))[0]; r.Code != CodeBackfillOrderConflict {
+		t.Fatalf("unknown existing: %+v", r)
+	}
+}
+
+func TestOrderBackfillConcurrentResolveUnknown(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	// SQLite serializes transactions through one connection. These concurrent
+	// service calls verify both winner orders; they do not certify MySQL locks.
+	sqlDB, _ := db.DB()
+	sqlDB.SetMaxOpenConns(1)
+	for i := 0; i < 12; i++ {
+		task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+		start := make(chan struct{})
+		var wg sync.WaitGroup
+		wg.Add(2)
+		var out OrderBackfillResponse
+		var backErr, manualErr error
+		go func() {
+			defer wg.Done()
+			<-start
+			out, backErr = s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(task.ID, "BACK-"+purchasecontract.AddressSuffix(task.ID))}}, f.token)
+		}()
+		go func() {
+			defer wg.Done()
+			<-start
+			_, _, manualErr = s.ResolveUnknown(context.Background(), task.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "MANUAL-" + purchasecontract.AddressSuffix(task.ID), OrderSubmittedAt: task.IrreversibleAt})
+		}()
+		close(start)
+		wg.Wait()
+		if backErr != nil {
+			t.Fatal(backErr)
+		}
+		got := loadBackfillTask(t, db, task.ID)
+		if got.StatusVersion != task.StatusVersion+1 || got.Status != models.PurchaseTaskStatusOrderCreated {
+			t.Fatal("competing writes changed version twice")
+		}
+		if manualErr == nil {
+			if out.Items[0].Code != CodeBackfillOrderConflict || !strings.HasPrefix(*got.PDDOrderNo, "MANUAL-") {
+				t.Fatalf("manual winner: %+v", out)
+			}
+		} else if code(manualErr) != CodeStateConflict || out.Items[0].Code != "BACKFILLED" || !strings.HasPrefix(*got.PDDOrderNo, "BACK-") {
+			t.Fatalf("backfill winner: %+v %v", out, manualErr)
+		}
+	}
+}
+
+func TestOrderBackfillConcurrentLateResultAndOtherTask(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	sqlDB, _ := db.DB()
+	sqlDB.SetMaxOpenConns(1)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	attempt := models.PurchaseTaskAttempt{TaskID: a.ID, AttemptID: uuid.NewString(), AttemptNumber: 1, Phase: models.PurchaseAttemptPhasePurchase, Status: models.PurchaseAttemptStatusFailed, DeviceID: &f.device.ID, RuleSnapshotHash: purchaseRuleSnapshotHash(a.RuleSnapshot), SpecDecisionSnapshot: `{}`}
+	if err := db.Omit("Task").Create(&attempt).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.First(&attempt, attempt.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	wg.Add(2)
+	var out OrderBackfillResponse
+	var backErr, lateErr error
+	go func() {
+		defer wg.Done()
+		<-start
+		out, backErr = s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(a.ID, "BACK")}}, f.token)
+	}()
+	go func() {
+		defer wg.Done()
+		<-start
+		_, lateErr = s.SubmitResult(context.Background(), a.ID, ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: attempt.AttemptID, ResultType: "order_created", PDDOrderNo: "LATE", OrderSubmittedAt: a.IrreversibleAt}, f.token)
+	}()
+	close(start)
+	wg.Wait()
+	if backErr != nil || out.Items[0].Code != "BACKFILLED" || code(lateErr) != CodeStateConflict {
+		t.Fatalf("late race: %+v %v %v", out, backErr, lateErr)
+	}
+	var savedAttempt models.PurchaseTaskAttempt
+	if err := db.First(&savedAttempt, attempt.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(savedAttempt, attempt) {
+		t.Fatal("backfill rewrote attempt")
+	}
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	_, _, err := s.ResolveUnknown(context.Background(), b.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "BACK", OrderSubmittedAt: b.IrreversibleAt})
+	if err == nil {
+		t.Fatal("manual path assigned another task's order")
+	}
+	if got := loadBackfillTask(t, db, b.ID); got.PDDOrderNo != nil || got.StatusVersion != b.StatusVersion {
+		t.Fatal("other task changed on conflict")
+	}
+}
+
+func TestOrderBackfillHTTPBoundary(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.POST("/order-backfill", device.RequireAgentHTTPS(false, false), (Handler{DB: db}).BackfillOrders)
+	body, _ := json.Marshal(OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(task.ID, "HTTP")}})
+	for _, test := range []struct {
+		body, token string
+		status      int
+	}{
+		{string(body), "", http.StatusUnauthorized},
+		{`{"requestId":"bad","items":[]}`, f.token, http.StatusUnprocessableEntity},
+		{`{"requestId":"x","address":"forbidden"}`, f.token, http.StatusUnprocessableEntity},
+		{string(body), f.token, http.StatusOK},
+	} {
+		req := httptest.NewRequest(http.MethodPost, "/order-backfill", strings.NewReader(test.body))
+		req.Header.Set("Authorization", "Bearer "+test.token)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, req)
+		if w.Code != test.status {
+			t.Fatalf("HTTP %d: %s", w.Code, w.Body.String())
+		}
+	}
+	_, err := testService(db).BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: make([]OrderBackfillItem, 51)}, f.token)
+	if code(err) != CodeInvalidRequest {
+		t.Fatalf("batch limit: %v", err)
+	}
+}
+
+func TestOrderBackfillConcurrentSameOrderDifferentTasks(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	sqlDB, _ := db.DB()
+	sqlDB.SetMaxOpenConns(1)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	start := make(chan struct{})
+	results := make(chan OrderBackfillResponse, 2)
+	errors := make(chan error, 2)
+	for _, id := range []uint64{a.ID, b.ID} {
+		go func(id uint64) {
+			<-start
+			out, err := s.BackfillOrders(context.Background(), OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(id, "SAME")}}, f.token)
+			results <- out
+			errors <- err
+		}(id)
+	}
+	close(start)
+	codes := make(map[string]int)
+	for i := 0; i < 2; i++ {
+		out := <-results
+		if err := <-errors; err != nil {
+			t.Fatal(err)
+		}
+		codes[out.Items[0].Code]++
+	}
+	if codes["BACKFILLED"] != 1 || codes[CodeBackfillOrderUsed] != 1 {
+		t.Fatalf("concurrent assignments: %+v", codes)
+	}
+	var count int64
+	if err := db.Model(&models.PurchaseTask{}).Where("pdd_order_no = ?", "SAME").Count(&count).Error; err != nil || count != 1 {
+		t.Fatalf("duplicate order: %d %v", count, err)
+	}
+}
+
+func TestOrderBackfillRejectsLateAssignmentOfSameOrder(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	a := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(a.ID, "SHARED"))[0]; r.Code != "BACKFILLED" {
+		t.Fatal(r)
+	}
+	b := backfillTask(t, db, f, models.PurchaseTaskStatusOrderSubmitStarted)
+	lease := s.Now().Add(time.Minute)
+	b.LeaseExpiresAt = &lease
+	if err := db.Save(&b).Error; err != nil {
+		t.Fatal(err)
+	}
+	attempt := models.PurchaseTaskAttempt{TaskID: b.ID, AttemptID: uuid.NewString(), AttemptNumber: 1, Phase: models.PurchaseAttemptPhasePurchase, Status: models.PurchaseAttemptStatusRunning, DeviceID: &f.device.ID, RuleSnapshotHash: purchaseRuleSnapshotHash(b.RuleSnapshot), SpecDecisionSnapshot: `{}`}
+	if err := db.Omit("Task").Create(&attempt).Error; err != nil {
+		t.Fatal(err)
+	}
+	req := ResultRequest{RequestID: uuid.NewString(), TaskAttemptID: attempt.AttemptID, ResultType: "order_created", PDDOrderNo: "SHARED", OrderSubmittedAt: b.IrreversibleAt}
+	out, err := s.SubmitResult(context.Background(), b.ID, req, f.token)
+	if err != nil || out.Status != models.PurchaseTaskStatusOrderResultUnknown {
+		t.Fatalf("conflicting result must commit as unknown: %+v %v", out, err)
+	}
+	got := loadBackfillTask(t, db, b.ID)
+	if got.Status != models.PurchaseTaskStatusOrderResultUnknown || got.StatusVersion != b.StatusVersion+1 || got.PDDOrderNo != nil {
+		t.Fatalf("duplicate assignment was not safely downgraded: %+v", got)
+	}
+	wantMessage := "读到订单号 SHARED，但该号已属于任务 " + taskNumber(a.ID)
+	if got.ErrorCode == nil || *got.ErrorCode != CodeOrderNumberUsed || got.ErrorMessage == nil || *got.ErrorMessage != wantMessage {
+		t.Fatalf("conflict evidence missing: %+v", got)
+	}
+	if got.OrderSubmittedAt == nil || !got.OrderSubmittedAt.Equal(*req.OrderSubmittedAt) || got.IrreversibleAt == nil || got.LeaseExpiresAt != nil || got.DeviceRunSlot != nil || got.AccountRunSlot != nil {
+		t.Fatalf("boundary evidence or released lease missing: %+v", got)
+	}
+	var saved models.PurchaseTaskAttempt
+	if err := db.First(&saved, attempt.ID).Error; err != nil {
+		t.Fatal(err)
+	}
+	if saved.Status != models.PurchaseAttemptStatusFailed || saved.ResultRequestID == nil || *saved.ResultRequestID != req.RequestID || saved.ResultHash == nil || saved.ResultType == nil || *saved.ResultType != "order_created" || saved.FinishedAt == nil || saved.ErrorCode == nil || *saved.ErrorCode != CodeOrderNumberUsed || saved.ErrorMessage == nil || *saved.ErrorMessage != wantMessage {
+		t.Fatalf("attempt result and conflict evidence missing: %+v", saved)
+	}
+	out, err = s.SubmitResult(context.Background(), b.ID, req, f.token)
+	if err != nil || !out.Replayed || out.Status != models.PurchaseTaskStatusOrderResultUnknown || loadBackfillTask(t, db, b.ID).StatusVersion != got.StatusVersion {
+		t.Fatalf("unknown result replay failed: %+v %v", out, err)
+	}
+	owner := loadBackfillTask(t, db, a.ID)
+	if owner.PDDOrderNo == nil || *owner.PDDOrderNo != "SHARED" || owner.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatalf("existing owner changed: %+v", owner)
+	}
+	var count int64
+	if err := db.Model(&models.PurchaseTask{}).Where("pdd_order_no = ?", "SHARED").Count(&count).Error; err != nil || count != 1 {
+		t.Fatalf("duplicate order: %d %v", count, err)
+	}
+	resolved, _, err := s.ResolveUnknown(context.Background(), b.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "CORRECTED", OrderSubmittedAt: req.OrderSubmittedAt})
+	if err != nil || resolved.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatalf("manual resolution unavailable: %+v %v", resolved, err)
+	}
+}
+
+func TestOrderBackfillHTTPTransportPolicy(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	for _, allow := range []string{"false", "true"} {
+		t.Setenv("GOAUTO_ALLOW_INSECURE_AGENT_HTTP", allow)
+		r := gin.New()
+		r.POST("/order-backfill", device.RequireAgentHTTPS(true, false), (Handler{}).BackfillOrders)
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/order-backfill", strings.NewReader(`{}`)))
+		if allow == "false" && w.Code != http.StatusUpgradeRequired {
+			t.Fatalf("HTTPS bypass: %d", w.Code)
+		}
+		if allow == "true" && w.Code == http.StatusUpgradeRequired {
+			t.Fatal("HTTP compatibility broken")
+		}
+	}
+}
+
+func TestOrderBackfillMultiConnectionResolveRace(t *testing.T) {
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	sqlDB, err := db.DB()
+	if err != nil {
+		t.Fatal(err)
+	}
+	sqlDB.SetMaxOpenConns(4)
+	task := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	wg.Add(2)
+	var back OrderBackfillResponse
+	var backErr, manualErr error
+	req := OrderBackfillRequest{RequestID: uuid.NewString(), Items: []OrderBackfillItem{backfillItem(task.ID, "BACK")}}
+	go func() { defer wg.Done(); <-start; back, backErr = s.BackfillOrders(context.Background(), req, f.token) }()
+	go func() {
+		defer wg.Done()
+		<-start
+		_, _, manualErr = s.ResolveUnknown(context.Background(), task.ID, ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "MANUAL", OrderSubmittedAt: task.IrreversibleAt})
+	}()
+	close(start)
+	wg.Wait()
+	// SQLite returns table-lock errors rather than waiting on FOR UPDATE.
+	// Only that documented DB contention or a domain conflict is acceptable;
+	// after the competing calls finish, replay must converge without overwrite.
+	if backErr != nil && !strings.Contains(backErr.Error(), "locked") {
+		t.Fatal(backErr)
+	}
+	if manualErr != nil && code(manualErr) != CodeStateConflict && !strings.Contains(manualErr.Error(), "locked") {
+		t.Fatal(manualErr)
+	}
+	if backErr == nil && back.Items[0].Code != "BACKFILLED" && back.Items[0].Code != CodeBackfillOrderConflict && !(back.Items[0].Code == CodeInternal && back.Items[0].Retryable) {
+		t.Fatalf("unexpected race result: %+v", back)
+	}
+	before := loadBackfillTask(t, db, task.ID)
+	replay := runBackfill(t, s, f.token, req.RequestID, req.Items...)[0]
+	after := loadBackfillTask(t, db, task.ID)
+	if before.PDDOrderNo != nil && !reflect.DeepEqual(before, after) {
+		t.Fatal("replay overwrote the concurrent winner")
+	}
+	if after.StatusVersion != task.StatusVersion+1 || after.Status != models.PurchaseTaskStatusOrderCreated {
+		t.Fatal("race did not converge to a single transition")
+	}
+	if manualErr == nil {
+		if *after.PDDOrderNo != "MANUAL" || replay.Code != CodeBackfillOrderConflict {
+			t.Fatal("manual winner overwritten")
+		}
+	} else if *after.PDDOrderNo != "BACK" || (replay.Code != "BACKFILLED" && replay.Code != "ALREADY_BACKFILLED") {
+		t.Fatalf("backfill did not converge: %+v", replay)
+	}
+}

server/app/goauto/purchase/order_conflict_test.go

@@ -0,0 +1,74 @@
+package purchase
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"go-admin/app/goauto/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+func TestOrderNumberConflictBusinessErrors(t *testing.T) {
+	for _, path := range []string{"resolve_unknown", "cancel", "lifecycle"} {
+		t.Run(path, func(t *testing.T) {
+			db := testDB(t)
+			f := seed(t, db, liveCaps(), true)
+			s := testService(db)
+			owner := backfillTask(t, db, f, models.PurchaseTaskStatusOrderResultUnknown)
+			if r := runBackfill(t, s, f.token, uuid.NewString(), backfillItem(owner.ID, "SHARED"))[0]; r.Code != "BACKFILLED" {
+				t.Fatal(r)
+			}
+			status := models.PurchaseTaskStatusOrderResultUnknown
+			if path == "lifecycle" {
+				status = models.PurchaseTaskStatusRunning
+			}
+			task := backfillTask(t, db, f, status)
+			if path != "resolve_unknown" {
+				// Model legacy duplicate data predating the global save guard.
+				if err := db.Session(&gorm.Session{SkipHooks: true}).Model(&models.PurchaseTask{}).Where("id = ?", task.ID).Updates(map[string]any{"pdd_order_no": "SHARED", "lease_expires_at": s.Now().Add(time.Minute)}).Error; err != nil {
+					t.Fatal(err)
+				}
+			}
+			req := ManualRequest{RequestID: uuid.NewString(), OperatorID: 1, Status: models.PurchaseTaskStatusOrderCreated, PDDOrderNo: "SHARED", OrderSubmittedAt: task.IrreversibleAt, Reason: "人工取消"}
+			var err error
+			switch path {
+			case "resolve_unknown":
+				_, _, err = s.ResolveUnknown(context.Background(), task.ID, req)
+			case "cancel":
+				_, _, err = s.Cancel(context.Background(), task.ID, req)
+			case "lifecycle":
+				attempt := models.PurchaseTaskAttempt{TaskID: task.ID, AttemptID: uuid.NewString(), AttemptNumber: 1, Phase: models.PurchaseAttemptPhasePurchase, Status: models.PurchaseAttemptStatusRunning, DeviceID: &f.device.ID, RuleSnapshotHash: purchaseRuleSnapshotHash(task.RuleSnapshot), SpecDecisionSnapshot: `{}`}
+				if e := db.Omit("Task").Create(&attempt).Error; e != nil {
+					t.Fatal(e)
+				}
+				_, err = s.MarkOrderSubmitStarted(context.Background(), task.ID, ActionRequest{RequestID: req.RequestID}, f.token)
+			}
+			want := "订单号已属于任务 " + taskNumber(owner.ID)
+			if code(err) != CodeOrderNumberUsed || err.Error() != want {
+				t.Fatalf("unmapped conflict: %v", err)
+			}
+			w := httptest.NewRecorder()
+			c, _ := gin.CreateTestContext(w)
+			writeError(c, err)
+			var body struct {
+				Code      string `json:"code"`
+				Message   string `json:"message"`
+				Retryable bool   `json:"retryable"`
+			}
+			if e := json.Unmarshal(w.Body.Bytes(), &body); e != nil || w.Code != http.StatusConflict || body.Code != CodeOrderNumberUsed || body.Message != want || body.Retryable {
+				t.Fatalf("unexpected HTTP error: %d %s (%v)", w.Code, w.Body.String(), e)
+			}
+			got := loadBackfillTask(t, db, task.ID)
+			if got.Status != status || got.StatusVersion != task.StatusVersion || got.UnknownResolveRequestID != nil || got.CancelRequestID != nil || got.OrderSubmitRequestID != nil {
+				t.Fatalf("rejected mutation persisted: %+v", got)
+			}
+		})
+	}
+}

server/app/goauto/purchase/router.go

@@ -18,6 +18,7 @@ func InitRouter(engine *gin.Engine, auth *jwt.GinJWTMiddleware) {
 	agent := engine.Group("/api/agent/v1/purchase-tasks").Use(device.RequireAgentHTTPS(config.ApplicationConfig.Mode == "prod", trust))
 	agent.GET("", h.AgentHistory)
 	agent.GET("/next", h.Next)
+	agent.POST("/order-backfill", h.BackfillOrders)
 	agent.GET("/:taskId", h.AgentHistoryDetail)
 	agent.POST("/:taskId/retry", h.AgentRetry)
 	agent.POST("/:taskId/reset", h.AgentReset)

server/app/goauto/purchase/types.go

@@ -22,6 +22,7 @@ const (
 	CodeRetryStale          = "PURCHASE_RETRY_STALE"
 	CodeSpecReprobeRejected = "PURCHASE_SPEC_REPROBE_REJECTED"
 	CodeOrderResultUnknown  = "PURCHASE_ORDER_RESULT_UNKNOWN"
+	CodeOrderNumberUsed     = "PURCHASE_ORDER_NUMBER_ALREADY_USED"
 	CodeOrderEmptyTimeout   = "PURCHASE_ORDER_EMPTY_TIMEOUT"
 	CodeOrderChooserBack    = "PURCHASE_ORDER_CHOOSER_BACK_FAILED"
 	CodeOrderWechatRestore  = "PURCHASE_ORDER_WECHAT_RESTORE_FAILED"

server/app/goauto/purchasecontract/address_suffix_test.go

@@ -0,0 +1,17 @@
+package purchasecontract
+
+import "testing"
+
+func TestParseAddressSuffix(t *testing.T) {
+	for _, id := range []uint64{7, 72, ^uint64(0)} {
+		got, err := ParseAddressSuffix(AddressSuffix(id))
+		if err != nil || got != id {
+			t.Fatalf("id=%d got=%d err=%v", id, got, err)
+		}
+	}
+	for _, raw := range []string{"", "_cg", "_cg0", "_cg00", "_cg07", "_cg+7", "_cg-7", "_cg18446744073709551616", "_CG7", "_cg7x", "_cg7_cg72", "address_cg7", " _cg7", "_cg7 ", "_cg７", "_cg7\n"} {
+		if id, err := ParseAddressSuffix(raw); err == nil || id != 0 {
+			t.Errorf("accepted %q: %d", raw, id)
+		}
+	}
+}

server/app/goauto/purchasecontract/contract.go

@@ -9,6 +9,7 @@ import (
 	"math"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 	"unicode/utf8"
 )
@@ -360,6 +361,18 @@ func RequiredCapabilities(rule RuleSnapshot) []string {
 
 func AddressSuffix(taskID uint64) string { return fmt.Sprintf("_cg%d", taskID) }
 
+// ParseAddressSuffix accepts only the exact canonical suffix, never an address.
+func ParseAddressSuffix(suffix string) (uint64, error) {
+	if !strings.HasPrefix(suffix, "_cg") {
+		return 0, errors.New("invalid address suffix")
+	}
+	id, err := strconv.ParseUint(strings.TrimPrefix(suffix, "_cg"), 10, 64)
+	if err != nil || id == 0 || AddressSuffix(id) != suffix {
+		return 0, errors.New("invalid address suffix")
+	}
+	return id, nil
+}
+
 func ensureEOF(decoder *json.Decoder) error {
 	var extra any
 	if err := decoder.Decode(&extra); err != io.EOF {

server/app/goauto/sybimport/import_handler.go

@@ -171,6 +171,9 @@ func runImport(db *gorm.DB, runID uint64, request ImportRequest, settings config
 	status := SyncRunSucceeded
 	if err != nil {
 		status = SyncRunFailed
+		if report.Created+report.Updated > 0 {
+			status = SyncRunPartial
+		}
 	}
 	finishCtx, finishCancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer finishCancel()

server/app/goauto/sybimport/pagination_overlap_test.go

@@ -4,44 +4,9 @@ import (
 	"context"
 	"strings"
 	"testing"
-	"time"
 )
 
-func freezePaginationToday(t *testing.T) {
-	t.Helper()
-	previous := syncNow
-	syncNow = func() time.Time { return time.Date(2026, 8, 29, 12, 0, 0, 0, time.FixedZone("Asia/Shanghai", 8*60*60)) }
-	t.Cleanup(func() { syncNow = previous })
-}
-
-func TestTodayCrossPageOverlapRestartsWithIndependentIDs(t *testing.T) {
-	freezePaginationToday(t)
-	f := &fakeSYB{perDay: map[string]int{"2026-08-29": 4}}
-	f.pageIDs = func(_ string, start, call int) []int64 {
-		if call == 2 {
-			return []int64{1001, 1002}
-		}
-		if call > 2 {
-			return []int64{int64(2000 + start), int64(2001 + start)}
-		}
-		return nil
-	}
-	rows, err := loadDailyListWithRecovery(context.Background(), newSyncClient(t, f), "2026-08-29", 2, 4, 100)
-	if err != nil || len(rows) != 4 || f.listTotalCalls != 2 {
-		t.Fatalf("rows=%d totals=%d err=%v", len(rows), f.listTotalCalls, err)
-	}
-	if got := strings.Join(f.listCalls, ","); got != "2026-08-29:0,2026-08-29:2,2026-08-29:0,2026-08-29:2" {
-		t.Fatalf("did not restart at first page: %s", got)
-	}
-	for index, row := range rows {
-		if row.ID != int64(2000+index) {
-			t.Fatal("rows leaked from abandoned attempt")
-		}
-	}
-}
-
-func TestTodayPersistentOverlapPreservesYesterdayButDoesNotImportToday(t *testing.T) {
-	freezePaginationToday(t)
+func TestTodayOverlapPreservesCommittedPagesWithoutImportingOverlappingPage(t *testing.T) {
 	f := &fakeSYB{perDay: map[string]int{"2026-08-28": 2, "2026-08-29": 4}}
 	f.pageIDs = func(date string, start, _ int) []int64 {
 		if date == "2026-08-29" && start == 2 {
@@ -54,7 +19,7 @@ func TestTodayPersistentOverlapPreservesYesterdayButDoesNotImportToday(t *testin
 	if err == nil {
 		t.Fatal("overlap was treated as successful sync")
 	}
-	for _, token := range []string{"连续 3 次", "跨页重复", "firstPage=1", "firstRow=2", "page=2", "row=1", "start=2", "pageSize=2", "expectedTotal=4", "unique=2"} {
+	for _, token := range []string{"跨页重复", "firstPage=1", "firstRow=2", "page=2", "row=1", "start=2", "pageSize=2", "expectedTotal=4", "unique=2"} {
 		if !strings.Contains(err.Error(), token) {
 			t.Fatalf("missing %s in %v", token, err)
 		}
@@ -62,7 +27,7 @@ func TestTodayPersistentOverlapPreservesYesterdayButDoesNotImportToday(t *testin
 	if strings.Contains(err.Error(), "1001") || strings.Contains(err.Error(), "已保存") {
 		t.Fatalf("unsafe diagnosis/degraded save: %v", err)
 	}
-	if len(f.listCalls) != 7 || f.detailCalls != 1 || report.OrderCount != 2 {
+	if len(f.listCalls) != 3 || f.detailCalls != 2 || report.OrderCount != 4 || report.Created != 2 || report.Updated != 2 {
 		t.Fatalf("unexpected retry/import boundary: pages=%d details=%d orders=%d", len(f.listCalls), f.detailCalls, report.OrderCount)
 	}
 	var count int64
@@ -72,7 +37,6 @@ func TestTodayPersistentOverlapPreservesYesterdayButDoesNotImportToday(t *testin
 }
 
 func TestPaginationHardErrorsDoNotUseOverlapRecovery(t *testing.T) {
-	freezePaginationToday(t)
 	for _, tc := range []struct {
 		name, date, message string
 		page                int
@@ -92,7 +56,7 @@ func TestPaginationHardErrorsDoNotUseOverlapRecovery(t *testing.T) {
 				}
 				return nil
 			}
-			rows, err := loadDailyListWithRecovery(context.Background(), newSyncClient(t, f), tc.date, 2, 4, 100)
+			rows, err := loadDailyList(context.Background(), newSyncClient(t, f), tc.date, 2, 4)
 			if rows != nil || err == nil || !strings.Contains(err.Error(), tc.message) || len(f.listCalls) != tc.calls || f.listTotalCalls != 0 {
 				t.Fatalf("unexpected recovery: rows=%d pages=%d totals=%d err=%v", len(rows), len(f.listCalls), f.listTotalCalls, err)
 			}

server/app/goauto/sybimport/sync.go

@@ -41,8 +41,7 @@ const (
 	// maxSyncDays bounds one request's window. It is a guard against a typo in
 	// the date range turning into tens of thousands of remote reads before
 	// MaxMatches trips.
-	maxSyncDays              = 31
-	maxTodaySnapshotAttempts = 3
+	maxSyncDays = 31
 )
 
 // SyncReport summarises one sync run.
@@ -82,8 +81,6 @@ type SyncProgress struct {
 	DaysProcessed int
 }
 
-var syncNow = time.Now
-
 type ProgressFunc func(SyncProgress) error
 
 type snapshotDriftError struct {
@@ -94,14 +91,6 @@ type snapshotDriftError struct {
 
 func (err *snapshotDriftError) Error() string { return err.message }
 
-func shanghaiToday() string {
-	location, err := time.LoadLocation("Asia/Shanghai")
-	if err != nil {
-		location = time.FixedZone("Asia/Shanghai", 8*60*60)
-	}
-	return syncNow().In(location).Format("2006-01-02")
-}
-
 // Sync pulls every shipment order in [dateFrom, dateTo] and folds each detail
 // line into the SYB/Shopee archive through ApplyDetail.
 //
@@ -109,16 +98,10 @@ func shanghaiToday() string {
 // a separate concern (see Connect); a session that dies mid-run surfaces as
 // sybclient.ErrSessionInvalid and is treated like any other mid-run failure.
 //
-// `[必须]` Failure stops the run immediately. Rows already written are NOT
-// rolled back — ApplyDetail is idempotent on (order_code, detail_id), so a
-// re-run overwrites them rather than duplicating. What must not happen is
-// reporting a partial run as a complete one, which would let the missing
-// orders go unnoticed forever.
-//
-// `[必须]` Every day is verified for completeness before anything is written:
-// the per-day total is re-read after paging and must not have drifted. SYB's
-// list endpoint returns the *page* size in `total` (§4.3, confirmed against
-// live data), so the paging loop is driven by listTotal, never by list.total.
+// Each validated page is committed independently. Date-local read failures
+// preserve committed pages and allow later dates to run. Database, cancellation
+// and progress persistence failures stop the run. Completeness is verified at
+// the end of each date; partial results must never be reported as full success.
 func Sync(ctx context.Context, db *gorm.DB, client *sybclient.Client, cfg SyncConfig, dateFrom, dateTo string) (SyncReport, error) {
 	return SyncWithProgress(ctx, db, client, cfg, dateFrom, dateTo, nil)
 }
@@ -190,106 +173,38 @@ func SyncWithShopSnapshot(ctx context.Context, db *gorm.DB, client *sybclient.Cl
 		plans = append(plans, dayPlan{date: date, total: total})
 	}
 
-	for dayIndex, plan := range plans {
-		if plan.total == 0 {
-			if err := emit(dayIndex + 1); err != nil {
-				return report, err
-			}
-			continue
-		}
-		// `[必须]` Completeness first, filtering second. loadDailyList proves the
-		// day's snapshot is whole; filtering before that would let drift among
-		// other shops' orders hide a hole in the ones we do want
-		// (docs/12-syb-erp-interface.md §8).
-		rows, listErr := loadDailyListWithRecovery(ctx, client, plan.date, pageSize, plan.total, maxMatches)
-		if listErr != nil && len(rows) == 0 {
-			return report, listErr
-		}
-		report.OrderCount += len(rows)
-
-		byID := make(map[int64]sybclient.StockRow, len(rows))
-		ids := make([]int64, 0, len(rows))
-		for _, row := range rows {
-			name := stringField(row.Raw, "shopName")
-			label := name
-			if sybshop.IsBlank(label) {
-				label = "(无店铺名)"
-			}
-			display, ok := allowed[sybshop.Normalize(name)]
-			if ok {
-				label = display
-			}
-			if !ok {
-				entry := report.ShopBreakdown[label]
-				entry.Skipped++
-				report.ShopBreakdown[label] = entry
-				report.ShopSkipped++
-				continue
-			}
-			entry := report.ShopBreakdown[label]
-			entry.Accepted++
-			report.ShopBreakdown[label] = entry
-			report.AcceptedCount++
-			byID[row.ID] = row
-			ids = append(ids, row.ID)
-		}
-		if len(ids) == 0 {
-			if err := emit(dayIndex + 1); err != nil {
-				return report, err
-			}
-			continue
-		}
-
-		for start := 0; start < len(ids); start += detailBatch {
-			end := start + detailBatch
-			if end > len(ids) {
-				end = len(ids)
-			}
-			batch := ids[start:end]
-			details, err := client.DetailListByStock(ctx, batch)
-			if err != nil {
-				return report, fmt.Errorf("拉取 %s 货运单明细失败（本次同步停止；"+
-					"已写入的数据保留，重跑会按 (order_code, detail_id) 覆盖）: %w", plan.date, err)
-			}
-			if err := validateDetailBatch(batch, details); err != nil {
-				return report, fmt.Errorf("%s 货运单明细不完整：%w；本次同步停止", plan.date, err)
-			}
-			for _, detail := range details {
-				// `[必须]` Re-check the shop on the detail response. The list said
-				// this order belongs to an enabled shop; if the detail disagrees,
-				// the two views are inconsistent and importing it would write a
-				// row for a shop nobody enabled.
-				name := stringField(detail.Raw, "shopName")
-				if sybshop.IsBlank(name) {
-					moveAcceptedToSkipped(&report, stringField(byID[detail.ID].Raw, "shopName"), "(无店铺名)", allowed)
-					report.AcceptedCount--
-					report.ShopSkipped++
-					continue
-				}
-				if _, ok := allowed[sybshop.Normalize(name)]; !ok {
-					moveAcceptedToSkipped(&report, stringField(byID[detail.ID].Raw, "shopName"), name, allowed)
-					report.AcceptedCount--
-					report.ShopSkipped++
-					continue
-				}
-				if err := applyStockDetail(ctx, db, byID[detail.ID], detail, &report); err != nil {
-					return report, err
-				}
-			}
-			if err := emit(dayIndex); err != nil {
-				return report, err
-			}
-		}
-		if listErr != nil {
-			return report, listErr
-		}
-		if err := emit(dayIndex + 1); err != nil {
+	daysCompleted := 0
+	var failures []error
+	for _, plan := range plans {
+		if err := ctx.Err(); err != nil {
 			return report, err
 		}
+		_, dayErr := loadDailyList(ctx, client, plan.date, pageSize, plan.total, func(rows []sybclient.StockRow, page int) error {
+			report.OrderCount += len(rows)
+			err := importSyncPage(ctx, db, client, rows, allowed, &report)
+			if err != nil {
+				return fmt.Errorf("%s 第 %d 页明细/入库阶段失败: %w", plan.date, page, err)
+			}
+			if err := emit(daysCompleted); err != nil {
+				return &syncFatalError{err}
+			}
+			return nil
+		})
+		if dayErr != nil {
+			failures = append(failures, dayErr)
+			var fatal *syncFatalError
+			if ctx.Err() != nil || errors.As(dayErr, &fatal) || errors.Is(dayErr, sybclient.ErrSessionInvalid) {
+				return report, errors.Join(failures...)
+			}
+			continue
+		}
+		daysCompleted++
+		if err := emit(daysCompleted); err != nil {
+			return report, errors.Join(append(failures, err)...)
+		}
 	}
-
 	report.FinishedAt = time.Now().UTC()
-	return report, nil
+	return report, errors.Join(failures...)
 }
 
 func shopSnapshotNames(allowed map[string]string) []string {
@@ -336,39 +251,7 @@ func moveAcceptedToSkipped(report *SyncReport, listName, detailName string, allo
 // `[必须]` The loop bound comes from expectedTotal (listTotal), because
 // list.total is the current page's row count, not the filtered total (§4.3).
 // Driving the loop with the response's own total would stop after page one.
-func loadDailyListWithRecovery(ctx context.Context, client *sybclient.Client, date string, pageSize, expectedTotal, maxMatches int) ([]sybclient.StockRow, error) {
-	if date != shanghaiToday() {
-		return loadDailyList(ctx, client, date, pageSize, expectedTotal)
-	}
-	var last *snapshotDriftError
-	for attempt := 1; attempt <= maxTodaySnapshotAttempts; attempt++ {
-		if attempt > 1 {
-			total, err := client.ListTotal(ctx, date, date, pageSize)
-			if err != nil {
-				return nil, fmt.Errorf("重新查询今天 %s 货运单总数失败: %w", date, err)
-			}
-			if total > maxMatches {
-				return nil, fmt.Errorf("今天 %s 的货运单总数 %d 超过单次同步上限 %d", date, total, maxMatches)
-			}
-			expectedTotal = total
-		}
-		rows, err := loadDailyList(ctx, client, date, pageSize, expectedTotal)
-		if err == nil {
-			return rows, nil
-		}
-		var drift *snapshotDriftError
-		if !errors.As(err, &drift) {
-			return nil, fmt.Errorf("今天第 %d/%d 次拉取失败: %w", attempt, maxTodaySnapshotAttempts, err)
-		}
-		last = drift
-	}
-	if last != nil && last.valid && len(last.rows) > 0 {
-		return last.rows, fmt.Errorf("今天持续变化，已保存本次取得的完整明细，但未形成稳定快照；下次同步继续覆盖: %w", last)
-	}
-	return nil, fmt.Errorf("今天持续变化，连续 %d 次未形成稳定快照，本次同步停止: %w", maxTodaySnapshotAttempts, last)
-}
-
-func loadDailyList(ctx context.Context, client *sybclient.Client, date string, pageSize, expectedTotal int) ([]sybclient.StockRow, error) {
+func loadDailyList(ctx context.Context, client *sybclient.Client, date string, pageSize, expectedTotal int, consume ...func([]sybclient.StockRow, int) error) ([]sybclient.StockRow, error) {
 	rows := make([]sybclient.StockRow, 0, expectedTotal)
 	type position struct{ page, row int }
 	seen := make(map[int64]position, expectedTotal)
@@ -413,6 +296,11 @@ func loadDailyList(ctx context.Context, client *sybclient.Client, date string, p
 		if len(page) != expectedPageCount {
 			return nil, &snapshotDriftError{message: fmt.Sprintf("%s 货运单列表第 %d 页不完整且相对初始总数发生变化：预期 %d 行，实际 %d 行", date, pageIndex, expectedPageCount, len(page)), rows: rows, valid: len(page) > expectedPageCount}
 		}
+		if len(consume) > 0 {
+			if err := consume[0](page, pageIndex); err != nil {
+				return nil, err
+			}
+		}
 	}
 
 	// Re-read the total: if it moved while we paged, some order was inserted or

server/app/goauto/sybimport/sync_page.go

@@ -0,0 +1,83 @@
+package sybimport
+
+import (
+	"context"
+	"go-admin/app/goauto/sybclient"
+	"go-admin/app/goauto/sybshop"
+	"gorm.io/gorm"
+)
+
+// Database/progress errors stop the entire run, not merely the current date.
+type syncFatalError struct{ error }
+
+func (e *syncFatalError) Unwrap() error { return e.error }
+
+// Read all remote details before opening a page transaction. Publish counters
+// only after commit, so a rollback never reports records as saved.
+func importSyncPage(ctx context.Context, db *gorm.DB, client *sybclient.Client, rows []sybclient.StockRow, allowed map[string]string, report *SyncReport) error {
+	next := *report
+	next.ShopBreakdown = make(map[string]ShopBreakdown, len(report.ShopBreakdown))
+	for k, v := range report.ShopBreakdown {
+		next.ShopBreakdown[k] = v
+	}
+	byID := make(map[int64]sybclient.StockRow)
+	var ids []int64
+	for _, row := range rows {
+		name := stringField(row.Raw, "shopName")
+		label := name
+		if sybshop.IsBlank(label) {
+			label = "(无店铺名)"
+		}
+		display, ok := allowed[sybshop.Normalize(name)]
+		if ok {
+			label = display
+		}
+		entry := next.ShopBreakdown[label]
+		if ok {
+			entry.Accepted++
+			next.AcceptedCount++
+			ids = append(ids, row.ID)
+			byID[row.ID] = row
+		} else {
+			entry.Skipped++
+			next.ShopSkipped++
+		}
+		next.ShopBreakdown[label] = entry
+	}
+	var details []sybclient.StockDetail
+	for start := 0; start < len(ids); start += detailBatch {
+		end := start + detailBatch
+		if end > len(ids) {
+			end = len(ids)
+		}
+		batch, err := client.DetailListByStock(ctx, ids[start:end])
+		if err != nil {
+			return err
+		}
+		if err := validateDetailBatch(ids[start:end], batch); err != nil {
+			return err
+		}
+		details = append(details, batch...)
+	}
+	err := db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		for _, detail := range details {
+			name := stringField(detail.Raw, "shopName")
+			_, ok := allowed[sybshop.Normalize(name)]
+			if sybshop.IsBlank(name) || !ok {
+				moveAcceptedToSkipped(&next, stringField(byID[detail.ID].Raw, "shopName"), name, allowed)
+				next.AcceptedCount--
+				next.ShopSkipped++
+				continue
+			}
+			if err := applyStockDetail(ctx, tx, byID[detail.ID], detail, &next); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return &syncFatalError{err}
+	}
+	*report = next
+	return nil
+}

server/app/goauto/sybimport/sync_page_test.go

@@ -0,0 +1,117 @@
+package sybimport
+
+import (
+	"context"
+	"errors"
+	"go-admin/app/goauto/models"
+	"strings"
+	"testing"
+)
+
+func TestPageFailurePreservesEarlierPagesContinuesDatesAndRerunsIdempotently(t *testing.T) {
+	db := newSyncTestDB(t)
+	f := &fakeSYB{perDay: map[string]int{"2026-08-01": 3, "2026-08-02": 1}, shortPageAtIndex: 2}
+	var last SyncProgress
+	report, err := SyncWithProgress(context.Background(), db, newSyncClient(t, f), SyncConfig{PageSize: 2, MaxMatches: 100}, "2026-08-01", "2026-08-02", func(p SyncProgress) error { last = p; return nil })
+	if err == nil || !strings.Contains(err.Error(), "第 2 页") || report.Created != 2 || report.Updated != 1 || last.DaysProcessed != 1 {
+		t.Fatalf("report=%+v progress=%+v err=%v", report, last, err)
+	}
+	var count int64
+	db.Model(&models.SYBProduct{}).Count(&count)
+	if count != 2 {
+		t.Fatal(count)
+	}
+	f.shortPageAtIndex = 0
+	report, err = Sync(context.Background(), db, newSyncClient(t, f), SyncConfig{PageSize: 2, MaxMatches: 100}, "2026-08-01", "2026-08-02")
+	if err != nil || report.Created != 1 || report.Updated != 3 {
+		t.Fatalf("rerun=%+v err=%v", report, err)
+	}
+	db.Model(&models.SYBProduct{}).Count(&count)
+	if count != 3 {
+		t.Fatal(count)
+	}
+}
+
+func TestPageTransactionRollbackDoesNotPublishCountersAndStopsDates(t *testing.T) {
+	db := newSyncTestDB(t)
+	if err := db.Exec("CREATE TRIGGER reject_second BEFORE INSERT ON syb_product WHEN NEW.detail_id = 10011 BEGIN SELECT RAISE(ABORT, 'test database failure'); END").Error; err != nil {
+		t.Fatal(err)
+	}
+	f := &fakeSYB{perDay: map[string]int{"2026-08-01": 3, "2026-08-02": 1}}
+	report, err := Sync(context.Background(), db, newSyncClient(t, f), SyncConfig{PageSize: 2, MaxMatches: 100}, "2026-08-01", "2026-08-02")
+	var fatal *syncFatalError
+	if !errors.As(err, &fatal) || report.Created != 0 || report.DetailCount != 0 || len(f.listCalls) != 1 {
+		t.Fatalf("report=%+v calls=%v err=%v", report, f.listCalls, err)
+	}
+	var count int64
+	db.Model(&models.SYBProduct{}).Count(&count)
+	if count != 0 {
+		t.Fatal(count)
+	}
+}
+
+func TestPageProgressFailureStopsAfterCommittedPage(t *testing.T) {
+	db := newSyncTestDB(t)
+	f := &fakeSYB{perDay: map[string]int{"2026-08-01": 3, "2026-08-02": 1}}
+	calls := 0
+	report, err := SyncWithProgress(context.Background(), db, newSyncClient(t, f), SyncConfig{PageSize: 2, MaxMatches: 100}, "2026-08-01", "2026-08-02", func(SyncProgress) error {
+		calls++
+		if calls == 2 {
+			return errors.New("progress unavailable")
+		}
+		return nil
+	})
+	if err == nil || report.Created != 2 || len(f.listCalls) != 1 {
+		t.Fatalf("report=%+v err=%v", report, err)
+	}
+}
+
+func TestPageMissingDetailPreservesPriorPageAndContinuesNextDate(t *testing.T) {
+	db := newSyncTestDB(t)
+	f := &fakeSYB{perDay: map[string]int{"2026-08-01": 3, "2026-08-02": 1}, detailDropID: 1002}
+	report, err := Sync(context.Background(), db, newSyncClient(t, f), SyncConfig{PageSize: 2, MaxMatches: 100}, "2026-08-01", "2026-08-02")
+	if err == nil || report.Created != 2 || report.Updated != 1 || report.OrderCount != 4 || len(f.listCalls) != 3 {
+		t.Fatalf("report=%+v err=%v", report, err)
+	}
+}
+
+func TestPageCancellationPreservesCommitAndStopsNextPage(t *testing.T) {
+	db := newSyncTestDB(t)
+	f := &fakeSYB{perDay: map[string]int{"2026-08-01": 3, "2026-08-02": 1}}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	report, err := SyncWithProgress(ctx, db, newSyncClient(t, f), SyncConfig{PageSize: 2, MaxMatches: 100}, "2026-08-01", "2026-08-02", func(p SyncProgress) error {
+		if p.Report.Created > 0 {
+			cancel()
+		}
+		return nil
+	})
+	if !errors.Is(err, context.Canceled) || report.Created != 2 || len(f.listCalls) != 1 {
+		t.Fatalf("report=%+v err=%v", report, err)
+	}
+}
+
+func TestPartialFinishPreservesProgressReleasesSlotAndIsFilterable(t *testing.T) {
+	db := newSyncTestDB(t)
+	ctx := context.Background()
+	s := NewSyncRunService(db)
+	run, err := s.Create(ctx, CreateSyncRunInput{DateFrom: "2026-08-01", DateTo: "2026-08-02"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	report := SyncReport{Created: 2, DetailCount: 2, ShopBreakdown: map[string]ShopBreakdown{}}
+	if err := s.UpdateProgress(ctx, run.ID, SyncProgress{Report: report, DaysTotal: 2, DaysProcessed: 1}); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Finish(ctx, run.ID, SyncRunPartial, report, errors.New("第 2 页失败")); err != nil {
+		t.Fatal(err)
+	}
+	row, err := s.Detail(ctx, run.ID)
+	if err != nil || row.Status != SyncRunPartial || row.ActiveSlot != nil || row.ProgressPercent != 50 || row.Created != 2 {
+		t.Fatalf("row=%+v err=%v", row, err)
+	}
+	result, err := s.List(ctx, SyncRunListRequest{Page: 1, PageSize: 20, Status: SyncRunPartial})
+	if err != nil || result.Total != 1 {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+}

server/app/goauto/sybimport/sync_run.go

@@ -18,6 +18,7 @@ import (
 const (
 	SyncRunRunning     = "running"
 	SyncRunSucceeded   = "succeeded"
+	SyncRunPartial     = "partial_success"
 	SyncRunFailed      = "failed"
 	SyncRunInterrupted = "interrupted"
 )
@@ -75,7 +76,7 @@ func (s *SyncRunService) UpdateProgress(ctx context.Context, id uint64, progress
 }
 
 func (s *SyncRunService) Finish(ctx context.Context, id uint64, status string, report SyncReport, runErr error) error {
-	if status != SyncRunSucceeded && status != SyncRunFailed {
+	if status != SyncRunSucceeded && status != SyncRunPartial && status != SyncRunFailed {
 		return fmt.Errorf("invalid terminal sync status %q", status)
 	}
 	payload, err := marshalSyncRunPayload(report.ShopBreakdown, report.ShopFilterSnapshot)

server/app/goauto/sybimport/sync_run_handler.go

@@ -20,7 +20,7 @@ func (handler Handler) ListSyncRuns(c *gin.Context) {
 		return
 	}
 	status := strings.TrimSpace(c.Query("status"))
-	if status != "" && status != SyncRunRunning && status != SyncRunSucceeded && status != SyncRunFailed && status != SyncRunInterrupted {
+	if status != "" && status != SyncRunRunning && status != SyncRunSucceeded && status != SyncRunPartial && status != SyncRunFailed && status != SyncRunInterrupted {
 		writeError(c, invalidRequest("status 无效"))
 		return
 	}

server/app/goauto/sybimport/sync_run_handler_test.go

@@ -36,4 +36,12 @@ func TestSyncRunListAndDetailHandlers(t *testing.T) {
 	if detail.Code != http.StatusOK || !strings.Contains(detail.Body.String(), `"operatorName":"管理员"`) {
 		t.Fatalf("详情响应不正确: %d %s", detail.Code, detail.Body.String())
 	}
+	if err := NewSyncRunService(db).Finish(context.Background(), run.ID, SyncRunPartial, SyncReport{Created: 1}, nil); err != nil {
+		t.Fatal(err)
+	}
+	partial := httptest.NewRecorder()
+	engine.ServeHTTP(partial, httptest.NewRequest(http.MethodGet, "/sync-runs?status=partial_success", nil))
+	if partial.Code != http.StatusOK || !strings.Contains(partial.Body.String(), `"total":1`) {
+		t.Fatalf("partial filter: %d %s", partial.Code, partial.Body.String())
+	}
 }

server/app/goauto/sybimport/sync_test.go

@@ -9,7 +9,6 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
-	"time"
 
 	"go-admin/app/goauto/migrations"
 	"go-admin/app/goauto/models"
@@ -276,39 +275,6 @@ func TestSyncStopsWhenTotalDriftsDuringPaging(t *testing.T) {
 	}
 }
 
-func TestTodaySnapshotDriftRetriesFromFirstPage(t *testing.T) {
-	originalNow := syncNow
-	syncNow = func() time.Time { return time.Date(2026, 8, 29, 12, 0, 0, 0, time.FixedZone("Asia/Shanghai", 8*60*60)) }
-	t.Cleanup(func() { syncNow = originalNow })
-	f := &fakeSYB{perDay: map[string]int{"2026-08-29": 10}, totalOverride: map[int]int{1: 11, 2: 10, 3: 10}}
-	rows, err := loadDailyListWithRecovery(context.Background(), newSyncClient(t, f), "2026-08-29", 10, 10, 1000)
-	if err != nil || len(rows) != 10 || f.listTotalCalls != 3 {
-		t.Fatalf("rows=%d totalCalls=%d err=%v", len(rows), f.listTotalCalls, err)
-	}
-}
-
-func TestTodayThirdDriftReturnsValidLastListForDegradedSave(t *testing.T) {
-	originalNow := syncNow
-	syncNow = func() time.Time { return time.Date(2026, 8, 29, 12, 0, 0, 0, time.FixedZone("Asia/Shanghai", 8*60*60)) }
-	t.Cleanup(func() { syncNow = originalNow })
-	f := &fakeSYB{perDay: map[string]int{"2026-08-29": 10}, totalOverride: map[int]int{1: 11, 2: 10, 3: 11, 4: 10, 5: 11}}
-	rows, err := loadDailyListWithRecovery(context.Background(), newSyncClient(t, f), "2026-08-29", 10, 10, 1000)
-	if err == nil || len(rows) != 10 || !strings.Contains(err.Error(), "已保存本次取得的完整明细") {
-		t.Fatalf("rows=%d err=%v", len(rows), err)
-	}
-}
-
-func TestHistoricalSnapshotDriftDoesNotRetry(t *testing.T) {
-	originalNow := syncNow
-	syncNow = func() time.Time { return time.Date(2026, 8, 29, 12, 0, 0, 0, time.FixedZone("Asia/Shanghai", 8*60*60)) }
-	t.Cleanup(func() { syncNow = originalNow })
-	f := &fakeSYB{perDay: map[string]int{"2026-08-28": 10}, totalOverride: map[int]int{1: 11}}
-	rows, err := loadDailyListWithRecovery(context.Background(), newSyncClient(t, f), "2026-08-28", 10, 10, 1000)
-	if err == nil || rows != nil || f.listTotalCalls != 1 {
-		t.Fatalf("rows=%v totalCalls=%d err=%v", rows, f.listTotalCalls, err)
-	}
-}
-
 // 某页行数少于预期同样是不完整快照。
 func TestSyncStopsOnShortPage(t *testing.T) {
 	db := newSyncTestDB(t)

web/src/views/goauto/syb-sync-runs/index.vue

@@ -36,8 +36,9 @@
       <el-drawer v-model="detail.open" title="同步记录详情" size="760px">
         <div v-loading="detail.loading" class="drawer-body">
           <template v-if="detail.item">
-            <el-alert v-if="detail.item.status === 'failed' || detail.item.status === 'interrupted'" :title="detail.item.errorMessage || statusMeta(detail.item.status).label" :type="detail.item.status === 'failed' ? 'error' : 'warning'" show-icon :closable="false" class="notice" />
+            <el-alert v-if="detail.item.status === 'failed' || detail.item.status === 'interrupted' || detail.item.status === 'partial_success'" :title="detail.item.errorMessage || statusMeta(detail.item.status).label" :type="detail.item.status === 'failed' ? 'error' : 'warning'" show-icon :closable="false" class="notice" />
             <el-alert v-else-if="detail.item.status === 'running'" title="任务正在后台运行，关闭本页不会中断导入。" type="info" show-icon :closable="false" class="notice" />
+            <el-alert v-if="detail.item.status === 'partial_success'" title="已保存的数据会保留。请重新同步该日期范围补齐缺失数据；重跑不会重复新增相同明细。" type="warning" show-icon :closable="false" class="notice" />
             <el-descriptions :column="2" border>
               <el-descriptions-item label="记录编号">{{ detail.item.id }}</el-descriptions-item>
               <el-descriptions-item label="状态"><el-tag :type="statusMeta(detail.item.status).type">{{ statusMeta(detail.item.status).label }}</el-tag></el-descriptions-item>
@@ -81,7 +82,7 @@ export default {
       detail: { open: false, loading: false, item: null },
       statusOptions: [
         { label: '执行中', value: 'running' }, { label: '成功', value: 'succeeded' },
-        { label: '失败', value: 'failed' }, { label: '已中断', value: 'interrupted' }
+        { label: '部分成功', value: 'partial_success' }, { label: '失败', value: 'failed' }, { label: '已中断', value: 'interrupted' }
       ]
     }
   },
@@ -92,7 +93,7 @@ export default {
   created() { this.load().then(() => { const id = Number(this.$route.query.runId); if (id > 0) this.openDetail(id) }) },
   beforeUnmount() { this.stopPolling() },
   methods: {
-    statusMeta(status) { return { running: { label: '执行中', type: 'primary' }, succeeded: { label: '成功', type: 'success' }, failed: { label: '失败', type: 'danger' }, interrupted: { label: '已中断', type: 'warning' }}[status] || { label: status || '-', type: 'info' } },
+    statusMeta(status) { return { running: { label: '执行中', type: 'primary' }, succeeded: { label: '成功', type: 'success' }, partial_success: { label: '部分成功', type: 'warning' }, failed: { label: '失败', type: 'danger' }, interrupted: { label: '已中断', type: 'warning' }}[status] || { label: status || '-', type: 'info' } },
     formatTime(value) { if (!value) return '—'; return new Date(value).toLocaleString('zh-CN', { hour12: false }) },
     async load() {
       this.loading = true; this.loadError = ''

web/tests/e2e/syb-sync-run.spec.ts

@@ -6,6 +6,34 @@ async function authenticate(context: any) {
 
 const syncMenu = [{ path: '/syb-sync-runs', component: 'Layout', visible: '0', menuName: 'SybSync', title: 'SYB 同步', children: [{ path: 'index', component: '/goauto/syb-sync-runs/index', visible: '0', menuName: 'GoAutoSybSyncRuns', title: 'SYB 同步记录' }] }];
 
+test('部分成功可筛选并查看已保存数量和补齐提示', async ({ page, context }) => {
+  await authenticate(context);
+  const item = { id: 239, status: 'partial_success', dateFrom: '2026-08-01', dateTo: '2026-08-02', daysProcessed: 1, daysTotal: 2, progressPercent: 50, created: 2, updated: 1, orderCount: 3, detailCount: 3, acceptedCount: 3, shopSkipped: 0, errorMessage: '2026-08-01 第 2 页读取失败', shopBreakdown: [] };
+  let selected = '';
+  await page.route('**/api/**', route => {
+    const url = new URL(route.request().url());
+    if (url.pathname.startsWith('/src/api/')) return route.continue();
+    if (url.pathname.endsWith('/getinfo')) return route.fulfill({ json: { code: 200, data: { roles: ['purchaser'], name: '测试用户', avatar: '', introduction: '', permissions: [] } } });
+    if (url.pathname.endsWith('/sync-runs/239')) return route.fulfill({ json: { code: 200, data: { item } } });
+    if (url.pathname.endsWith('/sync-runs')) { selected = url.searchParams.get('status') || ''; return route.fulfill({ json: { code: 200, data: { items: [item], total: 1 } } }); }
+    return route.fulfill({ json: { code: 200, data: url.pathname.endsWith('/menurole') ? syncMenu : [] } });
+  });
+  await page.goto('/#/syb-sync-runs/index');
+  await expect(page.locator('.el-table').getByText('部分成功')).toBeVisible();
+  await page.locator('.search-form .el-select').click();
+  await page.getByRole('option', { name: '部分成功' }).click();
+  await page.getByRole('button', { name: '查询', exact: true }).click();
+  await expect.poll(() => selected).toBe('partial_success');
+  await page.getByRole('button', { name: '详情', exact: true }).click();
+  await expect(page.getByText(item.errorMessage)).toBeVisible();
+  await expect(page.getByText('已保存的数据会保留。', { exact: false })).toBeVisible();
+  await expect(page.locator('.el-drawer').getByText('2 / 1', { exact: true })).toBeVisible();
+  await expect.poll(async () => {
+    const box = await page.locator('.el-drawer').boundingBox();
+    return box ? Math.round(box.x + box.width) : 0;
+  }).toBe(page.viewportSize()!.width);
+});
+
 test('同步记录展示失败原因和按店铺统计', async ({ page, context }) => {
   await authenticate(context);
   await page.route('**/api/**', async route => {