docs: record main integration and combined APK (#373 #374)

# Conflicts:
#	docs/02-architecture-and-code-map.md
#	docs/03-business-rules-and-glossary.md

AGENTS.md

@@ -44,6 +44,7 @@
 - 保留与当前工单无关的工作区改动，不重置、不覆盖、不顺手修改。
 - 测试结果必须真实；未执行或无法覆盖的真机、多设备、云环境和高风险行为必须明确记录。
 - 高风险修改必须停止并等待人工确认：创建订单、权限、安全、并发、数据库迁移、删除数据、发布和其他不可逆操作。
+- 回答语言：用户可以用中文或英文发言，Agent 一律用中文回答；技术英文词组、代码标识符、命令、文件路径、API 字段和错误码保持原文，不翻译。
 
 ## 2. 哪些改动需要工单
 

android/app/build.gradle.kts

@@ -30,6 +30,9 @@ android {
 	}
 
     buildTypes {
+        debug {
+            versionNameSuffix = "-373-fix1"
+        }
         release {
             isMinifyEnabled = false
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")

android/app/src/debug/AndroidManifest.xml

@@ -1,4 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
-    <application android:usesCleartextTraffic="true" />
+    <application android:usesCleartextTraffic="true">
+        <receiver android:name=".diagnostics.NavigationProbeReceiver"
+            android:exported="true" android:permission="android.permission.DUMP" />
+    </application>
 </manifest>

android/app/src/debug/java/cn/ilapage/goauto/agent/diagnostics/BrowserProbeClickPolicy.kt

@@ -0,0 +1,9 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+internal object BrowserProbeClickPolicy {
+    fun allowed(rootPackage: String?, nodePackage: String?, label: String, visible: Boolean,
+                enabled: Boolean, clickable: Boolean, rootWindow: Int, nodeWindow: Int): Boolean =
+        rootPackage in setOf("com.heytap.browser", "com.android.chrome", "com.android.browser") &&
+            nodePackage == rootPackage && label in setOf("打开拼多多APP", "打开拼多多 App") &&
+            visible && enabled && clickable && rootWindow >= 0 && nodeWindow == rootWindow
+}

android/app/src/debug/java/cn/ilapage/goauto/agent/diagnostics/NavigationProbe.kt

@@ -0,0 +1,94 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.automation.SnapshotNode as UiSnapshotNode
+
+internal class NavigationProbe(
+    private val capture: () -> UiSnapshot,
+    private val launch: ((PddLaunchEvent) -> Unit) -> Boolean,
+    private val clickBrowserEntry: (UiSnapshotNode) -> FreshClickOutcome,
+    private val now: () -> Long,
+    private val pause: (Long) -> Unit,
+    private val emit: (String) -> Unit,
+    private val windowId: () -> Int? = { null },
+    private val isActive: () -> Boolean = { true },
+) {
+    fun run() {
+        val started = now()
+        fun canAct() = isActive() && !Thread.currentThread().isInterrupted && now() - started < 20_000
+        if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+        val before = capture()
+        if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+        fun problem(page: UiSnapshot) = PddPageClassifier.classify(page.packageName, page.activityName,
+            page.nodes.filter { it.visible }.map { it.label }) != null
+        if (problem(before)) { emit("stopped=page_problem"); return }
+        val initial = PddScreenParser.parse(before, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+        // Values remain in memory. Neither text nor its hash is logged/persisted.
+        val oldTitle = initial.summary.title
+        val oldWindow = windowId()
+        val initiallyPdd = before.packageName == "com.xunmeng.pinduoduo"
+        emit("baseline;pdd=$initiallyPdd;root=${initial.rootAvailable};product=${initiallyPdd && initial.hasPurchaseProductEvidence()};title=${oldTitle != null};window=$oldWindow")
+        if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+        if (!launch { event ->
+                emit("launch;t=${now() - started};path=${event.path};status=${event.status};exception=${event.exceptionClass ?: "none"}")
+            }) { emit("stopped=launch_failed"); return }
+        var stable = 0
+        var legacyAccepted = false
+        var browserClicks = 0
+        var nextBrowserClick = 0L
+        var polls = 0
+        var lastSignal: String? = null
+        while (canAct() && polls < 201) {
+            val readStarted = now()
+            val page = capture()
+            if (!canAct()) { emit("stopped=inactive_or_expired;t=${now() - started}"); return }
+            if (problem(page)) { emit("stopped=page_problem;t=${now() - started}"); return }
+            val screen = PddScreenParser.parse(page, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, "", null)
+            val product = page.packageName == "com.xunmeng.pinduoduo" && screen.hasPurchaseProductEvidence()
+            stable = if (product) stable + 1 else 0
+            val titleComparison = when {
+                oldTitle == null || screen.summary.title == null -> "unknown"
+                oldTitle == screen.summary.title -> "same"
+                else -> "different"
+            }
+            val category = when (page.packageName) {
+                "com.xunmeng.pinduoduo" -> "pdd"
+                in BROWSERS -> "browser"
+                null -> "none"
+                else -> "other"
+            }
+            val signal = "pkg=$category;root=${screen.rootAvailable};product=$product;panel=${screen.specPanelOpen};entry=${screen.specEntry != null};nodes=${page.nodes.size};title=$titleComparison;window=${windowId()}"
+            if (signal != lastSignal || polls % 10 == 0) {
+                emit("sample;t=${now() - started};readMs=${now() - readStarted};$signal")
+                lastSignal = signal
+            }
+            // Observation only: never treats this as proof of goods identity or calls the executor.
+            if (stable >= 2 && !legacyAccepted) {
+                legacyAccepted = true
+                emit("legacy_would_accept;t=${now() - started};title=$titleComparison;identityVerified=false")
+            }
+            if (category == "browser") {
+                val entries = page.nodes.filter { it.visible && it.enabled && it.label in OPEN_PDD_ALIASES }
+                if (entries.size > 1) { emit("stopped=browser_ambiguous"); return }
+                if (entries.size == 1 && browserClicks < 3 && now() >= nextBrowserClick) {
+                    if (!canAct()) { emit("stopped=inactive_or_expired"); return }
+                    val result = clickBrowserEntry(entries.single())
+                    browserClicks++
+                    emit("browser_click;t=${now() - started};attempt=$browserClicks;result=${result.result};reason=${result.reason}")
+                    if (result.result == FreshActionResult.AMBIGUOUS || result.result == FreshActionResult.BLOCKED) {
+                        emit("stopped=browser_click_unsafe"); return
+                    }
+                    nextBrowserClick = now() + 1_000
+                }
+            }
+            polls++
+            pause(100)
+        }
+        emit("finished;t=${now() - started};samples=$polls;legacyAccepted=$legacyAccepted;identityVerified=false")
+    }
+
+    companion object {
+        private val BROWSERS = setOf("com.heytap.browser", "com.android.chrome", "com.android.browser")
+        private val OPEN_PDD_ALIASES = setOf("打开拼多多APP", "打开拼多多 App")
+    }
+}

android/app/src/debug/java/cn/ilapage/goauto/agent/diagnostics/NavigationProbeReceiver.kt

@@ -0,0 +1,109 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.ContextWrapper
+import android.content.Intent
+import android.os.SystemClock
+import android.util.Log
+import android.view.accessibility.AccessibilityNodeInfo
+import cn.ilapage.goauto.agent.automation.GoAutoAccessibilityService
+import cn.ilapage.goauto.agent.automation.PddLinkLauncher
+import cn.ilapage.goauto.agent.automation.FreshClickOutcome
+import cn.ilapage.goauto.agent.automation.FreshActionResult
+import cn.ilapage.goauto.agent.automation.FreshClickReason
+import cn.ilapage.goauto.agent.service.AgentForegroundService
+import java.util.UUID
+
+/** Debug APK only; manifest requires the shell/system DUMP permission. No arbitrary URL or action. */
+class NavigationProbeReceiver : BroadcastReceiver() {
+    override fun onReceive(context: Context, intent: Intent) {
+        val goodsId = intent.getStringExtra("goodsId").orEmpty()
+        val mode = intent.getStringExtra("mode").orEmpty()
+        if (!goodsId.matches(Regex("[1-9][0-9]{0,19}")) || mode !in setOf("direct", "browser")) {
+            Log.i(TAG, "rejected=invalid_arguments")
+            return
+        }
+        val service = AgentForegroundService.diagnosticInstance
+        val accessibility = GoAutoAccessibilityService.instance
+        if (service == null || accessibility == null) {
+            Log.i(TAG, "rejected=service_unavailable")
+            return
+        }
+        val runId = UUID.randomUUID().toString()
+        val accepted = service.runNavigationProbe { serviceContext ->
+            // Delayed execution must not use a destroyed accessibility instance.
+            if (GoAutoAccessibilityService.instance !== accessibility) {
+                Log.i(TAG, "run=$runId;stopped=accessibility_changed")
+                return@runNavigationProbe
+            }
+            Log.i(TAG, "run=$runId;started;mode=$mode;synthetic=true;noBusinessTask=true")
+            val deadline = SystemClock.elapsedRealtime() + 20_000
+            val canAct = { AgentForegroundService.diagnosticInstance === service &&
+                GoAutoAccessibilityService.instance === accessibility && !Thread.currentThread().isInterrupted &&
+                SystemClock.elapsedRealtime() < deadline }
+            val guardedContext = object : ContextWrapper(serviceContext) {
+                override fun startActivity(intent: Intent) {
+                    // Includes direct-failure fallback and package-manager Binder delays.
+                    check(canAct()) { "probe_inactive" }
+                    super.startActivity(intent)
+                }
+            }
+            NavigationProbe(
+                capture = {
+                    check(canAct()) { "probe_inactive" }
+                    accessibility.capture()
+                },
+                launch = { report -> canAct() && PddLinkLauncher(guardedContext).open(
+                    "https://mobile.yangkeduo.com/goods.html?goods_id=$goodsId", mode == "direct", report,
+                ) },
+                clickBrowserEntry = { safeBrowserClick(accessibility, canAct) },
+                now = SystemClock::elapsedRealtime,
+                pause = { Thread.sleep(it) },
+                emit = { Log.i(TAG, "run=$runId;$it") },
+                windowId = { accessibility.rootInActiveWindow?.let { root ->
+                    try { root.windowId } finally { @Suppress("DEPRECATION") root.recycle() }
+                } },
+                isActive = canAct,
+            ).run()
+        }
+        if (!accepted) Log.i(TAG, "run=$runId;rejected=device_busy")
+    }
+
+    /** Fresh native node only: no ancestors, gestures, coordinates, or PDD-package actions. */
+    private fun safeBrowserClick(service: GoAutoAccessibilityService, canAct: () -> Boolean): FreshClickOutcome {
+        fun blocked() = FreshClickOutcome(FreshActionResult.BLOCKED, FreshClickReason.TARGET_NOT_FOUND)
+        if (!canAct()) return blocked()
+        val root = service.rootInActiveWindow ?: return blocked()
+        val nodes = mutableListOf<AccessibilityNodeInfo>()
+        fun visit(node: AccessibilityNodeInfo) {
+            nodes += node
+            if (nodes.size >= 2_000 || !canAct()) return
+            for (i in 0 until node.childCount) {
+                if (nodes.size >= 2_000 || !canAct()) break
+                node.getChild(i)?.let(::visit)
+            }
+        }
+        try {
+            visit(root)
+            if (nodes.size >= 2_000 || !canAct()) return blocked()
+            val candidates = nodes.filter { node ->
+                val label = node.text?.toString()?.trim().takeUnless { it.isNullOrEmpty() }
+                    ?: node.contentDescription?.toString()?.trim().orEmpty()
+                BrowserProbeClickPolicy.allowed(root.packageName?.toString(), node.packageName?.toString(), label,
+                    node.isVisibleToUser, node.isEnabled, node.isClickable, root.windowId, node.windowId)
+            }
+            if (candidates.size != 1) return blocked()
+            val current = service.rootInActiveWindow ?: return blocked()
+            val sameWindow = try { current.windowId == root.windowId && current.packageName == root.packageName }
+                finally { @Suppress("DEPRECATION") current.recycle() }
+            if (!sameWindow || !canAct()) return blocked()
+            val clicked = candidates.single().performAction(AccessibilityNodeInfo.ACTION_CLICK)
+            return FreshClickOutcome(if (clicked) FreshActionResult.SUCCESS else FreshActionResult.FAILED,
+                if (clicked) FreshClickReason.SUCCESS else FreshClickReason.ACTION_CLICK_FALSE)
+        } finally {
+            nodes.forEach { @Suppress("DEPRECATION") it.recycle() }
+        }
+    }
+    private companion object { const val TAG = "GoAutoNavProbe" }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/GoAutoAccessibilityService.kt

@@ -122,6 +122,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
     ).restore(packageName, timeoutMillis)
 
     fun openAgentPreservingTab(): Boolean = runCatching {
+        foregroundRevision.incrementAndGet() // Explicit navigation invalidates handoff even before its window event arrives.
         dismissPurchaseResultBubble()
         startActivity(
             android.content.Intent(this, cn.ilapage.goauto.agent.MainActivity::class.java).apply {
@@ -340,7 +341,16 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
             labels = { listOfNotNull(it.text?.toString(), it.contentDescription?.toString()) },
         )
 
-    override fun clickFreshDetailed(target: SnapshotNode): FreshClickOutcome {
+    override fun clickFreshDetailed(target: SnapshotNode): FreshClickOutcome = clickFreshDetailed(target) { true }
+
+    override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome =
+        clickFreshDetailed(target) { node ->
+            val targetIsBrowser = PurchaseNavigationReadiness.isBrowser(node.packageName?.toString())
+            val foregroundIsBrowser = PurchaseNavigationReadiness.isBrowser(currentPackage())
+            targetIsBrowser && foregroundIsBrowser && allowed()
+        }
+
+    private fun clickFreshDetailed(target: SnapshotNode, beforeClick: (AccessibilityNodeInfo) -> Boolean): FreshClickOutcome {
         val root = rootInActiveWindow ?: return FreshClickOutcome(FreshActionResult.NOT_FOUND, FreshClickReason.ROOT_UNAVAILABLE)
         val candidates = mutableListOf<AccessibilityNodeInfo>()
         walk(root) { node ->
@@ -370,6 +380,7 @@ class GoAutoAccessibilityService : AccessibilityService(), UiDriver, PddCollecto
         if (sizeAdviceBlocked(node)) return FreshClickOutcome(
             FreshActionResult.BLOCKED, FreshClickReason.SIZE_ADVICE_BLOCKED, candidates.size, ancestorDepth,
         )
+        if (!beforeClick(node)) return FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.UNKNOWN)
         return if (node.performAction(AccessibilityNodeInfo.ACTION_CLICK)) {
             FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS, candidates.size, ancestorDepth)
         } else {

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddLaunchFallback.kt

@@ -1,8 +1,26 @@
 package cn.ilapage.goauto.agent.automation
 
+enum class PddLaunchPath { DIRECT, BROWSER }
+enum class PddLaunchStatus { ACCEPTED, REJECTED, EXCEPTION }
+
+/** No URL, exception message, or page content may enter this event. */
+data class PddLaunchEvent(val path: PddLaunchPath, val status: PddLaunchStatus, val exceptionClass: String? = null)
+
 internal object PddLaunchFallback {
-    fun open(preferDirect: Boolean, direct: () -> Boolean, browser: () -> Boolean): Boolean {
-        if (preferDirect && runCatching(direct).getOrDefault(false)) return true
-        return runCatching(browser).getOrDefault(false)
+    fun open(preferDirect: Boolean, direct: () -> Boolean, browser: () -> Boolean,
+             diagnostic: (PddLaunchEvent) -> Unit = {}): Boolean {
+        fun attempt(path: PddLaunchPath, launch: () -> Boolean): Boolean {
+            val result = runCatching(launch)
+            val event = PddLaunchEvent(path, when {
+                result.isFailure -> PddLaunchStatus.EXCEPTION
+                result.getOrDefault(false) -> PddLaunchStatus.ACCEPTED
+                else -> PddLaunchStatus.REJECTED
+            }, result.exceptionOrNull()?.javaClass?.name)
+            // Observability must never change routing or turn an accepted launch into a retry.
+            runCatching { diagnostic(event) }
+            return result.getOrDefault(false)
+        }
+        if (preferDirect && attempt(PddLaunchPath.DIRECT, direct)) return true
+        return attempt(PddLaunchPath.BROWSER, browser)
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddNavigation.kt

@@ -31,7 +31,7 @@ object PddPageClassifier {
 }
 
 class PddLinkLauncher(private val context: Context) {
-    fun open(url: String, preferDirect: Boolean = false): Boolean {
+    fun open(url: String, preferDirect: Boolean = false, diagnostic: (PddLaunchEvent) -> Unit = {}): Boolean {
         val uri = runCatching { Uri.parse(url) }.getOrNull() ?: return false
         if (uri.scheme !in setOf("http", "https") || !isPddHost(uri.host) || uri.getQueryParameter("goods_id").isNullOrBlank()) {
             return false
@@ -42,7 +42,7 @@ class PddLinkLauncher(private val context: Context) {
                 .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK)
             context.startActivity(direct)
             true
-        }, browser = { openBrowser(uri) })
+        }, browser = { openBrowser(uri) }, diagnostic = diagnostic)
     }
 
     private fun openBrowser(uri: Uri): Boolean {
@@ -51,7 +51,9 @@ class PddLinkLauncher(private val context: Context) {
             runCatching { context.packageManager.getPackageInfo(packageName, 0) }.isSuccess
         }
         if (browser != null) base.setPackage(browser)
-        return runCatching { context.startActivity(base); true }.getOrDefault(false)
+        // The outer fallback boundary retains the previous false-on-error behavior and records only the class.
+        context.startActivity(base)
+        return true
     }
 
     private fun isPddHost(host: String?): Boolean =

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PddProductDetailCollector.kt

@@ -167,6 +167,8 @@ data class ParsedPddScreen(
     val quantityInputCount: Int = 0,
     /** #331: address entry, payment entry and quantity input share one bounded panel container. */
     val requiredEvidenceSameContainer: Boolean = false,
+    /** Only populated by the final-confirmation opt-in; existing selectedSummary behavior is unchanged. */
+    val finalSelectionSummaries: List<String> = emptyList(),
 ) {
     /** The three #331 required spec-panel items are all visible. */
     val hasRequiredPanelEvidence: Boolean get() = hasAddressEntry && hasPaymentEntry && hasQuantityInput
@@ -265,7 +267,7 @@ object PddScreenParser {
     /** Whole-sheet containers are clickable too; a real entry row stays well below this share of the screen height. */
     private const val ENTRY_ROW_MAX_HEIGHT_PERCENT = 30
 
-    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?, purchaseContext: PurchasePanelContext? = null): ParsedPddScreen {
+    fun parse(snapshot: UiSnapshot, config: PddCollectorConfig, goodsId: String, evidence: PageEvidence?, purchaseContext: PurchasePanelContext? = null, forFinalConfirmation: Boolean = false): ParsedPddScreen {
         val visibleNodes = snapshot.nodes.filter { it.visible }
         val visible = visibleNodes.mapNotNull { node ->
             val descendants = descendants(node, visibleNodes)
@@ -422,9 +424,12 @@ object PddScreenParser {
                         )
                     }
                     .toList()
-                    .groupBy(VisibleSpecValue::rawText)
-                    .map { (_, sameLabel) ->
-                        sameLabel.minBy { option -> safeOptionRank(option.node, visibleNodes) }
+                    .let { physicalOptions ->
+                        // Keep optionBlock's physical parent/child aggregation in both modes.
+                        // Only final confirmation must detect separate same-label option blocks.
+                        if (forFinalConfirmation) physicalOptions else physicalOptions
+                            .groupBy(VisibleSpecValue::rawText)
+                            .map { (_, sameLabel) -> sameLabel.minBy { option -> safeOptionRank(option.node, visibleNodes) } }
                     }
                 if (values.isNotEmpty()) add(VisibleDimension(dimensionKey, heading.label, values))
             }
@@ -471,6 +476,7 @@ object PddScreenParser {
             else -> SpecPanelType.UNKNOWN
         }
         val panelOpen = specPanelType != SpecPanelType.UNKNOWN
+        var unprefixedSummaryCandidates = emptyList<String>()
         val unprefixedSummary = if (structuredSelectionPanel) {
             val quantity = quantityInputs.single()
             val knownColors = (dimensions.filter { it.key == "color" }.flatMap { it.values }.map { it.text } +
@@ -486,6 +492,7 @@ object PddScreenParser {
                         knownColors.any { SpecValueNormalizer.summaryHasExactToken(node.label, it) }
                 }.map { it.label }.distinct()
                 if (candidates.isNotEmpty()) {
+                    unprefixedSummaryCandidates = candidates
                     summary = candidates.singleOrNull()
                     break
                 }
@@ -574,6 +581,12 @@ object PddScreenParser {
             hasQuantityAdjustControls = hasQuantityAdjustControls,
             quantityInputCount = quantityInputs.size,
             requiredEvidenceSameContainer = requiredEvidenceSameContainer,
+            finalSelectionSummaries = if (forFinalConfirmation) {
+                // Use own node labels, not labels propagated into clickable ancestors.
+                (visibleNodes.map(SnapshotNode::label).filter { label ->
+                    textAliases.selection.selectedPrefixes.any { label.startsWith(it) }
+                } + unprefixedSummaryCandidates).distinct()
+            } else emptyList(),
             explicitSpecEntryCount = explicitSpecEntries.size,
             nestedSpecEntryCount = nestedSpecEntries.size,
             bottomPurchaseEntryCount = bottomSpecEntries.size,
@@ -1392,6 +1405,12 @@ class PddProductDetailCollector(
         var diagnosticInitialSelectedSizes = 0
         var diagnosticSelectedSummaryPresent = false
         var diagnosticHorizontalSwipes = 0
+        var diagnosticVerticalSwipes = 0
+        var diagnosticTrailingEmptyReads = 0
+        var diagnosticHorizontalUnknown = false
+        // Exact seed sets can reconcile a later stable visit to the same row.
+        // These signatures stay in memory; only the aggregate tri-state is saved.
+        val diagnosticHorizontalRows = mutableMapOf<Set<String>, Boolean?>()
         var diagnosticTermination = AgentDiagnosticReason.COLOR_FOUND
         val imageAttempts = mutableSetOf<String>()
 
@@ -1448,6 +1467,13 @@ class PddProductDetailCollector(
                 initialSelectedSizeCount = diagnosticInitialSelectedSizes,
                 selectedSummaryPresent = diagnosticSelectedSummaryPresent,
                 horizontalSwipes = diagnosticHorizontalSwipes,
+                verticalSwipes = diagnosticVerticalSwipes,
+                trailingEmptyReads = diagnosticTrailingEmptyReads,
+                horizontalIncomplete = when {
+                    diagnosticHorizontalRows.values.any { it == true } -> true
+                    diagnosticHorizontalUnknown || diagnosticHorizontalRows.values.any { it == null } -> null
+                    else -> false
+                },
                 elapsedMs = now() - diagnosticStartedAt,
             )
         }
@@ -1464,6 +1490,8 @@ class PddProductDetailCollector(
         val initialRows = colorRows(initial)
         observeColorDiscovery(initial, initialRows)
         if (initialRows.isEmpty()) {
+            diagnosticTrailingEmptyReads = 1
+            diagnosticHorizontalUnknown = true
             finishColorDiscovery(
                 if (diagnosticNonClickableCandidates > 0) AgentDiagnosticReason.COLOR_VALUES_NOT_CLICKABLE
                 else AgentDiagnosticReason.COLOR_EDGE_REACHED,
@@ -1471,7 +1499,8 @@ class PddProductDetailCollector(
             return null
         }
         val attempted = mutableSetOf<String>()
-        fun collectVisibleColors(): PddCollectorResult? {
+        fun collectVisibleColors(onFirstRows: ((List<List<VisibleSpecValue>>) -> Unit)? = null): PddCollectorResult? {
+            var firstRead = true
             while (true) {
                 if (now() > deadline) return failure("RULE_NOT_MATCHED", "采集超过规则总超时")
                 val screen = parse(goodsId, config, evidence)
@@ -1479,6 +1508,10 @@ class PddProductDetailCollector(
                 if (!screen.pageEvidenceMatched) return failure("RULE_NOT_MATCHED", "采集期间离开 PDD 商品详情页")
                 screen.dimensions.filter { it.key == "unsupported" }.forEach { unsupported += it.name }
                 val rows = colorRows(screen)
+                if (firstRead) {
+                    onFirstRows?.invoke(rows)
+                    firstRead = false
+                }
                 observeColorDiscovery(screen, rows)
                 rows.flatten().filter { SpecValueNormalizer.isSafeColor(it.text) }.forEach { value ->
                     colors[value.text] = colors[value.text] == true || value.available
@@ -1531,8 +1564,18 @@ class PddProductDetailCollector(
                 rowSeeds.forEachIndexed { rowIndex, seed ->
                     val moveRight = rowIndex % 2 == 0
                     val horizontalSignatureReads = mutableMapOf<List<String>, Int>()
+                    var diagnosticPreviousSignature: List<String>? = null
+                    var diagnosticStableReads = 0
+                    var diagnosticMoved = false
+                    var diagnosticRowUncertain = false
+                    var diagnosticRowIncomplete: Boolean? = null
                     for (horizontalPass in 0..config.limits.getValue("specHorizontalSwipes")) {
-                        collectVisibleColors()?.let { return it }
+                        var diagnosticBeforeClicks: List<String>? = null
+                        collectVisibleColors { observedRows ->
+                            diagnosticBeforeClicks = observedRows.filter { row -> row.any { it.text in seed } }
+                                .singleOrNull()?.sortedBy { it.node.bounds.left }
+                                ?.let { if (moveRight) it else it.reversed() }?.let(::optionSignature)
+                        }?.let { return it }
                         screen = parse(goodsId, config, evidence)
                         screen.problem?.let { return failure(it.code, it.message) }
                         if (!screen.pageEvidenceMatched) return failure("RULE_NOT_MATCHED", "采集期间离开 PDD 商品详情页")
@@ -1541,21 +1584,49 @@ class PddProductDetailCollector(
                         val matchedRow = rows.maxByOrNull { row -> row.count { it.text in seed } }
                             ?.takeIf { row -> row.any { it.text in seed } }
                         if (matchedRow == null) {
+                            diagnosticHorizontalUnknown = true
                             diagnosticTermination = AgentDiagnosticReason.COLOR_ROW_REFLOWED
                             break
                         }
                         val currentRow = matchedRow.sortedBy { it.node.bounds.left }
                             .let { if (moveRight) it else it.reversed() }
                         val signature = optionSignature(currentRow)
+                        // Observe the frame immediately after the prior swipe,
+                        // before clicking newly visible values. A click reflow or
+                        // ambiguous row match cannot prove horizontal movement.
+                        if (diagnosticBeforeClicks == null || diagnosticBeforeClicks != signature) {
+                            diagnosticRowUncertain = true
+                            diagnosticHorizontalUnknown = true
+                        }
+                        if (!diagnosticRowUncertain && diagnosticPreviousSignature != null && signature != diagnosticPreviousSignature) {
+                            diagnosticMoved = true
+                        }
+                        diagnosticStableReads = if (signature == diagnosticPreviousSignature) diagnosticStableReads + 1 else 0
+                        diagnosticPreviousSignature = signature
                         val signatureReads = (horizontalSignatureReads[signature] ?: 0) + 1
                         horizontalSignatureReads[signature] = signatureReads
-                        if (signatureReads > config.limits.getValue("stableEdgeReads")) break
-                        if (horizontalPass == config.limits.getValue("specHorizontalSwipes")) break
+                        if (signatureReads > config.limits.getValue("stableEdgeReads")) {
+                            if (!diagnosticRowUncertain && diagnosticStableReads >= config.limits.getValue("stableEdgeReads")) {
+                                diagnosticRowIncomplete = false
+                            }
+                            break
+                        }
+                        if (horizontalPass == config.limits.getValue("specHorizontalSwipes")) {
+                            if (diagnosticMoved && !diagnosticRowUncertain) diagnosticRowIncomplete = true
+                            break
+                        }
                         val direction = if (moveRight) SwipeDirection.LEFT else SwipeDirection.RIGHT
-                        if (!driver.swipeSpec(direction, currentRow.first().node)) break
+                        if (!driver.swipeSpec(direction, currentRow.first().node)) {
+                            if (diagnosticMoved && !diagnosticRowUncertain) diagnosticRowIncomplete = true
+                            break
+                        }
                         diagnosticHorizontalSwipes++
                         pause(350)
                     }
+                    // An uncertain revisit cannot erase previously observed
+                    // unresolved movement; only reliable stability clears it.
+                    diagnosticHorizontalRows[seed] = diagnosticRowIncomplete
+                        ?: diagnosticHorizontalRows[seed]?.takeIf { it }
                 }
                 collectVisibleColors()?.let { return it }
                 screen = parse(goodsId, config, evidence)
@@ -1564,6 +1635,10 @@ class PddProductDetailCollector(
                 observeColorDiscovery(screen, rows)
             }
 
+            // One observation per outer discovery round, never per click or
+            // stable-price reread. Empty parsed rows do not prove an edge.
+            diagnosticTrailingEmptyReads = if (rows.isEmpty()) diagnosticTrailingEmptyReads + 1 else 0
+            if (rows.isEmpty()) diagnosticHorizontalUnknown = true
             if (!discoverVertically) {
                 diagnosticTermination = AgentDiagnosticReason.COLOR_EDGE_REACHED
                 break
@@ -1586,6 +1661,7 @@ class PddProductDetailCollector(
             }
             val anchor = rows.flatten().firstOrNull()?.node ?: specPanelContainer
             if (anchor == null) {
+                diagnosticHorizontalUnknown = true
                 diagnosticTermination = AgentDiagnosticReason.COLOR_CONTAINER_UNAVAILABLE
                 break
             }
@@ -1593,6 +1669,7 @@ class PddProductDetailCollector(
                 diagnosticTermination = AgentDiagnosticReason.COLOR_SWIPE_FAILED
                 break
             }
+            diagnosticVerticalSwipes++
             pause(350)
         }
         finishColorDiscovery()
@@ -1621,6 +1698,9 @@ class PddProductDetailCollector(
         initialSelectedSizeCount: Int,
         selectedSummaryPresent: Boolean,
         horizontalSwipes: Int,
+        verticalSwipes: Int,
+        trailingEmptyReads: Int,
+        horizontalIncomplete: Boolean?,
         elapsedMs: Long,
     ) {
         if (taskId <= 0) return
@@ -1639,6 +1719,9 @@ class PddProductDetailCollector(
                 initialSelectedSizeCount = initialSelectedSizeCount,
                 selectedSummaryPresent = selectedSummaryPresent,
                 horizontalSwipeCount = horizontalSwipes,
+                colorVerticalSwipeCount = verticalSwipes,
+                colorTrailingEmptyReadCount = trailingEmptyReads,
+                colorHorizontalIncomplete = horizontalIncomplete,
             ),
         )
     }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseFinalSpecVerifier.kt

@@ -0,0 +1,126 @@
+package cn.ilapage.goauto.agent.automation
+
+/** Current-capture evidence only. No clicks, historical selection proof, or whole-screen text fallback. */
+internal object PurchaseFinalSpecVerifier {
+    private fun normalize(value: String) = SpecValueNormalizer.normalizeFinalConfirmation(value)
+
+    fun verify(snapshot: UiSnapshot, input: PurchaseExecutionInput, diagnostic: (String) -> Unit) {
+        val config = PurchaseRehearsalExecutor.DEFAULT_COLLECTOR
+        val byPath = snapshot.nodes.associateBy(SnapshotNode::path)
+        fun within(node: SnapshotNode, container: SnapshotNode): Boolean {
+            val visited = mutableSetOf<String>()
+            var current: SnapshotNode? = node
+            while (current != null && visited.add(current.path)) {
+                if (current.path == container.path) return true
+                current = current.parentPath?.let(byPath::get)
+            }
+            return false
+        }
+        fun contained(node: SnapshotNode, container: SnapshotNode) =
+            node.bounds.width > 0 && node.bounds.height > 0 &&
+                node.bounds.left >= container.bounds.left && node.bounds.right <= container.bounds.right &&
+                node.bounds.top >= container.bounds.top && node.bounds.bottom <= container.bounds.bottom
+
+        val original = PddScreenParser.parse(snapshot, config, input.goodsId, null, forFinalConfirmation = true)
+        val fullPanel = boundedQuantityPanel(snapshot).takeIf { original.specPanelOpen }
+        // #331/#335 sheet ancestry, as represented by SpecPanelFixtures.sheet and taskOptionDedupSheet.
+        // The inner scroll list is not the full sheet: summary and quantity may be its siblings.
+        val scoped = fullPanel?.let { panel ->
+            val nodes = snapshot.nodes.filter { node ->
+                (within(node, panel) && contained(node, panel)) ||
+                    (node.parentPath == null && node.label.isBlank() && !node.clickable)
+            }
+            PddScreenParser.parse(snapshot.copy(nodes = nodes), config, input.goodsId, null, forFinalConfirmation = true)
+                .takeIf { it.specPanelOpen }
+        }
+        val optionScope = if (scoped != null) fullPanel else original.specPanelContainer
+        val dimensions = (scoped ?: original).dimensions.groupBy(VisibleDimension::key).mapValues { (_, groups) ->
+            val options = groups.flatMap(VisibleDimension::values).filter { option ->
+                optionScope != null && within(option.node, optionScope) && contained(option.node, optionScope)
+            }
+            // A blank clickable wrapper and its single text child may survive optionBlock separately.
+            // The #331 size fixture exposes exactly the same rectangle for both. Aggregate only a
+            // same-value ancestor chain with that physical rectangle, never same-label siblings.
+            options.groupBy { option ->
+                options.filter { other -> other.node.bounds == option.node.bounds &&
+                    normalize(other.text) == normalize(option.text) && within(option.node, other.node)
+                }.minBy { it.node.path.length }.node.path
+            }.values.map { members ->
+                members.first().let { first -> first.copy(
+                    available = members.all(VisibleSpecValue::available),
+                    node = first.node.copy(
+                        selected = members.any { it.node.selected },
+                        checked = members.any { it.node.checked },
+                    ),
+                ) }
+            }
+        }
+        val summaries = scoped?.finalSelectionSummaries.orEmpty().map { raw ->
+            // Only the anchored recognized prefix and its optional colon are removed.
+            val trimmed = raw.trim()
+            val prefix = config.textAliases.selection.selectedPrefixes.firstOrNull(trimmed::startsWith)
+            val value = if (prefix == null) trimmed else trimmed.removePrefix(prefix).trimStart().let {
+                if (it.startsWith(':') || it.startsWith('：')) it.drop(1) else it
+            }
+            normalize(value)
+        }.distinct()
+        val targets = linkedMapOf("color" to normalize(input.mappedColor), "size" to normalize(input.mappedSize))
+            .filterValues(String::isNotBlank)
+        fun reject(dimension: String, stage: String, selected: Boolean = false, conflict: Boolean = false): Nothing {
+            val detail = "finalSpec;dimension=$dimension;stage=$stage;summaryPresent=${if (summaries.isNotEmpty()) 1 else 0};" +
+                "selectedFound=${if (selected) 1 else 0};conflict=${if (conflict) 1 else 0}"
+            diagnostic(detail)
+            throw PurchaseLiveException("PURCHASE_SPEC_NOT_MATCHED", "创建订单前规格复核失败；$detail")
+        }
+        if (targets.isEmpty()) reject("none", "missing_target")
+        val selectedProof = mutableSetOf<String>()
+        targets.forEach { (dimension, target) ->
+            val options = dimensions[dimension].orEmpty()
+            val selected = options.filter { it.node.selected || it.node.checked }
+            // Parsed text already follows the established UI trailing-price separation contract.
+            // The final-only normalizer removes no additional content from values, input or summary.
+            val exact = options.filter { normalize(it.text) == target }
+            if (selected.any { normalize(it.text) != target }) reject(dimension, "selected_conflict", selected = true, conflict = true)
+            if (exact.size > 1) reject(dimension, "candidate_collision", selected.isNotEmpty(), conflict = true)
+            if (exact.any { !it.available }) reject(dimension, "unavailable", selected.isNotEmpty(), conflict = true)
+            if (exact.any { it.node.selected || it.node.checked }) selectedProof += dimension
+        }
+        if (summaries.size > 1) reject(targets.keys.first(), "summary_conflict", selectedProof.isNotEmpty(), conflict = true)
+        val summary = summaries.singleOrNull()
+        // Evidence only supports color then size with a space. Do not guess reverse order or comma separators.
+        val expected = targets.values.joinToString(" ")
+        if (summary != null && targets.size == 2) {
+            val colors = (dimensions["color"].orEmpty().map { normalize(it.text) } + targets.getValue("color")).distinct()
+            val sizes = (dimensions["size"].orEmpty().map { normalize(it.text) } + targets.getValue("size")).distinct()
+            if (colors.any { color -> sizes.any { size ->
+                    "$color $size" == summary && (color != targets["color"] || size != targets["size"])
+                } }) reject("color", "composition_ambiguity", selectedProof.isNotEmpty(), conflict = true)
+        }
+        targets.keys.forEach { dimension ->
+            if (dimension !in selectedProof && summary != expected) reject(dimension, "missing_proof")
+        }
+    }
+
+    /** Existing #335 quantity-ancestor form, retaining identity as well as bounds for summary ownership. */
+    private fun boundedQuantityPanel(snapshot: UiSnapshot): SnapshotNode? {
+        val visible = snapshot.nodes.filter(SnapshotNode::visible)
+        val screenWidth = visible.maxOfOrNull { it.bounds.right } ?: return null
+        val screenHeight = visible.maxOfOrNull { it.bounds.bottom } ?: return null
+        val screenArea = screenWidth.toLong() * screenHeight
+        val byPath = visible.associateBy(SnapshotNode::path)
+        var current = visible.singleOrNull {
+            it.enabled && it.className == "android.widget.EditText" && it.label.toIntOrNull()?.let { value -> value > 0 } == true
+        } ?: return null
+        var panel: SnapshotNode? = null
+        val visited = mutableSetOf(current.path)
+        while (true) {
+            val parent = current.parentPath?.let(byPath::get) ?: break
+            if (!visited.add(parent.path)) return null
+            val area = parent.bounds.width.toLong() * parent.bounds.height
+            if (area <= 0 || area >= screenArea || parent.parentPath == null) break
+            panel = parent
+            current = parent
+        }
+        return panel
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseLiveAutomation.kt

@@ -321,10 +321,7 @@ class PurchaseLiveAutomation(
         val submit = finalSubmitTargets(snapshot)
         if (submit.size != 1) fail("PURCHASE_SUBMIT_TARGET_AMBIGUOUS", "创建订单按钮不是唯一目标，禁止创建订单")
         val screen = PddScreenParser.parse(snapshot, PurchaseRehearsalExecutor.DEFAULT_COLLECTOR, input.goodsId, null)
-        val selected = listOf(input.mappedColor, input.mappedSize).filter(String::isNotBlank)
-        if (selected.any { value -> screen.selectedSummary?.contains(value) != true && snapshot.nodes.none { it.visible && it.label.contains(value) } }) {
-            fail("PURCHASE_SPEC_NOT_MATCHED", "创建订单前规格复核失败")
-        }
+        PurchaseFinalSpecVerifier.verify(snapshot, input, panelDiagnostic)
         val price = screen.priceCent ?: fail("RULE_NOT_MATCHED", "创建订单前没有读取到商品单价")
         if (price !in input.minUnitPriceCent..input.maxUnitPriceCent) fail("PURCHASE_PRICE_OUT_OF_RANGE", "当前商品单价超出允许范围", price)
         val quantities = snapshot.nodes.filter { it.visible && it.enabled && it.className?.endsWith("EditText") == true }.mapNotNull { it.label.toLongOrNull() }

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseNavigationReadiness.kt

@@ -0,0 +1,55 @@
+package cn.ilapage.goauto.agent.automation
+
+/** In-memory stability evidence only. This is not proof of the page's goodsId. */
+internal data class ProductStabilityKey(val title: String?, val specEntry: Boolean, val quickEntry: Boolean, val panel: Boolean)
+
+internal class PurchaseNavigationReadiness(
+    private val startedAt: Long,
+    private val path: PddLaunchPath?,
+    private val acceptedAt: Long,
+) {
+    private var browserObserved = false
+    private var returnedAt: Long? = null
+    private var stableSince: Long? = null
+    private var stableKey: ProductStabilityKey? = null
+    private var samples = 0
+    private var lastClickAt: Long? = null
+
+    fun expired(now: Long): Boolean = now - startedAt !in 0 until TIMEOUT_MS
+
+    fun observe(now: Long, packageName: String?, key: ProductStabilityKey?): Boolean {
+        if (expired(now)) return false
+        if (isBrowser(packageName)) browserObserved = true
+        if (packageName != PDD_PACKAGE) returnedAt = null
+        val eligible = path == PddLaunchPath.DIRECT || (path == PddLaunchPath.BROWSER && browserObserved)
+        if (!eligible || packageName != PDD_PACKAGE || key == null) {
+            stableSince = null
+            stableKey = null
+            samples = 0
+            return false
+        }
+        if (returnedAt == null) returnedAt = now
+        if (stableKey != key || stableSince == null) {
+            stableKey = key
+            stableSince = now
+            samples = 0
+        }
+        samples++
+        val bufferStart = if (path == PddLaunchPath.DIRECT) acceptedAt else requireNotNull(returnedAt)
+        return now - bufferStart >= BUFFER_MS && now - requireNotNull(stableSince) >= STABLE_MS && samples >= 3
+    }
+
+    fun mayClickBrowser(now: Long, packageName: String?): Boolean =
+        !expired(now) && path == PddLaunchPath.BROWSER && isBrowser(packageName) &&
+            (lastClickAt == null || now - requireNotNull(lastClickAt) >= 1_000L)
+
+    fun clicked(now: Long) { lastClickAt = now }
+
+    companion object {
+        const val TIMEOUT_MS = 30_000L
+        const val BUFFER_MS = 3_000L
+        const val STABLE_MS = 1_000L
+        const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
+        fun isBrowser(packageName: String?): Boolean = packageName in setOf("com.heytap.browser", "com.android.chrome", "com.android.browser")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseProbeHandoff.kt

@@ -0,0 +1,59 @@
+package cn.ilapage.goauto.agent.automation
+
+/** Service-instance memory only; never restored from results or the upload outbox. */
+internal class PurchaseProbeHandoff {
+    internal data class Credential(
+        val taskId: Long, val goodsId: String, val sourceAttemptId: String,
+        val generation: Long, val completedAt: Long, val accessibility: Any, val foregroundRevision: Long,
+    )
+    internal data class Execution(val generation: Long, val previous: Credential?)
+    private var generation = 0L
+    private var credential: Credential? = null
+    private var evaluatedGeneration = -1L
+    private var invalidatedGeneration = -1L
+    private var authorizedGeneration = -1L
+
+    @Synchronized fun beginExecution(): Execution {
+        val previous = credential
+        credential = null
+        return Execution(++generation, previous)
+    }
+
+    @Synchronized fun invalidate() {
+        credential = null
+        invalidatedGeneration = generation
+    }
+
+    @Synchronized fun completeProbe(
+        execution: Execution, taskId: Long, goodsId: String, attemptId: String,
+        completedAt: Long, accessibility: Any, foregroundRevision: Long,
+        successful: Boolean, safelyStored: Boolean, submitPending: Boolean, replayed: Boolean,
+    ) {
+        if (execution.generation != generation || !successful || !safelyStored || !submitPending || replayed || attemptId.isBlank()) return
+        credential = Credential(taskId, goodsId, attemptId, generation, completedAt, accessibility, foregroundRevision)
+    }
+
+    @Synchronized fun eligible(
+        execution: Execution, taskId: Long, goodsId: String, phase: String, attemptId: String,
+        accessibility: Any, foregroundRevision: Long, now: Long,
+    ): Boolean {
+        if (evaluatedGeneration == execution.generation) return false
+        evaluatedGeneration = execution.generation
+        val prior = execution.previous ?: return false
+        val eligible = generation == execution.generation && invalidatedGeneration != execution.generation &&
+            prior.generation + 1 == execution.generation && phase == "purchase" &&
+            prior.taskId == taskId && prior.goodsId == goodsId && attemptId.isNotBlank() && prior.sourceAttemptId != attemptId &&
+            prior.accessibility === accessibility && prior.foregroundRevision == foregroundRevision &&
+            now - prior.completedAt in 0 until 30_000L
+        if (eligible) authorizedGeneration = execution.generation
+        return eligible
+    }
+
+    /** Revalidate the already consumed credential after a potentially slow fresh capture; never creates another. */
+    @Synchronized fun stillValid(execution: Execution, accessibility: Any?, foregroundRevision: Long, now: Long): Boolean {
+        val prior = execution.previous ?: return false
+        return authorizedGeneration == execution.generation && generation == execution.generation &&
+            invalidatedGeneration != execution.generation && prior.accessibility === accessibility &&
+            prior.foregroundRevision == foregroundRevision && now - prior.completedAt in 0 until 30_000L
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/automation/PurchaseRehearsalExecutor.kt

@@ -16,6 +16,9 @@ interface PurchaseUiDriver {
         result = clickFresh(target),
         reason = FreshClickReason.UNKNOWN,
     )
+    /** Recheck after fresh-node Binder reads and immediately before a browser navigation click. */
+    fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome =
+        if (allowed()) clickFreshDetailed(target) else FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.UNKNOWN)
     /**
      * Reacquires one address-entry node by its accessibility path and validates
      * its immutable snapshot traits before clicking its nearest clickable
@@ -85,6 +88,7 @@ data class PurchaseExecutionInput(
     val minUnitPriceCent: Long,
     val maxUnitPriceCent: Long,
     val addressSuffix: String = "",
+    val reuseProbeProduct: Boolean = false,
 )
 
 data class PurchaseExecutionOutcome(
@@ -109,6 +113,9 @@ class PurchaseRehearsalExecutor(
     private val panelDiagnostic: (String) -> Unit = {},
     private val beforeOrderSubmit: (FinalConfirmationEvidence) -> Unit = { throw PurchaseLiveException("PURCHASE_MODE_NOT_ALLOWED", "当前执行器没有正式采购授权") },
     private val probeClickDiagnostic: (AgentDiagnosticStage, SnapshotNode, FreshClickOutcome) -> Unit = { _, _, _ -> },
+    private val acceptedLaunchPath: () -> PddLaunchPath? = { null },
+    private val monotonicNow: () -> Long = { System.nanoTime() / 1_000_000L },
+    private val confirmProbeHandoff: () -> Boolean = { true },
 ) {
     private var purchasePanelContext: PurchasePanelContext? = null
 
@@ -121,12 +128,9 @@ class PurchaseRehearsalExecutor(
         val specSelectionProofs = mutableMapOf<String, ExactSpecSelectionProof>()
         val live = PurchaseLiveAutomation(driver, pause, panelDiagnostic)
         for (action in rule.actions) {
-            // The immediate phase-two handoff can reuse the PDD page retained by
-            // spec_probe. A later manual retry may start from Agent (or another
-            // unrelated screen), so only skip navigation when a fresh snapshot
-            // still carries safe PDD product/spec evidence.
+            // Only the service's one-shot probe handoff permits reuse; fresh structure alone is insufficient.
             if (
-                input.phase == "purchase" &&
+                input.phase == "purchase" && input.reuseProbeProduct &&
                 action.type == PurchaseActionType.OPEN_PRODUCT &&
                 canReuseCurrentProduct(input)
             ) continue
@@ -205,7 +209,7 @@ class PurchaseRehearsalExecutor(
 
     private fun canReuseCurrentProduct(input: PurchaseExecutionInput): Boolean =
         currentScreen(input).let { screen ->
-            screen.problem == null && screen.hasPurchaseProductEvidence()
+            screen.problem == null && screen.hasPurchaseProductEvidence() && confirmProbeHandoff()
         }
 
     private fun validateBeforeDeviceAction(
@@ -260,57 +264,38 @@ class PurchaseRehearsalExecutor(
 
     private fun openProduct(input: PurchaseExecutionInput, action: PurchaseAction): PurchaseExecutionOutcome? {
         purchasePanelContext = null
+        val startedAt = monotonicNow()
         if (!openLink(input.url)) return failure("PDD_LINK_INVALID", "任务中的 PDD 链接无法打开")
+        val readiness = PurchaseNavigationReadiness(startedAt, acceptedLaunchPath(), monotonicNow())
         val aliases = action.textAliases ?: listOf("打开拼多多APP", "打开拼多多 App", "打开")
-        var clickAttempted = false
-        var nextClickPoll = 0
-        var lastClickReason = FreshClickReason.UNKNOWN
-        var stableEvidenceReads = 0
-        var pddForegroundObserved = false
-        repeat(OPEN_PRODUCT_POLL_LIMIT) { poll ->
+        repeat(300) {
+            if (readiness.expired(monotonicNow())) return navigationTimeout()
             val snapshot = driver.capture()
+            if (readiness.expired(monotonicNow())) return navigationTimeout()
             pageProblem(snapshot)?.let { return it }
-            if (snapshot.packageName == PDD_PACKAGE) {
-                pddForegroundObserved = true
-                val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null)
-                stableEvidenceReads = if (screen.hasPurchaseProductEvidence()) stableEvidenceReads + 1 else 0
-                if (stableEvidenceReads >= PRODUCT_PAGE_STABLE_READS) return null
-                pause(OPEN_PRODUCT_POLL_MILLIS)
-                return@repeat
-            }
-            stableEvidenceReads = 0
-            val candidates = snapshot.nodes.filter { it.visible && it.enabled && it.label in aliases }
-            if (candidates.size > 1) return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
-            if (candidates.size == 1 && poll >= nextClickPoll) {
-                clickAttempted = true
-                val outcome = driver.clickFreshDetailed(candidates.single())
-                lastClickReason = outcome.reason
-                if (outcome.result == FreshActionResult.AMBIGUOUS) {
-                    return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
+            val screen = PddScreenParser.parse(snapshot, DEFAULT_COLLECTOR, input.goodsId, null)
+            val key = if (screen.problem == null && screen.hasPurchaseProductEvidence()) ProductStabilityKey(
+                screen.summary.title, screen.specEntry != null, screen.quickConfirmationEntry != null, screen.specPanelOpen,
+            ) else null
+            if (readiness.observe(monotonicNow(), snapshot.packageName, key)) return null
+            if (readiness.mayClickBrowser(monotonicNow(), snapshot.packageName)) {
+                val candidates = snapshot.nodes.filter { it.visible && it.enabled && it.label in aliases }
+                if (candidates.size > 1) return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
+                if (candidates.size == 1 && !readiness.expired(monotonicNow())) {
+                    val outcome = driver.clickNavigationFresh(candidates.single()) { !readiness.expired(monotonicNow()) }
+                    readiness.clicked(monotonicNow())
+                    if (readiness.expired(monotonicNow())) return navigationTimeout()
+                    if (outcome.result == FreshActionResult.AMBIGUOUS) return failure("RULE_AMBIGUOUS", "打开拼多多按钮不唯一")
                 }
-                // The browser can rerender while handing the URL to PDD, and
-                // ACTION_CLICK may report false after the app transition has
-                // already started. The observed PDD foreground is the success
-                // condition; retry only this unique target after a short bound.
-                nextClickPoll = poll + OPEN_PRODUCT_RETRY_POLLS
             }
-            pause(OPEN_PRODUCT_POLL_MILLIS)
+            if (readiness.expired(monotonicNow())) return navigationTimeout()
+            pause(100)
         }
-        if (pddForegroundObserved) {
-            return failure("PDD_DETAIL_ENTRY_FAILED", "打开拼多多后未识别到稳定商品页面")
-        }
-        if (clickAttempted) {
-            val message = when (lastClickReason) {
-                FreshClickReason.ROOT_UNAVAILABLE, FreshClickReason.TARGET_NOT_FOUND -> "打开拼多多入口发生变化"
-                FreshClickReason.NO_CLICKABLE_ANCESTOR -> "打开拼多多入口暂时无法点击"
-                FreshClickReason.ACTION_CLICK_FALSE -> "打开拼多多后未进入商品页面"
-                else -> "打开拼多多失败"
-            }
-            return failure("RULE_ACTION_FAILED", message)
-        }
-        return failure("PDD_DETAIL_ENTRY_FAILED", "没有进入拼多多商品页面")
+        return navigationTimeout()
     }
 
+    private fun navigationTimeout() = failure("PDD_DETAIL_ENTRY_FAILED", "打开拼多多后未识别到稳定商品页面")
+
     private fun verifyProduct(input: PurchaseExecutionInput): PurchaseExecutionOutcome? {
         var stableEvidenceReads = 0
         repeat(PRODUCT_PAGE_POLL_LIMIT) {
@@ -1267,10 +1252,8 @@ class PurchaseRehearsalExecutor(
 
     companion object {
         private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
-        private const val OPEN_PRODUCT_POLL_LIMIT = 150
         private const val PRODUCT_PAGE_POLL_LIMIT = 150
         private const val PRODUCT_PAGE_STABLE_READS = 2
-        private const val OPEN_PRODUCT_RETRY_POLLS = 10
         private const val OPEN_PRODUCT_POLL_MILLIS = 100L
         private const val SPEC_ENTRY_READY_WAIT_POLLS = 20
         private const val SPEC_ENTRY_READY_POLL_MILLIS = 100L

android/app/src/main/java/cn/ilapage/goauto/agent/automation/SpecValueNormalizer.kt

@@ -13,6 +13,20 @@ object SpecValueNormalizer {
 
     fun normalizeSize(value: String): String = normalizeTrailingPrice(value)
 
+    /** Final purchase confirmation only: display equivalents, never semantic/content removal. */
+    fun normalizeFinalConfirmation(value: String): String = buildString {
+        value.forEach { ch ->
+            append(when (ch) {
+                '【', '〔', '［' -> '['
+                '】', '〕', '］' -> ']'
+                '（' -> '('
+                '）' -> ')'
+                in 'Ａ'..'Ｚ', in 'ａ'..'ｚ', in '０'..'９' -> (ch.code - 0xFEE0).toChar()
+                else -> if (ch.isWhitespace()) ' ' else ch
+            })
+        }
+    }.replace(Regex(" +"), " ").trim()
+
     /** The same terminal-price grammar as normalization; never reads numbers inside a spec. */
     internal fun trailingPriceAmount(value: String): java.math.BigDecimal? =
         trailingPrice.find(value)?.value?.replace(currency, "")?.trim()?.toBigDecimalOrNull()

android/app/src/main/java/cn/ilapage/goauto/agent/diagnostics/AccessibilitySnapshotSource.kt

@@ -0,0 +1,102 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+import android.graphics.Rect
+import android.os.Build
+import android.view.accessibility.AccessibilityNodeInfo
+import android.view.accessibility.AccessibilityWindowInfo
+import cn.ilapage.goauto.agent.automation.GoAutoAccessibilityService
+import cn.ilapage.goauto.agent.BuildConfig
+
+/** Independent getWindows adapter. The normal capture()/UiSnapshot parser stays untouched. */
+class AccessibilitySnapshotSource(private val service: GoAutoAccessibilityService) {
+    fun windows(): List<SnapshotWindow> {
+        // This guard is part of the timed synchronous sampling callback, not a preceding unbounded read.
+        val started = System.nanoTime()
+        val foreground = try { service.currentPackage() } catch (_: Exception) { throw SnapshotUnavailableException("accessibility_unavailable") }
+        if (foreground == BuildConfig.APPLICATION_ID) throw SnapshotUnavailableException("execution_not_entered")
+        if ((System.nanoTime() - started) / 1_000_000 >= 1500) throw SnapshotUnavailableException("time_limit")
+        return service.windows.map { Window(it) }
+    }
+
+    private inner class Window(private val window: AccessibilityWindowInfo) : SnapshotWindow {
+        private var cachedRoot: AccessibilityNodeInfo? = null
+        private var rootRead = false
+        private fun rawRoot(): AccessibilityNodeInfo? {
+            if (!rootRead) { cachedRoot = window.root; rootRead = true }
+            return cachedRoot
+        }
+        override fun attribute(name: String): SnapshotAttribute = read {
+            when (name) {
+                "id" -> window.id
+                "type" -> window.type
+                "layer" -> window.layer
+                "title" -> if (Build.VERSION.SDK_INT >= 24) window.title else return SnapshotAttribute(state="unsupported")
+                "active" -> window.isActive
+                "focused" -> window.isFocused
+                "bounds" -> Rect().also(window::getBoundsInScreen).flatten()
+                "packageName" -> rawRoot()?.packageName
+                "activityName" -> if (window.isActive) service.currentActivity() else null
+                else -> return SnapshotAttribute(state="unsupported")
+            }
+        }
+        override fun root(): SnapshotNode? = rawRoot()?.let { Node(AccessibilityNodeInfo.obtain(it)) }
+        @Suppress("DEPRECATION")
+        override fun close() { cachedRoot?.recycle(); window.recycle() }
+    }
+
+    private class Node(private val node: AccessibilityNodeInfo) : SnapshotNode {
+        override fun attribute(name: String): SnapshotAttribute = read {
+            when (name) {
+                "text" -> node.text
+                "resource-id" -> node.viewIdResourceName
+                "class" -> node.className
+                "package" -> node.packageName
+                "content-desc" -> node.contentDescription
+                "checkable" -> node.isCheckable
+                "checked" -> node.isChecked
+                "clickable" -> node.isClickable
+                "enabled" -> node.isEnabled
+                "focusable" -> node.isFocusable
+                "focused" -> node.isFocused
+                "scrollable" -> node.isScrollable
+                "long-clickable" -> node.isLongClickable
+                "password" -> node.isPassword
+                "selected" -> node.isSelected
+                "bounds" -> Rect().also(node::getBoundsInScreen).flatten()
+                "visible-to-user" -> node.isVisibleToUser
+                "editable" -> node.isEditable
+                "hint" -> if (Build.VERSION.SDK_INT >= 26) node.hintText else return SnapshotAttribute(state="unsupported")
+                "state-description" -> if (Build.VERSION.SDK_INT >= 30) node.stateDescription else return SnapshotAttribute(state="unsupported")
+                "tooltip" -> if (Build.VERSION.SDK_INT >= 28) node.tooltipText else return SnapshotAttribute(state="unsupported")
+                "input-type" -> node.inputType
+                "max-text-length" -> node.maxTextLength
+                "drawing-order" -> if (Build.VERSION.SDK_INT >= 24) node.drawingOrder else return SnapshotAttribute(state="unsupported")
+                "collection-row-count" -> node.collectionInfo?.rowCount
+                "collection-column-count" -> node.collectionInfo?.columnCount
+                "collection-hierarchical" -> node.collectionInfo?.isHierarchical
+                "collection-selection-mode" -> node.collectionInfo?.selectionMode
+                "collection-item-row-index" -> node.collectionItemInfo?.rowIndex
+                "collection-item-row-span" -> node.collectionItemInfo?.rowSpan
+                "collection-item-column-index" -> node.collectionItemInfo?.columnIndex
+                "collection-item-column-span" -> node.collectionItemInfo?.columnSpan
+                "collection-item-heading" -> node.collectionItemInfo?.isHeading
+                "collection-item-selected" -> node.collectionItemInfo?.isSelected
+                "range-type" -> node.rangeInfo?.type
+                "range-min" -> node.rangeInfo?.min
+                "range-max" -> node.rangeInfo?.max
+                "range-current" -> node.rangeInfo?.current
+                else -> return SnapshotAttribute(state="unsupported")
+            }
+        }
+        override fun childCount() = node.childCount
+        override fun child(index: Int) = node.getChild(index)?.let(::Node)
+        override fun actions() = node.actionList.map { it.id to read { it.label } }
+        @Suppress("DEPRECATION")
+        override fun close() = node.recycle()
+    }
+
+    companion object {
+        private inline fun read(block: () -> Any?): SnapshotAttribute = try { SnapshotAttribute(block()?.toString()) } catch (_: Exception) { SnapshotAttribute(state="read_error") }
+        private fun Rect.flatten() = "[$left,$top][$right,$bottom]"
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/diagnostics/FailureSnapshotCapture.kt

@@ -0,0 +1,20 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+/** Synchronous capture boundary; persistence/upload must never move the live read onto another task. */
+class FailureSnapshotCapture(
+    private val hasArchive: (String) -> Boolean,
+    private val persist: (FailureSnapshot) -> Unit,
+    private val exporter: FailureSnapshotExporter = FailureSnapshotExporter(),
+) {
+    fun record(context: SnapshotContext?, resultType: String, safelyStored: Boolean, executionEntered: Boolean,
+               accessibilityAvailable: Boolean, windows: () -> List<SnapshotWindow>, unavailableReason: String? = null) {
+        if (context == null || !FailureSnapshotPolicy.eligible(context.phase,resultType,safelyStored) || hasArchive(context.taskAttemptId)) return
+        val reason = unavailableReason ?: when {
+            !executionEntered -> "execution_not_entered"
+            !accessibilityAvailable -> "accessibility_unavailable"
+            else -> null
+        }
+        val snapshot = try { exporter.capture(context, reason, windows) } catch (_: Exception) { exporter.notCaptured(context,"capture_failed") }
+        persist(snapshot)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/diagnostics/FailureSnapshotExporter.kt

@@ -0,0 +1,304 @@
+package cn.ilapage.goauto.agent.diagnostics
+
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.ByteArrayOutputStream
+import java.text.SimpleDateFormat
+import java.util.ArrayDeque
+import java.util.Date
+import java.util.Locale
+import java.util.TimeZone
+import java.util.zip.ZipEntry
+import java.util.zip.ZipOutputStream
+
+data class FailureSnapshot(val metadataJson: String, val archive: ByteArray?, val serverOrigin: String = "")
+class SnapshotUnavailableException(val reason: String) : Exception(reason)
+data class SnapshotAttribute(val value: String? = null, val state: String = if (value == null) "null" else "value")
+interface SnapshotNode {
+    fun attribute(name: String): SnapshotAttribute
+    fun childCount(): Int
+    fun child(index: Int): SnapshotNode?
+    fun actions(): List<Pair<Int, SnapshotAttribute>> = emptyList()
+    fun close() {}
+}
+interface SnapshotWindow {
+    fun attribute(name: String): SnapshotAttribute
+    fun root(): SnapshotNode?
+    fun close() {}
+}
+data class SnapshotContext(
+    val taskId: Long, val deviceId: Long, val taskAttemptId: String, val phase: String,
+    val ruleSnapshotHash: String?, val errorCode: String, val agentVersion: String,
+    val source: String, val serverOrigin: String = "",
+)
+
+object FailureSnapshotPolicy {
+    fun eligible(phase: String, result: String, safelyStored: Boolean) =
+        !safelyStored && phase in setOf("purchase", "spec_probe") && result in setOf("failed", "order_result_unknown")
+    fun retryUpload(httpStatus: Int) = httpStatus == 0 || httpStatus in setOf(408, 429) || httpStatus >= 500
+    fun exceptionEligible(knownResult: String?, safelyStored: Boolean) = !safelyStored &&
+        knownResult !in setOf("spec_probe_completed", "order_created", "rehearsal_completed")
+}
+
+/** No extras, reflection, screenshots, parsing or text normalization. */
+object SnapshotXml {
+    private const val alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+    val contentAttributes = setOf("text", "content-desc", "hint", "state-description", "tooltip")
+    val attributes = listOf("text", "resource-id", "class", "package", "content-desc", "checkable", "checked", "clickable", "enabled", "focusable", "focused", "scrollable", "long-clickable", "password", "selected", "bounds", "visible-to-user", "editable", "hint", "state-description", "tooltip", "input-type", "max-text-length", "drawing-order", "collection-row-count", "collection-column-count", "collection-hierarchical", "collection-selection-mode", "collection-item-row-index", "collection-item-row-span", "collection-item-column-index", "collection-item-column-span", "collection-item-heading", "collection-item-selected", "range-type", "range-min", "range-max", "range-current")
+    fun decode(value: String): String {
+        val output = ByteArrayOutputStream()
+        var accumulator = 0; var bits = 0
+        for (c in value) {
+            if (c == '=') break
+            val digit = alphabet.indexOf(c); require(digit >= 0)
+            accumulator = (accumulator shl 6) or digit; bits += 6
+            if (bits >= 8) { bits -= 8; output.write((accumulator shr bits) and 255) }
+        }
+        val bytes = output.toByteArray()
+        return CharArray(bytes.size / 2) { ((bytes[it * 2].toInt() and 255) * 256 + (bytes[it * 2 + 1].toInt() and 255)).toChar() }.concatToString()
+    }
+    private fun encode(value: String): String {
+        val bytes = ByteArray(value.length * 2)
+        value.forEachIndexed { index, c -> bytes[index * 2] = (c.code shr 8).toByte(); bytes[index * 2 + 1] = c.code.toByte() }
+        val encoded = StringBuilder((bytes.size + 2) / 3 * 4)
+        var index = 0
+        while (index < bytes.size) {
+            val remaining = bytes.size - index
+            val value24 = ((bytes[index].toInt() and 255) shl 16) or
+                (if (remaining > 1) (bytes[index + 1].toInt() and 255) shl 8 else 0) or
+                (if (remaining > 2) bytes[index + 2].toInt() and 255 else 0)
+            encoded.append(alphabet[(value24 shr 18) and 63]).append(alphabet[(value24 shr 12) and 63])
+                .append(if (remaining > 1) alphabet[(value24 shr 6) and 63] else '=')
+                .append(if (remaining > 2) alphabet[value24 and 63] else '=')
+            index += 3
+        }
+        return encoded.toString()
+    }
+    private fun legal(value: String): Boolean {
+        var i = 0
+        while (i < value.length) {
+            val c = value[i].code
+            if (c in 0xD800..0xDBFF) {
+                if (i + 1 >= value.length || value[i + 1].code !in 0xDC00..0xDFFF) return false
+                i += 2; continue
+            }
+            if (!(c == 9 || c == 10 || c == 13 || c in 0x20..0xD7FF || c in 0xE000..0xFFFD)) return false
+            i++
+        }
+        return true
+    }
+    fun attribute(name: String, attr: SnapshotAttribute): String {
+        if (attr.state != "value") return " $name-state=\"${attr.state}\""
+        val value = attr.value ?: return " $name-state=\"null\""
+        if (!legal(value)) return " $name-base64=\"${encode(value)}\""
+        return " $name=\"" + value.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;").replace("\"", "&quot;").replace("\n", "&#10;").replace("\r", "&#13;").replace("\t", "&#9;") + "\""
+    }
+}
+
+class FailureSnapshotExporter(
+    private val nodeLimit: Int = 5000,
+    private val timeLimitMillis: Long = 1500,
+    private val expandedLimit: Int = 8 * 1024 * 1024,
+    private val archiveLimit: Int = 2 * 1024 * 1024,
+    private val monotonicMillis: () -> Long = { System.nanoTime() / 1_000_000 },
+    private val epochMillis: () -> Long = System::currentTimeMillis,
+) {
+    fun notCaptured(context: SnapshotContext, reason: String): FailureSnapshot = capture(context, reason) { emptyList() }
+
+    fun capture(context: SnapshotContext, unavailableReason: String? = null, windows: () -> List<SnapshotWindow>): FailureSnapshot {
+        val now = timestamp(epochMillis())
+        val reasons = linkedSetOf<String>()
+        val metadata = JSONObject().put("schemaVersion", 1).put("attributeVersion", 1)
+            .put("taskId", context.taskId).put("deviceId", context.deviceId).put("taskAttemptId", context.taskAttemptId)
+            .put("phase", context.phase).put("errorCode", context.errorCode.take(64)).put("agentVersion", context.agentVersion.take(64))
+            .put("recordedAt", now).put("source", context.source)
+        val validHash = context.ruleSnapshotHash?.matches(Regex("[a-f0-9]{64}")) == true
+        metadata.put("ruleSnapshotHash", if (validHash) context.ruleSnapshotHash else JSONObject.NULL).put("ruleSnapshotHashValid", validHash)
+        val windowMetadata = JSONArray()
+        val files = linkedMapOf<String, ByteArray>()
+        data class Cut(val offset: Int, val openNodes: Int)
+        val fileCuts = mutableMapOf<String, List<Cut>>()
+        metadata.put("windows", windowMetadata)
+        val start = monotonicMillis()
+        var count = 0
+        var expanded = 0
+        fun timeAvailable(): Boolean {
+            if (monotonicMillis() - start >= timeLimitMillis) { reasons.add("time_limit"); return false }
+            return true
+        }
+        if (!validHash) reasons.add("rule_hash_invalid")
+        else if (unavailableReason != null) reasons.add(unavailableReason)
+        else {
+            val sources = try { if (timeAvailable()) windows() else emptyList() } catch (error: SnapshotUnavailableException) {
+                reasons.add(error.reason); emptyList()
+            } catch (_: UnsupportedOperationException) {
+                reasons.add("windows_unsupported"); emptyList()
+            } catch (_: Exception) { reasons.add("windows_unavailable"); emptyList() }
+            try {
+                for (window in sources) {
+                    if (!timeAvailable()) break
+                    // Bound the metadata separately from the expanded archive; retain explicit partial evidence.
+                    if (windowMetadata.length() >= 128 || windowMetadata.toString().toByteArray(Charsets.UTF_8).size > 32 * 1024) { reasons.add("expanded_size_limit"); break }
+                    val wm = JSONObject().put("capturedAt", now).put("fileName", JSONObject.NULL)
+                    val states = JSONObject()
+                    val wr = linkedSetOf<String>()
+                    val fields = listOf("id", "type", "layer", "title", "active", "focused", "bounds", "packageName", "activityName")
+                    for (name in fields) {
+                        if (!timeAvailable()) { wm.put(name, JSONObject.NULL); states.put(name, "read_error"); wr.add("time_limit"); continue }
+                        val value = try { window.attribute(name) } catch (_: Exception) { SnapshotAttribute(state="read_error") }
+                        if (!timeAvailable()) wr.add("time_limit")
+                        if (value.state == "read_error") wr.add("window_read_error")
+                        if (value.value != null && value.value.length > 4096) {
+                            wm.put(name, JSONObject.NULL); states.put(name, "read_error"); wr.add("expanded_size_limit")
+                        } else if (value.state != "value" || value.value == null) {
+                            wm.put(name, JSONObject.NULL); states.put(name, value.state)
+                        } else when (name) {
+                            "id", "type", "layer" -> {
+                                val number = value.value.toIntOrNull()
+                                wm.put(name, number ?: JSONObject.NULL)
+                                if (number == null) { states.put(name,"read_error"); wr.add("window_read_error") }
+                            }
+                            "active", "focused" -> wm.put(name, value.value == "true")
+                            else -> wm.put(name, value.value)
+                        }
+                    }
+                    wm.put("attributeStates", states)
+                    windowMetadata.put(wm)
+                    val id = if (wm.isNull("id")) null else wm.getInt("id")
+                    val fileName = id?.let { "window-$it.xml" }
+                    var root: SnapshotNode? = null
+                    if (fileName != null && !files.containsKey(fileName) && timeAvailable()) {
+                        root = try { window.root() } catch (_: Exception) { wr.add("window_read_error"); null }
+                        if (!timeAvailable()) { root?.close(); root = null; wr.add("time_limit") }
+                        else if (root == null) wr.add("window_root_null")
+                    } else if (fileName == null || files.containsKey(fileName)) wr.add("window_read_error")
+                    if (root != null) {
+                        val xml = StringBuilder("<?xml version=\"1.0\" encoding=\"UTF-8\"?><hierarchy>")
+                        var bytes = xml.length
+                        data class Frame(val node: SnapshotNode, val path: String, var next: Int = -1, var children: Int = 0)
+                        val stack = ArrayDeque<Frame>()
+                        stack.push(Frame(root, "0"))
+                        var emitted = 0
+                        val cuts = mutableListOf<Cut>()
+                        try {
+                            while (stack.isNotEmpty()) {
+                                val frame = requireNotNull(stack.peek())
+                                if (!timeAvailable()) { wr.add("time_limit"); break }
+                                if (frame.next == -1) {
+                                    if (count >= nodeLimit || stack.size > 250) { wr.add("node_limit"); break }
+                                    val attrs = StringBuilder("<node index=\"${frame.path.substringAfterLast('/')}\" path=\"${frame.path}\"")
+                                    fun read(name: String): SnapshotAttribute {
+                                        if (!timeAvailable()) { wr.add("time_limit"); return SnapshotAttribute(state="read_error") }
+                                        val a = try { frame.node.attribute(name) } catch (_: Exception) { SnapshotAttribute(state="read_error") }
+                                        if (!timeAvailable()) wr.add("time_limit")
+                                        if (a.state == "read_error") wr.add("node_read_error")
+                                        return a
+                                    }
+                                    val password = read("password")
+                                    // Fail closed if password status is unavailable: do not retain content-bearing fields.
+                                    val omitContent = password.state != "value" || password.value == "true"
+                                    var tooLarge = false
+                                    for (name in SnapshotXml.attributes) {
+                                        if (omitContent && name in SnapshotXml.contentAttributes) continue
+                                        val value = if (name == "password") password else read(name)
+                                        if ((value.value?.length ?: 0) > expandedLimit / 4) { tooLarge = true; break }
+                                        attrs.append(SnapshotXml.attribute(name, value))
+                                        if (attrs.length > expandedLimit / 4) { tooLarge = true; break }
+                                    }
+                                    var childCountState: String? = null
+                                    frame.children = try { if (timeAvailable()) frame.node.childCount().coerceAtLeast(0) else { childCountState = "read_error"; 0 } } catch (_: Exception) { wr.add("node_read_error"); childCountState = "read_error"; 0 }
+                                    if (!timeAvailable()) wr.add("time_limit")
+                                    attrs.append(if (childCountState == null) " child-count=\"${frame.children}\"" else " child-count-state=\"$childCountState\"")
+                                    var actionsReadError = false
+                                    val actions = try { if (timeAvailable()) frame.node.actions() else { actionsReadError = true; emptyList() } } catch (_: Exception) { wr.add("node_read_error"); actionsReadError = true; emptyList() }
+                                    if (actionsReadError) attrs.append(" actions-state=\"read_error\"")
+                                    attrs.append('>')
+                                    if (!timeAvailable()) wr.add("time_limit")
+                                    for ((actionId, label) in actions) {
+                                        attrs.append("<action id=\"$actionId\"")
+                                        if (!omitContent) {
+                                            if ((label.value?.length ?: 0) > expandedLimit / 4) { tooLarge = true; break }
+                                            attrs.append(SnapshotXml.attribute("label", label))
+                                            if (label.state == "read_error") wr.add("node_read_error")
+                                        }
+                                        attrs.append("/>")
+                                        if (attrs.length > expandedLimit / 4 || !timeAvailable()) { tooLarge = true; break }
+                                    }
+                                    val addition = attrs.toString().toByteArray(Charsets.UTF_8).size
+                                    if (tooLarge || expanded + bytes + addition + stack.size * 7 + 65536 >= expandedLimit) { wr.add("expanded_size_limit"); break }
+                                    if (!timeAvailable()) { wr.add("time_limit"); break }
+                                    cuts.add(Cut(xml.length, stack.size - 1))
+                                    xml.append(attrs); bytes += addition; count++; emitted++; frame.next = 0
+                                } else if (frame.next >= frame.children) {
+                                    xml.append("</node>"); bytes += 7; stack.pop().node.close()
+                                } else {
+                                    if (count >= nodeLimit) { wr.add("node_limit"); break }
+                                    val index = frame.next++
+                                    val child = try { frame.node.child(index) } catch (_: Exception) { wr.add("node_read_error"); null }
+                                    if (child == null) wr.add("window_disappeared")
+                                    else stack.push(Frame(child, "${frame.path}/$index"))
+                                }
+                            }
+                        } finally {
+                            while (stack.isNotEmpty()) {
+                                val frame = stack.pop()
+                                if (frame.next >= 0) xml.append("</node>")
+                                runCatching { frame.node.close() }
+                            }
+                        }
+                        xml.append("</hierarchy>")
+                        if (emitted > 0) {
+                            val content = xml.toString().toByteArray(Charsets.UTF_8)
+                            files[requireNotNull(fileName)] = content; expanded += content.size
+                            fileCuts[fileName] = cuts
+                            wm.put("fileName", fileName)
+                        }
+                    }
+                    wm.put("status", if (wr.isEmpty() && !wm.isNull("fileName")) "complete" else "partial").put("reasons", JSONArray(wr.toList()))
+                    reasons.addAll(wr)
+                }
+            } finally { sources.forEach { runCatching { it.close() } } }
+            if (sources.isEmpty() && reasons.isEmpty()) reasons.add("windows_unavailable")
+        }
+        fun finishMetadata() {
+            metadata.put("status", if (files.isEmpty()) "not_captured" else if (reasons.isEmpty()) "complete" else "partial")
+                .put("capturedAt", if (files.isEmpty()) JSONObject.NULL else now).put("reasons", JSONArray(reasons.toList()))
+        }
+        finishMetadata()
+        var archive: ByteArray? = null
+        while (files.isNotEmpty()) {
+            val output = ByteArrayOutputStream()
+            ZipOutputStream(output).use { zip ->
+                zip.setLevel(1)
+                fun entry(name: String, data: ByteArray) { zip.putNextEntry(ZipEntry(name).apply { time = 0 }); zip.write(data); zip.closeEntry() }
+                entry("manifest.json", metadata.toString().toByteArray(Charsets.UTF_8))
+                files.forEach { (name, data) -> entry(name, data) }
+            }
+            val alreadyTimedOut = "time_limit" in reasons
+            if (!timeAvailable() && !alreadyTimedOut) { finishMetadata(); continue }
+            if (output.size() <= archiveLimit) { archive = output.toByteArray(); break }
+            reasons.add("archive_size_limit")
+            val removed = files.keys.last()
+            val cuts = fileCuts.getValue(removed)
+            if (cuts.size > 1) {
+                val index = (cuts.size / 2).coerceAtLeast(1)
+                val cut = cuts[index]
+                val prefix = String(files.getValue(removed), Charsets.UTF_8).substring(0, cut.offset)
+                files[removed] = (prefix + "</node>".repeat(cut.openNodes) + "</hierarchy>").toByteArray(Charsets.UTF_8)
+                fileCuts[removed] = cuts.take(index)
+            } else files.remove(removed)
+            for (i in 0 until windowMetadata.length()) {
+                val w = windowMetadata.getJSONObject(i)
+                if (w.optString("fileName") == removed) {
+                    if (removed !in files) w.put("fileName", JSONObject.NULL)
+                    w.put("status", "partial")
+                    if (!w.getJSONArray("reasons").toString().contains("archive_size_limit")) w.getJSONArray("reasons").put("archive_size_limit")
+                }
+            }
+            finishMetadata()
+        }
+        return FailureSnapshot(metadata.toString(), archive, context.serverOrigin)
+    }
+
+    private fun timestamp(millis: Long) = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", Locale.US).apply { timeZone = TimeZone.getTimeZone("UTC") }.format(Date(millis))
+}

android/app/src/main/java/cn/ilapage/goauto/agent/network/AgentApiClient.kt

@@ -100,8 +100,19 @@ data class PurchaseAgentTask(
     val ruleSnapshot: String,
     val ruleSnapshotHash: String,
     val leaseVersion: Long,
+    val attemptNumber: Int = 0,
 )
 
+data class PurchaseResultAcknowledgement(val pending: Boolean, val replayed: Boolean) {
+    companion object {
+        fun from(data: JSONObject) = PurchaseResultAcknowledgement(
+            pending = data.optString("status") == "pending",
+            // The server deliberately omits replayed=false. A malformed explicit value is not a first response.
+            replayed = data.has("replayed") && data.opt("replayed") != false,
+        )
+    }
+}
+
 data class CollectionHistoryItem(
     val taskId: Long,
     val attemptNumber: Int,
@@ -211,6 +222,47 @@ class AgentApiException(
 ) : Exception(message)
 
 class AgentApiClient(private val serverUrl: String) {
+    @Volatile var lastResponseServerTimeMillis: Long? = null
+        private set
+    val failureSnapshotOrigin: String get() = ServerUrlPolicy.normalize(serverUrl)
+    /** Stream the two bounded parts; never build another combined copy of the archive. */
+    fun uploadFailureSnapshot(snapshot: cn.ilapage.goauto.agent.diagnostics.FailureSnapshot, token: String) {
+        val metadata = snapshot.metadataJson.toByteArray(Charsets.UTF_8)
+        require(metadata.size <= 64 * 1024 && (snapshot.archive?.size ?: 0) <= 2 * 1024 * 1024)
+        val json = JSONObject(snapshot.metadataJson)
+        val taskId = json.getLong("taskId")
+        val attemptId = json.getString("taskAttemptId")
+        require(taskId > 0 && attemptId.matches(Regex("[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}")))
+        val boundary = "GoAuto-${UUID.randomUUID()}"
+        val prefix = "--$boundary\r\nContent-Disposition: form-data; name=\"metadata\"\r\nContent-Type: application/json; charset=UTF-8\r\n\r\n".toByteArray(Charsets.UTF_8)
+        val archiveHeader = if (snapshot.archive != null) "\r\n--$boundary\r\nContent-Disposition: form-data; name=\"archive\"; filename=\"failure-snapshot.zip\"\r\nContent-Type: application/zip\r\n\r\n".toByteArray(Charsets.UTF_8) else ByteArray(0)
+        val suffix = "\r\n--$boundary--\r\n".toByteArray(Charsets.UTF_8)
+        val origin = ServerUrlPolicy.normalize(serverUrl)
+        require(snapshot.serverOrigin.isEmpty() || origin == snapshot.serverOrigin)
+        val connection = (URL("$origin/api/agent/v1/purchase-tasks/$taskId/attempts/$attemptId/failure-snapshot").openConnection() as HttpURLConnection).apply {
+            requestMethod = "POST"; connectTimeout = 5000; readTimeout = 5000
+            doOutput = true; useCaches = false; instanceFollowRedirects = false
+            setFixedLengthStreamingMode(prefix.size + metadata.size + archiveHeader.size + (snapshot.archive?.size ?: 0) + suffix.size)
+            setRequestProperty("Content-Type", "multipart/form-data; boundary=$boundary")
+            setRequestProperty("Authorization", "Bearer $token")
+            setRequestProperty("Accept", "application/json")
+            setRequestProperty("Cache-Control", "no-store")
+        }
+        try {
+            connection.outputStream.use { output ->
+                output.write(prefix); output.write(metadata); output.write(archiveHeader)
+                snapshot.archive?.inputStream()?.use { it.copyTo(output, 16 * 1024) }
+                output.write(suffix)
+            }
+            val status = connection.responseCode
+            if (status !in 200..299) throw AgentApiException(status, "SNAPSHOT_UPLOAD_HTTP_$status", "诊断快照上传失败", cn.ilapage.goauto.agent.diagnostics.FailureSnapshotPolicy.retryUpload(status))
+            val response = connection.inputStream.bufferedReader(Charsets.UTF_8).use { it.readText() }
+            val data = JSONObject(response).getJSONObject("data")
+            check(data.getString("taskAttemptId") == attemptId && data.getString("status") == json.getString("status"))
+            data.getBoolean("replayed")
+        } finally { connection.disconnect() }
+    }
+
     fun backfillOrders(requestId: String, items: List<cn.ilapage.goauto.agent.automation.BackfillItem>, token: String): List<BackfillResult> =
         parseBackfillResults(post("/api/agent/v1/purchase-tasks/order-backfill", backfillPayload(requestId, items), token))
 
@@ -485,9 +537,10 @@ class AgentApiClient(private val serverUrl: String) {
         return purchaseTask(requireNotNull(request("POST", "/api/agent/v1/purchase-tasks/$taskId/order-submit-started", payload, token)).getJSONObject("data"))
     }
 
-    fun submitPurchaseResult(taskId: Long, payloadJson: String, token: String) {
+    fun submitPurchaseResult(taskId: Long, payloadJson: String, token: String): PurchaseResultAcknowledgement {
         val payload = JSONObject(payloadJson)
-        requireNotNull(request("POST", "/api/agent/v1/purchase-tasks/$taskId/result", payload, token))
+        val data = requireNotNull(request("POST", "/api/agent/v1/purchase-tasks/$taskId/result", payload, token)).getJSONObject("data")
+        return PurchaseResultAcknowledgement.from(data)
     }
 
     fun collectionHistory(token: String, page: Int, status: String?, taskNo: String?, days: Int = 30, pageSize: Int = 20): HistoryPage<CollectionHistoryItem> {
@@ -627,6 +680,7 @@ class AgentApiClient(private val serverUrl: String) {
     private fun purchaseTask(data: JSONObject) = PurchaseAgentTask(
         taskId = data.getLong("taskId"),
         taskAttemptId = data.optString("taskAttemptId"),
+        attemptNumber = data.optInt("attemptNumber"),
         phase = data.optString("phase"),
         executionMode = data.getString("executionMode"),
         status = data.getString("status"),
@@ -670,6 +724,9 @@ class AgentApiClient(private val serverUrl: String) {
                 connection.outputStream.use { it.write(payload.toString().toByteArray(Charsets.UTF_8)) }
             }
             val status = connection.responseCode
+            // Metadata only: batch cutoff must use the API clock, never the phone's clock.
+            // A missing Date invalidates the sample instead of retaining an older response.
+            lastResponseServerTimeMillis = connection.getHeaderFieldDate("Date", 0L).takeIf { it > 0L }
             if (status == HttpURLConnection.HTTP_NO_CONTENT) return null
             val stream = if (status in 200..299) connection.inputStream else connection.errorStream
             val body = stream?.bufferedReader(Charsets.UTF_8)?.use { it.readText() }.orEmpty()

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/AgentDiagnosticSchema.kt

@@ -1,7 +1,26 @@
 package cn.ilapage.goauto.agent.persistence
 
 internal object AgentDiagnosticSchema {
-    const val VERSION = 3
+    const val VERSION = 5
+
+    val failureSnapshotStatements = listOf(
+        """CREATE TABLE IF NOT EXISTS purchase_failure_snapshot (
+            attempt_id TEXT PRIMARY KEY, server_origin TEXT NOT NULL,
+            task_id INTEGER NOT NULL, device_id INTEGER NOT NULL, phase TEXT NOT NULL,
+            recorded_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+            source TEXT NOT NULL, status TEXT NOT NULL, metadata TEXT NOT NULL,
+            archive BLOB, fingerprint TEXT NOT NULL, size_bytes INTEGER NOT NULL
+        )""".trimIndent(),
+        """CREATE TABLE IF NOT EXISTS purchase_failure_snapshot_queue (
+            attempt_id TEXT PRIMARY KEY, fingerprint TEXT NOT NULL,
+            next_attempt_at INTEGER NOT NULL, attempts INTEGER NOT NULL DEFAULT 0
+        )""".trimIndent(),
+        """CREATE TABLE IF NOT EXISTS purchase_failure_snapshot_context (
+            attempt_id TEXT PRIMARY KEY, server_origin TEXT NOT NULL,
+            context TEXT NOT NULL, created_at INTEGER NOT NULL
+        )""".trimIndent(),
+        "CREATE INDEX IF NOT EXISTS idx_failure_snapshot_expiry ON purchase_failure_snapshot(expires_at)",
+    )
 
     val purchaseDiagnosticColumns = linkedMapOf(
         "task_type" to "TEXT", "task_attempt_id" to "TEXT", "device_id" to "INTEGER",
@@ -19,6 +38,12 @@ internal object AgentDiagnosticSchema {
         "horizontal_swipe_count" to "INTEGER",
     )
 
+    val colorDiscoveryOutcomeColumns = linkedMapOf(
+        "color_vertical_swipe_count" to "INTEGER",
+        "color_trailing_empty_read_count" to "INTEGER",
+        "color_horizontal_incomplete" to "INTEGER",
+    )
+
     val createTableSql =
         """CREATE TABLE agent_diagnostic (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -47,6 +72,9 @@ internal object AgentDiagnosticSchema {
             initial_selected_size_count INTEGER,
             selected_summary_present INTEGER,
             horizontal_swipe_count INTEGER,
+            color_vertical_swipe_count INTEGER,
+            color_trailing_empty_read_count INTEGER,
+            color_horizontal_incomplete INTEGER,
             task_type TEXT,
             task_attempt_id TEXT,
             device_id INTEGER,
@@ -65,7 +93,11 @@ internal object AgentDiagnosticSchema {
 
     fun migrationStatements(oldVersion: Int, newVersion: Int, existingColumns: Set<String>): List<String> =
         v2MigrationStatements(oldVersion, newVersion, existingColumns) +
-            if (oldVersion < 3 && newVersion >= 3) purchaseDiagnosticColumns.mapNotNull { (name, definition) ->
+            (if (oldVersion < 3 && newVersion >= 3) purchaseDiagnosticColumns.mapNotNull { (name, definition) ->
                 if (name in existingColumns) null else "ALTER TABLE agent_diagnostic ADD COLUMN $name $definition"
-            } else emptyList()
+            } else emptyList()) +
+            (if (oldVersion < 4 && newVersion >= 4) failureSnapshotStatements else emptyList()) +
+            (if (oldVersion < 5 && newVersion >= 5) colorDiscoveryOutcomeColumns.mapNotNull { (name, definition) ->
+                if (name in existingColumns) null else "ALTER TABLE agent_diagnostic ADD COLUMN $name $definition"
+            } else emptyList())
 }

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/AgentDiagnosticStore.kt

@@ -7,6 +7,7 @@ import android.database.sqlite.SQLiteOpenHelper
 import cn.ilapage.goauto.agent.BuildConfig
 
 enum class AgentDiagnosticStage {
+    PRODUCT_NAVIGATION,
     SPEC_ENTRY_CLICK,
     SPEC_ENTRY_GESTURE,
     QUICK_CONFIRMATION_CLICK,
@@ -24,6 +25,12 @@ enum class AgentDiagnosticStage {
 }
 
 enum class AgentDiagnosticReason {
+    NAV_DIRECT_ACCEPTED,
+    NAV_DIRECT_REJECTED,
+    NAV_DIRECT_EXCEPTION,
+    NAV_BROWSER_ACCEPTED,
+    NAV_BROWSER_REJECTED,
+    NAV_BROWSER_EXCEPTION,
     SIZE_ADVICE_CLICK_BLOCKED,
     DETAIL_ENTRY_MATCHED,
     SPEC_PANEL_OPENED,
@@ -114,6 +121,12 @@ data class AgentDiagnosticEvent(
     val deviceId: Long? = null,
     val phase: String? = null,
     val ruleSnapshotHash: String? = null,
+    /** Successfully dispatched UP swipes during this color discovery; null means unknown. */
+    val colorVerticalSwipeCount: Int? = null,
+    /** Consecutive empty parsed-color discovery rounds at termination, excluding click/price reads. */
+    val colorTrailingEmptyReadCount: Int? = null,
+    /** Required horizontal exploration still unresolved at termination; not needed or recovered is false. */
+    val colorHorizontalIncomplete: Boolean? = null,
 )
 
 class SafeAgentDiagnosticRecorder(
@@ -136,6 +149,7 @@ class AgentDiagnosticStore(context: Context) : SQLiteOpenHelper(context, DATABAS
     override fun onCreate(db: SQLiteDatabase) {
         db.execSQL(AgentDiagnosticSchema.createTableSql)
         db.execSQL("CREATE INDEX idx_agent_diagnostic_task ON agent_diagnostic(task_id, id)")
+        AgentDiagnosticSchema.failureSnapshotStatements.forEach(db::execSQL)
     }
 
     override fun onUpgrade(db: SQLiteDatabase, oldVersion: Int, newVersion: Int) {
@@ -196,10 +210,16 @@ class AgentDiagnosticStore(context: Context) : SQLiteOpenHelper(context, DATABAS
                 putNullableInt("initial_selected_size_count", event.initialSelectedSizeCount)
                 putNullableBoolean("selected_summary_present", event.selectedSummaryPresent)
                 putNullableInt("horizontal_swipe_count", event.horizontalSwipeCount)
+                putNullableInt("color_vertical_swipe_count", event.colorVerticalSwipeCount)
+                putNullableInt("color_trailing_empty_read_count", event.colorTrailingEmptyReadCount)
+                putNullableBoolean("color_horizontal_incomplete", event.colorHorizontalIncomplete)
                 put("agent_version", BuildConfig.VERSION_NAME)
                 put("created_at", event.createdAt)
             }
-            check(db.insert("agent_diagnostic", null, values) != -1L)
+            val insertedId = db.insertOrThrow("agent_diagnostic", null, values)
+            db.rawQuery("SELECT id FROM agent_diagnostic WHERE id=?", arrayOf(insertedId.toString())).use {
+                check(it.moveToFirst()) { "diagnostic_readback_failed" }
+            }
             db.delete("agent_diagnostic", "created_at < ?", arrayOf(AgentDiagnosticRetentionPolicy.cutoff(event.createdAt).toString()))
             db.execSQL(
                 "DELETE FROM agent_diagnostic WHERE id NOT IN " +

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/FailureSnapshotRepository.kt

@@ -0,0 +1,182 @@
+package cn.ilapage.goauto.agent.persistence
+
+import cn.ilapage.goauto.agent.diagnostics.FailureSnapshot
+import java.net.URI
+import java.security.MessageDigest
+import java.text.SimpleDateFormat
+import java.text.ParsePosition
+import java.util.Date
+import java.util.Locale
+import java.util.TimeZone
+import org.json.JSONObject
+
+/** Small SQL boundary shared by the Android adapter and real SQLite JVM tests. */
+internal interface FailureSnapshotDatabase {
+    fun execute(sql: String, args: List<Any?> = emptyList())
+    fun query(sql: String, args: List<Any?> = emptyList()): List<Map<String, Any?>>
+    fun <T> transaction(block: () -> T): T
+}
+
+internal class FailureSnapshotRepository(
+    private val db: FailureSnapshotDatabase,
+    private val clock: () -> Long = System::currentTimeMillis,
+    private val maxBytes: Long = 64L * 1024 * 1024,
+) {
+    @Synchronized
+    fun recordFailureSnapshotContext(taskId: Long, attemptId: String, deviceId: Long, phase: String, ruleSnapshotHash: String?, serverOrigin: String) {
+        validateIdentity(taskId, attemptId, deviceId, phase)
+        val origin = origin(serverOrigin)
+        val hash = ruleSnapshotHash?.takeIf(HASH::matches)
+        val now = clock()
+        val context = JSONObject().put("taskId", taskId).put("taskAttemptId", attemptId).put("deviceId", deviceId)
+            .put("phase", phase).put("ruleSnapshotHash", hash ?: JSONObject.NULL).put("ruleSnapshotHashValid", hash != null)
+            .put("recordedAt", utcFormat().format(Date(now))).put("serverOrigin", origin).toString()
+        db.execute("INSERT OR IGNORE INTO purchase_failure_snapshot_context (attempt_id,server_origin,context,created_at) VALUES (?,?,?,?)", listOf(attemptId, origin, context, now))
+    }
+
+    @Synchronized
+    fun failureSnapshotContext(attemptId: String): String? = db.query(
+        "SELECT context FROM purchase_failure_snapshot_context WHERE attempt_id=? AND created_at>?",
+        listOf(attemptId, clock() - RETENTION_MILLIS),
+    ).firstOrNull()?.get("context") as? String
+
+    @Synchronized
+    fun hasFailureSnapshotArchive(attemptId: String): Boolean = db.query(
+        "SELECT attempt_id FROM purchase_failure_snapshot WHERE attempt_id=? AND archive IS NOT NULL AND expires_at>?",
+        listOf(attemptId, clock()),
+    ).isNotEmpty()
+
+    @Synchronized
+    fun saveFailureSnapshot(snapshot: FailureSnapshot): Boolean {
+        require(snapshot.metadataJson.toByteArray(Charsets.UTF_8).size <= 64 * 1024)
+        require(snapshot.archive == null || snapshot.archive.size in 1..2 * 1024 * 1024)
+        val metadata = JSONObject(snapshot.metadataJson)
+        val taskId = metadata.getLong("taskId")
+        val attemptId = metadata.getString("taskAttemptId")
+        val deviceId = metadata.getLong("deviceId")
+        val phase = metadata.getString("phase")
+        validateIdentity(taskId, attemptId, deviceId, phase)
+        val serverOrigin = origin(snapshot.serverOrigin)
+        val recordedAt = parseTimestamp(metadata.getString("recordedAt"))
+        val status = metadata.getString("status")
+        val source = metadata.getString("source")
+        require(source in setOf("execution", "recovery"))
+        require(status in setOf("complete", "partial", "not_captured"))
+        require((status == "not_captured") == (snapshot.archive == null))
+        val validHash = metadata.getBoolean("ruleSnapshotHashValid")
+        require(if (validHash) HASH.matches(metadata.getString("ruleSnapshotHash")) else metadata.isNull("ruleSnapshotHash") && snapshot.archive == null)
+        val now = clock()
+        if (recordedAt <= now - RETENTION_MILLIS) return false
+        require(recordedAt <= now + 5 * 60_000)
+        val fingerprint = fingerprint(snapshot)
+        return db.transaction {
+            cleanup(now)
+            val old = db.query("SELECT archive IS NOT NULL AS has_archive,server_origin FROM purchase_failure_snapshot WHERE attempt_id=?", listOf(attemptId)).firstOrNull()
+            if (old != null && ((old["has_archive"] as Number).toInt() != 0 || old["server_origin"] != serverOrigin || snapshot.archive == null || source != "recovery")) return@transaction false
+            db.execute(
+                "INSERT OR REPLACE INTO purchase_failure_snapshot (attempt_id,server_origin,task_id,device_id,phase,recorded_at,expires_at,source,status,metadata,archive,fingerprint,size_bytes) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
+                listOf(attemptId, serverOrigin, taskId, deviceId, phase, recordedAt, recordedAt + RETENTION_MILLIS, source, status,
+                    snapshot.metadataJson, snapshot.archive, fingerprint, snapshot.metadataJson.toByteArray(Charsets.UTF_8).size.toLong() + (snapshot.archive?.size ?: 0)),
+            )
+            db.execute("INSERT OR REPLACE INTO purchase_failure_snapshot_queue (attempt_id,fingerprint,next_attempt_at,attempts) VALUES (?,?,?,0)", listOf(attemptId, fingerprint, now))
+            check(db.query("SELECT fingerprint FROM purchase_failure_snapshot WHERE attempt_id=?", listOf(attemptId)).single()["fingerprint"] == fingerprint)
+            cleanup(now)
+            db.query("SELECT attempt_id FROM purchase_failure_snapshot WHERE attempt_id=?", listOf(attemptId)).isNotEmpty()
+        }
+    }
+
+    @Synchronized
+    fun pendingFailureSnapshots(serverOrigin: String, nowMillis: Long = clock(), limit: Int = 1): List<FailureSnapshot> = db.transaction {
+        cleanup(nowMillis)
+        db.query("SELECT s.attempt_id,s.metadata,length(s.archive) AS archive_length,s.server_origin FROM purchase_failure_snapshot s JOIN purchase_failure_snapshot_queue q ON s.attempt_id=q.attempt_id AND s.fingerprint=q.fingerprint WHERE s.server_origin=? AND q.next_attempt_at<=? ORDER BY s.recorded_at,s.attempt_id LIMIT ?",
+            listOf(origin(serverOrigin), nowMillis, limit.coerceIn(1, 10))).map { row ->
+            val size = (row["archive_length"] as? Number)?.toInt()
+            require(size == null || size in 1..(2 * 1024 * 1024))
+            val archive = size?.let { length ->
+                // CursorWindow is only ~2MiB on many devices. Never SELECT the whole ZIP row.
+                ByteArray(length).also { bytes ->
+                    var offset = 0
+                    while (offset < length) {
+                        val amount = minOf(256 * 1024, length - offset)
+                        val chunk = db.query("SELECT substr(archive,?,?) AS chunk FROM purchase_failure_snapshot WHERE attempt_id=?",
+                            listOf(offset + 1, amount, row["attempt_id"])).single()["chunk"] as ByteArray
+                        check(chunk.size == amount) { "snapshot_readback_failed" }
+                        chunk.copyInto(bytes, offset); offset += amount
+                    }
+                }
+            }
+            FailureSnapshot(row["metadata"] as String, archive, row["server_origin"] as String)
+        }
+    }
+
+    @Synchronized
+    fun markFailureSnapshotUploaded(snapshot: FailureSnapshot, terminalStatus: String = "uploaded") {
+        require(terminalStatus in setOf("uploaded", "expired", "rejected"))
+        db.execute("DELETE FROM purchase_failure_snapshot_queue WHERE attempt_id=? AND fingerprint=? AND EXISTS (SELECT 1 FROM purchase_failure_snapshot s WHERE s.attempt_id=purchase_failure_snapshot_queue.attempt_id AND s.server_origin=?)",
+            listOf(JSONObject(snapshot.metadataJson).getString("taskAttemptId"), fingerprint(snapshot), origin(snapshot.serverOrigin)))
+    }
+
+    @Synchronized
+    fun retryFailureSnapshotLater(snapshot: FailureSnapshot, nowMillis: Long = clock()) = db.transaction {
+        val attemptId = JSONObject(snapshot.metadataJson).getString("taskAttemptId")
+        val digest = fingerprint(snapshot)
+        val queued = db.query("SELECT q.attempts FROM purchase_failure_snapshot_queue q JOIN purchase_failure_snapshot s ON s.attempt_id=q.attempt_id WHERE q.attempt_id=? AND q.fingerprint=? AND s.server_origin=?",
+            listOf(attemptId, digest, origin(snapshot.serverOrigin))).firstOrNull() ?: return@transaction
+        val attempts = (queued["attempts"] as Number).toInt().coerceIn(0, 10)
+        val delay = (60_000L * (1L shl attempts)).coerceAtMost(3_600_000L)
+        db.execute("UPDATE purchase_failure_snapshot_queue SET next_attempt_at=?,attempts=? WHERE attempt_id=? AND fingerprint=?", listOf(nowMillis + delay, attempts + 1, attemptId, digest))
+    }
+
+    @Synchronized
+    fun cleanupFailureSnapshots(nowMillis: Long = clock()) = db.transaction { cleanup(nowMillis) }
+
+    private fun cleanup(now: Long) {
+        db.execute("DELETE FROM purchase_failure_snapshot WHERE expires_at<=?", listOf(now))
+        db.execute("DELETE FROM purchase_failure_snapshot_context WHERE created_at<=?", listOf(now - RETENTION_MILLIS))
+        val rows = db.query("SELECT attempt_id,size_bytes FROM purchase_failure_snapshot ORDER BY recorded_at,attempt_id")
+        var total = rows.sumOf { (it["size_bytes"] as Number).toLong() }
+        for (row in rows) {
+            if (total <= maxBytes) break
+            db.execute("DELETE FROM purchase_failure_snapshot WHERE attempt_id=?", listOf(row["attempt_id"]))
+            total -= (row["size_bytes"] as Number).toLong()
+        }
+        db.execute("DELETE FROM purchase_failure_snapshot_queue WHERE attempt_id NOT IN (SELECT attempt_id FROM purchase_failure_snapshot)")
+    }
+
+    private fun validateIdentity(taskId: Long, attemptId: String, deviceId: Long, phase: String) {
+        require(taskId > 0 && deviceId > 0 && UUID.matches(attemptId) && phase in setOf("spec_probe", "purchase"))
+    }
+
+    // java.time is unavailable on API 23-25; the exporter writes UTC milliseconds.
+    private fun utcFormat() = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'", Locale.US).apply {
+        timeZone = TimeZone.getTimeZone("UTC"); isLenient = false
+    }
+
+    private fun parseTimestamp(value: String): Long {
+        val match = TIMESTAMP.matchEntire(value) ?: throw IllegalArgumentException("snapshot_time_invalid")
+        val normalized = match.groupValues[1] + "." + match.groupValues[2].padEnd(3, '0') + "Z"
+        val position = ParsePosition(0)
+        val parsed = utcFormat().parse(normalized, position)
+        require(parsed != null && position.index == normalized.length) { "snapshot_time_invalid" }
+        return parsed.time
+    }
+
+    private fun origin(value: String): String {
+        val normalized = value.trimEnd('/')
+        val uri = URI(normalized)
+        require(uri.scheme in setOf("http", "https") && !uri.host.isNullOrBlank() && uri.userInfo == null && uri.rawQuery == null && uri.fragment == null)
+        return normalized
+    }
+
+    private fun fingerprint(snapshot: FailureSnapshot): String = MessageDigest.getInstance("SHA-256").run {
+        update(snapshot.metadataJson.toByteArray(Charsets.UTF_8)); update(0.toByte()); snapshot.archive?.let(::update)
+        digest().joinToString("") { "%02x".format(it) }
+    }
+
+    companion object {
+        const val RETENTION_MILLIS = 30L * 24 * 60 * 60 * 1000
+        private val UUID = Regex("[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}")
+        private val HASH = Regex("[0-9a-f]{64}")
+        private val TIMESTAMP = Regex("(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2})(?:\\.(\\d{1,3}))?Z")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/PurchaseFailureSnapshotStore.kt

@@ -0,0 +1,40 @@
+package cn.ilapage.goauto.agent.persistence
+
+import android.database.Cursor
+import cn.ilapage.goauto.agent.diagnostics.FailureSnapshot
+
+/** Uses the same private SQLite database, without sharing the old 7-day/50-row retention. */
+class PurchaseFailureSnapshotStore(helper: AgentDiagnosticStore) {
+    private val repository = FailureSnapshotRepository(object : FailureSnapshotDatabase {
+        override fun execute(sql: String, args: List<Any?>) { helper.writableDatabase.execSQL(sql, args.toTypedArray()) }
+        override fun query(sql: String, args: List<Any?>): List<Map<String, Any?>> =
+            helper.readableDatabase.rawQuery(sql, args.map { it?.toString() }.toTypedArray()).use { cursor -> buildList {
+                while (cursor.moveToNext()) add((0 until cursor.columnCount).associate { index ->
+                    cursor.getColumnName(index) to when (cursor.getType(index)) {
+                        Cursor.FIELD_TYPE_NULL -> null
+                        Cursor.FIELD_TYPE_INTEGER -> cursor.getLong(index)
+                        Cursor.FIELD_TYPE_FLOAT -> cursor.getDouble(index)
+                        Cursor.FIELD_TYPE_BLOB -> cursor.getBlob(index)
+                        else -> cursor.getString(index)
+                    }
+                })
+            } }
+        override fun <T> transaction(block: () -> T): T {
+            val database = helper.writableDatabase
+            database.beginTransaction()
+            try { val result = block(); database.setTransactionSuccessful(); return result }
+            finally { database.endTransaction() }
+        }
+    })
+
+    fun saveFailureSnapshot(snapshot: FailureSnapshot): Boolean = repository.saveFailureSnapshot(snapshot)
+    fun hasFailureSnapshotArchive(attemptId: String): Boolean = repository.hasFailureSnapshotArchive(attemptId)
+    fun recordFailureSnapshotContext(taskId: Long, attemptId: String, deviceId: Long, phase: String, ruleSnapshotHash: String?, serverOrigin: String) =
+        repository.recordFailureSnapshotContext(taskId, attemptId, deviceId, phase, ruleSnapshotHash, serverOrigin)
+    fun failureSnapshotContext(attemptId: String): String? = repository.failureSnapshotContext(attemptId)
+    fun pendingFailureSnapshots(serverOrigin: String, nowMillis: Long = System.currentTimeMillis(), limit: Int = 1): List<FailureSnapshot> =
+        repository.pendingFailureSnapshots(serverOrigin, nowMillis, limit)
+    fun markFailureSnapshotUploaded(snapshot: FailureSnapshot, terminalStatus: String = "uploaded") = repository.markFailureSnapshotUploaded(snapshot, terminalStatus)
+    fun retryFailureSnapshotLater(snapshot: FailureSnapshot, nowMillis: Long = System.currentTimeMillis()) = repository.retryFailureSnapshotLater(snapshot, nowMillis)
+    fun cleanupFailureSnapshots(nowMillis: Long = System.currentTimeMillis()) = repository.cleanupFailureSnapshots(nowMillis)
+}

android/app/src/main/java/cn/ilapage/goauto/agent/persistence/PurchaseOutboxUploader.kt

@@ -5,11 +5,13 @@ class PurchaseOutboxUploader(
     private val pending: () -> List<PendingPurchaseOutbox>,
     private val submit: (PendingPurchaseOutbox) -> Unit,
     private val markUploaded: (PendingPurchaseOutbox) -> Unit,
+    private val afterUploaded: (PendingPurchaseOutbox) -> Unit = {},
 ) {
     fun flush() {
         pending().forEach { item ->
             submit(item)
             markUploaded(item)
+            afterUploaded(item)
         }
     }
 }

android/app/src/main/java/cn/ilapage/goauto/agent/service/AgentForegroundService.kt

@@ -41,6 +41,11 @@ import cn.ilapage.goauto.agent.automation.CollectionRule
 import cn.ilapage.goauto.agent.automation.PurchaseAgentCapabilities
 import cn.ilapage.goauto.agent.automation.PurchaseSpecProbePolicy
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionInput
+import cn.ilapage.goauto.agent.automation.PurchaseProbeHandoff
+import cn.ilapage.goauto.agent.automation.PddLaunchPath
+import cn.ilapage.goauto.agent.automation.PddLaunchStatus
+import cn.ilapage.goauto.agent.network.PurchaseResultAcknowledgement
+import cn.ilapage.goauto.agent.persistence.PendingPurchaseOutbox
 import cn.ilapage.goauto.agent.automation.PurchaseExecutionOutcome
 import cn.ilapage.goauto.agent.automation.PurchaseLiveAutomation
 import cn.ilapage.goauto.agent.automation.PurchaseRehearsalExecutor
@@ -62,6 +67,11 @@ import cn.ilapage.goauto.agent.persistence.AgentDiagnosticEvent
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticReason
 import cn.ilapage.goauto.agent.persistence.AgentDiagnosticStage
 import cn.ilapage.goauto.agent.persistence.SafeAgentDiagnosticRecorder
+import cn.ilapage.goauto.agent.persistence.PurchaseFailureSnapshotStore
+import cn.ilapage.goauto.agent.diagnostics.AccessibilitySnapshotSource
+import cn.ilapage.goauto.agent.diagnostics.FailureSnapshotCapture
+import cn.ilapage.goauto.agent.diagnostics.FailureSnapshotPolicy
+import cn.ilapage.goauto.agent.diagnostics.SnapshotContext
 import cn.ilapage.goauto.agent.ui.PurchaseResultBubblePolicy
 import org.json.JSONArray
 import org.json.JSONObject
@@ -79,7 +89,14 @@ class AgentForegroundService : Service() {
     private val executor: ScheduledExecutorService = Executors.newSingleThreadScheduledExecutor()
     private val taskExecutor: ExecutorService = Executors.newSingleThreadExecutor()
     private val diagnosticExecutor: ExecutorService = Executors.newSingleThreadExecutor()
+    private val snapshotUploadExecutor: ScheduledExecutorService = Executors.newSingleThreadScheduledExecutor()
+    private val repurchaseExecutor: ScheduledExecutorService = Executors.newSingleThreadScheduledExecutor()
+    private val repurchaseClosed = AtomicBoolean(false)
+    private val repurchase = RepurchaseCoordinator(SystemClock::elapsedRealtime, { UUID.randomUUID().toString() }, ::publishRepurchase)
+    private var repurchaseSession: RepurchaseSession? = null
+    private val repurchaseEvidence = java.util.concurrent.ConcurrentHashMap<Long, java.util.concurrent.ConcurrentHashMap<Long, RepurchaseExecutionEvidence>>()
     private val taskMutex = TaskExecutionMutex()
+    private val probeHandoff = PurchaseProbeHandoff()
     private val backfillGuard = OrderBackfillGuard(taskMutex)
     private val runningTaskId = AtomicReference<Long?>(null)
     private val working = AtomicBoolean(false)
@@ -99,6 +116,7 @@ class AgentForegroundService : Service() {
     private lateinit var purchaseStore: PurchaseTaskStore
     private lateinit var diagnosticStore: AgentDiagnosticStore
     private lateinit var diagnosticRecorder: SafeAgentDiagnosticRecorder
+    private lateinit var failureSnapshotStore: PurchaseFailureSnapshotStore
     private lateinit var connectivityManager: ConnectivityManager
 
     private val networkCallback = object : ConnectivityManager.NetworkCallback() {
@@ -112,18 +130,20 @@ class AgentForegroundService : Service() {
         identityStore = SecureDeviceStore(this)
         settingsStore = AgentSettingsStore(this)
         stateStore = AgentStateStore(this)
+        repurchaseState = RepurchaseState()
         // Wake locks and cooldown tickets are process-local. Never restore a stale UI flag.
         stateStore.setKeepScreenOn(false)
         purchaseStore = PurchaseTaskStore(this)
         diagnosticStore = AgentDiagnosticStore(this)
+        failureSnapshotStore = PurchaseFailureSnapshotStore(diagnosticStore)
         diagnosticRecorder = SafeAgentDiagnosticRecorder(
             persist = { event ->
                 diagnosticExecutor.execute {
                     runCatching { diagnosticStore.record(event) }
-                        .onFailure { error -> Log.w("GoAutoDiagnostic", "agent diagnostic write failed: ${error.javaClass.simpleName}") }
+                        .onFailure(::logDiagnosticPersistenceFailure)
                 }
             },
-            onFailure = { error -> Log.w("GoAutoDiagnostic", "agent diagnostic write failed: ${error.javaClass.simpleName}") },
+            onFailure = ::logDiagnosticPersistenceFailure,
         )
         val restoredPurchaseTaskId = purchaseStore.activeTaskId()
         runningTaskId.set(restoredPurchaseTaskId)
@@ -135,9 +155,32 @@ class AgentForegroundService : Service() {
         registerNetworkCallback()
         resumeCollectionCooldown()
         executor.scheduleWithFixedDelay(::triggerSync, 0, HEARTBEAT_SECONDS, TimeUnit.SECONDS)
+        // Independent retention/upload ticks run even when no further task is dispatched.
+        snapshotUploadExecutor.scheduleWithFixedDelay(::maintainFailureSnapshots, 0, 60, TimeUnit.SECONDS)
+        // Separate, serialized I/O ticks keep history reads and result observation off the
+        // heartbeat scheduler and, especially, off the single purchase execution thread.
+        repurchaseExecutor.scheduleWithFixedDelay(::tickRepurchase, 2, 2, TimeUnit.SECONDS)
+        diagnosticInstance = this
     }
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        when (intent?.action) {
+            ACTION_REPURCHASE_PREPARE -> {
+                repurchaseExecutor.execute(::prepareRepurchase)
+                return START_STICKY
+            }
+            ACTION_REPURCHASE_CONFIRM -> {
+                val roundId = intent.getStringExtra("roundId").orEmpty()
+                repurchaseExecutor.execute { repurchase.confirm(roundId); tickRepurchase() }
+                return START_STICKY
+            }
+            ACTION_REPURCHASE_STOP -> {
+                // Atomic: a network request must not delay the user's stop signal.
+                repurchase.requestStop(intent.getStringExtra("roundId").orEmpty())
+                repurchaseExecutor.execute(::tickRepurchase)
+                return START_STICKY
+            }
+        }
         if (intent?.action == ACTION_BACKFILL_STOP) {
             backfillGuard.cancelled.set(true)
             return START_STICKY
@@ -161,6 +204,12 @@ class AgentForegroundService : Service() {
     }
 
     override fun onDestroy() {
+        probeHandoff.invalidate()
+        if (diagnosticInstance === this) diagnosticInstance = null
+        repurchaseClosed.set(true)
+        repurchase.requestStop(repurchase.state.roundId)
+        repurchaseExecutor.shutdownNow()
+        repurchaseState = RepurchaseState(message = "服务已停止；不会恢复整轮重购")
         backfillGuard.cancelled.set(true)
         runCatching { connectivityManager.unregisterNetworkCallback(networkCallback) }
         cancelIdleReturn("服务已停止")
@@ -172,6 +221,7 @@ class AgentForegroundService : Service() {
         diagnosticExecutor.shutdown()
         runCatching { diagnosticExecutor.awaitTermination(1, TimeUnit.SECONDS) }
         diagnosticExecutor.shutdownNow()
+        snapshotUploadExecutor.shutdownNow()
         purchaseStore.close()
         diagnosticStore.close()
         super.onDestroy()
@@ -179,6 +229,30 @@ class AgentForegroundService : Service() {
 
     override fun onBind(intent: Intent?): IBinder? = null
 
+    /** Shell-protected debug receiver only. Never claims/resets a server task or invokes a purchase executor. */
+    internal fun runNavigationProbe(probe: (Context) -> Unit): Boolean {
+        if (!BuildConfig.DEBUG) return false
+        val reservation = Long.MAX_VALUE - 2
+        val acquired = synchronized(taskMutex) {
+            !repurchaseClosed.get() && repurchaseLocalIdle() && !repurchaseState.busy &&
+                activeCollectionCooldown() == null && taskMutex.tryAcquire(reservation)
+        }
+        if (!acquired) return false
+        probeHandoff.beginExecution()
+        cancelIdleReturn("导航诊断")
+        try {
+            taskExecutor.execute {
+                try { probe(this) }
+                catch (error: Exception) { Log.w("GoAutoNavProbe", "probe_exception=${error.javaClass.name}") }
+                finally { taskMutex.release(reservation) }
+            }
+        } catch (error: java.util.concurrent.RejectedExecutionException) {
+            taskMutex.release(reservation)
+            return false
+        }
+        return true
+    }
+
     private fun triggerSync() {
         if (!synchronized(taskMutex) { working.compareAndSet(false, true) }) return
         executor.execute {
@@ -322,6 +396,110 @@ class AgentForegroundService : Service() {
         })
     }
 
+    private data class RepurchaseSession(val origin: String, val deviceId: Long, val token: String)
+
+    private fun publishRepurchase(state: RepurchaseState) {
+        if (repurchaseClosed.get()) return
+        repurchaseState = state
+        sendBroadcast(Intent(ACTION_REPURCHASE_STATE).setPackage(packageName))
+        updateNotification(state.message, force = true)
+    }
+
+    private fun repurchaseLocalIdle(): Boolean = !working.get() && taskMutex.currentTaskId() == null &&
+        purchaseStore.activeTaskId() == null && purchaseStore.pendingOutbox().isEmpty() &&
+        stateStore.read().currentTaskId == null && !backfillState.running
+
+    private fun repurchaseEnvironment(session: RepurchaseSession): String? {
+        if (repurchaseClosed.get()) return "服务已经停止"
+        val credentials = identityStore.credentials()
+        if (credentials?.deviceId != session.deviceId || credentials.token != session.token ||
+            ServerUrlPolicy.normalize(settingsStore.serverUrl()) != session.origin) return "设备身份或服务器配置已变化，请重新连接"
+        if (!registeredThisProcess.get()) return "设备尚未完成连接校验，请先测试连接"
+        if (GoAutoAccessibilityService.instance == null) return "请先开启无障碍服务"
+        val network = connectivityManager.activeNetwork ?: return "网络不可用"
+        if (connectivityManager.getNetworkCapabilities(network)?.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) != true) return "网络不可用"
+        return null
+    }
+
+    private fun prepareRepurchase() {
+        if (repurchaseClosed.get() || !repurchase.prepare()) return
+        repurchaseEvidence.clear()
+        try {
+            val credentials = identityStore.credentials() ?: error("missing credentials")
+            val session = RepurchaseSession(ServerUrlPolicy.normalize(settingsStore.serverUrl()), credentials.deviceId, credentials.token)
+            repurchaseSession = session
+            repurchaseEnvironment(session)?.let { repurchase.fail(it); return }
+            val port = repurchasePort(session)
+            if (!repurchaseLocalIdle() || port.hasOtherWork(null)) {
+                repurchase.fail("设备已有未结束工作或结果上传尚未收尾，请完成后再重购")
+                return
+            }
+            // Discovery owns its client. No other request can overwrite its page's Date sample.
+            val api = AgentApiClient(session.origin)
+            val batch = RepurchaseBatchDiscovery({ query ->
+                check(!repurchase.isStopRequested() && !repurchaseClosed.get())
+                check(repurchaseEnvironment(session) == null)
+                api.purchaseHistory(session.token, query.page, query.status, query.taskNo, query.days, query.pageSize)
+            }, { requireNotNull(api.lastResponseServerTimeMillis) }).discover()
+            repurchaseEnvironment(session)?.let { repurchase.fail(it); return }
+            if (!repurchaseLocalIdle() || port.hasOtherWork(null)) {
+                repurchase.fail("读取期间出现新的采集或采购工作，请完成后重新读取")
+                return
+            }
+            repurchase.prepared(batch)
+        } catch (error: RepurchaseBatchException) {
+            repurchase.fail(if (repurchase.isStopRequested()) "已停止读取，没有发起重购" else when (error.reason) {
+                RepurchaseBatchFailure.LIST_CHANGED -> "采购列表已变化，请重新读取"
+                RepurchaseBatchFailure.PAGE_FAILED -> "读取采购记录失败，请检查连接后重试"
+                else -> "无法完整确定最后一批采购记录，请检查时间或记录后重试（${error.reason}）"
+            })
+        } catch (_: Exception) {
+            repurchase.fail("设备连接或记录读取失败，请恢复后重试")
+        }
+    }
+
+    private fun tickRepurchase() {
+        if (repurchaseClosed.get() || !repurchase.state.busy) return
+        val session = repurchaseSession ?: return
+        val previousTaskId = repurchase.state.currentTaskId
+        repurchase.tick(repurchasePort(session))
+        // Reset only makes the original task pending. The original dispatcher owns all
+        // claim/start/automation/upload steps; the round never executes a PDD action.
+        if (repurchase.state.currentTaskId != null && repurchase.state.currentTaskId != previousTaskId) triggerSync()
+    }
+
+    private fun repurchasePort(session: RepurchaseSession): RepurchasePort = object : RepurchasePort {
+        private val api = AgentApiClient(session.origin)
+        override fun environmentProblem() = repurchaseEnvironment(session)
+        override fun localIdle() = repurchaseLocalIdle()
+        override fun latestTaskId() = api.purchaseHistory(session.token, 1, null, null, 30, 1).items.firstOrNull()?.taskId
+        override fun detail(taskId: Long) = api.purchaseHistoryDetail(taskId, session.token)
+        override fun executionEvidence(taskId: Long) = repurchaseEvidence[taskId]?.values?.toList().orEmpty()
+        override fun hasOtherWork(currentTaskId: Long?): Boolean {
+            if (api.nextTask(session.token) != null) return true // collection IDs are a separate namespace
+            val next = api.nextPurchaseTask(session.token)
+            if (next != null && next.taskId != currentTaskId) return true
+            // /next returns the current running/probing purchase first and can conceal new pending work.
+            return listOf("pending", "running", "spec_probe_pending", "order_submit_started").any { status ->
+                val page = api.purchaseHistory(session.token, 1, status, null, 30, 50)
+                page.items.any { it.taskId != currentTaskId } || page.total > page.items.size
+            }
+        }
+        override fun reset(taskId: Long, requestId: String): cn.ilapage.goauto.agent.network.PurchaseResetResult {
+            val acquired = synchronized(taskMutex) {
+                !working.get() && taskMutex.tryAcquire(REPURCHASE_RESERVATION_ID)
+            }
+            if (!acquired) throw RepurchaseLocalBusy()
+            try {
+                if (environmentProblem() != null || repurchase.isStopRequested() || repurchaseClosed.get() ||
+                    purchaseStore.activeTaskId() != null || purchaseStore.pendingOutbox().isNotEmpty()) {
+                    throw AgentApiException(409, "DEVICE_BUSY", "本地工作边界变化", false)
+                }
+                return api.resetPurchaseTask(taskId, requestId, session.token)
+            } finally { taskMutex.release(REPURCHASE_RESERVATION_ID) }
+        }
+    }
+
     private fun publishBackfill(state: OrderBackfillState) {
         backfillState = state
         sendBroadcast(Intent(ACTION_BACKFILL_STATE).setPackage(packageName))
@@ -339,6 +517,7 @@ class AgentForegroundService : Service() {
         }
         try {
             val window = cn.ilapage.goauto.agent.automation.OrderBackfillWindow(days, confirmedAt)
+            probeHandoff.beginExecution()
             val server = settingsStore.serverUrl()
             val credentials = identityStore.credentials() ?: error("设备尚未注册")
             val accessibility = GoAutoAccessibilityService.instance ?: error("请先启用无障碍服务")
@@ -433,6 +612,7 @@ class AgentForegroundService : Service() {
             return
         }
         cancelIdleReturn("正在创建当前页面采集任务")
+        probeHandoff.beginExecution()
         taskExecutor.execute {
             var taskId = 0L
             try {
@@ -574,10 +754,26 @@ class AgentForegroundService : Service() {
     }
 
     private fun executePurchaseTask(api: AgentApiClient, initial: PurchaseAgentTask, token: String) {
+        // Take and clear before claim/start or any eligibility checks. Every execution consumes the previous handoff.
+        val handoffExecution = probeHandoff.beginExecution()
+        var probeCompletedAt: Long? = null
+        var probeAccessibility: GoAutoAccessibilityService? = null
+        var probeForegroundRevision = -1L
+        var acceptedPath: PddLaunchPath? = null
         GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         var resultSafelyStored = false
+        var knownResultType: String? = null
+        var snapshotContext: SnapshotContext? = null
+        var executionEntered = false
+        var snapshotAttempted = false
+        var probeDiagnosticEvents = 0
         val lastStep = AtomicReference("started")
+        fun failureSnapshot(resultType: String, errorCode: String) {
+            if (snapshotAttempted || !FailureSnapshotPolicy.exceptionEligible(knownResultType, resultSafelyStored)) return
+            snapshotAttempted = true
+            savePurchaseFailureSnapshot(snapshotContext?.copy(errorCode = errorCode), resultType, executionEntered)
+        }
         try {
             val claimed = if (initial.status == "pending") {
                 api.claimPurchaseTask(initial.taskId, UUID.randomUUID().toString(), token)
@@ -586,12 +782,21 @@ class AgentForegroundService : Service() {
                 api.startPurchaseTask(claimed.taskId, UUID.randomUUID().toString(), token)
             } else claimed
             check(task.status == "running" && task.taskAttemptId.isNotBlank()) { "采购任务没有有效 attempt" }
+            recordRepurchaseExecution(task, null)
+            val diagnosticDeviceId = runCatching { identityStore.credentials()?.takeIf { it.token == token }?.deviceId }.getOrNull()
+            if (task.taskAttemptId.matches(Regex("[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}")) &&
+                (diagnosticDeviceId ?: 0) > 0 && task.phase in setOf("spec_probe", "purchase")) {
+                snapshotContext = SnapshotContext(task.taskId, requireNotNull(diagnosticDeviceId), task.taskAttemptId, task.phase,
+                    task.ruleSnapshotHash, "PURCHASE_EXECUTION_FAILED", BuildConfig.VERSION_NAME, "execution", api.failureSnapshotOrigin)
+                runCatching { failureSnapshotStore.recordFailureSnapshotContext(task.taskId, task.taskAttemptId, diagnosticDeviceId,
+                    task.phase, task.ruleSnapshotHash, api.failureSnapshotOrigin) }.onFailure(::logDiagnosticPersistenceFailure)
+            }
             val snapshotHashValid = task.ruleSnapshotHash.matches(Regex("^[0-9a-f]{64}$"))
             val snapshotHash = task.ruleSnapshotHash.takeIf { snapshotHashValid } ?: "0".repeat(64)
             purchaseStore.recordRunning(task.taskId, task.taskAttemptId, snapshotHash)
             val taskLabel = if (task.executionMode == "live") "正式采购" else "采购演练"
-            val diagnosticDeviceId = runCatching { identityStore.credentials()?.deviceId }.getOrNull()
             val probeDiagnostic: (AgentDiagnosticEvent) -> Unit = { event ->
+                probeDiagnosticEvents++
                 diagnosticRecorder.record(event.copy(
                     taskId = task.taskId, taskType = "purchase", taskAttemptId = task.taskAttemptId,
                     deviceId = diagnosticDeviceId, phase = task.phase, ruleSnapshotHash = task.ruleSnapshotHash,
@@ -619,12 +824,40 @@ class AgentForegroundService : Service() {
                     } else {
                         PurchaseRehearsalExecutor(
                             driver = accessibility,
-                            openLink = { PddLinkLauncher(this).open(it, preferDirect = true) },
-                            probeSpecs = { collectPurchaseProbe(accessibility, task, parsedRule, probeDiagnostic) },
+                            openLink = { url ->
+                                probeHandoff.invalidate()
+                                acceptedPath = null
+                                val navigationStarted = SystemClock.elapsedRealtime()
+                                PddLinkLauncher(this).open(url, preferDirect = true) { event ->
+                                    if (event.status == PddLaunchStatus.ACCEPTED) acceptedPath = event.path
+                                    probeDiagnostic(AgentDiagnosticEvent(
+                                        taskId = task.taskId,
+                                        stage = AgentDiagnosticStage.PRODUCT_NAVIGATION,
+                                        reason = AgentDiagnosticReason.valueOf("NAV_${event.path}_${event.status}"),
+                                        elapsedMs = SystemClock.elapsedRealtime() - navigationStarted,
+                                        targetClassName = event.exceptionClass,
+                                    ))
+                                }
+                            },
+                            acceptedLaunchPath = { acceptedPath },
+                            monotonicNow = SystemClock::elapsedRealtime,
+                            confirmProbeHandoff = {
+                                val current = GoAutoAccessibilityService.instance
+                                probeHandoff.stillValid(handoffExecution, current,
+                                    current?.currentForegroundRevision() ?: -1L, SystemClock.elapsedRealtime())
+                            },
+                            probeSpecs = {
+                                collectPurchaseProbe(accessibility, task, parsedRule, probeDiagnostic).also {
+                                    probeCompletedAt = SystemClock.elapsedRealtime()
+                                    probeAccessibility = accessibility
+                                    probeForegroundRevision = accessibility.currentForegroundRevision()
+                                }
+                            },
                             probeClickDiagnostic = { stage, target, outcome ->
                                 probeDiagnostic(specClickDiagnostic(task.taskId, stage, target, outcome))
                             },
                             stepChanged = { step ->
+                                executionEntered = true
                                 lastStep.set(step)
                                 purchaseStore.updateStep(task.taskId, task.taskAttemptId, step)
                             },
@@ -657,6 +890,10 @@ class AgentForegroundService : Service() {
                                 minUnitPriceCent = task.minUnitPriceCent,
                                 maxUnitPriceCent = task.maxUnitPriceCent,
                                 addressSuffix = task.addressSuffix,
+                                reuseProbeProduct = probeHandoff.eligible(
+                                    handoffExecution, task.taskId, task.pddGoodsId, task.phase, task.taskAttemptId,
+                                    accessibility, accessibility.currentForegroundRevision(), SystemClock.elapsedRealtime(),
+                                ),
                             ),
                             parsedRule,
                             PurchaseAgentCapabilities.supported,
@@ -667,6 +904,10 @@ class AgentForegroundService : Service() {
             // #334: a spec probe that read zero colors/sizes must fail explicitly
             // instead of being reported as a normal, empty spec_probe_completed.
             val outcome = PurchaseSpecProbePolicy.demote(rawOutcome)
+            recordRepurchaseExecution(task, outcome.resultType)
+            knownResultType = outcome.resultType
+            // The live read finishes before persistence, the new failure bubble, return to Agent, or lease release.
+            if (FailureSnapshotPolicy.eligible(task.phase, outcome.resultType, false)) failureSnapshot(outcome.resultType, outcome.errorCode ?: "PURCHASE_EXECUTION_FAILED")
             val requestId = UUID.randomUUID().toString()
             val payload = purchaseResultPayload(requestId, task.taskAttemptId, outcome)
             purchaseStore.completeAndEnqueue(task.taskId, task.taskAttemptId, requestId, payload)
@@ -680,20 +921,44 @@ class AgentForegroundService : Service() {
                 GoAutoAccessibilityService.instance?.showPurchaseResultBubble(presentation)
             }
             beginIdleReturnCooldown()
-            flushPurchaseOutbox(api, token)
+            // Only this first synchronous upload may establish a handoff. Outbox replays have no callback.
+            flushPurchaseOutbox(api, token) { item, acknowledgement ->
+                val completedAt = probeCompletedAt
+                val accessibility = probeAccessibility
+                if (item.requestId == requestId && item.attemptId == task.taskAttemptId && completedAt != null &&
+                    accessibility != null && GoAutoAccessibilityService.instance === accessibility &&
+                    accessibility.currentPackage() == "com.xunmeng.pinduoduo" &&
+                    accessibility.currentForegroundRevision() == probeForegroundRevision) {
+                    probeHandoff.completeProbe(
+                        handoffExecution, task.taskId, task.pddGoodsId, task.taskAttemptId, completedAt,
+                        accessibility, probeForegroundRevision,
+                        successful = task.phase == "spec_probe" && outcome.resultType == "spec_probe_completed",
+                        safelyStored = resultSafelyStored, submitPending = acknowledgement.pending, replayed = acknowledgement.replayed,
+                    )
+                }
+            }
             val message = if (outcome.resultType == "failed") "${outcome.errorCode}：${outcome.message}" else outcome.message
             stateStore.update(if (outcome.resultType == "failed") "TASK_ERROR" else "ONLINE", message, tokenStored = true)
             updateNotification(if (outcome.resultType == "failed") "$taskLabel #${task.taskId} 失败" else "$taskLabel #${task.taskId} 已提交")
         } catch (error: AgentApiException) {
+            failureSnapshot("failed", error.code.takeIf { it.matches(Regex("[A-Z][A-Z0-9_]{0,63}")) } ?: "PURCHASE_API_FAILED")
             stateStore.update("TASK_ERROR", "${error.code}：${error.message}", tokenStored = true)
         } catch (error: Exception) {
+            failureSnapshot("failed", "PURCHASE_EXECUTION_EXCEPTION")
             stateStore.update("TASK_ERROR", error.message ?: "采购演练执行异常", tokenStored = true)
         } finally {
+            if (snapshotContext?.phase == "spec_probe" && probeDiagnosticEvents == 0) Log.i("GoAutoDiagnostic", "purchase_diagnostic_no_event")
             if (!resultSafelyStored) cancelIdleReturn("采购结果未安全保存")
             releaseTaskWakeLock()
         }
     }
 
+    private fun recordRepurchaseExecution(task: PurchaseAgentTask, resultType: String?) {
+        if (!repurchaseState.busy || repurchaseState.currentTaskId != task.taskId || task.attemptNumber <= 0) return
+        val taskEvidence = repurchaseEvidence.getOrPut(task.taskId) { java.util.concurrent.ConcurrentHashMap() }
+        taskEvidence[task.attemptNumber.toLong()] = RepurchaseExecutionEvidence(task.attemptNumber.toLong(), task.taskAttemptId, task.phase, resultType)
+    }
+
     private fun collectPurchaseProbe(
         accessibility: GoAutoAccessibilityService, task: PurchaseAgentTask, purchaseRule: PurchaseRule,
         diagnostic: (AgentDiagnosticEvent) -> Unit,
@@ -735,12 +1000,17 @@ class AgentForegroundService : Service() {
 
     private fun recoverInterruptedPurchases(api: AgentApiClient, token: String) {
         purchaseStore.interruptedAttempts().forEach { interrupted ->
+            probeHandoff.beginExecution()
             if (interrupted.status == PurchaseTaskStore.STATUS_ORDER_SUBMIT_STARTED) {
                 val boundaryRequestId = interrupted.orderSubmitRequestId ?: return@forEach
                 try {
                     api.markPurchaseOrderSubmitStarted(interrupted.taskId, boundaryRequestId, token)
                     val automation = GoAutoAccessibilityService.instance?.let(::PurchaseLiveAutomation)
-                    val evidence = automation?.readOrderResult()
+                    val evidence = try { automation?.readOrderResult() } catch (error: Exception) {
+                        savePurchaseFailureSnapshot(restoredFailureSnapshotContext(interrupted.attemptId, api.failureSnapshotOrigin,
+                            "PURCHASE_ORDER_RESULT_UNKNOWN"), "order_result_unknown", true)
+                        throw error
+                    }
                     val outcome = if (evidence == null) {
                         val readFailure = automation?.lastOrderReadFailure
                         PurchaseExecutionOutcome(
@@ -752,6 +1022,11 @@ class AgentForegroundService : Service() {
                     } else {
                         PurchaseExecutionOutcome("order_created", message = "订单已创建，等待人工检查和支付", pddOrderNo = evidence.orderNo, orderSubmittedAt = evidence.submittedAt, pddOrderAmountCent = evidence.pddOrderAmountCent)
                     }
+                    if (outcome.resultType == "order_result_unknown") {
+                        val context = restoredFailureSnapshotContext(interrupted.attemptId, api.failureSnapshotOrigin,
+                            outcome.errorCode ?: "PURCHASE_ORDER_RESULT_UNKNOWN")
+                        savePurchaseFailureSnapshot(context, outcome.resultType, true)
+                    }
                     val requestId = UUID.randomUUID().toString()
                     purchaseStore.completeAndEnqueue(interrupted.taskId, interrupted.attemptId, requestId, purchaseResultPayload(requestId, interrupted.attemptId, outcome))
                 } catch (_: AgentApiException) {
@@ -766,6 +1041,8 @@ class AgentForegroundService : Service() {
                 "AGENT_RESTARTED_DURING_EXECUTION",
                 "手机服务在创建订单前重启，任务已停止且不会重复操作拼多多",
             )
+            savePurchaseFailureSnapshot(restoredFailureSnapshotContext(interrupted.attemptId, api.failureSnapshotOrigin,
+                "AGENT_RESTARTED_DURING_EXECUTION"), "failed", false, "process_interrupted")
             purchaseStore.completeAndEnqueue(
                 interrupted.taskId,
                 interrupted.attemptId,
@@ -775,20 +1052,83 @@ class AgentForegroundService : Service() {
         }
     }
 
-    private fun flushPurchaseOutbox(api: AgentApiClient, token: String) {
+    private fun flushPurchaseOutbox(
+        api: AgentApiClient, token: String,
+        onFirstSubmitted: (PendingPurchaseOutbox, PurchaseResultAcknowledgement) -> Unit = { _, _ -> },
+    ) {
+        var acknowledgement: PurchaseResultAcknowledgement? = null
         PurchaseOutboxUploader(
             pending = purchaseStore::pendingOutbox,
-            submit = { item -> api.submitPurchaseResult(item.taskId, item.payloadJson, token) },
+            submit = { item -> acknowledgement = api.submitPurchaseResult(item.taskId, item.payloadJson, token) },
             markUploaded = { item -> purchaseStore.markUploaded(item.id, item.taskId, item.attemptId) },
+            afterUploaded = { item ->
+                // A local upload-mark failure creates no credential; optional handoff inspection cannot fail the upload.
+                runCatching { onFirstSubmitted(item, requireNotNull(acknowledgement)) }
+                    .onFailure { probeHandoff.invalidate(); logDiagnosticPersistenceFailure(it) }
+            },
         ).flush()
         runningTaskId.set(purchaseStore.activeTaskId())
     }
 
+    private fun logDiagnosticPersistenceFailure(error: Throwable) {
+        val category = when (error) {
+            is IllegalArgumentException -> "diagnostic_validation_failed"
+            is android.database.SQLException -> "diagnostic_sql_failed"
+            else -> "diagnostic_persistence_failed"
+        }
+        // Never include exception messages or a stack trace: SQL/binder errors may contain page data.
+        Log.w("GoAutoDiagnostic", category)
+    }
+
+    private fun savePurchaseFailureSnapshot(context: SnapshotContext?, resultType: String, executionEntered: Boolean, reason: String? = null) {
+        if (context == null) { Log.i("GoAutoDiagnostic", "failure_snapshot_attempt_context_missing"); return }
+        runCatching {
+            val accessibility = GoAutoAccessibilityService.instance
+            FailureSnapshotCapture(failureSnapshotStore::hasFailureSnapshotArchive, { failureSnapshotStore.saveFailureSnapshot(it) })
+                .record(context, resultType, false, executionEntered, accessibility != null,
+                    { AccessibilitySnapshotSource(requireNotNull(accessibility)).windows() }, reason)
+        }.onFailure(::logDiagnosticPersistenceFailure)
+    }
+
+    private fun restoredFailureSnapshotContext(attemptId: String, serverOrigin: String, errorCode: String): SnapshotContext? = runCatching {
+        val raw = failureSnapshotStore.failureSnapshotContext(attemptId) ?: return@runCatching null
+        val context = JSONObject(raw)
+        if (context.getString("serverOrigin") != serverOrigin) return@runCatching null
+        SnapshotContext(context.getLong("taskId"), context.getLong("deviceId"), context.getString("taskAttemptId"),
+            context.getString("phase"), if (context.isNull("ruleSnapshotHash")) null else context.getString("ruleSnapshotHash"),
+            errorCode, BuildConfig.VERSION_NAME, "recovery", serverOrigin)
+    }.onFailure(::logDiagnosticPersistenceFailure).getOrNull()
+
+    private fun maintainFailureSnapshots() {
+        runCatching {
+            failureSnapshotStore.cleanupFailureSnapshots()
+            // Result submission has priority. Snapshot transfer never owns the device/task mutex.
+            if (purchaseStore.pendingOutbox().isNotEmpty()) return@runCatching
+            val configured = settingsStore.serverUrl()
+            if (configured.isBlank()) return@runCatching
+            val origin = ServerUrlPolicy.normalize(configured)
+            val credentials = identityStore.credentials() ?: return@runCatching
+            val snapshot = failureSnapshotStore.pendingFailureSnapshots(origin).firstOrNull() ?: return@runCatching
+            if (purchaseStore.pendingOutbox().isNotEmpty() ||
+                ServerUrlPolicy.normalize(settingsStore.serverUrl()) != origin || identityStore.credentials() != credentials) return@runCatching
+            try {
+                AgentApiClient(origin).uploadFailureSnapshot(snapshot, credentials.token)
+                failureSnapshotStore.markFailureSnapshotUploaded(snapshot)
+            } catch (error: AgentApiException) {
+                if (FailureSnapshotPolicy.retryUpload(error.status)) failureSnapshotStore.retryFailureSnapshotLater(snapshot)
+                else failureSnapshotStore.markFailureSnapshotUploaded(snapshot, if (error.status == 410) "expired" else "rejected")
+            } catch (_: Exception) {
+                failureSnapshotStore.retryFailureSnapshotLater(snapshot)
+            }
+        }.onFailure(::logDiagnosticPersistenceFailure)
+    }
+
     private fun executeTask(
         api: AgentApiClient,
         initialTask: cn.ilapage.goauto.agent.network.AgentTask,
         token: String,
     ): TaskExecutionSummary {
+        probeHandoff.beginExecution()
         GoAutoAccessibilityService.instance?.dismissPurchaseResultBubble()
         acquireTaskWakeLock()
         return try {
@@ -1139,6 +1479,7 @@ class AgentForegroundService : Service() {
     }
 
     private fun evaluateIdleReturn() {
+        if (repurchaseState.phase == RepurchasePhase.RUNNING) return
         if (!idleReturn.isArmed()) return
         val accessibility = GoAutoAccessibilityService.instance
         if (accessibility == null) {
@@ -1161,6 +1502,7 @@ class AgentForegroundService : Service() {
     }
 
     private fun requestReturnToAgent(accessibility: GoAutoAccessibilityService) {
+        probeHandoff.invalidate()
         val launched = accessibility.openAgentPreservingTab()
         if (launched) SystemClock.sleep(RETURN_CONFIRM_DELAY_MILLIS)
         val returned = launched && accessibility.currentPackage() == packageName
@@ -1283,10 +1625,20 @@ class AgentForegroundService : Service() {
                 PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
             builder.addAction(Notification.Action.Builder(null, "停止回填", stop).build())
         }
+        if (repurchaseState.busy) {
+            val stop = PendingIntent.getService(this, 367,
+                Intent(this, AgentForegroundService::class.java).setAction(ACTION_REPURCHASE_STOP).putExtra("roundId", repurchaseState.roundId),
+                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT)
+            builder.addAction(Notification.Action.Builder(null, "停止重购", stop).build())
+        }
         return builder
             .setSmallIcon(android.R.drawable.stat_notify_sync)
             .setContentTitle(getString(R.string.app_name))
-            .setContentText(if (backfillState.running) "订单回填 · 已检查 ${backfillState.checked}" else content)
+            .setContentText(when {
+                repurchaseState.busy -> "重购 ${repurchaseState.currentTaskId?.let { "CG-$it" }.orEmpty()} · 成功${repurchaseState.successCount} 失败${repurchaseState.failedCount} 跳过${repurchaseState.skippedCount}"
+                backfillState.running -> "订单回填 · 已检查 ${backfillState.checked}"
+                else -> content
+            })
             .setContentIntent(pendingIntent)
             .setOngoing(true)
             .build()
@@ -1305,6 +1657,7 @@ class AgentForegroundService : Service() {
      * 归位要的是相反的效果，所以单独加 FLAG_ACTIVITY_CLEAR_TOP，两条路径各自保留（#292）。
      */
     private fun resetPddToHome(): PddLaunchResult {
+        probeHandoff.invalidate()
         val launchIntent = packageManager.getLaunchIntentForPackage(PDD_PACKAGE)
             ?: return PddLaunchResult.INTENT_MISSING
         launchIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
@@ -1319,6 +1672,7 @@ class AgentForegroundService : Service() {
     }
 
     private fun launchPddToForeground(): PddLaunchResult {
+        probeHandoff.invalidate()
         val launchIntent = packageManager.getLaunchIntentForPackage(PDD_PACKAGE)
             ?: return PddLaunchResult.INTENT_MISSING
         launchIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
@@ -1333,6 +1687,14 @@ class AgentForegroundService : Service() {
     }
 
     companion object {
+        @Volatile internal var diagnosticInstance: AgentForegroundService? = null
+            private set
+        const val ACTION_REPURCHASE_PREPARE = "cn.ilapage.goauto.agent.REPURCHASE_PREPARE"
+        const val ACTION_REPURCHASE_CONFIRM = "cn.ilapage.goauto.agent.REPURCHASE_CONFIRM"
+        const val ACTION_REPURCHASE_STOP = "cn.ilapage.goauto.agent.REPURCHASE_STOP"
+        const val ACTION_REPURCHASE_STATE = "cn.ilapage.goauto.agent.REPURCHASE_STATE"
+        @Volatile var repurchaseState = RepurchaseState()
+            private set
         const val ACTION_BACKFILL_START = "cn.ilapage.goauto.agent.BACKFILL_START"
         const val ACTION_BACKFILL_STOP = "cn.ilapage.goauto.agent.BACKFILL_STOP"
         const val ACTION_BACKFILL_STATE = "cn.ilapage.goauto.agent.BACKFILL_STATE"
@@ -1368,6 +1730,7 @@ class AgentForegroundService : Service() {
         private const val COOLDOWN_WAKE_GRACE_MILLIS = 5_000L
         private const val RETURN_CONFIRM_DELAY_MILLIS = 750L
         private const val CURRENT_PAGE_RESERVATION_ID = Long.MAX_VALUE
+        private const val REPURCHASE_RESERVATION_ID = Long.MAX_VALUE - 1
         private const val PDD_PACKAGE = "com.xunmeng.pinduoduo"
         private const val CURRENT_PAGE_RESULT_NOTIFICATION_MILLIS = 30_000L
 

android/app/src/main/java/cn/ilapage/goauto/agent/service/RepurchaseBatch.kt

@@ -0,0 +1,168 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.HistoryPage
+import cn.ilapage.goauto.agent.network.PurchaseHistoryItem
+import java.text.ParsePosition
+import java.text.SimpleDateFormat
+import java.util.Collections
+import java.util.Locale
+import java.util.TimeZone
+
+data class RepurchaseHistoryQuery(val page: Int, val pageSize: Int = 50, val days: Int = 30, val status: String? = null, val taskNo: String? = null)
+
+enum class RepurchaseBatchFailure { PAGE_FAILED, INVALID_PAGE, INVALID_TIMESTAMP, INVALID_ORDER, INCOMPLETE_BATCH, LIST_CHANGED, PAGE_LIMIT }
+
+class RepurchaseBatchException(val reason: RepurchaseBatchFailure) : IllegalStateException(reason.name)
+
+class RepurchaseBatch internal constructor(items: List<PurchaseHistoryItem>) {
+    val items: List<PurchaseHistoryItem> = immutable(items)
+    val candidates: List<PurchaseHistoryItem> = immutable(items.filter { it.status == "failed" && it.retryable })
+    val failures: List<PurchaseHistoryItem> = immutable(items.filter { it.status == "failed" })
+    val skips: List<PurchaseHistoryItem> = immutable(failures.filterNot { it.retryable })
+    val headTaskId = items.firstOrNull()?.taskId
+    val newestCreatedAt = items.firstOrNull()?.createdAt
+    val oldestCreatedAt = items.lastOrNull()?.createdAt
+
+    private fun immutable(items: List<PurchaseHistoryItem>): List<PurchaseHistoryItem> =
+        Collections.unmodifiableList(ArrayList(items))
+}
+
+/** Read-only discovery. The callback must use the current device's authenticated history endpoint.
+ *
+ * [nowMillis] MUST return the trusted server Date time from the response to that fetch, and throw
+ * when it is missing or invalid. Never fall back to the phone clock or a previous response's Date:
+ * the server applies the rolling 30-day cutoff, and a slow phone could accept a truncated batch.
+ * Tests may inject a synthetic server clock. It is read only after each successful page response.
+ *
+ * Offset overlap is tolerated; a changed head is rejected. This is not a snapshot guarantee for
+ * arbitrary concurrent deletion, reassignment or timestamp edits on the server.
+ */
+class RepurchaseBatchDiscovery(
+    private val fetchPage: (RepurchaseHistoryQuery) -> HistoryPage<PurchaseHistoryItem>,
+    private val nowMillis: () -> Long,
+    private val maxPages: Int = 200,
+) {
+    init { require(maxPages > 0) }
+
+    fun discover(): RepurchaseBatch {
+        var latestServerTime = 0L
+        fun readWithServerTime(pageNumber: Int): HistoryPage<PurchaseHistoryItem> {
+            val page = readPage(pageNumber)
+            val serverTime = try { nowMillis() } catch (_: Exception) {
+                refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+            }
+            if (serverTime <= 0) refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+            latestServerTime = maxOf(latestServerTime, serverTime)
+            return page
+        }
+        val seen = linkedMapOf<Long, Entry>()
+        val batch = mutableListOf<PurchaseHistoryItem>()
+        var head: Long? = null
+        var previous: Entry? = null
+        var originalTotal: Long? = null
+        var foundBoundary = false
+        var reachedEnd = false
+        for (pageNumber in 1..maxPages) {
+            val page = readWithServerTime(pageNumber)
+            if (originalTotal == null) originalTotal = page.total
+            else if (page.total != originalTotal) refuse(RepurchaseBatchFailure.LIST_CHANGED)
+            val entries = parseOrdered(page.items)
+            if (pageNumber == 1) head = entries.firstOrNull()?.item?.taskId
+            for (entry in entries) {
+                val duplicate = seen[entry.item.taskId]
+                if (duplicate != null) {
+                    if (duplicate.time != entry.time) refuse(RepurchaseBatchFailure.INVALID_ORDER)
+                    continue
+                }
+                val prior = previous
+                if (prior != null) {
+                    if (ENTRY_ORDER.compare(prior, entry) > 0) refuse(RepurchaseBatchFailure.INVALID_ORDER)
+                    if (prior.time.moreThanSixtySecondsAfter(entry.time)) {
+                        foundBoundary = true
+                        break
+                    }
+                }
+                seen[entry.item.taskId] = entry
+                batch += entry.item
+                previous = entry
+            }
+            if (foundBoundary) break
+            if (pageNumber.toLong() * PAGE_SIZE >= page.total) {
+                // Offset overlap without enough unique rows cannot establish a complete tail.
+                if (seen.size.toLong() != page.total) refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+                reachedEnd = true
+                break
+            }
+        }
+        if (!foundBoundary && !reachedEnd) refuse(RepurchaseBatchFailure.PAGE_LIMIT)
+
+        val finalPage = readWithServerTime(1)
+        val finalHead = parseOrdered(finalPage.items).firstOrNull()?.item?.taskId
+        if (finalHead != head || finalPage.total != originalTotal) refuse(RepurchaseBatchFailure.LIST_CHANGED)
+        if (reachedEnd && previous != null) {
+            // The API applies a rolling 30-day range, not a midnight-based date filter.
+            // HTTP Date has whole-second precision; include its possible fractional second.
+            // Preserve the latest observed time if a later response's Date moves backwards.
+            val floorMillis = latestServerTime + 1000 - DAYS * 24L * 60 * 60 * 1000
+            val floorSeconds = floorMillis / 1000 - if (floorMillis < 0 && floorMillis % 1000 != 0L) 1 else 0
+            val floor = Timestamp(floorSeconds, ((floorMillis - floorSeconds * 1000) * 1_000_000).toInt())
+            if (!previous.time.moreThanSixtySecondsAfter(floor)) refuse(RepurchaseBatchFailure.INCOMPLETE_BATCH)
+        }
+        return RepurchaseBatch(batch)
+    }
+
+    private fun readPage(pageNumber: Int): HistoryPage<PurchaseHistoryItem> {
+        val page = try {
+            fetchPage(RepurchaseHistoryQuery(page = pageNumber))
+        } catch (_: Exception) {
+            // Do not expose a network exception that might contain credentials or response data.
+            refuse(RepurchaseBatchFailure.PAGE_FAILED)
+        }
+        val offset = (pageNumber - 1L) * PAGE_SIZE
+        if (page.page != pageNumber || page.pageSize != PAGE_SIZE || page.total < 0 ||
+            page.items.size.toLong() != (page.total - offset).coerceIn(0, PAGE_SIZE.toLong()) ||
+            page.items.any { it.taskId <= 0 } || page.items.map { it.taskId }.distinct().size != page.items.size
+        ) refuse(RepurchaseBatchFailure.INVALID_PAGE)
+        return page
+    }
+
+    private fun parseOrdered(items: List<PurchaseHistoryItem>): List<Entry> {
+        val entries = items.map { Entry(it, parseTime(it.createdAt)) }
+        val ordered = entries.sortedWith(ENTRY_ORDER)
+        if (entries != ordered) refuse(RepurchaseBatchFailure.INVALID_ORDER)
+        return ordered
+    }
+
+    private fun parseTime(raw: String): Timestamp {
+        val match = TIMESTAMP.matchEntire(raw) ?: refuse(RepurchaseBatchFailure.INVALID_TIMESTAMP)
+        val zone = match.groupValues[3].let { if (it == "Z") "+0000" else it.replace(":", "") }
+        val normalized = match.groupValues[1] + zone
+        val position = ParsePosition(0)
+        val parsed = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ", Locale.ROOT).apply {
+            isLenient = false
+            timeZone = TimeZone.getTimeZone("UTC")
+        }.parse(normalized, position)
+        if (parsed == null || position.index != normalized.length) refuse(RepurchaseBatchFailure.INVALID_TIMESTAMP)
+        return Timestamp(parsed.time / 1000, match.groupValues[2].padEnd(9, '0').toInt())
+    }
+
+    private data class Entry(val item: PurchaseHistoryItem, val time: Timestamp)
+
+    private data class Timestamp(val seconds: Long, val nanos: Int) : Comparable<Timestamp> {
+        override fun compareTo(other: Timestamp): Int =
+            seconds.compareTo(other.seconds).takeIf { it != 0 } ?: nanos.compareTo(other.nanos)
+
+        fun moreThanSixtySecondsAfter(older: Timestamp): Boolean {
+            val secondsApart = seconds - older.seconds
+            return secondsApart > 60 || (secondsApart == 60L && nanos > older.nanos)
+        }
+    }
+
+    companion object {
+        private const val PAGE_SIZE = 50
+        private const val DAYS = 30
+        private val TIMESTAMP = Regex("(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2})(?:\\.(\\d{1,9}))?(Z|[+-]\\d{2}:\\d{2})")
+        private val ENTRY_ORDER = compareByDescending<Entry> { it.time }.thenByDescending { it.item.taskId }
+        private fun refuse(reason: RepurchaseBatchFailure): Nothing = throw RepurchaseBatchException(reason)
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/RepurchaseCoordinator.kt

@@ -0,0 +1,235 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.PurchaseHistoryDetail
+import cn.ilapage.goauto.agent.network.PurchaseResetResult
+import cn.ilapage.goauto.agent.network.AgentApiException
+import java.util.concurrent.atomic.AtomicReference
+
+interface RepurchasePort {
+    fun environmentProblem(): String?
+    fun localIdle(): Boolean
+    fun hasOtherWork(currentTaskId: Long?): Boolean
+    fun latestTaskId(): Long?
+    fun detail(taskId: Long): PurchaseHistoryDetail
+    fun reset(taskId: Long, requestId: String): PurchaseResetResult
+    fun executionEvidence(taskId: Long): List<RepurchaseExecutionEvidence> = emptyList()
+}
+
+/** Only emitted by the original executor after Start and after a known outcome. */
+data class RepurchaseExecutionEvidence(val attemptNumber: Long, val attemptId: String, val phase: String, val resultType: String?)
+class RepurchaseLocalBusy : IllegalStateException()
+
+class RepurchaseCoordinator(
+    private val now: () -> Long,
+    private val requestId: () -> String,
+    private val publish: (RepurchaseState) -> Unit,
+) {
+    @Volatile var state = RepurchaseState()
+        private set
+    private val stopRequest = AtomicReference<String?>(null)
+    private var position = 0
+    private var expectedAttempt = 0L
+    private var issuedAt = 0L
+    private var busySince: Long? = null
+    private var headChecked = false
+    private val resetRequestIds = mutableMapOf<Long, String>()
+
+    // All mutation except requestStop is confined to the Service's orchestration worker.
+    fun prepare(): Boolean {
+        if (state.busy) return false
+        stopRequest.set(null)
+        position = 0
+        expectedAttempt = 0
+        busySince = null
+        headChecked = false
+        resetRequestIds.clear()
+        emit(RepurchaseState(phase = RepurchasePhase.READING, roundId = requestId(), message = "正在读取本设备最后一批采购记录…"))
+        return true
+    }
+
+    fun prepared(batch: RepurchaseBatch) {
+        if (state.phase != RepurchasePhase.READING) return
+        if (isStopRequested()) { finish("已停止读取，没有发起重购"); return }
+        val skips = batch.skips.map { RepurchaseItemResult(it.taskId, RepurchaseResult.SKIPPED, it.retryDisabledReason ?: "当前不可重试") }
+        val message = when {
+            batch.items.isEmpty() -> "近30天没有采购记录"
+            batch.failures.isEmpty() -> "最后一批没有失败任务，不回退更早批次"
+            batch.candidates.isEmpty() -> "最后一批失败任务均不可重试，请查看逐条结果"
+            else -> "请确认本轮重购范围"
+        }
+        emit(state.copy(phase = if (batch.candidates.isEmpty()) RepurchasePhase.FINISHED else RepurchasePhase.READY,
+            batch = batch, results = skips, message = message))
+    }
+
+    fun confirm(roundId: String) {
+        if (state.phase != RepurchasePhase.READY || roundId != state.roundId) return
+        if (isStopRequested()) { finish("已取消重购"); return }
+        emit(state.copy(phase = RepurchasePhase.RUNNING, message = "正在复核本轮任务"))
+    }
+
+    fun requestStop(roundId: String) {
+        if (roundId.isNotBlank() && roundId == state.roundId) stopRequest.set(roundId)
+    }
+    fun isStopRequested(): Boolean = stopRequest.get() == state.roundId && state.roundId.isNotBlank()
+
+    fun fail(message: String) {
+        if (!state.busy) return
+        if (state.currentTaskId == null) finish(message)
+        else if (state.phase != RepurchasePhase.STOPPING) emit(state.copy(phase = RepurchasePhase.STOPPING, message = "$message；停止后续，当前任务沿用原流程收尾"))
+    }
+
+    fun tick(port: RepurchasePort) {
+        if (!state.busy) return
+        if (isStopRequested()) fail("已请求停止重购")
+        if (state.phase !in setOf(RepurchasePhase.RUNNING, RepurchasePhase.STOPPING)) return
+        if (state.currentTaskId != null && now() - issuedAt >= TASK_TIMEOUT_MILLIS) {
+            finish("单条等待已达15分钟，已停止编排；当前任务未被取消，请人工检查")
+            return
+        }
+        try {
+            port.environmentProblem()?.let { fail(it); return }
+            val current = state.currentTaskId
+            if (port.hasOtherWork(current)) fail("检测到新的采集或采购工作")
+            if (!state.busy) return
+            if (current != null) {
+                observe(port, current)
+                return
+            }
+            if (state.phase != RepurchasePhase.RUNNING) return
+            if (busySince != null && now() - requireNotNull(busySince) >= DRAIN_TIMEOUT_MILLIS) {
+                fail("设备忙碌或结果上传尚未收尾"); return
+            }
+            if (!port.localIdle()) {
+                val since = busySince ?: now().also { busySince = it }
+                if (now() - since >= DRAIN_TIMEOUT_MILLIS) fail("设备忙碌或结果上传尚未收尾")
+                return
+            }
+            val batch = requireNotNull(state.batch)
+            if (!headChecked) {
+                if (port.latestTaskId() != batch.headTaskId) { fail("采购列表已变化，请重新读取后确认"); return }
+                headChecked = true
+            }
+            if (position >= batch.candidates.size) { finish("本轮重购已结束"); return }
+            val taskId = batch.candidates[position].taskId
+            val detail = try { port.detail(taskId) } catch (error: AgentApiException) {
+                if (error.code == "PURCHASE_TASK_NOT_FOUND") { skip(taskId, "任务已过期或不再属于本设备"); return }
+                throw error
+            }
+            check(detail.task.taskId == taskId)
+            if (detail.task.status != "failed" || !detail.task.retryable) {
+                skip(taskId, detail.task.retryDisabledReason ?: "当前状态不可重试")
+                return
+            }
+            // Recheck after network reads. The reset adapter also holds a short local reservation.
+            if (isStopRequested()) { fail("已请求停止重购"); return }
+            port.environmentProblem()?.let { fail(it); return }
+            if (!port.localIdle()) return
+            if (port.hasOtherWork(null)) { fail("检测到新的采集或采购工作"); return }
+            if (isStopRequested()) { fail("已请求停止重购"); return }
+            issueReset(port, taskId, detail.attemptCount)
+        } catch (_: Exception) {
+            fail("连接、身份或服务端校验失败，请恢复后再操作")
+        }
+    }
+
+    private fun issueReset(port: RepurchasePort, taskId: Long, priorAttempt: Long) {
+        val fixedRequestId = resetRequestIds.getOrPut(taskId, requestId)
+        issuedAt = now()
+        expectedAttempt = 0
+        emit(state.copy(currentTaskId = taskId, message = "正在重置 CG-$taskId（原任务号）"))
+        var ambiguous = false
+        repeat(2) { attempt ->
+            // A stop while an ambiguous request was in flight must not start a fresh write.
+            if (attempt > 0 && isStopRequested()) { fail("重置响应不明确，已停止，请人工核对当前任务"); return }
+            try {
+                val result = port.reset(taskId, fixedRequestId)
+                check(result.taskId == taskId && result.attemptNumber > priorAttempt)
+                expectedAttempt = result.attemptNumber.toLong()
+                busySince = null
+                emit(state.copy(message = "等待 CG-$taskId 本次执行与结果上传"))
+                if (isStopRequested()) fail("已请求停止重购")
+                return
+            } catch (error: Exception) {
+                if (!ambiguous && error is RepurchaseLocalBusy) {
+                    emit(state.copy(currentTaskId = null, message = "等待本地忙碌操作收尾"))
+                    if (busySince == null) busySince = now()
+                    return
+                }
+                if (!ambiguous && error is AgentApiException && error.status in 400..499 && error.code in BUSINESS_REFUSALS) {
+                    emit(state.copy(currentTaskId = null))
+                    skip(taskId, "当前业务资格拒绝：${error.code}")
+                    return
+                }
+                if (error is AgentApiException && error.status in 400..499) {
+                    if (!ambiguous) emit(state.copy(currentTaskId = null))
+                    fail(if (ambiguous) "重置响应不明确，请人工核对" else "设备、规则或身份校验失败")
+                    return
+                }
+                ambiguous = true
+            }
+        }
+        fail("重置响应仍不明确，已停止，请人工核对当前任务")
+    }
+
+    private fun observe(port: RepurchasePort, taskId: Long) {
+        if (expectedAttempt == 0L) return // Never treat an old failed result as this reset's outcome.
+        val detail = port.detail(taskId)
+        check(detail.task.taskId == taskId)
+        if (detail.attemptCount < expectedAttempt) return
+        if (detail.attemptCount > expectedAttempt) {
+            val evidence = port.executionEvidence(taskId)
+            var linkedAttempt = expectedAttempt
+            // Each extra attempt needs a completed probe/rematch and the original executor's
+            // Start evidence for the immediately following purchase attempt. A separate reset
+            // after failed/cancelled/success cannot satisfy this chain.
+            while (linkedAttempt < detail.attemptCount) {
+                val from = evidence.singleOrNull { it.attemptNumber == linkedAttempt }
+                val to = evidence.singleOrNull { it.attemptNumber == linkedAttempt + 1 }
+                if (from?.resultType !in setOf("spec_probe_completed", "spec_rematch_completed") ||
+                    to?.phase != "purchase" || from?.attemptId.isNullOrBlank() || to.attemptId.isBlank() || from?.attemptId == to.attemptId) {
+                    fail("同任务出现无法关联本轮的后续尝试，已停止，请人工核对")
+                    if (port.localIdle()) finish(state.message)
+                    return
+                }
+                linkedAttempt++
+            }
+            expectedAttempt = linkedAttempt
+        }
+        val status = detail.task.status
+        if (status == "order_result_unknown") {
+            fail("订单结果待核对，请人工检查，不能继续重购")
+            if (port.localIdle()) finish(state.message)
+            return
+        }
+        if (status !in TERMINAL) return
+        if (!port.localIdle()) return
+        val failed = status == "failed"
+        val result = when (status) {
+            "order_created" -> RepurchaseItemResult(taskId, RepurchaseResult.SUCCESS, "订单已创建")
+            "cancelled" -> RepurchaseItemResult(taskId, RepurchaseResult.SKIPPED, "本次任务已取消")
+            else -> RepurchaseItemResult(taskId, RepurchaseResult.FAILED, "再次失败：${detail.task.errorCode ?: "PURCHASE_FAILED"}")
+        }
+        position++
+        val stopping = state.phase == RepurchasePhase.STOPPING
+        emit(state.copy(currentTaskId = null, results = state.results + result))
+        if (failed && detail.task.errorCode in ENVIRONMENT_FAILURES) finish("登录、验证码、风控或设备环境异常，已停止后续重购")
+        else if (stopping || isStopRequested()) finish(state.message)
+        else if (position >= requireNotNull(state.batch).candidates.size) finish("本轮重购已结束；再次失败的任务不会在本轮重复执行")
+    }
+
+    private fun skip(taskId: Long, reason: String) {
+        position++
+        emit(state.copy(results = state.results + RepurchaseItemResult(taskId, RepurchaseResult.SKIPPED, reason)))
+        if (position >= requireNotNull(state.batch).candidates.size) finish("本轮重购已结束")
+    }
+    private fun finish(message: String) = emit(state.copy(phase = RepurchasePhase.FINISHED, message = message))
+    private fun emit(value: RepurchaseState) { state = value; publish(value) }
+
+    companion object {
+        const val TASK_TIMEOUT_MILLIS = 15 * 60 * 1000L
+        private const val DRAIN_TIMEOUT_MILLIS = 10_000L
+        private val TERMINAL = setOf("order_created", "failed", "cancelled")
+        private val BUSINESS_REFUSALS = setOf("PURCHASE_TASK_NOT_FOUND", "PURCHASE_RETRY_NOT_ALLOWED", "PURCHASE_RETRY_UNSAFE", "PURCHASE_RETRY_STALE", "PURCHASE_SPEC_MAPPING_REQUIRED")
+        private val ENVIRONMENT_FAILURES = setOf("PDD_LOGIN_REQUIRED", "PDD_CAPTCHA_REQUIRED", "PDD_RISK_CONTROL", "ACCESSIBILITY_NOT_READY", "DEVICE_OFFLINE", "AGENT_RESTARTED_DURING_EXECUTION")
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/service/RepurchaseState.kt

@@ -0,0 +1,40 @@
+package cn.ilapage.goauto.agent.service
+
+enum class RepurchasePhase { IDLE, READING, READY, RUNNING, STOPPING, FINISHED }
+enum class RepurchaseResult { SUCCESS, FAILED, SKIPPED }
+data class RepurchaseItemResult(val taskId: Long, val result: RepurchaseResult, val message: String)
+
+/** Process-local presentation only; never persists or resumes a round after process death. */
+data class RepurchaseState(
+    val phase: RepurchasePhase = RepurchasePhase.IDLE,
+    val roundId: String = "",
+    val batch: RepurchaseBatch? = null,
+    val currentTaskId: Long? = null,
+    val results: List<RepurchaseItemResult> = emptyList(),
+    val message: String = "",
+) {
+    val busy get() = phase in setOf(RepurchasePhase.READING, RepurchasePhase.READY, RepurchasePhase.RUNNING, RepurchasePhase.STOPPING)
+    val successCount get() = results.count { it.result == RepurchaseResult.SUCCESS }
+    val failedCount get() = results.count { it.result == RepurchaseResult.FAILED }
+    val skippedCount get() = results.count { it.result == RepurchaseResult.SKIPPED }
+    fun confirmationText(): String = buildString {
+        append("本设备最后一批（近30天全部状态）\n")
+        append("${batch?.oldestCreatedAt.orEmpty()} ～ ${batch?.newestCreatedAt.orEmpty()}\n")
+        append("共 ${batch?.items?.size ?: 0} 条 · 失败 ${batch?.failures?.size ?: 0} 条\n")
+        append("可重购 ${batch?.candidates?.size ?: 0} 条 · 跳过 ${batch?.skips?.size ?: 0} 条\n\n")
+        append("相邻创建时间不超过60秒推算为同批，不受当前搜索和筛选影响。\n")
+        append("逐条复用原任务号重试，本轮再次失败不重复执行。单条等待上限15分钟，超时只停止后续编排。\n\n")
+        append("可能真实创建拼多多待付款订单，系统不会付款。停止重购不取消已经提交或正在执行的任务。")
+    }
+
+    fun summaryText(): String = buildString {
+        if (message.isNotBlank()) append(message).append('\n')
+        currentTaskId?.let { append("当前 CG-$it\n") }
+        append("成功 $successCount · 再次失败 $failedCount · 跳过 $skippedCount")
+        batch?.let {
+            val candidateIds = it.candidates.map { task -> task.taskId }.toSet()
+            val handled = results.count { result -> result.taskId in candidateIds }
+            append("\n本轮已结束 $handled / ${it.candidates.size} · 未结束 ${(it.candidates.size - handled).coerceAtLeast(0)}")
+        }
+    }
+}

android/app/src/main/java/cn/ilapage/goauto/agent/ui/TaskHistoryFragment.kt

@@ -142,8 +142,19 @@ class TaskHistoryFragment : Fragment() {
     private val imageRequests = mutableListOf<HistoryImageRequest>()
     private var currentPageReceiverRegistered = false
     private var backfillPanel: LinearLayout? = null
+    private var repurchasePanel: LinearLayout? = null
+    private var repurchaseButton: MaterialButton? = null
+    private var repurchaseDialog: androidx.appcompat.app.AlertDialog? = null
+    private var repurchaseDialogRound: String? = null
     private val currentPageReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
+            if (intent?.action == AgentForegroundService.ACTION_REPURCHASE_STATE) {
+                renderRepurchase()
+                if (!collection && isResumed && AgentForegroundService.repurchaseState.phase == cn.ilapage.goauto.agent.service.RepurchasePhase.FINISHED) {
+                    detailState.taskId?.let(::loadPurchaseDetail) ?: load()
+                }
+                return
+            }
             if (intent?.action == AgentForegroundService.ACTION_BACKFILL_STATE) {
                 renderBackfill()
                 if (!collection && isResumed && !AgentForegroundService.backfillState.running) {
@@ -191,6 +202,9 @@ class TaskHistoryFragment : Fragment() {
         pageColumn.addView(context.screenTitle(if (collection) "采集记录" else "采购记录"))
         pageColumn.addView(buildSearch())
         if (!collection) {
+            repurchasePanel = context.column(0)
+            pageColumn.addView(repurchasePanel)
+            renderRepurchase()
             backfillPanel = context.column(0)
             pageColumn.addView(backfillPanel)
             renderBackfill()
@@ -214,12 +228,19 @@ class TaskHistoryFragment : Fragment() {
 
     override fun onResume() {
         super.onResume()
+        renderRepurchase()
         detailState.taskId?.let { taskId ->
             if (collection) loadCollectionDetail(taskId) else loadPurchaseDetail(taskId)
         } ?: load()
     }
 
     override fun onDestroyView() {
+        repurchaseDialog?.setOnDismissListener(null)
+        repurchaseDialog?.dismiss()
+        repurchaseDialog = null
+        repurchaseDialogRound = null
+        repurchasePanel = null
+        repurchaseButton = null
         backfillPanel = null
         requestGeneration++
         cancelImageRequests()
@@ -289,11 +310,16 @@ class TaskHistoryFragment : Fragment() {
                 }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
             } else {
                 row.addView(MaterialButton(context).apply {
-                    text = "回填"
+                    repurchaseButton = this
+                    text = "重购"
                     textSize = 14f
                     minimumHeight = context.dp(48)
-                    contentDescription = "回填拼多多订单号和下单时间"
-                    setOnClickListener { showBackfillInput() }
+                    contentDescription = "重试本设备最后一批失败采购"
+                    isEnabled = !AgentForegroundService.repurchaseState.busy
+                    setOnClickListener {
+                        isEnabled = false
+                        sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_PREPARE)
+                    }
                 }, LinearLayout.LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, context.dp(48)).apply { marginStart = context.dp(8) })
             }
             addView(row, row.fullWidth())
@@ -302,6 +328,61 @@ class TaskHistoryFragment : Fragment() {
         }
     }
 
+    private fun sendRepurchaseAction(action: String, roundId: String = AgentForegroundService.repurchaseState.roundId) {
+        val context = context ?: return
+        val intent = Intent(context, AgentForegroundService::class.java).setAction(action).putExtra("roundId", roundId)
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) context.startForegroundService(intent) else context.startService(intent)
+    }
+
+    private fun renderRepurchase() {
+        val panel = repurchasePanel ?: return
+        val context = context ?: return
+        val state = AgentForegroundService.repurchaseState
+        val phase = state.phase
+        repurchaseButton?.isEnabled = !state.busy
+        panel.removeAllViews()
+        if (phase != cn.ilapage.goauto.agent.service.RepurchasePhase.READY) {
+            repurchaseDialog?.setOnDismissListener(null)
+            repurchaseDialog?.dismiss()
+            repurchaseDialog = null
+            repurchaseDialogRound = null
+        }
+        if (phase == cn.ilapage.goauto.agent.service.RepurchasePhase.IDLE) return
+        panel.addView(context.card(context.cardColumn().apply {
+            addView(context.label(if (state.busy) "本轮重购" else "重购结果", 16f))
+            addView(context.label(state.summaryText(), 14f))
+            if (state.busy) addView(MaterialButton(context).apply {
+                text = if (phase == cn.ilapage.goauto.agent.service.RepurchasePhase.STOPPING) "正在收尾…" else "停止重购"
+                minimumHeight = context.dp(48)
+                isEnabled = phase != cn.ilapage.goauto.agent.service.RepurchasePhase.STOPPING
+                setOnClickListener {
+                    isEnabled = false
+                    sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_STOP, state.roundId)
+                }
+            })
+            if (state.results.isNotEmpty()) addView(MaterialButton(context).apply {
+                text = "查看逐条结果"
+                minimumHeight = context.dp(48)
+                setOnClickListener {
+                    MaterialAlertDialogBuilder(context).setTitle("本轮重购明细")
+                        .setMessage(state.results.joinToString("\n") { "CG-${it.taskId}：${it.message}" })
+                        .setPositiveButton("关闭", null).show()
+                }
+            })
+        }))
+        if (phase == cn.ilapage.goauto.agent.service.RepurchasePhase.READY && isResumed && repurchaseDialogRound != state.roundId) {
+            repurchaseDialogRound = state.roundId
+            repurchaseDialog = MaterialAlertDialogBuilder(context).setTitle("重购最后一批")
+                .setMessage(state.confirmationText())
+                .setNegativeButton("取消") { _, _ -> sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_STOP, state.roundId) }
+                .setPositiveButton("确认重购") { _, _ -> sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_CONFIRM, state.roundId) }
+                .create().also { dialog ->
+                    dialog.setOnCancelListener { sendRepurchaseAction(AgentForegroundService.ACTION_REPURCHASE_STOP, state.roundId) }
+                    dialog.show()
+                }
+        }
+    }
+
     private fun showBackfillInput() {
         if (AgentForegroundService.backfillState.running) {
             toast("设备忙碌，请稍后操作")
@@ -729,6 +810,7 @@ class TaskHistoryFragment : Fragment() {
         if (currentPageReceiverRegistered) return
         val filter = IntentFilter(AgentForegroundService.ACTION_CURRENT_PAGE_RESULT)
         filter.addAction(AgentForegroundService.ACTION_BACKFILL_STATE)
+        filter.addAction(AgentForegroundService.ACTION_REPURCHASE_STATE)
         if (Build.VERSION.SDK_INT >= 33) {
             requireContext().registerReceiver(currentPageReceiver, filter, Context.RECEIVER_NOT_EXPORTED)
         } else {

android/app/src/test/java/cn/ilapage/goauto/agent/AgentDiagnosticRecorderTest.kt

@@ -9,6 +9,27 @@ import org.junit.Assert.assertEquals
 import org.junit.Test
 
 class AgentDiagnosticRecorderTest {
+    @Test
+    fun colorDiscoveryOutcomeDefaultsToUnknownAndPreservesExplicitValues() {
+        val event = AgentDiagnosticEvent(
+            taskId = 370,
+            stage = AgentDiagnosticStage.COLOR_DISCOVERY,
+            reason = AgentDiagnosticReason.COLOR_EDGE_REACHED,
+        )
+        assertEquals(null, event.colorVerticalSwipeCount)
+        assertEquals(null, event.colorTrailingEmptyReadCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+        val completed = event.copy(
+            colorVerticalSwipeCount = 4,
+            colorTrailingEmptyReadCount = 2,
+            colorHorizontalIncomplete = false,
+        )
+        assertEquals(4, completed.colorVerticalSwipeCount)
+        assertEquals(2, completed.colorTrailingEmptyReadCount)
+        assertEquals(false, completed.colorHorizontalIncomplete)
+        assertEquals(true, completed.copy(colorHorizontalIncomplete = true).colorHorizontalIncomplete)
+    }
+
     @Test
     fun diagnosticsAreBoundedToFiftyRecordsAndSevenDays() {
         assertEquals(50, AgentDiagnosticRetentionPolicy.MAX_RECORDS)

android/app/src/test/java/cn/ilapage/goauto/agent/FailureSnapshotCaptureTest.kt

@@ -0,0 +1,32 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.diagnostics.*
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+
+class FailureSnapshotCaptureTest {
+    private val context = SnapshotContext(9,4,"11111111-1111-4111-8111-111111111111","purchase","a".repeat(64),"FAILED","test","execution")
+    @Test fun noAttemptOrSuccessfulStoredResultDoesNotReadWindows() {
+        var calls=0
+        val capture=FailureSnapshotCapture(hasArchive={false}, persist={calls++})
+        val source={ calls++; emptyList<SnapshotWindow>() }
+        capture.record(null,"failed",false,true,true,source)
+        capture.record(context,"order_created",false,true,true,source)
+        capture.record(context,"failed",true,true,true,source)
+        assertEquals(0,calls)
+    }
+    @Test fun notEnteredUnavailableAndInterruptedNeverCaptureCurrentScreen() {
+        val saved=mutableListOf<FailureSnapshot>()
+        val capture=FailureSnapshotCapture(hasArchive={false},persist={saved.add(it)})
+        val source={ fail("must not capture current screen"); emptyList<SnapshotWindow>() }
+        capture.record(context,"failed",false,false,true,source)
+        capture.record(context,"failed",false,true,false,source)
+        capture.record(context.copy(source="recovery"),"failed",false,true,true,source,"process_interrupted")
+        assertEquals(listOf("execution_not_entered","accessibility_unavailable","process_interrupted"),saved.map { JSONObject(it.metadataJson).getJSONArray("reasons").getString(0) })
+    }
+    @Test fun existingArchivePreventsAnyRecaptureDuringRecovery() {
+        val capture=FailureSnapshotCapture(hasArchive={true},persist={fail("must preserve original ZIP")})
+        capture.record(context.copy(source="recovery"),"order_result_unknown",false,true,true,{fail("must preserve original scene"); emptyList()})
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/FailureSnapshotExporterTest.kt

@@ -0,0 +1,191 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.diagnostics.*
+import org.junit.Assert.*
+import org.junit.Test
+import java.io.ByteArrayInputStream
+import java.util.zip.ZipInputStream
+import javax.xml.parsers.DocumentBuilderFactory
+import org.json.JSONObject
+
+class FailureSnapshotExporterTest {
+    private val context = SnapshotContext(9, 4, "11111111-1111-4111-8111-111111111111", "spec_probe", "a".repeat(64), "TEST_FAILURE", "test", "execution")
+    private fun node(values: Map<String, String> = emptyMap(), children: List<SnapshotNode> = emptyList()) = object : SnapshotNode {
+        override fun attribute(name: String) = SnapshotAttribute(values[name] ?: if (name == "password") "false" else null)
+        override fun childCount() = children.size
+        override fun child(index: Int) = children[index]
+    }
+    private fun window(root: SnapshotNode?) = object : SnapshotWindow {
+        override fun attribute(name: String) = SnapshotAttribute(if (name == "id") "1" else null)
+        override fun root() = root
+    }
+    private fun files(bytes: ByteArray): Map<String, ByteArray> = buildMap {
+        ZipInputStream(ByteArrayInputStream(bytes)).use { zip ->
+            while (true) { val entry = zip.nextEntry ?: break; put(entry.name, zip.readBytes()) }
+        }
+    }
+    @Test fun validXmlPreservesRawOrderInvisibleTextAndIllegalCodeUnits() {
+        val text = "中文😀\n\t\r<&\"\u0001\uD800"
+        val result = FailureSnapshotExporter().capture(context) { listOf(window(node(children=listOf(node(mapOf("text" to text,"visible-to-user" to "false")),node(mapOf("text" to "same")),node(mapOf("text" to "same")))))) }
+        val entries = files(requireNotNull(result.archive))
+        val doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(ByteArrayInputStream(entries.getValue("window-1.xml")))
+        val nodes = doc.getElementsByTagName("node")
+        assertEquals(4, nodes.length)
+        val first = nodes.item(1) as org.w3c.dom.Element
+        assertEquals("0/0", first.getAttribute("path"))
+        assertEquals(text, SnapshotXml.decode(first.getAttribute("text-base64")))
+        assertEquals("false", first.getAttribute("visible-to-user"))
+        assertEquals(JSONObject(result.metadataJson).toString(), JSONObject(String(entries.getValue("manifest.json"), Charsets.UTF_8)).toString())
+    }
+    @Test fun passwordOmitsEveryContentFieldAndBackup() {
+        val values = SnapshotXml.contentAttributes.associateWith { "SECRET\u0001" } + ("password" to "true")
+        val result = FailureSnapshotExporter().capture(context) { listOf(window(node(values))) }
+        val xml = String(files(requireNotNull(result.archive)).getValue("window-1.xml"), Charsets.UTF_8)
+        assertFalse(xml.contains("SECRET"))
+        SnapshotXml.contentAttributes.forEach { assertFalse(xml.contains(" $it=")); assertFalse(xml.contains(" $it-state=")); assertFalse(xml.contains(" $it-base64=")) }
+    }
+    @Test fun rootNullIsNotCapturedAndInvalidHashNeverReadsWindows() {
+        val result = FailureSnapshotExporter().capture(context) { listOf(window(null)) }
+        assertNull(result.archive)
+        assertEquals("not_captured", JSONObject(result.metadataJson).getString("status"))
+        assertTrue(JSONObject(result.metadataJson).isNull("capturedAt"))
+        var called = false
+        val invalid = FailureSnapshotExporter().capture(context.copy(ruleSnapshotHash="bad")) { called=true; emptyList() }
+        assertFalse(called)
+        assertEquals("rule_hash_invalid", JSONObject(invalid.metadataJson).getJSONArray("reasons").getString(0))
+    }
+    @Test fun budgetStopsTraversalWithLegalXmlAndPartialStatus() {
+        val result = FailureSnapshotExporter(nodeLimit=2).capture(context) { listOf(window(node(children=List(10) { node(mapOf("text" to "$it")) }))) }
+        val xml = files(requireNotNull(result.archive)).getValue("window-1.xml")
+        val doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(ByteArrayInputStream(xml))
+        assertEquals(2, doc.getElementsByTagName("node").length)
+        assertEquals("partial", JSONObject(result.metadataJson).getString("status"))
+        assertTrue(JSONObject(result.metadataJson).getJSONArray("reasons").toString().contains("node_limit"))
+    }
+    @Test fun archiveBudgetRetainsLegalPartialTreeInsteadOfDiscardingEntireWindow() {
+        val random=java.util.Random(7)
+        val children=List(30) { node(mapOf("text" to CharArray(1000) { (33+random.nextInt(90)).toChar() }.concatToString())) }
+        val result=FailureSnapshotExporter(archiveLimit=4096).capture(context) { listOf(window(node(children=children))) }
+        assertNotNull("small prefix of a large window must survive ZIP cap",result.archive)
+        assertTrue(result.archive!!.size<=4096)
+        val xml=files(requireNotNull(result.archive)).getValue("window-1.xml")
+        val doc=DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(ByteArrayInputStream(xml))
+        assertTrue(doc.getElementsByTagName("node").length in 1..29)
+        assertTrue(JSONObject(result.metadataJson).getJSONArray("reasons").toString().contains("archive_size_limit"))
+    }
+    @Test fun ordinaryXmlPreservesWhitespaceEmojiAndNullVsUnsupportedVsReadError() {
+        val root=object:SnapshotNode {
+            override fun attribute(name:String)=when(name) {
+                "password" -> SnapshotAttribute("false")
+                "text" -> SnapshotAttribute("中文😀\n\r\t<&\"")
+                "hint" -> SnapshotAttribute(state="unsupported")
+                "state-description" -> SnapshotAttribute(state="read_error")
+                else -> SnapshotAttribute()
+            }
+            override fun childCount()=0
+            override fun child(index:Int):SnapshotNode?=null
+        }
+        val result=FailureSnapshotExporter().capture(context) { listOf(window(root)) }
+        val doc=DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(ByteArrayInputStream(files(result.archive!!).getValue("window-1.xml")))
+        val element=doc.getElementsByTagName("node").item(0) as org.w3c.dom.Element
+        assertEquals("中文😀\n\r\t<&\"",element.getAttribute("text"))
+        assertEquals("unsupported",element.getAttribute("hint-state"))
+        assertEquals("read_error",element.getAttribute("state-description-state"))
+        assertEquals("null",element.getAttribute("tooltip-state"))
+        assertEquals("partial",JSONObject(result.metadataJson).getString("status"))
+    }
+    @Test fun passwordActionLabelsAndUnknownPasswordContentAreNeverReadOrSaved() {
+        for (password in listOf(SnapshotAttribute("true"),SnapshotAttribute(state="read_error"))) {
+            val root=object:SnapshotNode {
+                override fun attribute(name:String):SnapshotAttribute {
+                    if(name in SnapshotXml.contentAttributes) fail("password content must not even be queried")
+                    return if(name=="password") password else SnapshotAttribute()
+                }
+                override fun actions()=listOf(16 to SnapshotAttribute("secret\u0001"))
+                override fun childCount()=0
+                override fun child(index:Int):SnapshotNode?=null
+            }
+            val result=FailureSnapshotExporter().capture(context) { listOf(window(root)) }
+            val xml=String(files(result.archive!!).getValue("window-1.xml"),Charsets.UTF_8)
+            assertTrue(xml.contains("<action id=\"16\"/>")); assertFalse(xml.contains("label")); assertFalse(xml.contains("secret"))
+        }
+    }
+    @Test fun failedChildCountMustNotPretendTheNodeHasZeroChildren() {
+        val root=object:SnapshotNode {
+            override fun attribute(name:String)=SnapshotAttribute(if(name=="password") "false" else null)
+            override fun childCount():Int=throw IllegalStateException("synthetic")
+            override fun child(index:Int):SnapshotNode?=null
+        }
+        val result=FailureSnapshotExporter().capture(context) { listOf(window(root)) }
+        val xml=String(files(result.archive!!).getValue("window-1.xml"),Charsets.UTF_8)
+        assertTrue(xml.contains("child-count-state=\"read_error\"")); assertFalse(xml.contains("child-count=\"0\""))
+    }
+    @Test fun timeBudgetChecksImmediatelyAfterBinderReadAndNeverVisitsLaterWindow() {
+        var elapsed=0L
+        var laterReads=0
+        val first=object:SnapshotWindow {
+            override fun attribute(name:String):SnapshotAttribute { elapsed=2000; return SnapshotAttribute("1") }
+            override fun root():SnapshotNode? { fail("budget was exceeded"); return null }
+        }
+        val later=object:SnapshotWindow {
+            override fun attribute(name:String):SnapshotAttribute { laterReads++; return SnapshotAttribute() }
+            override fun root():SnapshotNode? { laterReads++; return null }
+        }
+        val result=FailureSnapshotExporter(monotonicMillis={elapsed}).capture(context) { listOf(first,later) }
+        assertEquals(0,laterReads); assertNull(result.archive)
+        assertTrue(JSONObject(result.metadataJson).getJSONArray("reasons").toString().contains("time_limit"))
+    }
+    @Test fun foregroundAgentGuardRunsInsideCaptureBudgetAndReportsNoCapture() {
+        val result=FailureSnapshotExporter().capture(context) { throw SnapshotUnavailableException("execution_not_entered") }
+        assertNull(result.archive)
+        assertEquals("execution_not_entered",JSONObject(result.metadataJson).getJSONArray("reasons").getString(0))
+    }
+    @Test fun expandedAndDepthLimitsRetainParseablePartialTrees() {
+        var deep:SnapshotNode=node()
+        repeat(300) { deep=node(children=listOf(deep)) }
+        val cases=listOf(
+            FailureSnapshotExporter() to deep,
+            FailureSnapshotExporter(expandedLimit=96*1024) to node(children=List(100) { node(mapOf("text" to "中".repeat(1000))) }),
+        )
+        for ((exporter,root) in cases) {
+            val result=exporter.capture(context) { listOf(window(root)) }
+            val entries=files(result.archive!!)
+            val doc=DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(ByteArrayInputStream(entries.getValue("window-1.xml")))
+            assertTrue(doc.getElementsByTagName("node").length in 1..250)
+            assertEquals("partial",JSONObject(result.metadataJson).getString("status"))
+            assertTrue(entries.values.sumOf { it.size }<=8*1024*1024)
+        }
+    }
+    @Test fun utf16EncodingMatchesExternalBase64Standard() {
+        assertEquals(" text-base64=\"AAHYAA==\"",SnapshotXml.attribute("text",SnapshotAttribute("\u0001\uD800")))
+        assertArrayEquals(byteArrayOf(0,1,0xD8.toByte(),0),java.util.Base64.getDecoder().decode("AAHYAA=="))
+    }
+    @Test fun generatesCrossPlatformFixtureFromSyntheticNodesOnly() {
+        fun syntheticWindow(id:Int,root:SnapshotNode?)=object:SnapshotWindow {
+            override fun attribute(name:String)=SnapshotAttribute(when(name) {
+                "id" -> id.toString(); "type" -> "1"; "layer" -> id.toString(); "title" -> "合成测试😀"
+                "active","focused" -> "true"; "bounds" -> "[0,0][100,100]"; "packageName" -> "synthetic.test"; else -> null
+            })
+            override fun root()=root
+        }
+        val password=object:SnapshotNode {
+            override fun attribute(name:String)=SnapshotAttribute(if(name=="password") "true" else if(name in SnapshotXml.contentAttributes) "SYNTHETIC_SECRET\u0001" else null)
+            override fun actions()=listOf(16 to SnapshotAttribute("SYNTHETIC_SECRET\u0001"))
+            override fun childCount()=0
+            override fun child(index:Int):SnapshotNode?=null
+        }
+        val root=node(children=listOf(node(mapOf("text" to "中文😀\n\t\r\u0001\uD800","visible-to-user" to "false")),node(mapOf("text" to "duplicate")),node(mapOf("text" to "duplicate")),password))
+        val result=FailureSnapshotExporter().capture(context) { listOf(syntheticWindow(7,root),syntheticWindow(-8,node(mapOf("text" to "second"))),syntheticWindow(9,null)) }
+        val entries=files(result.archive!!)
+        assertEquals(setOf("manifest.json","window-7.xml","window--8.xml"),entries.keys)
+        for ((name,content) in entries) if(name.endsWith(".xml")) {
+            DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(ByteArrayInputStream(content))
+            assertFalse(String(content,Charsets.UTF_8).contains("SYNTHETIC_SECRET"))
+        }
+        System.getenv("GOAUTO_DIAGNOSTIC_FIXTURE_DIR")?.takeIf { it.isNotBlank() }?.let { path ->
+            val directory=java.io.File(path); check(directory.isDirectory || directory.mkdirs())
+            java.io.File(directory,"manifest.json").writeText(result.metadataJson,Charsets.UTF_8)
+            java.io.File(directory,"archive.zip").writeBytes(requireNotNull(result.archive))
+        }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/FailureSnapshotPolicyTest.kt

@@ -0,0 +1,30 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.diagnostics.FailureSnapshotPolicy
+import org.junit.Assert.*
+import org.junit.Test
+
+class FailureSnapshotPolicyTest {
+    @Test fun onlyFailedOrUnknownPurchaseOutcomesAreEligible() {
+        for (phase in listOf("spec_probe", "purchase")) {
+            assertTrue(FailureSnapshotPolicy.eligible(phase,"failed",false))
+            assertTrue(FailureSnapshotPolicy.eligible(phase,"order_result_unknown",false))
+            for (result in listOf("spec_probe_completed","order_created","rehearsal_completed")) assertFalse(FailureSnapshotPolicy.eligible(phase,result,false))
+        }
+        assertFalse(FailureSnapshotPolicy.eligible("collection","failed",false))
+        assertFalse(FailureSnapshotPolicy.eligible("purchase","failed",true))
+    }
+    @Test fun retryClassificationConvergesPermanentErrors() {
+        for (status in listOf(400,401,403,404,409,410,413,422)) assertFalse(FailureSnapshotPolicy.retryUpload(status))
+        for (status in listOf(0,408,429,500,502,503)) assertTrue(FailureSnapshotPolicy.retryUpload(status))
+    }
+    @Test fun successfulOutcomeDoesNotBecomeSceneFailureWhenResultStorageThrows() {
+        for (result in listOf("spec_probe_completed","order_created","rehearsal_completed")) {
+            assertFalse(FailureSnapshotPolicy.exceptionEligible(result,false))
+            assertFalse(FailureSnapshotPolicy.exceptionEligible(result,true))
+        }
+        assertTrue(FailureSnapshotPolicy.exceptionEligible(null,false))
+        assertTrue(FailureSnapshotPolicy.exceptionEligible("failed",false))
+        assertFalse(FailureSnapshotPolicy.exceptionEligible("failed",true))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/FailureSnapshotUploadTest.kt

@@ -0,0 +1,40 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.diagnostics.FailureSnapshot
+import cn.ilapage.goauto.agent.network.AgentApiClient
+import java.net.ServerSocket
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+
+class FailureSnapshotUploadTest {
+    @Test fun streamsUtf8MetadataAndArchiveAsSeparateMultipartParts() {
+        val attempt = "11111111-1111-4111-8111-111111111111"
+        val server = ServerSocket(0)
+        val executor = Executors.newSingleThreadExecutor()
+        var body = ByteArray(0)
+        var auth = ""
+        val received = executor.submit {
+            server.accept().use { socket ->
+                val input = socket.getInputStream()
+                fun line(): String { val s=StringBuilder(); while (true) { val c=input.read(); if (c < 0 || c==10) break; if(c!=13) s.append(c.toChar()) }; return s.toString() }
+                assertTrue(line().contains("/api/agent/v1/purchase-tasks/9/attempts/$attempt/failure-snapshot"))
+                var length = 0
+                while(true) { val header=line(); if(header.isEmpty()) break; if(header.startsWith("Content-Length:",true)) length=header.substringAfter(':').trim().toInt(); if(header.startsWith("Authorization:",true)) auth=header.substringAfter(':').trim() }
+                body=ByteArray(length); var offset=0; while(offset<length) { val n=input.read(body,offset,length-offset); check(n>0); offset+=n }
+                val response = "{\"data\":{\"taskAttemptId\":\"$attempt\",\"status\":\"partial\",\"replayed\":false}}".toByteArray()
+                socket.getOutputStream().apply { write("HTTP/1.1 200 OK\r\nContent-Length: ${response.size}\r\nConnection: close\r\n\r\n".toByteArray()); write(response); flush() }
+            }
+        }
+        try {
+            val json = JSONObject().put("taskId",9).put("taskAttemptId",attempt).put("status","partial").put("test","中文😀").toString()
+            AgentApiClient("http://127.0.0.1:${server.localPort}").uploadFailureSnapshot(FailureSnapshot(json,byteArrayOf(0,1,2)), "synthetic-token")
+            received.get(5,TimeUnit.SECONDS)
+            val text = String(body,Charsets.UTF_8)
+            assertTrue(text.contains("name=\"metadata\"")); assertTrue(text.contains("application/json; charset=UTF-8"))
+            assertTrue(text.contains(json)); assertTrue(text.contains("name=\"archive\"")); assertEquals("Bearer synthetic-token",auth)
+        } finally { server.close(); executor.shutdownNow() }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PddLaunchFallbackTest.kt

@@ -1,10 +1,43 @@
 package cn.ilapage.goauto.agent
 
 import cn.ilapage.goauto.agent.automation.PddLaunchFallback
+import cn.ilapage.goauto.agent.automation.PddLaunchEvent
+import cn.ilapage.goauto.agent.automation.PddLaunchPath
+import cn.ilapage.goauto.agent.automation.PddLaunchStatus
 import org.junit.Assert.*
 import org.junit.Test
 
 class PddLaunchFallbackTest {
+    @Test fun reportsDirectAcceptanceWithoutCallingBrowser() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertTrue(PddLaunchFallback.open(true, { true }, { error("unexpected") }, events::add))
+        assertEquals(listOf(PddLaunchEvent(PddLaunchPath.DIRECT, PddLaunchStatus.ACCEPTED)), events)
+    }
+    @Test fun reportsOnlyExceptionClassThenBrowserAcceptance() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertTrue(PddLaunchFallback.open(true, { throw SecurityException("secret URL and address") }, { true }, events::add))
+        assertEquals(listOf(
+            PddLaunchEvent(PddLaunchPath.DIRECT, PddLaunchStatus.EXCEPTION, "java.lang.SecurityException"),
+            PddLaunchEvent(PddLaunchPath.BROWSER, PddLaunchStatus.ACCEPTED),
+        ), events)
+        assertFalse(events.toString().contains("secret"))
+    }
+    @Test fun reportsFalseAndBrowserExceptionWithoutChangingResult() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertFalse(PddLaunchFallback.open(true, { false }, { throw IllegalStateException("private") }, events::add))
+        assertEquals(PddLaunchStatus.REJECTED, events[0].status)
+        assertEquals(PddLaunchStatus.EXCEPTION, events[1].status)
+    }
+    @Test fun diagnosticFailureDoesNotCauseBrowserFallbackOrChangeResult() {
+        var browserCalls = 0
+        assertTrue(PddLaunchFallback.open(true, { true }, { browserCalls++; true }, { error("storage failed") }))
+        assertEquals(0, browserCalls)
+    }
+    @Test fun browserOnlyReportsNoDirectAttempt() {
+        val events = mutableListOf<PddLaunchEvent>()
+        assertFalse(PddLaunchFallback.open(false, { error("unexpected") }, { false }, events::add))
+        assertEquals(listOf(PddLaunchEvent(PddLaunchPath.BROWSER, PddLaunchStatus.REJECTED)), events)
+    }
     @Test fun directSuccessDoesNotStartBrowser() {
         assertTrue(PddLaunchFallback.open(true, { true }, { error("browser must not start") }))
     }

android/app/src/test/java/cn/ilapage/goauto/agent/PddProductDetailCollectorTest.kt

@@ -1220,6 +1220,246 @@ class PddProductDetailCollectorTest {
         assertTrue(driver.swipes.any { it.first == SwipeDirection.UP })
     }
 
+    @Test
+    fun `color discovery counts only its own successful vertical swipes`() {
+        val colors = listOf("A色", "B色", "C色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(
+            colors = colors,
+            colorVerticalPages = listOf(colors.take(2), colors.takeLast(2)),
+            sizePages = listOf(listOf("S"), listOf("M"), listOf("L")),
+            rowSize = 1,
+            hideColorHeadingAfterFirstVerticalPage = true,
+        )
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule(config().copy(timeoutsMs = config().timeoutsMs + ("overall" to 30000))))
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(2, event.colorVerticalSwipeCount)
+        assertTrue(driver.swipes.count { it.first == SwipeDirection.UP } > requireNotNull(event.colorVerticalSwipeCount))
+        assertTrue(driver.swipes.any { it.first == SwipeDirection.DOWN })
+    }
+
+    @Test
+    fun `color discovery failed vertical dispatch is not counted`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(colors = listOf("A色", "B色"), rowSize = 1, verticalSwipeSucceeds = false)
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(AgentDiagnosticReason.COLOR_SWIPE_FAILED, event.reason)
+        assertEquals(0, event.colorVerticalSwipeCount)
+        assertEquals(0, event.colorTrailingEmptyReadCount)
+        assertEquals(false, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery counts empty parsed rounds after heading scrolls away without counting price reads`() {
+        val colors = listOf("A色", "B色", "C色", "D色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(
+            colors = colors,
+            colorVerticalPages = listOf(colors.take(2), colors.takeLast(2)),
+            rowSize = 1,
+            hideColorHeadingAfterFirstVerticalPage = true,
+            priceDelayReads = colors.associateWith { 2 },
+        )
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule(config().copy(timeoutsMs = config().timeoutsMs + ("overall" to 30000))))
+
+        assertTrue(result.successful)
+        // This fixture retains the options while their heading disappears. The
+        // existing parser/traversal still misses the second page in this stage.
+        assertEquals(colors.take(2), requireNotNull(result.payload).dimensions.first { it.key == "color" }.values)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(2, event.colorTrailingEmptyReadCount)
+        assertEquals(2, event.colorVerticalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery initially empty is one empty round with unknown horizontal state`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = emptyList()), { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(0, event.colorVerticalSwipeCount)
+        assertEquals(1, event.colorTrailingEmptyReadCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery resets trailing empty rounds after nonempty discovery`() {
+        val colors = listOf("A色", "B色", "C色", "D色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val driver = FakeCollectorDriver(
+            colors = colors,
+            colorVerticalPages = listOf(colors.take(2), emptyList(), colors.takeLast(2)),
+            rowSize = 1,
+        )
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule(config().copy(timeoutsMs = config().timeoutsMs + ("overall" to 30000))))
+
+        assertTrue(result.successful)
+        assertEquals(colors, requireNotNull(result.payload).dimensions.first { it.key == "color" }.values)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(3, event.colorVerticalSwipeCount)
+        assertEquals(0, event.colorTrailingEmptyReadCount)
+    }
+
+    @Test
+    fun `color discovery stable horizontal rows are complete`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = listOf("A色", "B色")), { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(false, event.colorHorizontalIncomplete)
+        assertEquals(0, event.colorTrailingEmptyReadCount)
+    }
+
+    @Test
+    fun `color discovery horizontal dispatch failure before movement stays unknown`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val base = FakeCollectorDriver(colors = listOf("A色", "B色"))
+        val driver = object : PddCollectorDriver by base {
+            override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean =
+                if (direction == SwipeDirection.LEFT) false else base.swipeSpec(direction, anchor)
+        }
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(0, event.horizontalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery successful horizontal dispatch alone does not prove required exploration`() {
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+        val limited = config().copy(limits = config().limits + mapOf("specHorizontalSwipes" to 1, "stableEdgeReads" to 2))
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = listOf("A色", "B色")), { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule(limited))
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(1, event.horizontalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery observed horizontal movement then failure is incomplete`() {
+        val colors = listOf("A色", "B色", "C色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val base = FakeCollectorDriver(colors = colors, colorPages = listOf(colors.take(2), colors.takeLast(2)))
+        var leftSwipes = 0
+        val driver = object : PddCollectorDriver by base {
+            override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean {
+                if (direction == SwipeDirection.LEFT && leftSwipes++ > 0) return false
+                return base.swipeSpec(direction, anchor)
+            }
+        }
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        assertEquals(colors, requireNotNull(result.payload).dimensions.first { it.key == "color" }.values)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(1, event.horizontalSwipeCount)
+        assertEquals(true, event.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery uncertain revisit preserves proven incomplete horizontal row`() {
+        val colors = listOf("A色", "B色", "C色", "D色", "E色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        val base = FakeCollectorDriver(
+            colors = colors,
+            colorPages = listOf(listOf("A色", "B色", "D色", "E色"), listOf("B色", "C色", "D色", "E色")),
+            rowSize = 2,
+            resetHorizontalPageOnVerticalSwipe = true,
+        )
+        var leftSwipes = 0
+        val driver = object : PddCollectorDriver by base {
+            override fun swipeSpec(direction: SwipeDirection, anchor: SnapshotNode?): Boolean {
+                if (direction == SwipeDirection.LEFT && leftSwipes++ > 0) return false
+                return base.swipeSpec(direction, anchor)
+            }
+        }
+        var clock = 0L
+
+        val result = PddProductDetailCollector(driver, { clock }, { clock += it }, taskId = 124, diagnostic = events::add)
+            .collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        assertTrue(requireNotNull(result.payload).dimensions.first { it.key == "color" }.values.contains("C色"))
+        assertTrue(leftSwipes > 2)
+        // The first A/B visit moves then fails; later A/B visits fail before
+        // movement. Unknown new evidence must not erase that unresolved work.
+        assertEquals(true, events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery observed horizontal movement at budget is incomplete`() {
+        val colors = listOf("A色", "B色", "C色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+        val limited = config().copy(limits = config().limits + ("specHorizontalSwipes" to 1))
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = colors, colorPages = listOf(colors.take(2), colors.takeLast(2))),
+            { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule(limited))
+
+        assertTrue(result.successful)
+        assertEquals(true, events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }.colorHorizontalIncomplete)
+    }
+
+    @Test
+    fun `color discovery disjoint horizontal reflow is unknown`() {
+        val colors = listOf("A色", "B色", "C色", "D色")
+        val events = mutableListOf<AgentDiagnosticEvent>()
+        var clock = 0L
+
+        val result = PddProductDetailCollector(
+            FakeCollectorDriver(colors = colors, colorPages = listOf(colors.take(2), colors.takeLast(2))),
+            { clock }, { clock += it }, taskId = 124, diagnostic = events::add,
+        ).collect(GOODS_ID, rule())
+
+        assertTrue(result.successful)
+        val event = events.single { it.stage == AgentDiagnosticStage.COLOR_DISCOVERY }
+        assertEquals(1, event.horizontalSwipeCount)
+        assertEquals(null, event.colorHorizontalIncomplete)
+    }
+
     @Test
     fun `color discovery records only bounded aggregate evidence`() {
         val colors = listOf("A色", "B色", "C色", "D色")
@@ -1857,6 +2097,7 @@ class PddProductDetailCollectorTest {
         sizes: List<String> = listOf("S"),
         private val colorPages: List<List<String>> = listOf(colors),
         private val colorVerticalPages: List<List<String>>? = null,
+        private val resetHorizontalPageOnVerticalSwipe: Boolean = false,
         private val sizePages: List<List<String>> = listOf(sizes),
         private val prices: Map<String, Long> = colors.associateWith { 1000L },
         private val failedClicks: Set<String> = emptySet(),
@@ -1867,6 +2108,7 @@ class PddProductDetailCollectorTest {
         private val rowSize: Int = 4,
         private val hideSelectedColorOption: Boolean = false,
         private val hideDimensionHeadingsAfterFirstVerticalPage: Boolean = false,
+        private val hideColorHeadingAfterFirstVerticalPage: Boolean = false,
         private val soldOutUntilPulls: Int = 0,
         private val startWithPanelClosed: Boolean = false,
         private val firstEntryOpensReview: Boolean = false,
@@ -1986,7 +2228,7 @@ class PddProductDetailCollectorTest {
                 ?: colorPages[horizontalPage.coerceAtMost(colorPages.lastIndex)]
             val colorRowCount = (visibleColors.size + rowSize - 1) / rowSize
             val sizeHeadingTop = maxOf(700, 470 + colorRowCount * 90 + 20)
-            if (!continuationPage && !panelCollapsedNow) {
+            if (!continuationPage && !panelCollapsedNow && !(hideColorHeadingAfterFirstVerticalPage && verticalPage > 0)) {
                 nodes += node("scroll/color-heading", "颜色分类", 20, 400, 300, 450, parentPath = "scroll")
             }
             if (!continuationPage && !hideColorNow && !panelCollapsedNow) {
@@ -2118,8 +2360,11 @@ class PddProductDetailCollectorTest {
             if ((direction == SwipeDirection.UP || direction == SwipeDirection.DOWN) && !verticalSwipeSucceeds) return false
             when (direction) {
                 SwipeDirection.LEFT -> horizontalPage = (horizontalPage + 1).coerceAtMost(colorPages.lastIndex)
-                SwipeDirection.UP -> verticalPage = (verticalPage + 1)
-                    .coerceAtMost(maxOf(sizePages.lastIndex, colorVerticalPages?.lastIndex ?: 0))
+                SwipeDirection.UP -> {
+                    verticalPage = (verticalPage + 1)
+                        .coerceAtMost(maxOf(sizePages.lastIndex, colorVerticalPages?.lastIndex ?: 0))
+                    if (resetHorizontalPageOnVerticalSwipe) horizontalPage = 0
+                }
                 SwipeDirection.DOWN -> {
                     verticalPage = (verticalPage - 1).coerceAtLeast(0)
                     downSwipeCount++

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseFinalSpecConfirmationTest.kt

@@ -0,0 +1,241 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import org.junit.Assert.*
+import org.junit.Test
+
+/** Final capture only; derived from the existing #331/#332 bounded purchase-sheet fixtures. */
+class PurchaseFinalSpecConfirmationTest {
+    @Test fun `bracket display variants and offscreen color are proven by full panel summary`() {
+        val snapshot = sheet("已选 [香槟]RW圆领 L码[105-115斤]", colors = listOf("其他颜色"), sizes = listOf("L码[105-115斤]"))
+            .selected("size/o0/t")
+        accepts(snapshot, "【香槟】RW圆领", "L码【105-115斤】")
+    }
+
+    @Test fun `summary above scroll area is accepted for scrollable and non scrollable sheets`() {
+        for (scrollable in listOf(true, false)) {
+            accepts(sheet("已选 黑色 XL", scrollable = scrollable))
+        }
+    }
+
+    @Test fun `checked only exact option and physical parent child duplicates provide selection proof`() {
+        accepts(sheet(null).selected("color/o0/img", checked = true).selected("size/o0/t", checked = true))
+    }
+
+    @Test fun `selected other color or size overrides matching summary and positive target`() {
+        rejects(sheet("已选 黑色 XL", colors = listOf("黑色", "白色")).selected("color/o0").selected("color/o1"))
+        rejects(sheet("已选 黑色 XL", sizes = listOf("XL", "L")).selected("size/o1/t"))
+    }
+
+    @Test fun `selected bracket variants are not a conflict`() {
+        accepts(sheet("已选 [白色] XL", colors = listOf("[白色]")).selected("color/o0").selected("size/o0/t"), "【白色】")
+    }
+
+    @Test fun `distinct physical identical or normalized target options are collisions`() {
+        for (colors in listOf(listOf("黑色", "黑色"), listOf("【白色】", "[白色]"))) {
+            rejects(sheet("已选 ${colors[0]} XL", colors = colors).selected("color/o0"), colors[0])
+        }
+    }
+
+    @Test fun `explicit unavailable target cannot be rescued by summary`() {
+        rejects(sheet("已选 黑色 XL").mapNodes { if (it.path.contains("color/o0")) it.copy(enabled = false) else it })
+    }
+
+    @Test fun `all required selected proofs take priority over a single non proving summary`() {
+        accepts(sheet("已选 其他颜色 其他尺码").selected("color/o0/img").selected("size/o0/t"))
+        rejects(sheet("已选 白色 L", colors = listOf("黑色", "白色"), sizes = listOf("XL", "L"))
+            .selected("color/o0/img").selected("size/o0/t")) // Known alternative composition is a conflict.
+    }
+
+    @Test fun `selected options retain established parser separation of trailing display price`() {
+        accepts(sheet("已选 黑色 XL", colors = listOf("黑色 ¥19.60"), sizes = listOf("XL ￥19.60"))
+            .selected("color/o0/img").selected("size/o0/t"))
+        rejects(sheet("已选 黑色 XL", colors = listOf("黑色加绒 ¥19.60")).selected("color/o0/img"))
+        rejects(sheet("已选 黑色 XL", colors = listOf("黑色 ¥19.60", "黑色 ¥20.00")).selected("color/o0/img"))
+    }
+
+    @Test fun `unselected visible options alone and unrelated title cannot prove selection`() {
+        rejects(sheet(null).addText("r/title", "示例黑色 XL 商品"))
+    }
+
+    @Test fun `panel external prefixed summary is ignored even at same coordinates`() {
+        rejects(sheet(null).addText("r/fake", "已选 黑色 XL"))
+        accepts(sheet("已选 黑色 XL").addText("r/fake", "已选 白色 L"))
+    }
+
+    @Test fun `structural ancestry overrides textual path prefix`() {
+        rejects(sheet(null).addText("r/sheet/fake", "已选 黑色 XL", parent = "r"))
+    }
+
+    @Test fun `whole summary rejects substring sizes colors extra dimensions quantity and unsupported separators`() {
+        for (summary in listOf("已选 黑色 XL", "已选 黑色 加绒 L", "已选 黑色 L 2件", "已选 黑色,L", "已选 L 黑色")) {
+            rejects(sheet(summary, sizes = listOf("L")), size = "L")
+        }
+        rejects(sheet("已选 [白色+黑色]超值两件装 XL", colors = emptyList()), "【白色】")
+    }
+
+    @Test fun `known candidates making another full composition reject ambiguous summary`() {
+        rejects(sheet("已选 黑色 加绒 XL", colors = listOf("黑色", "黑色 加绒"), sizes = listOf("加绒 XL", "XL")), size = "加绒 XL")
+        rejects(sheet("已选 黑色 加绒 XL", colors = listOf("黑色", "黑色 加绒"), sizes = listOf("加绒 XL", "XL")), color = "黑色 加绒")
+    }
+
+    @Test fun `summary permits invisible color despite another unselected visible color`() {
+        accepts(sheet("已选 黑色 XL", colors = listOf("白色")))
+    }
+
+    @Test fun `required single dimension must equal whole summary and empty pair is never proof`() {
+        accepts(sheet("已选 黑色"), size = "")
+        accepts(sheet("已选 XL"), color = "")
+        rejects(sheet("已选 黑色 XL"), size = "")
+        rejects(sheet("已选 黑色 XL"), color = "")
+        rejects(sheet("已选 黑色 XL"), color = " ", size = "")
+    }
+
+    @Test fun `anchored selected prefix variants preserve internal colons commas and whitespace`() {
+        for (prefix in listOf("已选", "已选 ", "已选:", "已选： ", "  已选： ")) {
+            accepts(sheet("$prefix 黑色:加绒,款 XL", colors = emptyList()), color = "黑色:加绒,款")
+        }
+        accepts(sheet("已选 黑色  加绒 XL", colors = emptyList()), color = "黑色 加绒")
+        rejects(sheet("已选 黑色 加绒 XL", colors = emptyList()), color = "黑色加绒")
+        rejects(sheet("已选 黑色:加绒 XL", colors = emptyList()), color = "黑色加绒")
+        rejects(sheet("已选:：黑色 XL"))
+        accepts(sheet("已选:：黑色 XL", colors = emptyList()), color = "：黑色")
+    }
+
+    @Test fun `conflicting scoped summaries reject even both exact options selected`() {
+        rejects(sheet("已选 黑色 XL").selected("color/o0").selected("size/o0/t").addText("r/sheet/second", "已选 白色 L"))
+        accepts(sheet("已选 黑色 XL").addText("r/sheet/second", "已选：黑色 XL"))
+    }
+
+    @Test fun `display normalization is narrow and content preserving`() {
+        accepts(sheet("已选 [白色](加绒) RW12 XL", colors = emptyList()), color = "〔白色〕（加绒）　ＲＷ１２")
+        rejects(sheet("已选 白色 RW12 XL", colors = emptyList()), color = "白色 rw12")
+        rejects(sheet("已选 白色 1 XL", colors = emptyList()), color = "白色 ①")
+        rejects(sheet("已选 白色 XL", colors = emptyList()), color = "白色 ¥19.6")
+    }
+
+    @Test fun `existing structurally recognized unprefixed summary is usable`() {
+        accepts(prefixlessSheet())
+        rejects(sheet("黑色 XL")) // No quantity/header relationship in this fixture.
+        rejects(sheet(null).addText("r/title", "黑色 XL"))
+        rejects(prefixlessSheet().addText("r/sheet/body/info/second", "黑色 L"))
+    }
+
+    @Test fun `same dimension groups retain earlier selected conflicts and physical candidates`() {
+        val base = sheet("已选 黑色 XL").addText("r/sheet/body/list/extra/h", "颜色分类")
+            .addText("r/sheet/body/list/extra/o", "白色")
+            .mapNodes { when (it.path) {
+                "r/sheet/body/list/extra/h" -> it.copy(bounds = NodeBounds(20, 1000, 500, 1040), parentPath = "r/sheet/body/list")
+                "r/sheet/body/list/extra/o" -> it.copy(bounds = NodeBounds(20, 1045, 500, 1100), parentPath = "r/sheet/body/list", clickable = true, selected = true)
+                "r/sheet/body/list" -> it.copy(bounds = NodeBounds(0, 980, 1080, 2036))
+                else -> it
+            } }
+        rejects(base)
+        rejects(base.mapNodes { if (it.path.endsWith("extra/o")) it.copy(text = "黑色") else it })
+    }
+
+    @Test fun `collector default still collapses same raw labels and leaves summary behavior unchanged`() {
+        val snapshot = sheet("已选 黑色 XL", colors = listOf("黑色", "黑色"))
+        val config = PurchaseRehearsalExecutor.DEFAULT_COLLECTOR
+        val regular = PddScreenParser.parse(snapshot, config, "374", null)
+        val final = PddScreenParser.parse(snapshot, config, "374", null, forFinalConfirmation = true)
+        assertEquals(1, regular.dimensions.single { it.key == "color" }.values.size)
+        assertEquals(2, final.dimensions.single { it.key == "color" }.values.size)
+        assertEquals(regular.selectedSummary, final.selectedSummary)
+        assertTrue(regular.finalSelectionSummaries.isEmpty())
+    }
+
+    @Test fun `independently bounded selected options survive absent full panel boundary`() {
+        val snapshot = sheet(null).selected("color/o0/img").selected("size/o0/t")
+            .mapNodes { if (it.path == "r/sheet") it.copy(bounds = NodeBounds(0, 0, 1080, 2216)) else it }
+        PurchaseFinalSpecVerifier.verify(snapshot, input()) { fail(it) }
+        val noSelections = snapshot.mapNodes { it.copy(selected = false, checked = false) }
+            .addText("r/sheet/fake", "已选 黑色 XL")
+        try {
+            PurchaseFinalSpecVerifier.verify(noSelections, input()) {}
+            fail("unproven full panel must not supply summary")
+        } catch (failure: PurchaseLiveException) { assertEquals("PURCHASE_SPEC_NOT_MATCHED", failure.code) }
+    }
+
+    @Test fun `price quantity and address checks remain enforced`() {
+        rejects(sheet("已选 黑色 XL"), expectedCode = "PURCHASE_PRICE_OUT_OF_RANGE", input = input().copy(maxUnitPriceCent = 1))
+        rejects(sheet("已选 黑色 XL"), expectedCode = "PURCHASE_QUANTITY_MISMATCH", input = input().copy(quantity = 2))
+        rejects(sheet("已选 黑色 XL").mapNodes { if (it.path == "r/sheet/body/addr/a/detail") it.copy(text = "示例地址") else it }, expectedCode = "PURCHASE_ADDRESS_UPDATE_FAILED")
+    }
+
+    private fun sheet(
+        summary: String?, colors: List<String> = listOf("黑色"), sizes: List<String> = listOf("XL"), scrollable: Boolean = true,
+    ): UiSnapshot = SpecPanelFixtures.sheet(SpecPanelFixtures.Sheet(colorLabels = colors, sizeLabels = sizes, listScrollable = scrollable))
+        .mapNodes { when (it.path) {
+            "r/sheet/body/summary" -> it.copy(text = summary, visible = summary != null)
+            "r/sheet/body/addr/a/detail" -> it.copy(text = ADDRESS)
+            else -> it
+        } }
+
+    /** Reuses the info-above-list shape from PddProductDetailCollectorTest.prefixlessPanel. */
+    private fun prefixlessSheet(): UiSnapshot {
+        val base = sheet("黑色 XL")
+        val info = base.nodes.single { it.path == "r/sheet/body/qty" }.copy(
+            path = "r/sheet/body/info", bounds = NodeBounds(0, 770, 1080, 1000), parentPath = "r/sheet/body",
+        )
+        return base.mapNodes { when {
+            it.path == "r/sheet/body/summary" -> it.copy(path = "r/sheet/body/info/summary", parentPath = info.path)
+            it.path == "r/sheet/body/qty" -> it.copy(path = "r/sheet/body/info/qty", parentPath = info.path)
+            it.path.startsWith("r/sheet/body/qty/") -> it.copy(path = it.path.replace("body/qty/", "body/info/qty/"), parentPath = "r/sheet/body/info/qty")
+            else -> it
+        } }.let { it.copy(nodes = it.nodes + info) }
+    }
+
+    private fun UiSnapshot.mapNodes(transform: (SnapshotNode) -> SnapshotNode) = copy(nodes = nodes.map(transform))
+    private fun UiSnapshot.selected(suffix: String, checked: Boolean = false) = mapNodes {
+        if (it.path.endsWith(suffix)) it.copy(selected = !checked, checked = checked) else it
+    }
+    private fun UiSnapshot.addText(path: String, text: String, parent: String = path.substringBeforeLast('/')) = copy(nodes = nodes + SnapshotNode(
+        path, parent, text, null, null, "android.widget.TextView", NodeBounds(384, 791, 1068, 852),
+        false, false, false, false, true, true,
+    ))
+    private fun input(color: String = "黑色", size: String = "XL") = PurchaseExecutionInput(
+        taskId = 374, executionMode = "live", phase = "purchase", url = "https://mobile.yangkeduo.com/goods.html?goods_id=374",
+        goodsId = "374", mappedColor = color, mappedSize = size, quantity = 1,
+        minUnitPriceCent = 1, maxUnitPriceCent = 3000, addressSuffix = "_cg374",
+    )
+
+    private fun check(snapshot: UiSnapshot, input: PurchaseExecutionInput, diagnostics: MutableList<String> = mutableListOf()): FinalConfirmationEvidence {
+        val driver = object : PurchaseUiDriver {
+            override fun capture() = snapshot
+            override fun clickFresh(target: SnapshotNode): FreshActionResult = error("final confirmation must be read only")
+            override fun tapPurchaseFresh(target: SnapshotNode): FreshActionResult = error("unexpected tap")
+            override fun inputFresh(target: SnapshotNode, value: String): FreshActionResult = error("unexpected input")
+            override fun swipePurchase(direction: SwipeDirection, durationMs: Long): Boolean = error("unexpected swipe")
+            override fun swipePurchaseIn(target: SnapshotNode, direction: SwipeDirection, durationMs: Long): Boolean = error("unexpected scoped swipe")
+            override fun backPurchase(): Boolean = error("unexpected back")
+        }
+        return PurchaseLiveAutomation(driver, pause = { error("unexpected pause") }, panelDiagnostic = diagnostics::add)
+            .finalConfirmation(input, ShippingAddressProof(ADDRESS, "_cg374"))
+    }
+    private fun accepts(snapshot: UiSnapshot, color: String = "黑色", size: String = "XL") {
+        val diagnostics = mutableListOf<String>()
+        val result = try { check(snapshot, input(color, size), diagnostics) } catch (failure: PurchaseLiveException) {
+            throw AssertionError("${failure.code}: ${diagnostics.lastOrNull()}", failure)
+        }
+        assertEquals(color, result.mappedColor)
+    }
+    private fun rejects(snapshot: UiSnapshot, color: String = "黑色", size: String = "XL", expectedCode: String = "PURCHASE_SPEC_NOT_MATCHED", input: PurchaseExecutionInput = input(color, size)) {
+        val diagnostics = mutableListOf<String>()
+        try {
+            check(snapshot, input, diagnostics)
+            fail("expected $expectedCode")
+        } catch (failure: PurchaseLiveException) {
+            assertEquals(expectedCode, failure.code)
+            if (expectedCode == "PURCHASE_SPEC_NOT_MATCHED") {
+                val detail = diagnostics.last()
+                assertTrue(detail, detail.matches(Regex("finalSpec;dimension=(color|size|none);stage=[a-z_]+;summaryPresent=[01];selectedFound=[01];conflict=[01]")))
+                assertTrue(failure.message.orEmpty(), failure.message.orEmpty().contains(detail))
+                assertFalse(failure.message.orEmpty().contains(ADDRESS))
+                assertFalse(failure.message.orEmpty().contains("黑色"))
+                assertFalse(failure.message.orEmpty().contains("XL"))
+            }
+        }
+    }
+    private companion object { const val ADDRESS = "示例区示例路374号_cg374" }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseNavigationReadinessTest.kt

@@ -0,0 +1,75 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseNavigationReadinessTest {
+    private val pdd = PurchaseNavigationReadiness.PDD_PACKAGE
+    private val browser = "com.heytap.browser"
+    private val old = ProductStabilityKey("old", true, false, false)
+    private val fresh = old.copy(title = "new")
+
+    @Test fun `diag3 browser route ignores old product before browser then buffers returned pdd`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.BROWSER, 0)
+        for (now in listOf(921L, 1_000L, 1_738L)) assertFalse(policy.observe(now, pdd, old))
+        assertFalse(policy.observe(1_739, browser, null))
+        assertFalse(policy.observe(12_189, pdd, old))
+        assertFalse(policy.observe(13_000, pdd, old))
+        assertFalse(policy.observe(13_218, pdd, fresh))
+        assertFalse(policy.observe(14_218, pdd, fresh))
+        assertFalse(policy.observe(15_188, pdd, fresh))
+        assertTrue(policy.observe(15_189, pdd, fresh))
+    }
+
+    @Test fun `stable initial product cannot pass browser route even after buffer`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.BROWSER, 0)
+        for (now in 0L..30_000L step 100) assertFalse(policy.observe(now, pdd, old))
+        assertTrue(policy.expired(30_000))
+    }
+
+    @Test fun `direct route requires buffer plus three stable samples without an empty frame`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 500)
+        assertFalse(policy.observe(500, pdd, old))
+        assertFalse(policy.observe(2_500, pdd, old))
+        assertFalse(policy.observe(3_499, pdd, old))
+        assertTrue(policy.observe(3_500, pdd, old))
+        val three = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 0)
+        assertFalse(three.observe(3_000, pdd, old))
+        assertFalse(three.observe(4_000, pdd, old))
+        assertTrue(three.observe(4_001, pdd, old))
+    }
+
+    @Test fun `stability resets on package root missing evidence title and structure changes`() {
+        for ((pkg, key) in listOf(browser to null, pdd to null, pdd to fresh, pdd to old.copy(panel = true))) {
+            val policy = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 0)
+            policy.observe(2_000, pdd, old)
+            policy.observe(2_500, pdd, old)
+            assertFalse(policy.observe(2_999, pkg, key))
+            assertFalse(policy.observe(3_000, pdd, old))
+            assertFalse(policy.observe(3_999, pdd, old))
+            assertTrue(policy.observe(4_000, pdd, old))
+        }
+    }
+
+    @Test fun `unknown path never passes and only approved browser route clicks at least one second apart`() {
+        val unknown = PurchaseNavigationReadiness(0, null, 0)
+        assertFalse(unknown.observe(4_000, pdd, old))
+        assertFalse(unknown.mayClickBrowser(4_000, browser))
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.BROWSER, 0)
+        for (pkg in listOf(pdd, "cn.ilapage.goauto.agent", "other.browser")) assertFalse(policy.mayClickBrowser(0, pkg))
+        for (pkg in listOf(browser, "com.android.chrome", "com.android.browser")) assertTrue(policy.mayClickBrowser(0, pkg))
+        policy.clicked(0)
+        assertFalse(policy.mayClickBrowser(999, browser))
+        assertTrue(policy.mayClickBrowser(1_000, browser))
+        assertFalse(policy.mayClickBrowser(30_000, browser))
+    }
+
+    @Test fun `deadline includes launch time and never accepts at thirty seconds`() {
+        val policy = PurchaseNavigationReadiness(0, PddLaunchPath.DIRECT, 29_000)
+        assertFalse(policy.observe(29_000, pdd, old))
+        assertFalse(policy.observe(29_500, pdd, old))
+        assertFalse(policy.observe(30_000, pdd, old))
+        assertTrue(policy.expired(-1))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseOutboxHandoffTest.kt

@@ -0,0 +1,34 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.persistence.PendingPurchaseOutbox
+import cn.ilapage.goauto.agent.persistence.PurchaseOutboxUploader
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseOutboxHandoffTest {
+    private val item = PendingPurchaseOutbox(1, 42, "probe", "request", "{}")
+
+    @Test fun `handoff callback runs only after successful submit and local upload mark`() {
+        for (failure in listOf("submit", "mark", "none")) {
+            val events = mutableListOf<String>()
+            val uploader = PurchaseOutboxUploader(
+                pending = { listOf(item) },
+                submit = { events += "submit"; if (failure == "submit") error("offline") },
+                markUploaded = { events += "mark"; if (failure == "mark") error("disk") },
+                afterUploaded = { events += "handoff" },
+            )
+            runCatching(uploader::flush)
+            assertEquals(when (failure) {
+                "submit" -> listOf("submit")
+                "mark" -> listOf("submit", "mark")
+                else -> listOf("submit", "mark", "handoff")
+            }, events)
+        }
+    }
+
+    @Test fun `ordinary replay uploader has no handoff callback`() {
+        var submitted = 0
+        PurchaseOutboxUploader({ listOf(item) }, { submitted++ }, {}).flush()
+        assertEquals(1, submitted)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseProbeHandoffTest.kt

@@ -0,0 +1,78 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.PurchaseProbeHandoff
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseProbeHandoffTest {
+    @Test fun `post capture confirmation rejects expiry foreground change recreation and later execution`() {
+        val state = seeded()
+        val execution = state.beginExecution()
+        assertTrue(state.eligible(execution, 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        assertTrue(state.stillValid(execution, accessibility, 7, 30_999))
+        assertFalse(state.stillValid(execution, accessibility, 7, 31_000))
+        assertFalse(state.stillValid(execution, accessibility, 8, 1_001))
+        assertFalse(state.stillValid(execution, Any(), 7, 1_001))
+        state.beginExecution()
+        assertFalse(state.stillValid(execution, accessibility, 7, 1_001))
+    }
+
+    private val accessibility = Any()
+    private fun seeded(age: Long = 0, success: Boolean = true, persisted: Boolean = true, pending: Boolean = true, replayed: Boolean = false): PurchaseProbeHandoff {
+        return PurchaseProbeHandoff().also { state ->
+            val execution = state.beginExecution()
+            state.completeProbe(execution, 42, "123", "probe-attempt", 1_000 - age, accessibility, 7,
+                successful = success, safelyStored = persisted, submitPending = pending, replayed = replayed)
+        }
+    }
+
+    @Test fun `handoff age is completion based exclusive thirty seconds`() {
+        for (age in listOf(0L, 29_999L, 30_000L, -1L)) {
+            val state = seeded(age)
+            assertEquals(age in 0..29_999, state.eligible(state.beginExecution(), 42, "123", "purchase", "purchase-attempt", accessibility, 7, 1_000))
+        }
+    }
+    @Test fun `handoff is consumed before all eligibility checks`() {
+        val state = seeded()
+        assertFalse(state.eligible(state.beginExecution(), 43, "123", "purchase", "next", accessibility, 7, 1_000))
+        assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+    }
+    @Test fun `different source and purchase attempts are normal but source replay cannot reuse`() {
+        val state = seeded()
+        assertTrue(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        val replay = seeded()
+        assertFalse(replay.eligible(replay.beginExecution(), 42, "123", "purchase", "probe-attempt", accessibility, 7, 1_000))
+    }
+    @Test fun `failed persistence failed matching and replayed uploads create no credential`() {
+        for (state in listOf(seeded(success = false), seeded(persisted = false), seeded(pending = false), seeded(replayed = true))) {
+            assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        }
+    }
+    @Test fun `interleaving generation accessibility foreground service and explicit navigation invalidate`() {
+        val interleaved = seeded()
+        val ticket = interleaved.beginExecution()
+        interleaved.beginExecution()
+        assertFalse(interleaved.eligible(ticket, 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        val replaced = seeded()
+        assertFalse(replaced.eligible(replaced.beginExecution(), 42, "123", "purchase", "next", Any(), 7, 1_000))
+        val foreground = seeded()
+        assertFalse(foreground.eligible(foreground.beginExecution(), 42, "123", "purchase", "next", accessibility, 8, 1_000))
+        val freshService = PurchaseProbeHandoff()
+        assertFalse(freshService.eligible(freshService.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+        val navigated = seeded()
+        navigated.invalidate()
+        assertFalse(navigated.eligible(navigated.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+    }
+    @Test fun `wrong goods or phase consumes and delayed completion cannot overwrite later execution`() {
+        for ((goods, phase) in listOf("456" to "purchase", "123" to "spec_probe", "123" to "collection")) {
+            val state = seeded()
+            assertFalse(state.eligible(state.beginExecution(), 42, goods, phase, "next", accessibility, 7, 1_000))
+        }
+        val state = PurchaseProbeHandoff()
+        val old = state.beginExecution()
+        state.beginExecution()
+        state.completeProbe(old, 42, "123", "probe", 1_000, accessibility, 7, true, true, true, false)
+        assertFalse(state.eligible(state.beginExecution(), 42, "123", "purchase", "next", accessibility, 7, 1_000))
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseRehearsalExecutorTest.kt

@@ -12,6 +12,8 @@ import cn.ilapage.goauto.agent.automation.PurchaseSpecGesturePolicy
 import cn.ilapage.goauto.agent.automation.PurchaseSwipeOutcome
 import cn.ilapage.goauto.agent.automation.PurchaseSwipeResult
 import cn.ilapage.goauto.agent.automation.PurchaseUiDriver
+import cn.ilapage.goauto.agent.automation.PddLaunchPath
+import cn.ilapage.goauto.agent.persistence.AgentDiagnosticStage
 import cn.ilapage.goauto.agent.automation.RuleValidationException
 import cn.ilapage.goauto.agent.automation.SnapshotNode
 import cn.ilapage.goauto.agent.automation.SwipeDirection
@@ -24,13 +26,197 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class PurchaseRehearsalExecutorTest {
+    @Test
+    fun `slow first browser lookup cannot compress the actual retry interval`() {
+        var now = 0L
+        val clickedAt = mutableListOf<Long>()
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome {
+                if (clickedAt.isEmpty()) now += 900
+                if (allowed()) clickedAt += now
+                return FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.ACTION_CLICK_FALSE)
+            }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(clickedAt.size > 1)
+        assertTrue(clickedAt.zipWithNext().all { (a, b) -> b - a >= 1_000 })
+        assertTrue(clickedAt.all { it < 30_000 })
+    }
+
+    @Test
+    fun `unapproved package with matching open button is never clicked`() {
+        var now = 0L
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture() = underlying.capture().copy(packageName = "other.application")
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `launch dispatch consumes the navigation deadline before first capture`() {
+        var now = 0L
+        var captures = 0
+        val underlying = FakePurchaseDriver()
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot { captures++; return underlying.capture() }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { now = 30_000; true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.DIRECT }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(0, captures)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `handoff invalidated during fresh capture reopens instead of reusing`() {
+        var now = 29_999L
+        var opens = 0
+        val underlying = FakePurchaseDriver()
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot { now = 30_000; return underlying.capture() }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { opens++; false }, { null }, pause = {},
+            monotonicNow = { now }, confirmProbeHandoff = { now < 30_000 },
+        ).execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals(1, opens)
+        assertEquals("PDD_LINK_INVALID", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `input reuse flag defaults false`() {
+        val task = PurchaseExecutionInput(42, "rehearsal", "purchase", input().url, input().goodsId,
+            "黑色", "XL", quantity = 2, minUnitPriceCent = 1000, maxUnitPriceCent = 3000)
+        assertFalse(task.reuseProbeProduct)
+    }
+
+    @Test
+    fun `diag3 timeline waits for browser and returned product buffer before any spec action`() {
+        var now = 921L
+        var probeAt = -1L
+        val underlying = FakePurchaseDriver()
+        val clicksAt = mutableListOf<Long>()
+        val browserSnapshot = FakePurchaseDriver().apply { browser = true }.capture()
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot {
+                if (now in 1_739 until 12_189) return browserSnapshot
+                val current = underlying.capture()
+                return if (now < 13_218) current else current.copy(nodes = current.nodes.map {
+                    if (it.path == "title") it.copy(text = "另一件商品标题文本") else it
+                })
+            }
+            override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome {
+                assertTrue(now in 1_739 until 12_189)
+                clicksAt += now
+                return FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS)
+            }
+            override fun clickFreshDetailed(target: SnapshotNode): FreshClickOutcome {
+                assertTrue("spec action at $now", now >= 15_200)
+                return underlying.clickFreshDetailed(target)
+            }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { probeAt = now; "{}" },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe", reuseProbeProduct = false), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("spec_probe_completed", outcome.resultType)
+        assertTrue(probeAt >= 15_200)
+        assertTrue(clicksAt.zipWithNext().all { (a, b) -> b - a >= 1_000 })
+    }
+
+    @Test
+    fun `slow capture crossing deadline cannot click browser or enter specs`() {
+        var now = 0L
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun capture(): UiSnapshot { now = 30_000; return underlying.capture() }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `fresh browser node lookup crossing deadline declines action`() {
+        var now = 0L
+        val underlying = FakePurchaseDriver().apply { browser = true }
+        val driver = object : PurchaseUiDriver by underlying {
+            override fun clickNavigationFresh(target: SnapshotNode, allowed: () -> Boolean): FreshClickOutcome {
+                now = 30_000
+                assertFalse(allowed())
+                return FreshClickOutcome(FreshActionResult.FAILED, FreshClickReason.UNKNOWN)
+            }
+        }
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertTrue(underlying.clicked.isEmpty())
+    }
+
+    @Test
+    fun `direct accepted launch buffers same package product without empty frame`() {
+        var now = 0L
+        var probeAt = -1L
+        val driver = FakePurchaseDriver()
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { probeAt = now; "{}" },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.DIRECT }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("spec_probe_completed", outcome.resultType)
+        assertTrue(probeAt >= 3_000)
+        assertEquals(0, driver.openClickCount)
+    }
+
+    @Test
+    fun `browser launch without observed browser times out on stable old pdd`() {
+        var now = 0L
+        val driver = FakePurchaseDriver()
+        val outcome = PurchaseRehearsalExecutor(driver, { true }, { error("probe must not run") },
+            pause = { now += it }, acceptedLaunchPath = { PddLaunchPath.BROWSER }, monotonicNow = { now },
+        ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(30_000L, now)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
+    @Test
+    fun `untrusted current product does not bypass navigation`() {
+        var opens = 0
+        val outcome = executor(FakePurchaseDriver(), { opens++; false }, { null }, pause = {})
+            .execute(input().copy(reuseProbeProduct = false), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals(1, opens)
+        assertEquals("PDD_LINK_INVALID", outcome.errorCode)
+    }
+
+    @Test
+    fun `old pdd product without accepted launch evidence times out before probe`() {
+        var probes = 0
+        val driver = FakePurchaseDriver()
+        val outcome = executor(driver, { true }, { probes++; "{}" }, pause = {}, path = null)
+            .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(0, probes)
+        assertTrue(driver.clicked.isEmpty())
+    }
+
     @Test
     fun `probe skips post open swipes but preserves wait and records click`() {
         val driver = FakePurchaseDriver()
         val pauses = mutableListOf<Long>()
         val clicks = mutableListOf<FreshClickOutcome>()
         val configured = rule().replace("\"type\":\"openSpecPanel\"", "\"type\":\"openSpecPanel\",\"waitAfterMs\":1234")
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" },
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" },
             pause = pauses::add, probeClickDiagnostic = { _, _, click -> clicks += click },
         ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(configured), PurchaseAgentCapabilities.supported)
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -43,7 +229,7 @@ class PurchaseRehearsalExecutorTest {
     fun `blocked entry stops without gesture or probe`() {
         val driver = FakePurchaseDriver(forcedEntryClickReason = FreshClickReason.SIZE_ADVICE_BLOCKED)
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("SIZE_ADVICE_CLICK_BLOCKED", outcome.errorCode)
         assertEquals(0, driver.specTapCount)
@@ -53,7 +239,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `blocked size stops without gesture retry`() {
         val driver = FakePurchaseDriver(forcedSizeClickReason = FreshClickReason.SIZE_ADVICE_BLOCKED)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("SIZE_ADVICE_CLICK_BLOCKED", outcome.errorCode)
         assertEquals(0, driver.specTapCount)
@@ -64,7 +250,7 @@ class PurchaseRehearsalExecutorTest {
     fun `blocked gesture stops without another click`() {
         val driver = FakePurchaseDriver(forcedEntryClickReason = FreshClickReason.ACTION_CLICK_FALSE, specTapResult = FreshActionResult.BLOCKED)
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("SIZE_ADVICE_CLICK_BLOCKED", outcome.errorCode)
         assertEquals(1, driver.specTapCount)
@@ -74,7 +260,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `purchase still fails required post open swipe`() {
         val driver = FakePurchaseDriver(purchaseSwipeSucceeds = false)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
         assertEquals(1, driver.swipeCount)
@@ -83,7 +269,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `color selection then single size heading completes without selecting color again`() {
         val driver = FakePurchaseDriver(prefixlessSingleHeadingAfterColor = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
         assertEquals(1, driver.clicked.count { it == "黑色" })
@@ -93,7 +279,7 @@ class PurchaseRehearsalExecutorTest {
     fun `full exact summary confirms size after option leaves viewport`() {
         val target = "2XL 建议131到150斤"
         val driver = FakePurchaseDriver(sizes = listOf(target), hideSizeAfterSelection = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
         assertEquals(1, driver.clicked.count { it == target })
@@ -106,7 +292,7 @@ class PurchaseRehearsalExecutorTest {
             sizes = listOf(target), hideSizeAfterSelection = true,
             selectedSizeSummaryOverride = "2XL 建议151到170斤",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("failed", outcome.resultType)
     }
@@ -160,7 +346,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver()
         val pauses = mutableListOf<Long>()
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = { openCount++; driver.browser = true; true },
             probeSpecs = { null },
@@ -181,7 +367,7 @@ class PurchaseRehearsalExecutorTest {
     fun `manual purchase retry from agent reopens the task product url`() {
         val driver = FakePurchaseDriver(initiallyInAgent = true)
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = {
                 openCount++
@@ -201,7 +387,7 @@ class PurchaseRehearsalExecutorTest {
     fun `purchase phase reopens when pdd foreground has no product evidence`() {
         val driver = FakePurchaseDriver(loadingPddCaptures = 1)
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = { openCount++; driver.browser = true; true },
             probeSpecs = { null },
@@ -217,7 +403,7 @@ class PurchaseRehearsalExecutorTest {
     fun `purchase phase does not reuse a pdd login page`() {
         val driver = FakePurchaseDriver(pddProblemLabels = listOf("手机号登录", "登录后继续"))
         var openCount = 0
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             openLink = { openCount++; driver.browser = true; true },
             probeSpecs = { null },
@@ -231,7 +417,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `price range failure reports the observed unit price`() {
         val driver = FakePurchaseDriver()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(maxUnitPriceCent = 1_999), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_PRICE_OUT_OF_RANGE", outcome.errorCode)
@@ -246,7 +432,7 @@ class PurchaseRehearsalExecutorTest {
             "\"purchase.rehearsal.v1\",\"purchase.spec-probe.v1\"",
             "\"purchase.rehearsal.v1\",\"purchase.spec-probe.v1\",\"purchase.future.v1\"",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { openCount++; true }, { null }, pause = {})
+        val outcome = executor(driver, { openCount++; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(unsupported), PurchaseAgentCapabilities.supported)
         assertEquals("AGENT_CAPABILITY_MISMATCH", outcome.errorCode)
         assertEquals(0, openCount)
@@ -256,7 +442,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `missing exact spec returns probe and never chooses similar value`() {
         val driver = FakePurchaseDriver(colors = listOf("黑色加绒"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("spec_probe_completed", outcome.resultType)
         assertEquals("{\"dimensions\":[]}", outcome.probedSpecs)
@@ -268,7 +454,7 @@ class PurchaseRehearsalExecutorTest {
     fun `missing exact spec without server permission preserves the real failure`() {
         val driver = FakePurchaseDriver(colors = listOf("黑色加绒"))
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{\"dimensions\":[]}" }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -280,7 +466,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `exact size below the visible panel is found after a bounded vertical search`() {
         val driver = FakePurchaseDriver(hiddenSizeUntilUpSwipes = 3)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -295,7 +481,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -307,7 +493,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `visible exact color keeps established path without horizontal fallback`() {
         val driver = FakePurchaseDriver(colors = listOf("黑色", "白色"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -319,7 +505,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             horizontalColorPages = listOf(listOf("黑色"), listOf("富贵粉")),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
@@ -334,7 +520,7 @@ class PurchaseRehearsalExecutorTest {
             horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
             horizontalSpecSwipeSucceeds = false,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedColor = "富贵粉"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
@@ -351,7 +537,7 @@ class PurchaseRehearsalExecutorTest {
                 listOf("2XL 推荐125-140斤", targetSize),
             ),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = targetSize), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -366,7 +552,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             horizontalSizePages = listOf(listOf("S 推荐80-95斤"), listOf(targetSize)),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = targetSize), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -381,7 +567,7 @@ class PurchaseRehearsalExecutorTest {
             horizontalColorPages = listOf(listOf("黑色", "白色"), listOf("蓝色", "富贵粉")),
             horizontalSizePages = listOf(listOf("S 推荐80-95斤", "M 推荐95-110斤"), listOf("2XL 推荐125-140斤", targetSize)),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(
                 input().copy(mappedColor = "富贵粉", mappedSize = targetSize),
                 PurchaseRuleParser.parse(rule()),
@@ -398,7 +584,7 @@ class PurchaseRehearsalExecutorTest {
     fun `two column size grid continues vertically without horizontal container`() {
         val target = "3XL 推荐140-155斤"
         val driver = FakePurchaseDriver(sizes = listOf(target), revealGridSizeAfterUpSwipes = 7)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("rehearsal_completed", outcome.resultType)
         assertEquals(target, driver.size)
@@ -415,7 +601,7 @@ class PurchaseRehearsalExecutorTest {
             horizontalSpecSwipeSucceeds = false,
             revealGridSizeAfterUpSwipes = 7,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals(outcome.message, "rehearsal_completed", outcome.resultType)
         assertEquals(target, driver.size)
@@ -425,7 +611,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `missing size terminates at stable viewport with bounded gestures`() {
         val driver = FakePurchaseDriver(sizes = listOf("S", "M"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("PURCHASE_SPEC_TARGET_NOT_VISIBLE", outcome.errorCode)
         assertTrue(outcome.message.contains("reason=stableViewport"))
@@ -436,7 +622,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `visible exact size does not enter horizontal fallback`() {
         val driver = FakePurchaseDriver(sizes = listOf("L", "XL"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -449,7 +635,7 @@ class PurchaseRehearsalExecutorTest {
             sizeClickResults = mutableListOf(FreshActionResult.FAILED),
             sizeSelectsOnFailedClick = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -463,7 +649,7 @@ class PurchaseRehearsalExecutorTest {
             sizeClickResults = mutableListOf(FreshActionResult.NOT_FOUND),
             specTapResult = FreshActionResult.SUCCESS,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -475,7 +661,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `already selected exact size is not clicked again`() {
         val driver = FakePurchaseDriver(initialSize = "XL")
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -491,7 +677,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             hideSizeSelectedState = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -501,7 +687,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `final verification accepts current attempt proof when selected color scrolls out of viewport`() {
         val driver = FakePurchaseDriver(hideColorAfterQuantitySet = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -517,7 +703,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             hideSizeAfterQuantitySet = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -530,7 +716,7 @@ class PurchaseRehearsalExecutorTest {
             hideColorAfterQuantitySet = true,
             hideSelectedSummaryAfterQuantitySet = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -540,7 +726,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `final verification keeps current attempt proof when selected panel becomes unclassified`() {
         val driver = FakePurchaseDriver(panelBecomesUnknownAfterSizeProof = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(quantity = 1), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -555,7 +741,7 @@ class PurchaseRehearsalExecutorTest {
             hideSelectedSummaryAfterQuantitySet = true,
             restoreHiddenColorOnDownSwipe = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -571,7 +757,7 @@ class PurchaseRehearsalExecutorTest {
             hideSelectedSummaryAfterQuantitySet = true,
             selectedColorOverrideAfterQuantitySet = "白色",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -589,7 +775,7 @@ class PurchaseRehearsalExecutorTest {
             hideSizeAfterQuantitySet = true,
             selectedSummaryOverrideAfterQuantitySet = "黑色 2XL",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -606,7 +792,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             finalSizesAfterQuantitySet = listOf("XL【建议B】"),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -624,7 +810,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "2XL",
             hideSizeSelectedState = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -639,7 +825,7 @@ class PurchaseRehearsalExecutorTest {
             selectedSizeSummaryOverride = "XL",
             hideSizeSelectedState = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(mappedSize = target), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -651,7 +837,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(
             sizeClickResults = mutableListOf(FreshActionResult.FAILED),
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_CLICK_FAILED", outcome.errorCode)
@@ -672,7 +858,7 @@ class PurchaseRehearsalExecutorTest {
 
         cases.forEach { (reason, expected) ->
             val driver = FakePurchaseDriver(forcedSizeClickReason = reason)
-            val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
                 .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
             assertEquals("PURCHASE_SPEC_CLICK_FAILED", outcome.errorCode)
@@ -684,7 +870,7 @@ class PurchaseRehearsalExecutorTest {
     fun `visible unavailable exact target fails as safe target missing without probing`() {
         val driver = FakePurchaseDriver(unavailableSizes = setOf("XL"))
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input().copy(specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_SAFE_TARGET_MISSING", outcome.errorCode)
@@ -697,7 +883,7 @@ class PurchaseRehearsalExecutorTest {
         listOf("¥15.78", "XL ¥15.78起").forEach { unsafeTarget ->
             val driver = FakePurchaseDriver()
             var probes = 0
-            val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+            val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
                 .execute(input().copy(mappedSize = unsafeTarget, specResolutionAllowed = true), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
             assertEquals("PURCHASE_SPEC_SAFE_TARGET_MISSING", outcome.errorCode)
@@ -709,7 +895,7 @@ class PurchaseRehearsalExecutorTest {
     fun `legacy task target with a safe trailing price selects the clean page value`() {
         val clean = "XL【建议121-140斤】"
         val driver = FakePurchaseDriver(sizes = listOf(clean))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(mappedSize = "$clean  ¥15.78"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -719,7 +905,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `two raw page values that normalize to one size fail as ambiguous`() {
         val driver = FakePurchaseDriver(sizes = listOf("XL  ¥15.78", "XL ￥16.80"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -730,7 +916,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `price outside range fails before any order action`() {
         val driver = FakePurchaseDriver(priceCent = 4_000)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("PURCHASE_PRICE_OUT_OF_RANGE", outcome.errorCode)
         assertFalse(driver.clicked.any { it.contains("订单") || it.contains("支付") })
@@ -739,7 +925,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `ambiguous browser target stops safely`() {
         val driver = FakePurchaseDriver(duplicateOpen = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("RULE_AMBIGUOUS", outcome.errorCode)
         assertTrue(driver.clicked.isEmpty())
@@ -751,7 +937,7 @@ class PurchaseRehearsalExecutorTest {
             openClickResults = mutableListOf(FreshActionResult.FAILED),
             openPddOnFailedClick = true,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -764,7 +950,7 @@ class PurchaseRehearsalExecutorTest {
             openClickResults = mutableListOf(FreshActionResult.NOT_FOUND, FreshActionResult.SUCCESS),
         )
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -775,46 +961,46 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `persistent open click failure is bounded and remains safely failed`() {
         val driver = FakePurchaseDriver(
-            openClickResults = MutableList(20) { FreshActionResult.FAILED },
+            openClickResults = MutableList(40) { FreshActionResult.FAILED },
         )
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
-        assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
-        assertTrue(driver.openClickCount in 1..15)
-        assertEquals(150, pauses.size)
+        assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
+        assertEquals(30, driver.openClickCount)
+        assertEquals(300, pauses.size)
     }
 
     @Test
     fun `five second browser interstitial can still reach a stable product page`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(browserOpenVisibleAfterCaptures = 50)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
         assertEquals(1, driver.openClickCount)
-        assertTrue(pauses.count { it == 100L } in 52..60)
+        assertTrue(pauses.count { it == 100L } in 82..90)
     }
 
     @Test
-    fun `pdd foreground without stable product evidence times out at fifteen seconds`() {
+    fun `pdd foreground without stable product evidence times out at thirty seconds`() {
         val pauses = mutableListOf<Long>()
-        val driver = FakePurchaseDriver(loadingPddCaptures = 200)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val driver = FakePurchaseDriver(loadingPddCaptures = 400)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_DETAIL_ENTRY_FAILED", outcome.errorCode)
         assertEquals("打开拼多多后未识别到稳定商品页面", outcome.message)
-        assertEquals(150, pauses.count { it == 100L })
+        assertEquals(300, pauses.count { it == 100L })
     }
 
     @Test
     fun `explicit pdd login page fails before the product timeout`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(pddProblemLabels = listOf("手机号登录", "登录后继续"))
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_LOGIN_REQUIRED", outcome.errorCode)
@@ -825,7 +1011,7 @@ class PurchaseRehearsalExecutorTest {
     fun `open spec panel skips required follow-up swipe only for confirmed non-scrollable panel`() {
         val driver = FakePurchaseDriver(nonScrollablePanel = true, purchaseSwipeSucceeds = false)
         val diagnostics = mutableListOf<String>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {}, panelDiagnostic = diagnostics::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -841,7 +1027,7 @@ class PurchaseRehearsalExecutorTest {
         )
         var probes = 0
         val diagnostics = mutableListOf<String>()
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver, { driver.browser = true; true }, { probes++; "{}" },
             pause = {}, panelDiagnostic = diagnostics::add,
         ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
@@ -857,7 +1043,7 @@ class PurchaseRehearsalExecutorTest {
         val driver = FakePurchaseDriver(purchaseSwipeSucceeds = false)
         var probes = 0
         val diagnostics = mutableListOf<String>()
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver, { driver.browser = true; true }, { probes++; "{}" },
             pause = {}, panelDiagnostic = diagnostics::add,
         ).execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
@@ -876,7 +1062,7 @@ class PurchaseRehearsalExecutorTest {
             PurchaseSwipeOutcome(PurchaseSwipeResult.ROOT_UNAVAILABLE, 0),
         ))
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; "{}" }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
@@ -891,7 +1077,7 @@ class PurchaseRehearsalExecutorTest {
             PurchaseSwipeOutcome(PurchaseSwipeResult.NO_SCROLLABLE_TARGET, 0),
         ))
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -903,7 +1089,7 @@ class PurchaseRehearsalExecutorTest {
     fun `scrollable spec reveal preserves configured swipe count and interval`() {
         val driver = FakePurchaseDriver()
         val pauses = mutableListOf<Long>()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = pauses::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -918,7 +1104,7 @@ class PurchaseRehearsalExecutorTest {
             "\"waitAfterMs\":700}",
             "\"waitAfterMs\":700,\"swipeAfter\":{\"direction\":\"up\",\"count\":1,\"durationMs\":500,\"intervalMs\":0}}",
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{}" }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(configured), PurchaseAgentCapabilities.supported)
 
         assertEquals("RULE_ACTION_FAILED", outcome.errorCode)
@@ -930,7 +1116,7 @@ class PurchaseRehearsalExecutorTest {
     fun `skipping a reveal does not skip a failed specification probe`() {
         val driver = FakePurchaseDriver(panelOverride = SpecPanelFixtures.liveShapedSheet())
         var probes = 0
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { probes++; null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { probes++; null }, pause = {})
             .execute(input().copy(phase = "spec_probe"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_NOT_MATCHED", outcome.errorCode)
@@ -940,7 +1126,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `unrecognized opened panel returns only scalar panel evidence`() {
         val driver = FakePurchaseDriver(unrecognizedPanel = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_PANEL_EVIDENCE_NOT_MATCHED", outcome.errorCode)
@@ -959,7 +1145,7 @@ class PurchaseRehearsalExecutorTest {
             entryActionHasEffect = false,
             specTapResult = FreshActionResult.SUCCESS,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -974,7 +1160,7 @@ class PurchaseRehearsalExecutorTest {
             specTapResult = FreshActionResult.SUCCESS,
             specTapHasEffect = false,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_CLICK_NO_EFFECT", outcome.errorCode)
@@ -988,7 +1174,7 @@ class PurchaseRehearsalExecutorTest {
             entryActionHasEffect = false,
             specTapResult = FreshActionResult.FAILED,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_CLICK_FAILED", outcome.errorCode)
@@ -1001,7 +1187,7 @@ class PurchaseRehearsalExecutorTest {
         val diagnostics = mutableListOf<String>()
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(missingSpecEntry = true)
-        val outcome = PurchaseRehearsalExecutor(
+        val outcome = executor(
             driver,
             { driver.browser = true; true },
             { null },
@@ -1022,33 +1208,31 @@ class PurchaseRehearsalExecutorTest {
     fun `open spec panel waits for a late safe bottom purchase entry`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(bottomPurchaseEntry = true, specEntryVisibleAfterPddCaptures = 4)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = pauses::add)
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
         assertTrue(driver.clickedPaths.contains("buy"))
-        // One 100ms pause belongs to the existing open-product foreground poll;
-        // two belong to the entry-ready wait before the bottom bar appears.
-        assertEquals(3, pauses.count { it == 100L })
+        // The browser return gets a full three-second buffer before the spec entry can be used.
+        assertEquals(32, pauses.count { it == 100L })
     }
 
     @Test
     fun `purchase reopens and waits for product evidence instead of a visible loading frame`() {
         val pauses = mutableListOf<Long>()
         val driver = FakePurchaseDriver(loadingPddCaptures = 1)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = pauses::add)
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = pauses::add)
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
-        // Two stable reads belong to reopening the product; verifyProduct then
-        // independently requires its second stable read before continuing.
-        assertEquals(3, pauses.count { it == 100L })
+        // Browser return buffer overlaps stable reads; verifyProduct performs its independent check.
+        assertEquals(32, pauses.count { it == 100L })
     }
 
     @Test
     fun `transient sold out page recovers before opening specs`() {
         val driver = FakePurchaseDriver(soldOut = true, recoverSoldOutAfterPull = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -1059,7 +1243,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `persistent sold out page returns replacement eligible error`() {
         val driver = FakePurchaseDriver(soldOut = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_GOODS_SOLD_OUT", outcome.errorCode)
@@ -1070,7 +1254,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `sold out recovery gesture failure stops immediately`() {
         val driver = FakePurchaseDriver(soldOut = true, pullDownSucceeds = false)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PDD_GOODS_SOLD_OUT", outcome.errorCode)
@@ -1080,7 +1264,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `sold out recovery rejects a page that lost product evidence`() {
         val driver = FakePurchaseDriver(soldOut = true, loseEvidenceAfterPull = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("RULE_NOT_MATCHED", outcome.errorCode)
@@ -1091,7 +1275,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `all unavailable specs recover on goods page and reopen panel`() {
         val driver = FakePurchaseDriver(allSpecsUnavailable = true, recoverSoldOutAfterPull = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("rehearsal_completed", outcome.resultType)
@@ -1102,7 +1286,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `goods id mismatch fails before opening pdd`() {
         var opened = false
-        val outcome = PurchaseRehearsalExecutor(FakePurchaseDriver(), { opened = true; true }, { null }, pause = {})
+        val outcome = executor(FakePurchaseDriver(), { opened = true; true }, { null }, pause = {})
             .execute(input().copy(goodsId = "999"), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
         assertEquals("PDD_GOODS_MISMATCH", outcome.errorCode)
         assertFalse(opened)
@@ -1111,7 +1295,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `live rule spec probe ignores historical mapping and returns before address or order actions`() {
         val driver = FakePurchaseDriver()
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(
                 input().copy(
                     executionMode = "live",
@@ -1131,7 +1315,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `spec probe opens panel through safe bottom purchase entry`() {
         val driver = FakePurchaseDriver(bottomPurchaseEntry = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { "{\"dimensions\":[]}" }, pause = {})
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("spec_probe_completed", outcome.resultType)
@@ -1142,7 +1326,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `purchase returns once and fails explicitly when spec entry opens reviews`() {
         val driver = FakePurchaseDriver(bottomPurchaseEntry = true, openReviewOnBottomClick = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("failed", outcome.resultType)
@@ -1163,7 +1347,7 @@ class PurchaseRehearsalExecutorTest {
         )
         cases.forEach { (reason, expected) ->
             val driver = FakePurchaseDriver(forcedEntryClickReason = reason)
-            val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+            val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
                 .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
             assertEquals("PURCHASE_SPEC_ENTRY_CLICK_FAILED", outcome.errorCode)
@@ -1179,7 +1363,7 @@ class PurchaseRehearsalExecutorTest {
             openReviewOnBottomClick = true,
             reviewBackSucceeds = false,
         )
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input().copy(executionMode = "live", phase = "spec_probe"), PurchaseRuleParser.parse(liveRule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_OPENED_REVIEW", outcome.errorCode)
@@ -1192,7 +1376,7 @@ class PurchaseRehearsalExecutorTest {
     fun `spec aliases cannot bypass semantic safe candidates`() {
         val driver = FakePurchaseDriver(includeReviewEntry = true)
         val unsafeRule = rule().replace("[\"选择规格\"]", "[\"商品评价\"]")
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(unsafeRule), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_NOT_FOUND", outcome.errorCode)
@@ -1202,7 +1386,7 @@ class PurchaseRehearsalExecutorTest {
     @Test
     fun `spec entry failures include scalar diagnostics only`() {
         val driver = FakePurchaseDriver(missingSpecEntry = true)
-        val outcome = PurchaseRehearsalExecutor(driver, { driver.browser = true; true }, { null }, pause = {})
+        val outcome = executor(driver, { driver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_NOT_FOUND", outcome.errorCode)
@@ -1212,7 +1396,7 @@ class PurchaseRehearsalExecutorTest {
         )
 
         val ambiguousDriver = FakePurchaseDriver(forcedEntryClickReason = FreshClickReason.TARGET_AMBIGUOUS)
-        val ambiguous = PurchaseRehearsalExecutor(ambiguousDriver, { ambiguousDriver.browser = true; true }, { null }, pause = {})
+        val ambiguous = executor(ambiguousDriver, { ambiguousDriver.browser = true; true }, { null }, pause = {})
             .execute(input(), PurchaseRuleParser.parse(rule()), PurchaseAgentCapabilities.supported)
 
         assertEquals("PURCHASE_SPEC_ENTRY_TARGET_AMBIGUOUS", ambiguous.errorCode)
@@ -1329,6 +1513,7 @@ class PurchaseRehearsalExecutorTest {
         assertEquals(1, submitted.map { it.payloadJson }.distinct().size)
     }
 
+    /** Existing spec/price tests explicitly model the trusted immediate probe handoff. */
     private fun input() = PurchaseExecutionInput(
         taskId = 42,
         executionMode = "rehearsal",
@@ -1340,8 +1525,26 @@ class PurchaseRehearsalExecutorTest {
         quantity = 2,
         minUnitPriceCent = 1_000,
         maxUnitPriceCent = 3_000,
+        reuseProbeProduct = true,
     )
 
+    private fun executor(
+        driver: PurchaseUiDriver,
+        openLink: (String) -> Boolean,
+        probeSpecs: () -> String?,
+        pause: (Long) -> Unit,
+        panelDiagnostic: (String) -> Unit = {},
+        probeClickDiagnostic: (AgentDiagnosticStage, SnapshotNode, FreshClickOutcome) -> Unit = { _, _, _ -> },
+        path: PddLaunchPath? = PddLaunchPath.BROWSER,
+    ): PurchaseRehearsalExecutor {
+        var now = 0L
+        return PurchaseRehearsalExecutor(driver, openLink, probeSpecs,
+            pause = { millis -> now += millis; pause(millis) },
+            panelDiagnostic = panelDiagnostic, probeClickDiagnostic = probeClickDiagnostic,
+            acceptedLaunchPath = { path }, monotonicNow = { now },
+        )
+    }
+
     private fun rule() = """{
       "schemaVersion":1,
       "ruleType":"pddPurchase",

android/app/src/test/java/cn/ilapage/goauto/agent/PurchaseResultAcknowledgementTest.kt

@@ -0,0 +1,19 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.network.PurchaseResultAcknowledgement
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+
+class PurchaseResultAcknowledgementTest {
+    @Test fun `server omits replayed false on pending first response`() {
+        val ack = PurchaseResultAcknowledgement.from(JSONObject("""{"status":"pending"}"""))
+        assertTrue(ack.pending)
+        assertFalse(ack.replayed)
+    }
+    @Test fun `failed matching and explicit or malformed replay never qualify`() {
+        assertFalse(PurchaseResultAcknowledgement.from(JSONObject("""{"status":"failed"}""")).pending)
+        assertTrue(PurchaseResultAcknowledgement.from(JSONObject("""{"status":"pending","replayed":true}""")).replayed)
+        assertTrue(PurchaseResultAcknowledgement.from(JSONObject("""{"status":"pending","replayed":"invalid"}""")).replayed)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/RepurchaseServerClockTest.kt

@@ -0,0 +1,37 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.network.AgentApiClient
+import org.junit.Assert.*
+import org.junit.Test
+import java.net.ServerSocket
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+
+class RepurchaseServerClockTest {
+    @Test fun historyCapturesServerDateAndMissingDateClearsPreviousSample() {
+        ServerSocket(0).use { server ->
+            val executor = Executors.newSingleThreadExecutor()
+            val response = "{\"data\":{\"items\":[],\"total\":0,\"page\":1,\"pageSize\":50}}"
+            val serving = executor.submit {
+                repeat(2) { index ->
+                    server.accept().use { socket ->
+                        socket.soTimeout = 3000
+                        val reader = socket.getInputStream().bufferedReader()
+                        while (!reader.readLine().isNullOrEmpty()) { }
+                        val date = if (index == 0) "Date: Thu, 08 Oct 2026 09:00:00 GMT\r\n" else ""
+                        socket.getOutputStream().write(("HTTP/1.1 200 OK\r\n" + date +
+                            "Content-Type: application/json\r\nContent-Length: ${response.toByteArray().size}\r\nConnection: close\r\n\r\n$response").toByteArray())
+                    }
+                }
+            }
+            try {
+                val api = AgentApiClient("http://127.0.0.1:${server.localPort}")
+                api.purchaseHistory("synthetic", 1, null, null, 30, 50)
+                assertEquals(1791450000000L, api.lastResponseServerTimeMillis)
+                api.purchaseHistory("synthetic", 1, null, null, 30, 50)
+                assertNull(api.lastResponseServerTimeMillis)
+                serving.get(5, TimeUnit.SECONDS)
+            } finally { executor.shutdownNow() }
+        }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/SpecOptionDedupTest.kt

@@ -63,6 +63,7 @@ class SpecOptionDedupTest {
 
     private fun input() = PurchaseExecutionInput(
         taskId = 332,
+        reuseProbeProduct = true, // This test starts at the trusted probe-to-purchase spec handoff.
         executionMode = "rehearsal",
         phase = "purchase",
         url = "https://mobile.yangkeduo.com/goods.html?goods_id=719834019024",

android/app/src/test/java/cn/ilapage/goauto/agent/SpecPanelRecognitionTest.kt

@@ -716,6 +716,7 @@ class SpecPanelRecognitionTest {
 
     private fun input() = PurchaseExecutionInput(
         taskId = 331,
+        reuseProbeProduct = true, // Panel tests start at the trusted probe-to-purchase handoff.
         executionMode = "rehearsal",
         phase = "purchase",
         url = "https://mobile.yangkeduo.com/goods.html?goods_id=719834019024",

android/app/src/test/java/cn/ilapage/goauto/agent/SpecValueNormalizerTest.kt

@@ -8,6 +8,15 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class SpecValueNormalizerTest {
+    @Test
+    fun `final confirmation maps only display brackets alphanumerics and whitespace`() {
+        assertEquals("[白][黑][灰](薄款) RW12 XL", SpecValueNormalizer.normalizeFinalConfirmation(" 【白】〔黑〕［灰］（薄款）　ＲＷ１２\t\nXL "))
+        assertEquals("白色,加绒：XL ¥19.60 ① 2件", SpecValueNormalizer.normalizeFinalConfirmation("白色,加绒：XL ¥19.60 ① 2件"))
+        assertEquals("xl", SpecValueNormalizer.normalizeFinalConfirmation("xl"))
+        assertEquals("【白色】 ＸＬ", SpecValueNormalizer.normalizeColor("【白色】 ＸＬ"))
+        assertEquals("【白色】 ＸＬ", SpecValueNormalizer.normalizeSize("【白色】 ＸＬ"))
+    }
+
     @Test
     fun `only trailing price is removed`() {
         assertEquals("紫色", SpecValueNormalizer.normalizeColor("紫色  ¥15.78"))

android/app/src/test/java/cn/ilapage/goauto/agent/TruncatedSpecCardTest.kt

@@ -213,7 +213,8 @@ class TruncatedSpecCardTest {
 
     private fun run(snapshot: UiSnapshot, target: String = full, driver: Driver = Driver(snapshot)) = executor(driver).execute(
         PurchaseExecutionInput(362, "rehearsal", "purchase", "https://mobile.yangkeduo.com/goods.html?goods_id=123456789",
-            "123456789", target, size, quantity = 1, minUnitPriceCent = 1000, maxUnitPriceCent = 3000),
+            "123456789", target, size, quantity = 1, minUnitPriceCent = 1000, maxUnitPriceCent = 3000,
+            reuseProbeProduct = true), // Exact-card tests explicitly model the immediate trusted handoff.
         PurchaseRuleParser.parse("""{"schemaVersion":1,"ruleType":"pddPurchase","requiredCapabilities":["purchase.rehearsal.v1"],
             "actions":[{"type":"openProduct"},{"type":"verifyProduct"},{"type":"openSpecPanel"},{"type":"selectSpec"},
             {"type":"setQuantity"},{"type":"verifyUnitPrice"},{"type":"verifyOrderSummary"}]}"""),

android/app/src/test/java/cn/ilapage/goauto/agent/persistence/AgentDiagnosticStoreMigrationTest.kt

@@ -3,10 +3,130 @@ package cn.ilapage.goauto.agent.persistence
 import java.sql.Connection
 import java.sql.DriverManager
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class AgentDiagnosticStoreMigrationTest {
+    @Test
+    fun freshV5DatabaseHasNullableColorDiscoveryOutcomeColumns() = withDatabase { db ->
+        db.createStatement().use { it.execute(AgentDiagnosticSchema.createTableSql) }
+        assertEquals(5, AgentDiagnosticSchema.VERSION)
+        assertV5Columns(db)
+        insertOldDiagnostic(db)
+        assertOldDiagnosticPreserved(db)
+        for (incomplete in listOf(0, 1)) {
+            db.createStatement().use { statement ->
+                statement.executeUpdate(
+                    "UPDATE agent_diagnostic SET color_vertical_swipe_count=4, " +
+                        "color_trailing_empty_read_count=2, color_horizontal_incomplete=$incomplete",
+                )
+                statement.executeQuery(
+                    "SELECT color_vertical_swipe_count, color_trailing_empty_read_count, " +
+                        "color_horizontal_incomplete FROM agent_diagnostic",
+                ).use { row ->
+                    assertTrue(row.next())
+                    assertEquals(4, row.getInt(1))
+                    assertEquals(2, row.getInt(2))
+                    assertEquals(incomplete, row.getInt(3))
+                }
+            }
+        }
+    }
+
+    @Test
+    fun everySupportedVersionUpgradesToV5WithoutChangingExistingRows() {
+        for (oldVersion in 1..4) withDatabase { db ->
+            createOldDatabase(db, oldVersion)
+            insertOldDiagnostic(db)
+            val existingTables = snapshotTables(db)
+
+            migrate(db, oldVersion, 5)
+
+            assertV5Columns(db)
+            assertOldDiagnosticPreserved(db)
+            existingTables.forEach { (name, rows) -> assertEquals(name, rows, tableRows(db, name)) }
+            assertTrue(columnNames(db).containsAll(AgentDiagnosticSchema.colorDiagnosticColumns.keys))
+            assertTrue(columnNames(db).containsAll(AgentDiagnosticSchema.purchaseDiagnosticColumns.keys))
+            assertEquals(3, snapshotTables(db).size)
+            migrate(db, oldVersion, 5)
+            assertOldDiagnosticPreserved(db)
+            existingTables.forEach { (name, rows) -> assertEquals(name, rows, tableRows(db, name)) }
+        }
+    }
+
+    @Test
+    fun v4UpgradeAddsOnlyMissingColumnsAndKeepsExistingV5Values() = withDatabase { db ->
+        createOldDatabase(db, 4)
+        insertOldDiagnostic(db)
+        db.createStatement().use {
+            it.execute("ALTER TABLE agent_diagnostic ADD COLUMN color_vertical_swipe_count INTEGER")
+            it.executeUpdate("UPDATE agent_diagnostic SET color_vertical_swipe_count=3")
+        }
+        val statements = AgentDiagnosticSchema.migrationStatements(4, 5, columnNames(db))
+        assertEquals(2, statements.size)
+        assertTrue(statements.all { it.startsWith("ALTER TABLE agent_diagnostic ADD COLUMN ") })
+        migrate(db, 4, 5)
+        assertV5Columns(db)
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT color_vertical_swipe_count, color_trailing_empty_read_count, color_horizontal_incomplete FROM agent_diagnostic").use {
+                assertTrue(it.next())
+                assertEquals(3, it.getInt(1))
+                assertNull(it.getObject(2))
+                assertNull(it.getObject(3))
+            }
+        }
+        assertTrue(AgentDiagnosticSchema.migrationStatements(4, 5, columnNames(db)).isEmpty())
+        assertTrue(AgentDiagnosticSchema.migrationStatements(5, 5, columnNames(db)).isEmpty())
+        assertTrue(AgentDiagnosticSchema.migrationStatements(4, 4, columnNames(db)).isEmpty())
+    }
+
+    @Test
+    fun v5UpgradeSurvivesDatabaseReopen() {
+        val file = java.io.File.createTempFile("goauto-diagnostic-migration-", ".db")
+        try {
+            Class.forName("org.sqlite.JDBC")
+            DriverManager.getConnection("jdbc:sqlite:${file.absolutePath}").use { db ->
+                createOldDatabase(db, 4)
+                insertOldDiagnostic(db)
+                migrate(db, 4, 5)
+                db.createStatement().use { it.execute("PRAGMA user_version=5") }
+            }
+            DriverManager.getConnection("jdbc:sqlite:${file.absolutePath}").use { db ->
+                assertV5Columns(db)
+                assertOldDiagnosticPreserved(db)
+                assertTrue(AgentDiagnosticSchema.migrationStatements(4, 5, columnNames(db)).isEmpty())
+                assertEquals(3, snapshotTables(db).size)
+                db.createStatement().use { statement ->
+                    statement.executeQuery("PRAGMA user_version").use {
+                        assertTrue(it.next())
+                        assertEquals(5, it.getInt(1))
+                    }
+                }
+            }
+        } finally {
+            check(file.delete()) { "Could not remove temporary migration test database" }
+        }
+    }
+
+    @Test
+    fun v4AddsIndependentFailureSnapshotQueueWithoutChangingStructuredRows() = withDatabase { db ->
+        db.createStatement().use {
+            it.execute(AgentDiagnosticSchema.createTableSql)
+            it.execute("INSERT INTO agent_diagnostic (task_id,stage,reason,attempt,elapsed_ms,agent_version,created_at) VALUES (1,'COLOR_CLICK','CLICK_SUCCESS',1,0,'old',1000)")
+        }
+        AgentDiagnosticSchema.migrationStatements(3, 4, columnNames(db)).forEach { sql ->
+            db.createStatement().use { it.execute(sql) }
+        }
+        for (table in listOf("purchase_failure_snapshot", "purchase_failure_snapshot_queue", "purchase_failure_snapshot_context")) {
+            db.prepareStatement("SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=?").use {
+                it.setString(1, table)
+                it.executeQuery().use { rows -> assertTrue(rows.next()); assertEquals(table, 1, rows.getInt(1)) }
+            }
+        }
+        assertEquals(1, rowCount(db))
+    }
+
     @Test
     fun upgradeFromV1OrV2PreservesOldRowsAndSeparatesPurchaseAttempts() {
         for (oldVersion in listOf(1, 2)) withDatabase { db ->
@@ -118,6 +238,80 @@ class AgentDiagnosticStoreMigrationTest {
         assertEquals(1, rowCount(db))
     }
 
+    private fun assertV5Columns(db: Connection) {
+        val actual = mutableSetOf<String>()
+        db.createStatement().use { statement ->
+            statement.executeQuery("PRAGMA table_info(agent_diagnostic)").use { rows ->
+                while (rows.next()) {
+                    val name = rows.getString("name")
+                    if (name in V5_COLUMNS) {
+                        actual.add(name)
+                        assertEquals(name, "INTEGER", rows.getString("type"))
+                        assertEquals(name, 0, rows.getInt("notnull"))
+                        assertNull(name, rows.getObject("dflt_value"))
+                    }
+                }
+            }
+        }
+        assertEquals(V5_COLUMNS, actual)
+    }
+
+    private fun createOldDatabase(db: Connection, version: Int) {
+        db.createStatement().use { it.execute(CREATE_V1_TABLE_SQL) }
+        migrate(db, 1, version)
+        if (version >= 4) db.createStatement().use {
+            it.execute("INSERT INTO purchase_failure_snapshot VALUES ('attempt','test-origin',106,7,'spec_probe',1000,2000,'test','ready','{}',X'0102','test-fingerprint',2)")
+            it.execute("INSERT INTO purchase_failure_snapshot_queue VALUES ('attempt','test-fingerprint',1500,2)")
+            it.execute("INSERT INTO purchase_failure_snapshot_context VALUES ('attempt','test-origin','{}',1000)")
+        }
+    }
+
+    private fun insertOldDiagnostic(db: Connection) {
+        db.createStatement().use {
+            it.execute("INSERT INTO agent_diagnostic (task_id,stage,reason,attempt,elapsed_ms,agent_version,created_at) VALUES (106,'COLOR_DISCOVERY','COLOR_EDGE_REACHED',2,10,'old',1000)")
+        }
+    }
+
+    private fun assertOldDiagnosticPreserved(db: Connection) {
+        assertEquals(1, rowCount(db))
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT id,task_id,stage,reason,attempt,elapsed_ms,agent_version,created_at,color_vertical_swipe_count,color_trailing_empty_read_count,color_horizontal_incomplete FROM agent_diagnostic").use {
+                assertTrue(it.next())
+                assertEquals(1L, it.getLong(1))
+                assertEquals(106L, it.getLong(2))
+                assertEquals("COLOR_DISCOVERY", it.getString(3))
+                assertEquals("COLOR_EDGE_REACHED", it.getString(4))
+                assertEquals(2, it.getInt(5))
+                assertEquals(10L, it.getLong(6))
+                assertEquals("old", it.getString(7))
+                assertEquals(1000L, it.getLong(8))
+                for (index in 9..11) assertNull(it.getObject(index))
+            }
+        }
+    }
+
+    private fun snapshotTables(db: Connection): Map<String, List<List<String?>>> =
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'purchase_failure_snapshot%'").use { rows ->
+                buildList { while (rows.next()) add(rows.getString(1)) }
+            }
+        }.associateWith { tableRows(db, it) }
+
+    private fun tableRows(db: Connection, table: String): List<List<String?>> =
+        db.createStatement().use { statement ->
+            statement.executeQuery("SELECT * FROM $table ORDER BY attempt_id").use { rows ->
+                buildList {
+                    while (rows.next()) add((1..rows.metaData.columnCount).map { rows.getString(it) })
+                }
+            }
+        }
+
+    private fun migrate(db: Connection, oldVersion: Int, newVersion: Int) {
+        AgentDiagnosticSchema.migrationStatements(oldVersion, newVersion, columnNames(db)).forEach { sql ->
+            db.createStatement().use { it.execute(sql) }
+        }
+    }
+
     private fun migrateV1ToV2(db: Connection) {
         AgentDiagnosticSchema.v2MigrationStatements(1, 2, columnNames(db)).forEach { sql ->
             db.createStatement().use { it.execute(sql) }
@@ -147,6 +341,7 @@ class AgentDiagnosticStoreMigrationTest {
     }
 
     private companion object {
+        val V5_COLUMNS = setOf("color_vertical_swipe_count", "color_trailing_empty_read_count", "color_horizontal_incomplete")
         val CREATE_V1_TABLE_SQL =
             """CREATE TABLE agent_diagnostic (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,

android/app/src/test/java/cn/ilapage/goauto/agent/persistence/FailureSnapshotRepositoryTest.kt

@@ -0,0 +1,131 @@
+package cn.ilapage.goauto.agent.persistence
+
+import cn.ilapage.goauto.agent.diagnostics.FailureSnapshot
+import java.sql.DriverManager
+import java.time.Instant
+import org.json.JSONObject
+import org.junit.Assert.*
+import org.junit.Test
+
+class FailureSnapshotRepositoryTest {
+    private val now = 1_791_400_000_000L
+    private val origin = "https://test.invalid"
+    private val attempt = "11111111-1111-4111-8111-111111111111"
+
+    private fun snapshot(zip: Boolean = false, source: String = "execution", time: Long = now) = FailureSnapshot(
+        JSONObject().put("taskId", 9).put("deviceId", 4).put("taskAttemptId", attempt)
+            .put("phase", "purchase").put("ruleSnapshotHash", "a".repeat(64)).put("ruleSnapshotHashValid", true)
+            .put("recordedAt", Instant.ofEpochMilli(time).toString()).put("source", source)
+            .put("status", if (zip) "partial" else "not_captured").toString(),
+        if (zip) byteArrayOf(1, 2, 3) else null, origin,
+    )
+
+    @Test fun durableQueueIsOriginBoundAndKeepsFirstArchive() = database { db ->
+        val repo = FailureSnapshotRepository(db, clock = { now })
+        val first = snapshot(true)
+        assertTrue(repo.saveFailureSnapshot(first))
+        assertFalse(repo.saveFailureSnapshot(snapshot(true, "recovery")))
+        assertEquals(0, repo.pendingFailureSnapshots("https://other.invalid").size)
+        val restarted = FailureSnapshotRepository(db, clock = { now })
+        assertArrayEquals(first.archive, restarted.pendingFailureSnapshots(origin).single().archive)
+        restarted.markFailureSnapshotUploaded(first)
+        assertTrue(restarted.pendingFailureSnapshots(origin).isEmpty())
+        assertTrue(restarted.hasFailureSnapshotArchive(attempt))
+    }
+
+    @Test fun recoveryPromotionCannotBeAcknowledgedByOldUpload() = database { db ->
+        val repo = FailureSnapshotRepository(db, clock = { now })
+        val old = snapshot()
+        assertTrue(repo.saveFailureSnapshot(old))
+        val recovery = snapshot(true, "recovery")
+        assertTrue(repo.saveFailureSnapshot(recovery))
+        repo.markFailureSnapshotUploaded(old)
+        repo.retryFailureSnapshotLater(old)
+        assertArrayEquals(recovery.archive, repo.pendingFailureSnapshots(origin).single().archive)
+    }
+
+    @Test fun cleanupRemovesExpiredSnapshotsAndQueueButNotStructuredRows() = database { db ->
+        db.execute(AgentDiagnosticSchema.createTableSql)
+        db.execute("INSERT INTO agent_diagnostic (task_id,stage,reason,attempt,elapsed_ms,agent_version,created_at) VALUES (1,'COLOR_CLICK','CLICK_SUCCESS',1,0,'old',1000)")
+        val repo = FailureSnapshotRepository(db, clock = { now })
+        assertTrue(repo.saveFailureSnapshot(snapshot()))
+        repo.cleanupFailureSnapshots(now + FailureSnapshotRepository.RETENTION_MILLIS)
+        assertTrue(repo.pendingFailureSnapshots(origin).isEmpty())
+        assertEquals(0L, db.query("SELECT COUNT(*) AS n FROM purchase_failure_snapshot").single()["n"])
+        assertEquals(0L, db.query("SELECT COUNT(*) AS n FROM purchase_failure_snapshot_queue").single()["n"])
+        assertEquals(1L, db.query("SELECT COUNT(*) AS n FROM agent_diagnostic").single()["n"])
+    }
+
+    @Test fun emptyArchiveIsRejectedBeforeItCanPoisonTheUploadQueue() = database { db ->
+        val repo = FailureSnapshotRepository(db, clock = { now })
+        assertThrows(IllegalArgumentException::class.java) {
+            repo.saveFailureSnapshot(snapshot(true).copy(archive = byteArrayOf()))
+        }
+        assertTrue(repo.pendingFailureSnapshots(origin).isEmpty())
+    }
+
+    @Test fun contextPreservesInvalidHashValidityWithoutInventingHash() = database { db ->
+        val repo = FailureSnapshotRepository(db, clock = { now })
+        repo.recordFailureSnapshotContext(9, attempt, 4, "purchase", "invalid", origin)
+        val context = JSONObject(repo.failureSnapshotContext(attempt)!!)
+        assertFalse(context.getBoolean("ruleSnapshotHashValid"))
+        assertTrue(context.isNull("ruleSnapshotHash"))
+        assertEquals(origin, context.getString("serverOrigin"))
+        assertTrue(repo.pendingFailureSnapshots(origin).isEmpty())
+    }
+
+    @Test fun retryDelayIsPersistentAndCapEvictionRemovesQueue() = database { db ->
+        val repo = FailureSnapshotRepository(db, { now }, maxBytes = 4096)
+        val first = snapshot(true)
+        assertTrue(repo.saveFailureSnapshot(first))
+        repo.retryFailureSnapshotLater(first)
+        assertTrue(repo.pendingFailureSnapshots(origin).isEmpty())
+        assertEquals(1, repo.pendingFailureSnapshots(origin, now + 60_000).size)
+        val tiny = FailureSnapshotRepository(db, { now }, maxBytes = 1)
+        tiny.cleanupFailureSnapshots(now)
+        assertTrue(tiny.pendingFailureSnapshots(origin).isEmpty())
+        assertFalse(tiny.hasFailureSnapshotArchive(attempt))
+    }
+
+    @Test fun nearLimitArchiveUsesSmallCursorRowsForUploadAndDuplicateDetection() = database { db ->
+        val bounded = object : FailureSnapshotDatabase by db {
+            override fun query(sql: String, args: List<Any?>): List<Map<String, Any?>> = db.query(sql, args).also { rows ->
+                rows.forEach { row -> row.values.filterIsInstance<ByteArray>().forEach { assertTrue("blob cursor row exceeds 256KiB", it.size <= 256 * 1024) } }
+            }
+        }
+        val repo = FailureSnapshotRepository(bounded, clock = { now })
+        val large = snapshot(true).copy(archive = ByteArray(2 * 1024 * 1024) { (it % 127).toByte() })
+        assertTrue(repo.saveFailureSnapshot(large))
+        assertFalse(repo.saveFailureSnapshot(large))
+        assertArrayEquals(large.archive, repo.pendingFailureSnapshots(origin).single().archive)
+    }
+
+    private fun database(block: (FailureSnapshotDatabase) -> Unit) {
+        DriverManager.getConnection("jdbc:sqlite::memory:").use { connection ->
+            AgentDiagnosticSchema.failureSnapshotStatements.forEach { connection.createStatement().use { s -> s.execute(it) } }
+            val db = object : FailureSnapshotDatabase {
+                override fun execute(sql: String, args: List<Any?>) {
+                    connection.prepareStatement(sql).use { s ->
+                        args.forEachIndexed { index, value -> s.setObject(index + 1, value) }; s.executeUpdate()
+                    }
+                }
+                override fun query(sql: String, args: List<Any?>): List<Map<String, Any?>> = connection.prepareStatement(sql).use { s ->
+                    args.forEachIndexed { index, value -> s.setObject(index + 1, value) }
+                    s.executeQuery().use { rows -> buildList {
+                        while (rows.next()) add((1..rows.metaData.columnCount).associate { index ->
+                            val value = rows.getObject(index)
+                            rows.metaData.getColumnLabel(index) to if (value is Number) value.toLong() else value
+                        })
+                    } }
+                }
+                override fun <T> transaction(block: () -> T): T {
+                    connection.autoCommit = false
+                    try { val result = block(); connection.commit(); return result }
+                    catch (error: Throwable) { connection.rollback(); throw error }
+                    finally { connection.autoCommit = true }
+                }
+            }
+            block(db)
+        }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/service/RepurchaseBatchTest.kt

@@ -0,0 +1,241 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.HistoryPage
+import cn.ilapage.goauto.agent.network.PurchaseHistoryItem
+import org.junit.Assert.*
+import org.junit.Test
+import java.text.SimpleDateFormat
+import java.util.Date
+import java.util.Locale
+import java.util.TimeZone
+
+class RepurchaseBatchTest {
+    private val now = 1_791_446_400_000L
+    private fun at(secondsAgo: Long) = SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'", Locale.ROOT).apply {
+        timeZone = TimeZone.getTimeZone("UTC")
+    }.format(Date(now - secondsAgo * 1000))
+
+    private fun item(id: Long, secondsAgo: Long = 0, status: String = "failed", retryable: Boolean = true) = PurchaseHistoryItem(
+        id, status, "synthetic", "synthetic", "synthetic", "", "", "", "", 1, null, "CNY", null, null,
+        null, null, retryable, if (retryable) null else "不可重试", at(secondsAgo),
+    )
+
+    private fun discover(items: List<PurchaseHistoryItem>): RepurchaseBatch = RepurchaseBatchDiscovery({ q ->
+        HistoryPage(items.drop((q.page - 1) * 50).take(50), items.size.toLong(), q.page, 50)
+    }, { now }).discover()
+
+    private fun refused(reason: RepurchaseBatchFailure, block: () -> Unit) {
+        try { block(); fail("Expected $reason") } catch (e: RepurchaseBatchException) { assertEquals(reason, e.reason) }
+    }
+
+    @Test fun sixtySecondsJoinsTransitivelyButSixtyOneStartsOlderBatch() {
+        val batch = discover(listOf(item(5), item(4, 60), item(3, 120), item(2, 181), item(1, 182)))
+        assertEquals(listOf(5L, 4L, 3L), batch.items.map { it.taskId })
+        assertEquals(at(0), batch.newestCreatedAt)
+        assertEquals(at(120), batch.oldestCreatedAt)
+        assertEquals(5L, batch.headTaskId)
+    }
+
+    @Test fun equalInstantsUseDescendingIdsAndRespectTimezones() {
+        val batch = discover(listOf(item(3).copy(createdAt = "2026-10-08T08:00:00.123456789+08:00"),
+            item(2).copy(createdAt = "2026-10-08T00:00:00.123456789Z"),
+            item(1).copy(createdAt = "2026-10-07T20:00:00.123456789-04:00")))
+        assertEquals(listOf(3L, 2L, 1L), batch.items.map { it.taskId })
+    }
+
+    @Test fun subMillisecondGapAboveSixtySecondsIsBoundary() {
+        val batch = discover(listOf(item(2).copy(createdAt = "2026-10-08T00:01:00.000000001Z"),
+            item(1).copy(createdAt = "2026-10-08T00:00:00Z")))
+        assertEquals(listOf(2L), batch.items.map { it.taskId })
+    }
+
+    @Test fun readsFullStateHistoryAcrossFiftyItemBoundaryAndRechecksHead() {
+        val requests = mutableListOf<RepurchaseHistoryQuery>()
+        val data = (70L downTo 1).map { item(it, 70 - it, if (it % 2 == 0L) "failed" else "order_created") }
+        val result = RepurchaseBatchDiscovery({ q ->
+            requests += q
+            HistoryPage(data.drop((q.page - 1) * 50).take(50), 70, q.page, 50)
+        }, { now }).discover()
+        assertEquals(70, result.items.size)
+        assertEquals(35, result.candidates.size)
+        assertEquals(listOf(1, 2, 1), requests.map { it.page })
+        assertTrue(requests.all { it.days == 30 && it.pageSize == 50 && it.status == null && it.taskNo == null })
+    }
+
+    @Test fun overlappingPagesDeduplicateTaskIdsBeforeBoundary() {
+        val data = (60L downTo 1).map { item(it, if (it >= 10) 60 - it else 300) }
+        val result = RepurchaseBatchDiscovery({ q ->
+            val page = if (q.page == 1) data.take(50) else data.drop(49)
+            HistoryPage(page, 61, q.page, 50)
+        }, { now }).discover()
+        assertEquals(51, result.items.size)
+        assertEquals(51, result.items.map { it.taskId }.distinct().size)
+    }
+
+    @Test fun headChangeRefusesEvenWhenBoundaryAlreadyFound() {
+        var calls = 0
+        refused(RepurchaseBatchFailure.LIST_CHANGED) {
+            RepurchaseBatchDiscovery({ q ->
+                calls++
+                HistoryPage(if (calls == 1) listOf(item(2), item(1, 100)) else listOf(item(3), item(2), item(1, 100)),
+                    if (calls == 1) 2 else 3, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun invalidDatesAndMissingZonesAreRefused() {
+        listOf("", "2026-02-30T00:00:00Z", "2026-10-08T00:00:00", "2026-10-08T00:00:00+25:00", "2026-10-08T00:00:00Zjunk").forEach {
+            refused(RepurchaseBatchFailure.INVALID_TIMESTAMP) { discover(listOf(item(1).copy(createdAt = it))) }
+        }
+    }
+
+    @Test fun invertedChronologicalOrIdOrderingIsRefused() {
+        refused(RepurchaseBatchFailure.INVALID_ORDER) { discover(listOf(item(2, 20), item(1))) }
+        refused(RepurchaseBatchFailure.INVALID_ORDER) { discover(listOf(item(1), item(2))) }
+    }
+
+    @Test fun nearThirtyDayCutoffCannotProveBatchComplete() {
+        val days30 = 30L * 24 * 60 * 60
+        listOf(days30, days30 - 60, days30 - 61, days30 + 1).forEach { age ->
+            refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) { discover(listOf(item(1, age))) }
+        }
+        assertEquals(1, discover(listOf(item(1, days30 - 62))).items.size)
+    }
+
+    @Test fun usesServerResponseClockEvenWhenPhoneIsFiveMinutesSlow() {
+        val phoneNow = now
+        val serverNow = phoneNow + 5 * 60 * 1000
+        val ageFromPhoneSeconds = 30L * 24 * 60 * 60 - 5 * 60 - 30
+        var responseTime: Long? = null
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q ->
+                responseTime = serverNow
+                HistoryPage(listOf(item(1, ageFromPhoneSeconds)), 1, q.page, 50)
+            }, { checkNotNull(responseTime) }).discover()
+        }
+    }
+
+    @Test fun responseTimeIsNotRequiredBeforeFirstFetch() {
+        var responseTime: Long? = null
+        val batch = RepurchaseBatchDiscovery({ q ->
+            responseTime = now
+            HistoryPage(listOf(item(1)), 1, q.page, 50)
+        }, { checkNotNull(responseTime) }).discover()
+        assertEquals(1, batch.items.size)
+    }
+
+    @Test fun missingServerResponseClockRefusesWithoutPhoneClockFallback() {
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q -> HistoryPage(listOf(item(1)), 1, q.page, 50) },
+                { error("No server Date") }).discover()
+        }
+    }
+
+    @Test fun retainsLatestObservedServerClockWhenLaterResponseTimeRegresses() {
+        var responseTime = now
+        var calls = 0
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q ->
+                responseTime = if (++calls == 1) now + 300_000 else now
+                HistoryPage(listOf(item(1, 30L * 24 * 60 * 60 - 330)), 1, q.page, 50)
+            }, { responseTime }).discover()
+        }
+    }
+
+    @Test fun exactlyFiftyRecordsCanEstablishTrustworthyEnd() {
+        val requested = mutableListOf<Int>()
+        val batch = RepurchaseBatchDiscovery({ q ->
+            requested += q.page
+            HistoryPage((50L downTo 1).map { item(it, 50 - it) }, 50, q.page, 50)
+        }, { now }).discover()
+        assertEquals(50, batch.items.size)
+        assertEquals(listOf(1, 1), requested)
+    }
+
+    @Test fun latestSuccessfulBatchDoesNotFallBackToOlderFailures() {
+        val result = discover(listOf(item(2, status = "order_created"), item(1, 61)))
+        assertEquals(1, result.items.size)
+        assertTrue(result.failures.isEmpty())
+        assertTrue(result.candidates.isEmpty())
+    }
+
+    @Test fun onlyFailedRetryableAreCandidatesAndSecondRoundUsesRemainingFailures() {
+        val items = (10L downTo 1).map { item(it, status = if (it <= 4) "failed" else "order_created") }
+        val first = discover(items)
+        assertEquals(listOf(4L, 3L, 2L, 1L), first.candidates.map { it.taskId })
+        val second = discover(items.map { if (it.taskId in 3L..4L) it.copy(status = "order_created") else it })
+        assertEquals(listOf(2L, 1L), second.candidates.map { it.taskId })
+        val blocked = discover(listOf(item(2, retryable = false), item(1, status = "pending")))
+        assertEquals(1, blocked.failures.size)
+        assertEquals("不可重试", blocked.skips.single().retryDisabledReason)
+        assertTrue(blocked.candidates.isEmpty())
+    }
+
+    @Test fun pageFailureCannotReturnPartOfBatch() {
+        refused(RepurchaseBatchFailure.PAGE_FAILED) {
+            RepurchaseBatchDiscovery({ q ->
+                if (q.page == 2) error("synthetic network failure")
+                HistoryPage((60L downTo 11).map { item(it, 60 - it) }, 60, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun shortPageWithUnseenTotalAndWrongMetadataAreRefused() {
+        listOf(HistoryPage(listOf(item(1)), 2, 1, 50), HistoryPage(listOf(item(1)), 1, 2, 50),
+            HistoryPage(listOf(item(1)), 1, 1, 20), HistoryPage(emptyList(), -1, 1, 50)).forEach { page ->
+            refused(RepurchaseBatchFailure.INVALID_PAGE) { RepurchaseBatchDiscovery({ page }, { now }).discover() }
+        }
+    }
+
+    @Test fun maximumPagesCannotReturnTruncatedBatch() {
+        refused(RepurchaseBatchFailure.PAGE_LIMIT) {
+            RepurchaseBatchDiscovery({ q -> HistoryPage((60L downTo 11).map { item(it, 60 - it) }, 60, q.page, 50) },
+                { now }, maxPages = 1).discover()
+        }
+    }
+
+    @Test fun crossPageOrderInversionAndChangedDuplicateTimestampAreRefused() {
+        listOf(item(1, 1), item(11, 99)).forEach { next ->
+            refused(RepurchaseBatchFailure.INVALID_ORDER) {
+                RepurchaseBatchDiscovery({ q ->
+                    HistoryPage(if (q.page == 1) (60L downTo 11).map { item(it, 60 - it) } else listOf(next),
+                        51, q.page, 50)
+                }, { now }).discover()
+            }
+        }
+    }
+
+    @Test fun duplicatesCannotMakeAnIncompleteTailLookComplete() {
+        refused(RepurchaseBatchFailure.INCOMPLETE_BATCH) {
+            RepurchaseBatchDiscovery({ q ->
+                HistoryPage(if (q.page == 1) (60L downTo 11).map { item(it, 60 - it) } else listOf(item(11, 49)),
+                    51, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun failedHeadRecheckRefusesTheAlreadyFoundBatch() {
+        var calls = 0
+        refused(RepurchaseBatchFailure.PAGE_FAILED) {
+            RepurchaseBatchDiscovery({ q ->
+                if (++calls > 1) error("synthetic network failure")
+                HistoryPage(listOf(item(1)), 1, q.page, 50)
+            }, { now }).discover()
+        }
+    }
+
+    @Test fun emptyHistoryIsRecheckedAndReturnedEmpty() {
+        var calls = 0
+        val batch = RepurchaseBatchDiscovery({ q -> calls++; HistoryPage(emptyList(), 0, q.page, 50) }, { now }).discover()
+        assertTrue(batch.items.isEmpty())
+        assertNull(batch.headTaskId)
+        assertEquals(2, calls)
+    }
+
+    @Test fun immutableSnapshotDoesNotExposeMutableLists() {
+        val batch = discover(listOf(item(1)))
+        listOf(batch.items, batch.candidates, batch.failures).forEach { items ->
+            try { (items as MutableList).clear(); fail("Mutable snapshot") } catch (_: UnsupportedOperationException) { }
+        }
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/service/RepurchaseCoordinatorTest.kt

@@ -0,0 +1,182 @@
+package cn.ilapage.goauto.agent.service
+
+import cn.ilapage.goauto.agent.network.*
+import org.junit.Assert.*
+import org.junit.Test
+import java.io.IOException
+
+class RepurchaseCoordinatorTest {
+    private fun item(id: Long, status: String = "failed", retryable: Boolean = true, error: String? = null) = PurchaseHistoryItem(
+        id, status, "", "", "", "", "", "", "", 1, null, "CNY", null, null, error, null, retryable, "不可重试", "2026-10-08T09:00:00Z")
+    private fun detail(id: Long, status: String = "failed", count: Long = 1, retryable: Boolean = true, error: String? = null) =
+        PurchaseHistoryDetail(item(id, status, retryable, error), count, error, null, false, null, null, null, null, false, null)
+    private inner class Fake : RepurchasePort {
+        var clock = 0L
+        var busy = false
+        var otherWork = false
+        var environment: String? = null
+        var head: Long? = 2L
+        var resetFailure: Exception? = null
+        var failOnce = false
+        var duringReset: (() -> Unit)? = null
+        val details = mutableMapOf(2L to this@RepurchaseCoordinatorTest.detail(2), 1L to this@RepurchaseCoordinatorTest.detail(1))
+        val resets = mutableListOf<Pair<Long, String>>()
+        var evidence = emptyList<RepurchaseExecutionEvidence>()
+        override fun executionEvidence(taskId: Long) = evidence
+        override fun environmentProblem() = environment
+        override fun localIdle() = !busy
+        override fun hasOtherWork(currentTaskId: Long?) = otherWork
+        override fun latestTaskId() = head
+        override fun detail(taskId: Long) = details.getValue(taskId)
+        override fun reset(taskId: Long, requestId: String): PurchaseResetResult {
+            resets += taskId to requestId
+            duringReset?.invoke()
+            resetFailure?.let { if (failOnce) resetFailure = null; throw it }
+            return PurchaseResetResult(taskId, "CG-$taskId", 2, "pending", resets.size > 1)
+        }
+        fun runner(): RepurchaseCoordinator {
+            var sequence = 0
+            return RepurchaseCoordinator({ clock }, { "request-${++sequence}" }, {}).also {
+                assertTrue(it.prepare())
+                it.prepared(RepurchaseBatch(listOf(item(2), item(1))))
+                it.confirm(it.state.roundId)
+            }
+        }
+    }
+
+    @Test fun serialResetsWaitForNewAttemptAndLocalDrain() {
+        val p = Fake(); val r = p.runner()
+        r.tick(p); assertEquals(listOf(2L), p.resets.map { it.first })
+        r.tick(p); assertEquals(0, r.state.results.size) // old failed, attempt1
+        p.details[2] = detail(2, "order_created", 2); p.busy = true
+        r.tick(p); assertEquals(0, r.state.results.size)
+        p.busy = false; r.tick(p); assertEquals(1, r.state.successCount)
+        r.tick(p); assertEquals(listOf(2L, 1L), p.resets.map { it.first })
+        p.details[1] = detail(1, count = 2); r.tick(p); r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertEquals(1, r.state.failedCount); assertEquals(2, p.resets.size)
+    }
+    @Test fun lostResetResponseUsesSameRequestIdAndReplayIsNotTerminal() {
+        val p = Fake(); val r = p.runner(); p.resetFailure = IOException(); p.failOnce = true
+        r.tick(p); r.tick(p)
+        assertEquals(2, p.resets.size); assertEquals(p.resets[0], p.resets[1])
+        assertEquals(0, r.state.results.size)
+    }
+    @Test fun unresolvedMappedValuesDoNotPreventReset() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        assertEquals(2L, p.resets.single().first)
+    }
+    @Test fun definiteBusinessRefusalSkipsButNetworkAmbiguityStops() {
+        val p = Fake(); val r = p.runner()
+        p.resetFailure = AgentApiException(409, "PURCHASE_RETRY_STALE", "safe", false)
+        r.tick(p); assertEquals(1, r.state.skippedCount)
+        p.resetFailure = IOException(); r.tick(p); r.tick(p)
+        assertTrue(r.state.phase in setOf(RepurchasePhase.STOPPING, RepurchasePhase.FINISHED))
+        assertEquals(3, p.resets.size)
+    }
+    @Test fun newWorkStopsSubsequentButNotCurrent() {
+        val p = Fake(); val r = p.runner(); r.tick(p); p.otherWork = true
+        r.tick(p); assertEquals(RepurchasePhase.STOPPING, r.state.phase)
+        p.details[2] = detail(2, "order_created", 2); r.tick(p); r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertEquals(1, p.resets.size)
+    }
+    @Test fun stopBeforeResetIssuesNothingAndStaleStopIgnored() {
+        val p = Fake(); val r = p.runner(); r.requestStop("old"); r.tick(p)
+        assertEquals(1, p.resets.size)
+        val p2 = Fake(); val r2 = p2.runner(); r2.requestStop(r2.state.roundId); r2.tick(p2)
+        assertEquals(0, p2.resets.size); assertEquals(RepurchasePhase.FINISHED, r2.state.phase)
+    }
+    @Test fun stopDuringIssuedResetAllowsOnlyCurrentToDrain() {
+        val p = Fake(); val r = p.runner(); p.duringReset = { r.requestStop(r.state.roundId) }
+        r.tick(p); p.details[2] = detail(2, "order_created", 2); r.tick(p); r.tick(p)
+        assertEquals(1, p.resets.size); assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+    }
+    @Test fun timeoutStopsOrchestrationWithoutAnotherReset() {
+        val p = Fake(); val r = p.runner(); r.tick(p); p.clock = 15 * 60 * 1000L
+        r.tick(p); assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertEquals(1, p.resets.size)
+    }
+    @Test fun unknownAndCaptchaStopTheRound() {
+        for ((status, error) in listOf("order_result_unknown" to null, "failed" to "PDD_CAPTCHA_REQUIRED")) {
+            val p = Fake(); val r = p.runner(); r.tick(p); p.details[2] = detail(2, status, 2, error = error)
+            r.tick(p); r.tick(p)
+            assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertEquals(1, p.resets.size)
+        }
+    }
+    @Test fun headChangedOrEnvironmentUnavailableDoesNotReset() {
+        val p = Fake(); val r = p.runner(); p.head = 3; r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase); assertTrue(p.resets.isEmpty())
+        val p2 = Fake(); val r2 = p2.runner(); p2.environment = "无障碍未开启"; r2.tick(p2)
+        assertEquals(RepurchasePhase.FINISHED, r2.state.phase); assertTrue(p2.resets.isEmpty())
+    }
+    @Test fun busyHasBoundedDrainAndProcessRestartDoesNotRestoreRound() {
+        val p = Fake(); val r = p.runner(); p.busy = true; r.tick(p)
+        p.clock = 10000; r.tick(p); assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertFalse(RepurchaseCoordinator({0}, {"x"}, {}).state.busy)
+    }
+    @Test fun noRetryableCandidatesDoesNotConfirmOrFallBack() {
+        val r = RepurchaseCoordinator({0}, {"x"}, {})
+        r.prepare(); r.prepared(RepurchaseBatch(listOf(item(3, "order_created"))))
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        r.confirm(r.state.roundId); assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+    }
+
+    @Test fun definiteEnvironmentRefusalStopsWithoutPretendingTaskWasIssued() {
+        val p = Fake(); val r = p.runner()
+        p.resetFailure = AgentApiException(401, "DEVICE_TOKEN_INVALID", "unauthorized", false)
+        r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertNull(r.state.currentTaskId)
+        assertEquals(1, p.resets.size)
+    }
+
+    @Test fun secondRoundOnlyUsesStillFailedCandidates() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        p.details[2] = detail(2, "order_created", 2); r.tick(p); r.tick(p)
+        p.details[1] = detail(1, count = 2); r.tick(p)
+        assertTrue(r.prepare())
+        r.prepared(RepurchaseBatch(listOf(item(2, "order_created"), item(1))))
+        assertEquals(listOf(1L), r.state.batch!!.candidates.map { it.taskId })
+        r.confirm(r.state.roundId)
+        // New reset must return a strictly newer attempt than the refreshed detail.
+        p.details[1] = detail(1)
+        r.tick(p)
+        assertEquals(listOf(2L, 1L, 1L), p.resets.map { it.first })
+    }
+
+    @Test fun unexpectedExceptionDoesNotLeakRawErrorOrSkipRest() {
+        val p = Fake(); val r = p.runner(); p.resetFailure = IOException("private remote body")
+        r.tick(p)
+        assertFalse(r.state.message.contains("private"))
+        assertEquals(RepurchasePhase.STOPPING, r.state.phase)
+        assertEquals(listOf(2L, 2L), p.resets.map { it.first })
+    }
+
+    @Test fun externalLaterAttemptIsNotCountedAsThisRoundsResult() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        p.details[2] = detail(2, "order_created", 3)
+        p.evidence = listOf(RepurchaseExecutionEvidence(2, "attempt2", "purchase", "failed"),
+            RepurchaseExecutionEvidence(3, "attempt3", "purchase", "order_created"))
+        r.tick(p); r.tick(p)
+        assertEquals(RepurchasePhase.FINISHED, r.state.phase)
+        assertEquals(0, r.state.successCount); assertEquals(1, p.resets.size)
+    }
+
+    @Test fun completedProbeCanLinkToOriginalExecutorsNextPurchaseAttempt() {
+        val p = Fake(); val r = p.runner(); r.tick(p)
+        p.details[2] = detail(2, "order_created", 3)
+        p.evidence = listOf(RepurchaseExecutionEvidence(2, "probe2", "spec_probe", "spec_probe_completed"),
+            RepurchaseExecutionEvidence(3, "purchase3", "purchase", "order_created"))
+        r.tick(p)
+        assertEquals(1, r.state.successCount)
+        r.tick(p); assertEquals(listOf(2L, 1L), p.resets.map { it.first })
+    }
+
+    @Test fun localReservationBusyNeverPretendsARequestWasSentAndUsesSameId() {
+        val p = Fake(); val r = p.runner(); p.resetFailure = RepurchaseLocalBusy(); p.failOnce = true
+        r.tick(p); assertNull(r.state.currentTaskId); assertEquals(RepurchasePhase.RUNNING, r.state.phase)
+        r.tick(p); assertEquals(p.resets[0], p.resets[1])
+        val p2 = Fake(); val r2 = p2.runner(); p2.resetFailure = RepurchaseLocalBusy()
+        r2.tick(p2); p2.clock = 10000; r2.tick(p2)
+        assertEquals(RepurchasePhase.FINISHED, r2.state.phase); assertNull(r2.state.currentTaskId)
+    }
+}

android/app/src/test/java/cn/ilapage/goauto/agent/service/RepurchaseStateTest.kt

@@ -0,0 +1,34 @@
+package cn.ilapage.goauto.agent.service
+
+import org.junit.Assert.*
+import org.junit.Test
+
+class RepurchaseStateTest {
+    @Test fun confirmationExplainsOriginalTaskAndUnpaidOrderRisk() {
+        val state = RepurchaseState(phase = RepurchasePhase.READY)
+        assertTrue(state.confirmationText().contains("不会付款"))
+        assertTrue(state.confirmationText().contains("原任务号"))
+        assertTrue(state.confirmationText().contains("15分钟"))
+        assertTrue(state.confirmationText().contains("60秒"))
+    }
+
+    @Test fun readingReadyRunningAndStoppingPreventDuplicateRounds() {
+        for (phase in listOf(RepurchasePhase.READING, RepurchasePhase.READY, RepurchasePhase.RUNNING, RepurchasePhase.STOPPING)) {
+            assertTrue(RepurchaseState(phase = phase).busy)
+        }
+        assertFalse(RepurchaseState().busy)
+        assertFalse(RepurchaseState(phase = RepurchasePhase.FINISHED).busy)
+    }
+
+    @Test fun countsDoNotMarkUnexecutedItemsAsFailures() {
+        val state = RepurchaseState(results = listOf(
+            RepurchaseItemResult(1, RepurchaseResult.SUCCESS, "订单已创建"),
+            RepurchaseItemResult(2, RepurchaseResult.FAILED, "再次失败"),
+            RepurchaseItemResult(3, RepurchaseResult.SKIPPED, "不可重试"),
+        ))
+        assertEquals(1, state.successCount)
+        assertEquals(1, state.failedCount)
+        assertEquals(1, state.skippedCount)
+        assertTrue(state.summaryText().contains("成功 1"))
+    }
+}

android/app/src/testDebug/java/cn/ilapage/goauto/agent/BrowserProbeClickPolicyTest.kt

@@ -0,0 +1,25 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.diagnostics.BrowserProbeClickPolicy
+import org.junit.Assert.*
+import org.junit.Test
+
+class BrowserProbeClickPolicyTest {
+    @Test fun onlyExactNativeBrowserEntryIsAllowed() {
+        assertTrue(BrowserProbeClickPolicy.allowed("com.heytap.browser", "com.heytap.browser", "打开拼多多APP", true, true, true, 3, 3))
+    }
+    @Test fun rejectsPackageSwitchHiddenDisabledNonClickableAndStaleWindow() {
+        fun allowed(root: String? = "com.heytap.browser", node: String? = root, label: String = "打开拼多多APP",
+                    visible: Boolean = true, enabled: Boolean = true, clickable: Boolean = true, window: Int = 3) =
+            BrowserProbeClickPolicy.allowed(root, node, label, visible, enabled, clickable, 3, window)
+        assertFalse(allowed(root = "com.xunmeng.pinduoduo"))
+        assertFalse(allowed(node = "com.xunmeng.pinduoduo"))
+        assertFalse(allowed(root = null))
+        assertFalse(allowed(label = "打开"))
+        assertFalse(allowed(label = "立即支付"))
+        assertFalse(allowed(visible = false))
+        assertFalse(allowed(enabled = false))
+        assertFalse(allowed(clickable = false))
+        assertFalse(allowed(window = 4))
+    }
+}

android/app/src/testDebug/java/cn/ilapage/goauto/agent/NavigationProbeTest.kt

@@ -0,0 +1,107 @@
+package cn.ilapage.goauto.agent
+
+import cn.ilapage.goauto.agent.automation.*
+import cn.ilapage.goauto.agent.diagnostics.NavigationProbe
+import org.junit.Assert.*
+import org.junit.Test
+
+class NavigationProbeTest {
+    @Test fun cancellationDuringInitialCapturePreventsLaunch() {
+        var active = true
+        var launches = 0
+        val page = UiSnapshot("com.xunmeng.pinduoduo", null, emptyList())
+        NavigationProbe(capture = { active = false; page }, launch = { launches++; true },
+            clickBrowserEntry = { error("no click") }, now = { 0 }, pause = {}, emit = {},
+            isActive = { active }).run()
+        assertEquals(0, launches)
+    }
+    @Test fun deadlineCrossedDuringCapturePreventsLaunch() {
+        var clock = 0L
+        var launches = 0
+        NavigationProbe(capture = { clock = 20_001; UiSnapshot(null, null, emptyList()) },
+            launch = { launches++; true }, clickBrowserEntry = { error("no click") }, now = { clock },
+            pause = {}, emit = {}).run()
+        assertEquals(0, launches)
+    }
+    @Test fun cancellationDuringBrowserCapturePreventsClick() {
+        var active = true
+        var reads = 0
+        var clock = 0L
+        var clicks = 0
+        val page = UiSnapshot("com.heytap.browser", null, listOf(node("打开拼多多APP")))
+        NavigationProbe(capture = { reads++; if (reads > 1) active = false; page }, launch = { true },
+            clickBrowserEntry = { clicks++; FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS) },
+            now = { clock }, pause = { clock += it }, emit = {}, isActive = { active }).run()
+        assertEquals(0, clicks)
+    }
+    @Test fun baselineUsesActualPackageRatherThanOptionalParserEvidence() {
+        val rig = Rig(UiSnapshot("com.heytap.browser", null, listOf(node("发起拼单"))))
+        rig.run()
+        assertTrue(rig.lines.first().contains("pdd=false"))
+        assertFalse(rig.lines.any { it.contains("legacy_would_accept") })
+    }
+    private class Rig(var page: UiSnapshot) {
+        var clock = 0L
+        var launches = 0
+        var clicks = 0
+        val lines = mutableListOf<String>()
+        fun run(accepted: Boolean = true) = NavigationProbe(
+            capture = { page },
+            launch = { report -> launches++; report(PddLaunchEvent(PddLaunchPath.DIRECT, PddLaunchStatus.ACCEPTED)); accepted },
+            clickBrowserEntry = { clicks++; FreshClickOutcome(FreshActionResult.SUCCESS, FreshClickReason.SUCCESS) },
+            now = { clock }, pause = { clock += it }, emit = lines::add,
+        ).run()
+    }
+    private fun node(text: String, path: String = "0") = SnapshotNode(path, null, text, null, null,
+        "android.widget.TextView", NodeBounds(0, 0, 100, 100), true, false, false, false, true, true)
+
+    @Test fun pddIsReadOnlyAndSamplingStopsWithinBound() {
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, listOf(node("立即下单"))))
+        rig.run()
+        assertEquals(1, rig.launches)
+        assertEquals(0, rig.clicks)
+        assertEquals(20_000L, rig.clock)
+        assertTrue(rig.lines.last().contains("finished"))
+    }
+    @Test fun failedLaunchStopsWithoutClicking() {
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, emptyList()))
+        rig.run(false)
+        assertEquals(1, rig.launches)
+        assertEquals(0L, rig.clock)
+        assertEquals(0, rig.clicks)
+        assertTrue(rig.lines.last().contains("launch_failed"))
+    }
+    @Test fun browserRequiresUniqueExplicitPddEntryAndBoundedRetries() {
+        val rig = Rig(UiSnapshot("com.heytap.browser", null, listOf(node("打开拼多多APP"))))
+        rig.run()
+        assertEquals(3, rig.clicks)
+    }
+    @Test fun ambiguousBrowserEntryStopsWithoutGuessing() {
+        val rig = Rig(UiSnapshot("com.heytap.browser", null, listOf(node("打开拼多多APP"), node("打开拼多多APP", "1"))))
+        rig.run()
+        assertEquals(0, rig.clicks)
+        assertTrue(rig.lines.last().contains("browser_ambiguous"))
+    }
+    @Test fun genericOpenAndPddControlsAreNeverClicked() {
+        for (pkg in listOf("com.heytap.browser", "com.xunmeng.pinduoduo", "other.package")) {
+            val rig = Rig(UiSnapshot(pkg, null, listOf(node("打开"), node("立即支付"), node("确认订单"))))
+            rig.run()
+            assertEquals(0, rig.clicks)
+            assertTrue(rig.lines.isNotEmpty())
+        }
+    }
+    @Test fun loginOrCaptchaStopsBeforeLaunch() {
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, listOf(node("手机号登录"))))
+        rig.run()
+        assertEquals(0, rig.launches)
+        assertEquals(0, rig.clicks)
+        assertTrue(rig.lines.last().contains("page_problem"))
+    }
+    @Test fun pageTextAndExceptionMessagesNeverAppearInOutput() {
+        val secret = "PRIVATE_ACCOUNT_ADDRESS_DO_NOT_LOG"
+        val rig = Rig(UiSnapshot("com.xunmeng.pinduoduo", null, listOf(node(secret))))
+        rig.run()
+        assertTrue(rig.lines.isNotEmpty())
+        assertFalse(rig.lines.joinToString().contains(secret))
+    }
+}

docs/02-architecture-and-code-map.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Architecture-and-Code-Map
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Architecture-and-Code-Map.-
-wiki_revision: b3d1c9b7ba1dd5820a20e59b0c21a971aaf1b8ee
-synchronized_at: 2026-10-08T01:41:51Z
+wiki_revision: 76854d900b2372ddedd46a2b82b5677d8bf5cb31
+synchronized_at: 2026-10-09T07:45:10Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -63,7 +63,7 @@ Android Portal/Agent
 - 重置在事务中清空原结果，保留 URL、goods_id、规则和设备快照，状态恢复为 `pending`。
 - Android 本地互斥与服务端原子领取共同保证单设备串行。
 - 正式采购在 Android 本地 SQLite 事务中先保存不可逆状态、稳定服务端请求 ID 和脱敏最终确认快照，再通知服务端并只允许一次创建订单点击；重启后只重放服务端标记、只读核单或上报，不再次点击。
-- 原始控件树和截图不持久化；Android Agent 端第一期不使用 OCR/VLM。服务端 SYB 登录验证码识别是唯一例外，见 [#48](https://git.ilapage.cn/OPC/goauto/issues/48)。
+- 普通原始控件树和截图不持久化；采购失败私有现场诊断是 #364 的限定例外，见本页对应节；Android Agent 端第一期不使用 OCR/VLM。服务端 SYB 登录验证码识别是唯一例外，见 [#48](https://git.ilapage.cn/OPC/goauto/issues/48)。
 - 蝦皮规格映射独立保存在 `shopee_product.specs_json`：颜色只能选择关联 PDD 当前可选颜色，允许多个蝦皮颜色共用一个 PDD 颜色。Admin 商品详情的“一键匹配颜色和尺码”在服务端统一计算两个维度：保留当前仍有效的已确认映射，将唯一确定匹配及达到阈值、具备理由且候选仍有效的 AI 匹配，在重新校验规格上下文后于同一事务直接写为 `confirmed`，无需人工确认；低置信度或无结果保持未匹配，Provider 异常或上下文变化时不写入任何本次结果。PDD 目标规格消失后页面标记失效，映射保存和采购创建均拒绝继续使用；无需新增数据库表或 Android 能力。
 
 ## 最小业务数据
@@ -639,3 +639,37 @@ Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态
 - 因预算超时不能再使用已取消context写统计，收尾仅使用最多5秒的独立上下文执行受所有权保护的完成更新，不启动新商品领取或AI调用；失租不强制落库。
 - MySQL默认返回实际修改行数；续租更新返回0时，只在当前持有行锁的事务内再次核验owner/状态/槽位/实时有效租约，以区分同毫秒值未变化与真实失租；其他完成/工作项更新仍要求恰好一行。
 - AI配置读取先返回数据库错误，再判断停用，避免基础设施错误被误记为业务跳过。仅批次私有上下文把基础设施错误作为本轮错误终止；普通单商品Provider重试策略保持不变。
+
+
+## 采购失败现场诊断（#364，待真机验收）
+
+实现绑定 `4581ee5`，后续合并记录见 #364；尚未发布。以下是普通原始控件树禁存规则的限定例外；普通采集、截图、OCR/VLM 和付款边界不变。
+
+- Android `diagnostics/FailureSnapshotCapture.kt` 统一判断失败/待核对、成功排除及既有 ZIP；`FailureSnapshotExporter.kt` 独立导出有限公开属性，`AccessibilitySnapshotSource.kt` 只读默认显示屏交互窗口，不改变正常 `capture()` 或解析器。
+- `AgentForegroundService` 在有效实际 attempt 的失败结果或执行异常处同步有界截取，先于新提示/返回/下一任务；恢复场景单独标识。成功结果后的保存/提示/上传异常不创建失败快照，不改变原业务状态和不可逆标记。
+- `goauto_diagnostics.db` 升级 v4；独立 `purchase_failure_snapshot`、`purchase_failure_snapshot_queue`、`purchase_failure_snapshot_context` 表。旧 `agent_diagnostic` 保持 7 天/50 条，新快照30天/64MiB逻辑容量。SQL 核心 `FailureSnapshotRepository` 共用真实 SQLite 测试，Android适配器以256KiB块读取BLOB，避开CursorWindow单行限制。
+- 队列绑定 Server Origin；已保存 ZIP 不覆盖，旧上传响应凭 fingerprint 不得清除首次恢复 ZIP 的新队列项。结果 Outbox 优先，诊断独立后台线程只上传已存字节，不持有设备任务锁；启动及每60秒执行维护。
+- Server `purchase/failure_snapshot*.go` 提供专用上传/安全摘要/管理员ZIP下载；`models/purchase_failure_snapshot.go` 独立私有表。追加迁移 `1791400000000_purchase_failure_snapshot.go` 保存 LONGBLOB ZIP、LONGTEXT manifest、attempt唯一约束及到期索引。
+- `access.AdminAPIs` 注册两个仅管理员读取接口；普通任务DTO和Client API不增加原始诊断字段。通用操作日志精确排除三个诊断端点，私有SQL读写使用静默logger。服务启动立即清理并每小时清理过期诊断，不依赖新任务。
+- Web `purchase-tasks/FailureSnapshotCell.vue` 是现有执行记录末尾200px管理员专属列，独立摘要查询、固定原因中文和附件下载；无原始XML在线预览。
+
+
+## Android 重购编排（#367）
+
+实现绑定 `5430dc1`，2026-10-09 已合并 main `e26743c` 并安装集成APK；无Server/Web、数据库或接口迁移，真机批量采购仍待验收。
+
+- `TaskHistoryFragment` 把采购搜索栏入口改为“重购”，发送 PREPARE/CONFIRM/STOP、显示 Service 内存状态；一次确认与逐条摘要由 `RepurchaseState` 提供，不由 Fragment 驱动采购生命周期。
+- `RepurchaseBatchDiscovery` 注入既有设备历史查询和服务端HTTP Date时钟，负责全状态/50条页/30天窗口、相邻60秒边界、去重、完整性及重读首页；最多200页，不使用本地历史缓存执行重购。
+- `RepurchaseCoordinator` 通过小型 `RepurchasePort` 执行非阻塞状态推进；只调用原reset和只读详情，固定每任务requestId、expected attempt、10秒本地忙碌复核及15分钟单条上限。依靠原执行器的attemptNumber/UUID/phase/已知结果识别合法探测续行，拒绝外部更晚attempt冒充本轮结果。
+- `AgentForegroundService` 独立单线程scheduled executor每2秒推进编排，历史网络不阻塞心跳或taskExecutor；发现使用独享API客户端，reset只短暂预留既有TaskExecutionMutex。原scheduler继续唯一负责claim/start/真实PDD操作及Outbox，编排不持整轮锁、不新建执行器路径。
+- 新工作查询同时检查采集next、采购next及本设备活动状态历史，防止采购next优先返回本轮current而遮蔽其他pending。停止信号为原子roundId，配置/身份冻结，仅内存保存摘要；进程重启不恢复整轮，既有单任务恢复及失败私有诊断不变。
+- `AgentApiClient` 仅补读已有采购payload的attemptNumber和标准HTTP Date响应元数据；不添加服务端字段或API。Date缺失清空样本，不沿用手机时间。
+
+## Android 颜色发现诊断追加（#370 第一阶段）
+
+实现绑定 `9e5f09a`，已合并 main，2026-10-09 随集成版本 `e26743c` 安装；本阶段不修改颜色遍历和采购结果判定。
+
+- `AgentDiagnosticSchema` 升至 v5，在 `agent_diagnostic` 追加可空 INTEGER `color_vertical_swipe_count`、`color_trailing_empty_read_count`、`color_horizontal_incomplete`；对应事件中的两个 Int? 和一个 Boolean?，Boolean 按 0/1 写入。新库包含列，v1–v4 逐级补齐并跳过已存在列，旧行新列为 NULL；不清表，不改独立采购失败快照、队列和 context。
+- `PddProductDetailCollector.collectColors` 只基于既有解析帧记录颜色阶段 UP 派发次数、空发现轮次和横向探索三态；不增加抓取、手势或等待。标签及签名只在内存使用，持久化仍为安全聚合。
+- 不新增 Server/Web API 字段、服务端迁移或权限；普通结果 payload/missing 与采购探测失败策略未改变。完整遍历与不完整候选拦截仍属 #370 后续待证据实施范围，不能把本地诊断值作为已实现的业务门禁。
+- 读取与三态限制见 Troubleshooting；旧版不保证降级打开 v5。JDBC 测试与实际 Android 安装升级分别验收，测试不代替真实竖向颜色采集验证。

docs/03-business-rules-and-glossary.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Business-Rules-and-Glossary
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Business-Rules-and-Glossary.-
-wiki_revision: 25fdd0c4837882dccb27c7b9e740d6d97065d490
-synchronized_at: 2026-10-08T03:25:26Z
+wiki_revision: a47b6b3b7ef7745417d1c2c88932f5bb12228f27
+synchronized_at: 2026-10-09T07:57:47Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -213,7 +213,7 @@ Admin 的「创建时间」范围按 SYB 货运单列表的 `t_stock.created`（
 - 浏览器“打开拼多多APP”和系统确认框“打开”属于允许动作。
 - 登录失效、验证码、风控、人机验证和找不到唯一控件时失败并给出具体错误。
 - Android Agent 到 GoAuto 服务端默认使用 HTTPS。管理员可在明确接受 Device Token、任务内容、设备状态和执行结果被链路监听或篡改的风险后，通过服务端 `GOAUTO_ALLOW_INSECURE_AGENT_HTTP=true` 显式允许全部 `/api/agent/v1/**` 使用 HTTP；该例外不放宽 PDD、SYB、OCR 或其他第三方服务约束。
-- Android Agent 端不使用 OCR/VLM 兜底，不保存原始控件树或截图。采集阶段不猜测缺失数据。
+- Android Agent 端不使用 OCR/VLM 兜底；普通采集不保存原始控件树或截图，采集阶段不猜测缺失数据。采购失败私有现场诊断是 #364 的限定例外，见本页对应节；历史各节的结构化日志/普通接口禁存规则保持不变。
 - 服务端顺云宝（SYB）登录例外：允许调用配置的线上 OCR 服务识别登录验证码（见 [#48](https://git.ilapage.cn/OPC/goauto/issues/48)）。验证码图片会离开本项目发送到该服务，更换服务地址前必须重新评估。此例外只适用于 SYB 登录，不扩大到 Agent 端或任何 PDD 相关流程。
 - 采购阶段的规格匹配由服务端决策（见 [#46](https://git.ilapage.cn/OPC/goauto/issues/46)、[#62](https://git.ilapage.cn/OPC/goauto/issues/62)）：Agent 本地不得自行猜测规格或点击相近候选，只执行服务端下发的精确规格；AI Provider 只有一个 OpenAI-compatible 配置，由管理员维护。根据 #62 已确认的内部部署例外，API Key 明文保存在专用设置表，并只向管理员设置接口返回以便查看和替换；它仍不得写入代码、日志、工单、Wiki、任务快照、采购员接口或 Android 接口。Provider Base URL 不限制内网或公网，支持 HTTP/HTTPS；HTTP 不加密传输中的 API Key，生产环境建议 HTTPS。
 - 采购规则的 `openSpecPanel` 默认不写死页面文字。Agent 只在已由页面语义确认的规格入口或底部购买入口中选择；规则若提供 `textAliases`，只能进一步缩小这些安全候选，不能把任意同名页面文字变成可点击入口。
@@ -375,6 +375,8 @@ Admin 的「创建时间」范围按 SYB 货运单列表的 `t_stock.created`（
 
 ## SYB 采购强制当次规格探测（#215）
 
+以下为 #373 之前的复用行为；#373 分支的限定复用和等待规则见“采购页面一次性交接与导航稳定等待”章节，未安装新版不能按新规则判断。
+
 - 每个新 SYB 采购任务固定执行“首趟只读探测 → 服务端确定性优先/必要时 AI → 固化任务级精确规格 → 第二趟正式采购”。首趟只打开一次浏览器商品链接；匹配期间当前设备保留给同一任务，不领取其他采购或采集任务。连续进入第二趟且当前仍有 PDD 商品页或规格面板强证据时复用当前页、不再次打开链接；手动同任务重试，或当前处于 Agent、其他应用及缺少上述强证据时，重新打开任务固化的商品 URL。复用或重开均不严格核验标题、goodsId 或页面指纹，但仍要求 PDD 包名与商品/规格/订单页面结构安全证据。已有长期映射只作商品档案事实，不直接进入任务执行规格。
 - 首趟候选与 `taskId`、`taskAttemptId`、`deviceId`、规则快照哈希和幂等结果哈希关联；第二趟失败不得回到首趟循环探测。备货 `stock/direct_select` 没有 SYB 目标规格，继续使用用户逐字选择的档案规格，不进入本规则。
 - 候选和 Provider 结果仅保存颜色、尺码原始标签及结构化决策，不保存控件树、整屏截图、账号、地址、订单或支付数据；付款仍永久禁止。
@@ -676,7 +678,7 @@ Web 唯一展示位置为“采集采购 → SYB 同步记录”：列表状态
 
 ## 支付页安全返回后的核单观察（#365）
 
-实现绑定 `37714d39b5ac8ff720cfa1d0d2609f9a8af3fbd9`，工单分支已实现，未合并 main、未安装或发布；自动化验证不代表真机核单成功率已改善。仅 Android 变化，Admin、Server、数据库和上传状态契约不改。
+实现绑定 `37714d39b5ac8ff720cfa1d0d2609f9a8af3fbd9`，已合并 main 并随2026-10-09集成APK安装；自动化验证不代表真机核单成功率已改善。仅 Android 变化，Admin、Server、数据库和上传状态契约不改。
 
 - 只有识别到 PDD 支付页且既有一次 Back 成功后，才记录单调时钟起点。在尚未取得订单/待付款上下文时，允许观察至该起点后约30秒，不因反复采样或上下文缺失重置；不能用 paymentPageObserved 代替成功返回事实。
 - 无成功返回，或在原60次内已取得普通订单上下文的路径，保持原预算。返回失败、持续支付页25次、空窗口15次、微信恢复失败和未授权应用等独立失败保持，不保证每种失败等满30秒。
@@ -846,3 +848,71 @@ Android 0.9.64 / versionCode 77，源码 `6550b9f`（分支实现，尚未安装
 - 正常完成或预算退出只保存最后已确定处理/跳过的位置；页中提前退出不跳到预取末尾。确实消费完末页才回绕0；下轮/进程重启从最近已终结且有有效游标的运行续扫，NULL不是有效游标，0是有效回绕点。
 - 单运行所有权在分页续期、领取、Provider调用及保存映射时检查。失租旧运行不能继续领取或覆盖新owner；基础设施错误或失租不提交新游标。
 - completed只表示本轮正常结束，处理0件可能合法；scanned为实际检查数，不是预取数或全表数，processed不是成功数，confirmed/unmatched是规格项数。商品变化后可能需要等扫描回绕，不保证固定小时内全部处理。
+
+
+## 采购失败现场私有诊断（#364，尚未发布）
+
+本节是用户已确认的原始控件树禁存规则限定例外，仅适用于采购 `spec_probe/purchase` 本次失败、结果待核对及有真实上下文的执行阶段异常。普通采集及此前各业务模块的普通日志/结果接口不因此放宽。
+
+- 不采集正常执行的连续帧，不抓成功结果；空探测在 demote 后失败才进入诊断。已知成功结果即使后续本地保存、提示或结果上传异常也不新增失败快照。
+- 使用实际已领取/开始的 task/device/attempt UUID/phase/规则快照哈希；无有效归属只留本机固定原因，无效hash如实标为无效，不为诊断伪造事实。前置失败只留未进入执行/无障碍不可用等状态，不把Agent页面当作PDD现场。
+- 原失败上传重试只复用原ZIP。进程中断不补拍当前页冒充原现场；已有恢复核单失败可生成首次 `source=recovery` ZIP，记录恢复实际时间。恢复前的API/网络异常不抓，恢复成功不抓，不新增任何恢复点击、下单或任务重试。
+- 原始订单/地址节点等可能含个人数据，只存手机私有诊断SQLite和服务端私有数据库，只允许管理员下载。不得写入普通日志、工单、Wiki、SynapBus、普通任务结果或采购员接口；不得保存整屏截图。密码标识为true、缺失或不可读时，内容文字及其编码备份、action label均不保存。
+- 每attempt最多保留一份ZIP，已有ZIP不可覆盖；只有无ZIP未截取记录可升级为首次恢复ZIP。以该现场 recordedAt 起保留30天，重复上传不续期；新恢复ZIP采用真实恢复时刻。两端定期清理，手机快照逻辑总量64MiB，淘汰时同时终止上传队列。清理不修改采购结果。
+- 管理员采购详情可见完整/部分/未截取/暂无现场数据及安全下载入口；普通采购员、售后、客户端密钥均无原始诊断下载权限。
+- 1500ms、5000节点、2MiB ZIP、8MiB展开、128窗口与深度保护是合成测试覆盖的开发边界，未经过代表性真机样本验收；单次系统Binder读取不能被这些前后检查强行中断。未知/部分必须如实显示，不宣称拿到了系统未暴露的节点。
+
+## 图搜采集部分完成的自动关联资格（#368）
+
+实现基线：`15ccab3`（2026-10-08）；2026-10-09 已合并 main `e26743c` 并部署122.228.200.167，真实图搜采集业务效果仍待验收。
+
+- 此规则仅作用于 `source=image_search` 的结果后置自动关联。正常 `completed` 沿用原行为，包括 `missing_json=[]`。
+- `completed_partial` 仅在 `missing_json` 为可解析、非空字符串数组且每一项精确属于 `reviewCount`、`salesText`、`shopName` 时允许自动关联。三项均为可选描述信息。
+- partial 的空值、JSON null、空数组、非法 JSON、非字符串项、空项、未知项、颜色/尺码/价格/不支持维度缺失一律不放宽。不修剪字段名、不按前缀推测。
+- 保留原图搜快照、目标 PDD active、`OriginalPDDProductID` 乐观比较；人工改动后的关联不被覆盖。只有实际写入关联并返回 Linked，才进入既有规格同步和匹配流程。
+- 采集任务仍为 `completed_partial`，missing 保留，界面仍显示部分完成；关联成功不等于 AI 匹配成功。匹配无结果或不可用沿用原处理，不自动创建采购。
+- 不改变普通采集、手动当前页采集、手动关联、价格保护、映射算法、同步后置 hook 的耗时及重放机制。同图多结果沿用原提交顺序和乐观比较，不新增历史筛选、补关联或回退旧商品。
+- 验证边界：自动化测试使用隔离 SQLite 与本地模拟 ERP 服务验证实际 SubmitResult、关联及映射落库；未以此宣称 MySQL、真实 AI、真机或线上发布验证。请求在匹配开始后取消时，匹配使用原有脱钩 context 继续；最后 Detail 读取仍使用原请求 context，可能向断开的调用端返回错误，已提交数据不因此回滚。
+
+
+## Android 本设备最后一批重购（#367）
+
+实现绑定 `5430dc1f64fc0a4d8ef124ada7356e21a975151f`（2026-10-08，工单分支 `feat/367-last-batch-repurchase`）；2026-10-09 已合并 main `e26743c` 并安装集成APK，真机批量采购仍待独立授权验收。
+
+- 采购页搜索栏的“回填”入口替换为“重购”。原回填弹窗、Service 动作和实现保留但不再由该按钮触发；原单条重试、继续采购不改。重购使用原任务的 `/reset`，保留 CG 编号，不使用创建替代任务的 `/retry`。
+- 读取本设备近30天全部状态、不继承页面编号/状态筛选；按创建时间倒序、同刻任务ID倒序，从最新记录逐项比较相邻时间，不超过60秒归入同一推算批次。跨50条分页去重，最多200页，结束复核首页；头部或总量变化、日期/页结构异常、查询截断无法证明完整时不启动，不拿部分列表执行。批次时间边界使用独享API客户端的 HTTP Date，不使用手机时钟，缺少有效 Date 拒绝；此轻量方案不保证任意并发删除/归属变动的数据库快照。
+- 最后一批没有失败或失败均不可重试时只提示，不回退更早批次。一次确认显示范围、总数、失败/可重购/跳过数量及真实待付款订单风险；系统永不付款。每轮冻结 `failed && retryable` 候选，每条只重置一次，本轮再次失败不重新入队；下次点击重新发现并确认剩余任务。
+- 每条前重新检查当前资格、设备身份/Origin、网络、无障碍、新工作与本地执行/结果上传边界；不额外要求已存在完整映射，沿用服务端 unresolved 规格探测资格。明确业务资格拒绝可跳过；环境、规则、鉴权或结果未知停止后续。
+- 每条固定 requestId；重置响应不明最多同ID发两次，仍不明确停止，不换UUID或把旧failed认成本次结果。本地短时忙碌且明确未发出请求时最多等待10秒复核；重放pending不是实时状态。后续 attempt 只有原执行器记录到连续探测/重匹配完成→正式采购启动的证据链才属于本轮，外部同任务另起attempt停止编排。
+- Service 独立串行后台调度观察，真正领取、执行、上传仍由原执行器和租约/任务锁负责。终态且执行锁、活跃记录和Outbox均收尾后才继续。检测新采集或采购工作停止剩余，本轮当前task本身不算新工作。
+- 页面和通知栏“停止重购”只停止后续，已提交/执行的任务沿用原流程；切Tab、切PDD、界面重建不中断。单条单调时钟等待上限15分钟，超时只停止编排，不取消任务、不重置或再次下单。进程死亡/服务重建不恢复整轮，原单任务恢复不改。
+- 本轮摘要与最小attempt关联仅在内存，不新增地址/树采集或数据库。接口、服务端、Web、权限及 #364 诊断契约不变。自动化回归和APK构建通过不代表真机页面/批量下单已验收。
+
+
+## 采购页面一次性交接与导航稳定等待（#373 v4）
+
+实现绑定分支 `fix/373-navigation-diagnostics` 提交 `dbf9a5f`；2026-10-09 与 #374 依次合并并推送 main，集成提交 `555a954605a83c12457ed1ada86eb732fe3bb023`。集成APK仍标识 `0.9.69-373-fix1 / code82`，须以哈希区分；未安装或发布。此节不代表线上旧版本已生效；替代此前仅凭商品结构复用页面的方式。
+
+- Agent在每次采购执行开始时先取出清空服务进程内的交接凭证。凭证只能来自同任务spec_probe正常完成、结果安全落盘、首次提交返回pending且非replayed，并且本地markUploaded成功之后；失败/重传不生成或延长。缺省没有凭证，不因当前有商品结构就复用。
+- 凭证绑定taskId、goodsId、源探测attemptId、本地执行代次、无障碍实例、前台变更序号和探测完成时的单调时钟。仅紧接的同任务同商品purchase可消费一次；源/目标attempt本来不同。有效年龄为0至不足30000ms；慢AI或网络等待超过上限只导致重开链接。30秒是基于15秒心跳的保守复用政策，不是实际AI耗时保证。
+- 采集、图搜、当前页采集、回填、恢复执行、导航诊断及已知主动离页操作都会使原交接不可用；服务/无障碍重建不恢复。复用仍要求新鲜PDD商品结构，读取后再次核对同一次已消费凭证的期限、实例、前台与代次，避免慢Binder读取期间过期。人工在同一PDD包内切页可能没有可观察前台变化，不能声称完全识别。
+- 不符合复用资格时打开本任务链接，沿用直达NEW_TASK|CLEAR_TASK及异常回退浏览器。等待从该次打开开始，不是给整个重购批次加固定间隔。执行器取得实际ACCEPTED路径；未知路径不当作直达。
+- 浏览器路径先观察到受支持浏览器，再允许PDD商品结构进入就绪判断，浏览器出现前的旧PDD帧不放行。直达接受后至少3秒缓冲；浏览器返回PDD后至少3秒缓冲。商品结构还需连续稳定至少1秒、至少3次读取，缓冲与稳定时间可以重叠。就绪后立即继续，不无条件等30秒。
+- 商品稳定特征只在内存比较标题和规格入口/面板结构，不以销量、价格或滚动拼单变化为依据。非PDD、空窗口、缺少商品证据或结构变化会打断稳定计时；登录、验证码、风控和无效商品保持明确失败。
+- 导航总预算为单调时钟30秒、最多300轮、轮间100ms；耗时系统读取可能超过预算，但返回后检查时限，不再继续点击。浏览器入口重试从点击调用返回后至少间隔1秒；原生点击前在新鲜节点重新校验浏览器与剩余预算。超时返回PDD_DETAIL_ENTRY_FAILED，不继续规格、地址或创建订单步骤。
+- 用户明确拒绝新增分享/复制链接操作，并接受本版仅解决跨任务无条件复用与导航抢跑。**稳定商品页不是goodsId身份核验；PDD忽略深链而稳定停在旧页、或无可观察变化的同包人工换页，仍可能无法识别。** 不得将任务携带goodsId当作页面回读，不能用本版宣称绝对排除错误商品。
+- 不改服务端/API线协议/数据库、采集器、规格选择、地址与下单逻辑、重购批次发现/停止逻辑；不涉及任何付款动作。仅增加Android对既有结果响应status/replayed的本地解析（replayed=false在服务端可省略）。普通流程不新增原始树、截图、分享URL或页面文本落盘。
+
+## 下单前最终规格复核（#374 v3）
+
+实现绑定 `6f1af70d0d2a4c70c31ba42e05c4321f08c6a78e`（原独立工单分支基于 `e26743c`）；2026-10-09 已与 #373 集成并推送 main `555a954605a83c12457ed1ada86eb732fe3bb023`。集成版本同时包含导航等待与最终规格复核，未安装或发布，真机采购未验收。
+
+- 仅替换 PurchaseLiveAutomation.finalConfirmation 的最终规格检查，不修改之前的规格选择/verifySummary、地址、单价、数量、提交目标与不可逆边界。没有 Server/Web、API 或数据库变化。
+- 最终专用规范化只统一【】〔〕［］、（）、全角字母数字与空白；压缩连续空白，不折叠大小写、不改同义词、不用通用 NFKC、不删除括号内容。选项使用解析器既有的规格 text（沿用 UI 尾价分离），目标和摘要不新增尾价或数量删除。
+- 复用既有数量输入有界祖先的完整面板形态，但保留真实祖先关系与边界双重归属；滚动列表不等于整个弹层，摘要可位于列表上方/兄弟区域。范围内重新确认面板结构，不将全屏/root 当面板，不用仅坐标重叠的面板外文字。完整范围不可靠时禁用摘要，只使用可独立确认的有界规格滚动区域内选项。
+- 最终确认专用解析参数默认 false，普通采集及既有调用不变。仅该路径保留同名独立物理选项；沿用原 optionBlock selected/checked 聚合，并合并同值、同矩形、真实祖先链的同一选项，不吞并同名兄弟候选。同一维度多组统一检查。
+- 只检查下发非空维度，先拒绝同维度明确选中非目标、目标不可用、不同实际候选归一到同一目标或已知候选组合歧义；随后当前面板内规范化完全相等且 selected/checked 的目标可证明该维度。没有选中证明但也没有冲突时才用可信摘要，即使其他未选中候选仍可见也允许摘要补证，不使用历史 attempt 证明。
+- 摘要仅剥离开头已识别的已选前缀和紧随的一个可选冒号，保留正文标点与内容。无前缀摘要仅沿用已有 quantity/header 结构识别且须属于完整面板。当前双维证据只覆盖“颜色 空格 尺码”，逗号分隔、反序、数量后缀或未知格式不猜测支持；仅一个维度时整段须等于该值，两维均空不作为证明。
+- 多个不一致的可信摘要、已知组合歧义均拒绝。单个不匹配的摘要不能补证缺失维度；若所有必需维度已有当前精确选中证明且无上述冲突，则按选中证明优先通过。不声称候选缺失时能证明全部潜在 SKU 唯一性。
+- 拒绝仍为 PURCHASE_SPEC_NOT_MATCHED，错误信息与诊断只附固定 dimension/stage/summaryPresent/selectedFound/conflict，不附页面文字、规格原文或地址。原本靠任意可见控件含有规格子串的通过路径已移除。
+- 自动化证据：8 个相关套件共366项通过，0失败/错误/跳过；debug构建、release单测源码编译通过。完整单测因未修改的图搜返回测试忙循环而中止，不能宣称全量通过。结构夹具依据为 SpecPanelFixtures.sheet/taskOptionDedupSheet 及 PddProductDetailCollectorTest.prefixlessPanel；未执行真实采购，不以合成测试代替真机效果。

docs/04-local-development-and-verification.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Local-Development-and-Verification
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Local-Development-and-Verification.-
-wiki_revision: 03ea269058b50fea2be7842b9c284018987c82d9
-synchronized_at: 2026-09-21T08:14:42Z
+wiki_revision: 4349298c740c0cb94d8c6bf33423c9c7965ff1c7
+synchronized_at: 2026-10-08T07:10:50Z
 <!-- gitea-wiki-mirror:end -->
 
 # 本地开发与验证
@@ -350,3 +350,15 @@ node --check popup.js
 ```
 
 自动化测试只使用合成 DOM 与 Chrome API mock，覆盖列表商品行负向选择、双展开与延迟字段、解析/冲突、启动互斥、停止、错误终态、扫描延迟增长、详情恢复、提交恢复、冻结配置、超时和可重试项。真实 PDD 浏览器点击、扩展安装和真实 Admin 上传不属于自动化验证，必须取得独立授权并在结果中明确区分。
+
+
+## 采购失败现场诊断验证（#364）
+
+实现 `4581ee5` 的合成验证不连接PDD、不创建订单、不付款、不读取真实个人数据。安装、真实现场抓取和上线须另行授权。
+
+- Android：`cd android; .\\gradlew.bat test assembleDebug`；重点类为 FailureSnapshotExporterTest、FailureSnapshotCaptureTest、FailureSnapshotPolicyTest、FailureSnapshotUploadTest、FailureSnapshotRepositoryTest、AgentDiagnosticStoreMigrationTest。旧结构化诊断实际无障碍回调到Android SQLite的真机闭环仍须另验，不能用JVM测试冒称真机问题已解决。
+- 跨端：仅测试时设置 `GOAUTO_DIAGNOSTIC_FIXTURE_DIR` 指向开发构建输出目录，运行 Android `FailureSnapshotExporterTest` 生成纯合成 `manifest.json/archive.zip`；保持同一环境目录后在 `server/` 执行 `go test ./app/goauto/purchase -run TestFailureSnapshotAndroidExporterContract -count=1`。这验证真实Android导出器生成的字节被Go校验器接受；未设置变量时该测试明确skip。禁止以真实下载ZIP替代该合成fixture，输出不提交Git。
+- Server：`go test ./app/goauto/purchase ./app/goauto/access ./app/goauto/migrations ./common/middleware ./cmd/migrate/migration/version-local ./cmd/api`；覆盖所有权、成功/待执行attempt拒绝、终态补传、幂等/恢复升级、密码内容排除、ZIP/XML/HTTP容量、日志排除及空闲清理。
+- Web：构建后本地preview，使用 `PLAYWRIGHT_TEST_BASE_URL=http://localhost:<端口>`（合成cookie域为localhost），执行 `pnpm exec playwright test tests/e2e/purchase-failure-snapshots.spec.ts tests/e2e/purchase-order-writeback.spec.ts --workers=1`；普通采购员角色为 `purchaser`。
+- 迁移：`1791400000000_purchase_failure_snapshot.go` 仅追加私有表与版本记录，提供 `MigratePurchaseFailureSnapshot` 幂等入口；专用API依赖既有启动权限对账。独立测试 `TestFailureSnapshotAuthorizedLocalMySQL` 须获得本地初始化/权限写入授权后显式注入 `GOAUTO_364_LOCAL_MYSQL_DSN`；硬限制本机 `127.0.0.1:3308/goauto` 且采购任务为空。它执行追加迁移、完整既有API/采购员权限对账，并以事务回滚的合成数据验证64KiB manifest/2MiB BLOB回读与attempt唯一。不是只读测试；不得对线上或已有业务库运行，不输出DSN。
+- 服务维护：Server清理启动立即运行并每小时运行；Android前台服务启动及每60秒维护，无新任务也清理。无需新增定时任务或开关。通过管理员专用下载路由取得ZIP，禁止把私有诊断表或下载目录暴露为静态资源。

docs/06-troubleshooting.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Troubleshooting
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Troubleshooting
-wiki_revision: fee37efc79b644ecfa3237283dd45f0a09796f44
-synchronized_at: 2026-10-08T03:25:33Z
+wiki_revision: 6b370764320d1f5148fbc31f0ef6ce999370173d
+synchronized_at: 2026-10-09T02:06:57Z
 <!-- gitea-wiki-mirror:end -->
 
 # 故障排查
@@ -76,7 +76,7 @@ Agent 0.9.13 起，颜色发现阶段在本地 `goauto_diagnostics.db` 的 `agen
 
 记录只包含颜色行数、各行值数量、可点击颜色数、不可点击候选数、首次颜色点击前的颜色/尺码选中数、是否存在“已选”摘要、横向滑动次数、终止原因和耗时，不保存规格文案、价格、摘要原文、坐标、链接、goods_id、控件树、XML 或截图。
 
-只对 Debug APK 使用以下读取流程：
+以下仅为 v4 之前纯结构化诊断库的历史读取方式。v4 及之后包含采购失败私有现场，不再按此导出整库；请使用下方“Android 颜色发现诊断 v5”中的定向只读方式：
 
 ```powershell
 adb shell run-as cn.ilapage.goauto.agent ls databases
@@ -136,3 +136,25 @@ adb -s <serial> shell run-as cn.ilapage.goauto.agent sqlite3 -readonly databases
 - 完整订单证据出现就结束；超时保留原订单结果未知语义，不能因为等待更久就把任务改为可重试失败或自动重下单。
 - 固定期限从 Back 成功时起算，不是从提交订单或进入核单函数起算，也不会因新样本重置；capture 阻塞不能被该检查中断，待付款分支拥有独立预算。
 - 不因本次延长断言历史问题就是加载慢。延长期出现必须点击才能展开的入口仍不会新增点击；页面识别/挽留弹窗等原因需要真实诊断证据另行分析。#364 的失败现场诊断不属于本单实现。
+
+## Android 颜色发现诊断 v5（#370 第一阶段）
+
+实现绑定 `9e5f09a`（工单分支），Debug 标识 `0.9.69-370-diag1`，尚未合并 main。本阶段只补诊断和测试夹具，不改变遍历、停止条件、采集完成状态或采购探测决策；不能据此宣称竖向漏采已修复。
+
+`COLOR_DISCOVERY` 的结束聚合新增三个可空列：
+
+- `color_vertical_swipe_count`：本次颜色循环中成功派发的 UP 次数，排除归顶及尺码阶段；不证明视口实际移动。
+- `color_trailing_empty_read_count`：终止前连续解析不到颜色的外层发现轮数；每轮只记一次，点击与采价重读不计，非空轮清零，初始空为 1。
+- `color_horizontal_incomplete`：1 表示已观察到同一行签名变化后，必要横向探索因失败或预算耗尽仍未完成；0 表示当前已观察行无需横扫或取得连续稳定证据；NULL 表示无法确认，包括重排、空解析、缺少横向容器或仅成功派发但没有移动证据。同 seed 的未知回访不能清除旧的 1，可靠完成的 0 可以清除。0 不代表整个商品已采全，签名变化也不是物理滑动成功的独立证明。
+
+只保存计数、布尔/NULL 和固定原因码，不保存标签、价格、坐标、原始控件树、截图或个人信息。每行累计数仍不是逐屏轨迹；缺少日志不证明没执行，错误/超时提前退出可能没有结束聚合。现有 50 条/7 天留存不变。
+
+本地 SQLite v4→v5 只补三列；旧行新值保持 NULL，不删除旧诊断或采购失败快照/队列/context。旧程序不保证能降级打开 v5，不能靠卸载清数据回退。
+
+`goauto_diagnostics.db` 从 v4 起还含采购失败私有现场，不能按早期“纯结构化库”的假设导出或上传整库。已授权的 Debug 设备有 sqlite3 时可只查询所需聚合字段；无 sqlite3 时只使用已确认的内存读取方式，避免整库落盘，不放宽应用权限。示例查询（须替换设备，且实际存在 sqlite3）：
+
+```powershell
+adb -s <serial> shell run-as cn.ilapage.goauto.agent sqlite3 -readonly databases/goauto_diagnostics.db "SELECT task_id,reason,color_vertical_swipe_count,color_trailing_empty_read_count,color_horizontal_incomplete FROM agent_diagnostic WHERE stage='COLOR_DISCOVERY' ORDER BY id DESC LIMIT 1;"
+```
+
+排查须绑定同一设备、Agent/PDD 版本、任务与规则快照，并对照同次 App 布局。网页竖排与 App 横排不是同一复现场景；当前横排只能做横向兼容性回归。真机测试结果及待验证项以 #370 工单为准。

docs/08-agent-api-contract.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Android-Agent-API-Contract
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Android-Agent-API-Contract.-
-wiki_revision: f97ac6b8784fc200ee68e9e2eb4a1201296049f0
-synchronized_at: 2026-10-08T03:25:37Z
+wiki_revision: 2102252a3f0ecb646b49941cc603423abb76ca2c
+synchronized_at: 2026-10-08T07:11:01Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -1493,3 +1493,40 @@ Web 输入去重后一个值提交旧标量、多个值提交重复集合键，
 - `stopReason`：旧记录默认空字符串；完成原因是`batch_limit`、`scan_budget`、`time_budget`、`end_of_scan`、`lease_lost`或`error`。失租旧进程不能为填此字段越权更新；合法回收路径标记lease_lost。
 - `scannedCount`改为实际检查的候选数；SQL已过滤的空档案及预取未检查项不计入。eligibleCount为Go资格通过数，processedCount为实际领取处理数；confirmedCount/unmatchedCount仍为规格项数，不能据此直接混算商品成功率。
 - 单轮处理默认20、每页200、实际扫描上限2000、整轮预算10分钟。正常0处理仍可completed，预算退出有持久游标；错误/失租不提交新游标。
+
+
+## 采购失败现场诊断 v1（#364，实现 4581ee5，2026-10-08）
+
+本节契约在 `4581ee5` 实现，后续合并记录见 #364；尚未发布或完成真机验收。只覆盖采购spec_probe/purchase的本次失败/结果待核对，不修改正常capture、采购结果/不可逆状态；成功结果后网络/提示异常不抓取。普通采集不纳入。每attempt UUID最多一份ZIP；重启不能补拍当前页面冒充原现场，恢复核单现场必须source=recovery。
+
+### 专用接口
+
+- POST `/api/agent/v1/purchase-tasks/{taskId}/attempts/{attemptId}/failure-snapshot`：Device Token鉴权及现有Agent传输策略。流式multipart，`metadata` UTF-8 JSON（≤64KiB），`archive` 可选ZIP（≤2MiB）；不得写临时原始文件。验证attempt持久化的task/device/phase，不依赖task当前设备或running状态，终态允许异步补传。响应沿用Agent JSON envelope，data含taskAttemptId/status/replayed。
+- GET `/api/admin/v1/purchase-tasks/{taskId}/failure-snapshots`：仅管理员，返回`{code:200,data:{items:[...]}}`；items仅attemptId/phase/status/source/errorCode/agentVersion/capturedAt/recordedAt/expiresAt/partial/reasons/downloadAvailable/zipSize等安全标量，不包含窗口标题、节点或manifest原文。
+- GET `/api/admin/v1/purchase-tasks/{taskId}/attempts/{attemptId}/failure-snapshot/download`：仅管理员，附件ZIP，Content-Type application/zip、Cache-Control no-store、nosniff，服务端生成安全文件名。无快照/过期不可下载，普通采购员/API Key及普通Agent业务接口不得读取。不得在线渲染XML。
+
+### metadata / ZIP
+
+schemaVersion=1、attributeVersion=1；taskId/deviceId正整数、taskAttemptId UUID、phase为spec_probe或purchase；ruleSnapshotHash为有效SHA256或null，ruleSnapshotHashValid明确标记；有效时必须与attempt快照hash相同，无效时仅not_captured并记录rule_hash_invalid，不伪造hash。errorCode为有界代码，agentVersion为有界版本；recordedAt/capturedAt为UTC RFC3339，未截取capturedAt=null。source为execution/recovery；status为complete/partial/not_captured；reasons固定代码数组；windows数组含id/fileName/status及可获取的窗口属性。窗口标题等实际文本只存私有诊断内容，不出现在Admin摘要。
+
+ZIP含manifest.json（与metadata语义一致）和每个可取得root窗口的window-<id>.xml，每个XML仅一个hierarchy根，禁止DTD/外部实体/路径穿越/重复条目；保留系统原顺序及不可见节点。窗口缺失/属性失败/节点数/字节数/耗时超限明确partial且仍可解析。password节点所有可能承载内容的文字字段均省略（text/contentDescription/hint/stateDescription/tooltip/action label等）；不反射任意extras。标准UIAutomator属性名，扩展属性合法；XML非法字符采用显式可逆编码，不能丢弃。schema区分空值、不支持和读取失败。
+
+未截取时只上传metadata，无ZIP，不制造空XML；无attempt只保存本机最小原因，不上传虚构归属。服务端解压后总量≤8MiB，不能只相信ZIP声明大小；按白名单条目流式有界验证，异常不回显正文。
+
+### 存储、幂等及清理
+
+Android复用诊断库升级至v4，新独立快照/待上传/实际执行上下文表；旧结构化诊断保持7天/50条，新快照开发容量64MiB和30天独立清理，队列随过期/淘汰终止；无新任务也定期清理。结果上报优先，上传单独线程/持久队列，失败不改变采购结果或阻塞设备释放；重传只复用已存字节。每attempt已有ZIP不得覆盖；仅无ZIP未截取状态允许后续该attempt首次恢复核单ZIP，不能阻止真实恢复现场。
+
+Server追加迁移 `1791400000000_purchase_failure_snapshot.go` 建立purchase_failure_snapshot独立表（ZIP LONGBLOB、私有manifest LONGTEXT、归属与安全摘要，attempt UUID唯一）。同一有效载荷重放返回replayed=true；已有ZIP不同载荷409且保留原件；终态补传有效。按recordedAt起30天，上传不续期，过期补传410供客户端停止；清理启动立即执行并每小时，无任务也执行，下载查询亦拒绝已过期数据。使用既有管理员身份和专用API注册，不给采购员开放权限。
+
+2MiB/8MiB/64MiB是经工单声明的开发测试起点；节点/耗时开发保护暂为5000节点、1500ms，采样前后检查，无法中断系统单次Binder读取的事实须记录；deadline后停止遍历，不异步继续抓下一任务。上述不是代表性真机实测结论，正式现场验收前仍需确认。上线/安装/真机抓取另行授权。
+
+### v1 编码与队列细节
+
+- windows 条目含 id、fileName（可空）、type、layer、title、active、focused、bounds、packageName、activityName、capturedAt、status、reasons、attributeStates；无 root 不制造空 XML。未暴露属性不得猜测。
+- XML 节点标准属性含 text/resource-id/class/package/content-desc/checkable/checked/clickable/enabled/focusable/focused/scrollable/long-clickable/password/selected/bounds；扩展 path、child-count、visible-to-user、editable、hint、state-description、tooltip、input-type、max-text-length、drawing-order，collection-* 与 range-* 为扁平字段；node 下的 action 子元素保留 id/label。版本1公开属性名单以 SnapshotXml.attributes 为准，不反射 extras。
+- 非值属性使用 `<属性名>-state=null|unsupported|read_error` 区分空值、不支持、读取失败；XML非法代码单元使用 `<属性名>-base64` 保存原始 UTF-16BE 字节的 Base64（包括未配对 surrogate）。换行/回车/Tab 使用数值实体。密码标识为 true、缺失或读取失败时，文字字段、状态/编码备份及 action label 均省略；只有显式 password=false 才允许保存内容，子 action 不得覆盖父节点保护。
+- 固定 reasons：rule_hash_invalid、execution_not_entered、accessibility_unavailable、process_interrupted、windows_unavailable、windows_unsupported、window_root_null、window_disappeared、window_read_error、node_read_error、attribute_unsupported、node_limit、time_limit、expanded_size_limit、archive_size_limit、capture_failed。
+- 有ZIP的新上传只接受相符的非成功执行 attempt；不能向 pending/成功 attempt 新增失败诊断，已有有效载荷重放仍幂等。manifest 与 multipart metadata 语义相同；ZIP拒绝未知条目、重复路径、加密/未知压缩、CRC错误，XML拒绝DTD和处理指令，除限定XML声明。
+- 本地队列绑定 Server Origin 和载荷 fingerprint，切换服务器不向新服务器转交旧ZIP；旧上传响应不删除后来首次恢复ZIP。每60秒维护，网络/408/429/5xx按60秒至1小时退避，410与其他永久4xx停止该队列项。结果Outbox优先，不因设备忙而永久饥饿；上传线程不持有任务互斥、不操作设备。
+- 诊断接口不进入通用请求正文日志；私有SQL记录器不输出manifest/BLOB。管理员摘要不包含窗口和节点内容。默认HTTP例外只沿用既有Agent设置，不新增开关；传输私有原始内容时同样存在明文风险，部署须确认现有传输策略。

docs/13-deployment-and-operations.md

@@ -2,8 +2,8 @@
 generated: true (请先修改 Gitea Wiki，禁止直接编辑本文件)
 wiki_page: Deployment-and-Operations
 wiki_url: https://git.ilapage.cn/OPC/goauto/wiki/Deployment-and-Operations.-
-wiki_revision: db99427fa2460989d34d28ef864230a907fc5e6d
-synchronized_at: 2026-10-08T01:42:22Z
+wiki_revision: 3f69f2e39675752dfd43dc38de41cb7defb74a42
+synchronized_at: 2026-10-09T07:58:00Z
 <!-- gitea-wiki-mirror:end -->
 
 <!-- gitea-wiki-mirror:start -->
@@ -308,3 +308,67 @@ Provider 故障日志只允许记录调用关联 ID、操作类型、耗时、
 - 新版启动日志结构检查未见panic/fatal/1146/1054。服务器systemd较旧，读取PID用 `systemctl show goauto -p MainPID` 并解析键值，不使用不支持的 `--value`；journalctl起始时间使用服务器本地格式 `YYYY-MM-DD HH:MM:SS`。
 - Nginx配置检查通过，本次无配置变化、不需重启或reload；仅恢复发布目录可读性即恢复前端。真实多轮续扫、末尾回绕和AI实际匹配仍待自然运行验收，健康检查不等于业务效果验收。
 - 回滚代码目标 `/home/goauto/releases/20261007-eb7cb6b-363` 保留；重启前核验任务空闲，保留追加列与已经保存的映射，不恢复旧备份覆盖此后业务。
+
+
+## 采购失败现场诊断部署与保留（#364）
+
+实现绑定 `4581ee5`；2026-10-09 已随 main `e26743c` 完成线上迁移及发布，见下方发布记录。#365/#366 为Android局部行为，#366仅②编辑框就绪/hint保护已交付，①地址列表识别仍待现场证据。
+
+1. 先取得目标环境的追加迁移及发布授权，核对唯一待执行版本 `1791400000000_purchase_failure_snapshot.go`，建立独立私有诊断表，再启动配套Server/Web。专用摘要/ZIP下载注册到既有启动权限对账，只允许管理员；对账会维护完整API目录及采购员既有权限，不是只写两条接口。
+2. Server接收与权限验证就绪后再安装新Agent。旧Server不支持新诊断接口；不要把“本机保存成功”当作“已上传”。仅合并main不启动服务、不执行线上迁移、不自动安装APK。
+3. Server启动立即清理过期诊断，其后每小时维护；Android前台服务启动及每60秒维护。两端默认30天，手机私有诊断逻辑容量64MiB；无需Admin定时任务或新开关，清理不修改采购任务与订单事实。不得把诊断ZIP/数据库映射成静态目录。
+4. 管理员从采购详情执行记录下载ZIP；无现场、未截取、partial、上传中/失败应按实际结果区分。排错日志仅固定错误分类，禁止复制ZIP内容到日志、工单、Wiki或消息；分析只摘必要脱敏结构。沿用现有Agent HTTPS/显式HTTP例外，HTTP上传有个人数据明文风险。
+5. 代码回滚时保留追加表和已存数据，不降级或删除手机数据库来恢复；回滚到尚不识别schema v4的旧Agent须先单独评估，不承诺可直接覆盖安装。保留期限清理须有仍在运行的相应新版维护组件。
+6. 本机换机后的数据库经用户授权初始化于 `127.0.0.1:3308/goauto`，配置仍来自仓库根目录已忽略的config.yaml；已完成baseline迁移及#364幂等、容量、权限验证，未启动业务服务或连接线上。不是将历史3307运行说明套用于所有环境；实际Supervisor目录/发布按目标环境另核对。
+
+
+## 2026-10-08 换机后本地 Supervisor 联调配置（#364 后续运行准备）
+
+本节是当前电脑的配置，优先于上文历史 D:/supervisor、3307 和 main-runtime 路径；不改变线上拓扑。
+
+- Supervisor 位于 `D:/supervisord`，主配置 `supervisord.conf` 通过 `[include] files=programs/goauto.conf` 引入两个实例：`goauto-admin-api` 和 `goauto-admin-ui`。两者 `autostart=false`、`autorestart=true`，添加/重读配置不等于批准启动所有服务；只对目标实例操作，不重启整个Supervisor。
+- 独立运行目录 `D:/OPC/goauto-runtime` 干净地固定在已合并main的 `e450ac28989de6827328b411e4bdc050dded9ab3`，用detached HEAD避免与开发分支混淆。根仓库 `D:/OPC/goauto` 仍保留用户旧分支和未提交资料，不在其中切main或覆盖。
+- 两实例读取 `D:/OPC/goauto/config.yaml`；本地MySQL为127.0.0.1:3308/goauto，API端口8010，Web端口9527。后端调用运行目录的 `scripts/start-server.ps1 -ConfigPath D:/OPC/goauto/config.yaml -SkipMigration`，前端调用 `scripts/start-web.ps1 -ConfigPath D:/OPC/goauto/config.yaml`。后端仍会校验/确保数据库存在并执行既有启动权限对账；SkipMigration不是只读启动。
+- 当前电脑默认go为1.24且GOTOOLCHAIN=local，继承的GOSUMDB=off又会阻止自动下载1.26.5；仅后端实例的PowerShell命令把已安装 `C:/Users/Qiu/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.5.windows-amd64/bin` 前置到进程PATH，并设置GOTOOLCHAIN=local。已用该环境构建验证；未更改全局环境、校验策略或项目go.mod。此绝对路径是本机配置，其他电脑须核实已安装工具链，不照抄。
+- 前端依赖属于运行目录自身，按锁文件安装，不链接其他worktree的node_modules。若旧残留依赖出现ERR_MODULE_NOT_FOUND且普通安装未补齐，先用 `node -e "import('vite')"` 复现，再在本目录按锁文件重新安装；不通过修改业务代码或升级依赖绕过。
+- 手动启动顺序为API就绪后Web；Web原脚本最多等待API健康60秒，并将/api同源代理到本机8010。浏览器本机入口 `http://127.0.0.1:9527/`，Agent使用电脑实际局域网IP的8010端口，不把127.0.0.1配置给手机。
+- 日志为 `D:/supervisord/goauto-admin-api.log`、`D:/supervisord/goauto-admin-ui.log`。检查依赖、端口和实际子进程环境；不能只因Supervisor显示Running就宣称HTTP就绪。
+- 新库预置SYB每小时同步与Yeeke同步status=2（启用）；蝦皮规格自动匹配、异常规格AI解析status=1（关闭）。本轮只读检查，未改任务状态；用户手动启动API后既有调度会运行，真实外部访问须结合本地凭据/配置确认，不能把本地环境当作自动隔离的沙箱。
+- 配置动作未新增迁移、未部署线上、未安装APK；用户随后确认亲自点击了启动。健康/页面验证记录在工单，不将健康检查冒充登录、诊断下载或真机端到端验收。
+
+
+## 2026-10-09 集成发布与 Android 签名连续性（#364/#365/#366/#367/#368/#370）
+
+- 集成源码 main `e26743c817275137f7dc8a3659461d552371b9e3`。122.228.200.167 当前发布目录 `/home/goauto/releases/20261009-e26743c-integrated`，旧目录 `/home/goauto/releases/20261007-0138da8-359` 保留供代码回退。用户明确要求线上有采集/采购执行时不得重启；迁移前及切换前相关运行计数均为0，没有取消、重置或发起业务。
+- 已授权追加迁移 `1791400000000_purchase_failure_snapshot.go`、启动权限对账及发布。私有备份 `/home/goauto/backups/20261009-integrated/database.sql` 目录0700/文件0600；只新增诊断表，回读LONGTEXT/LONGBLOB及attempt唯一索引通过。定时任务启停、Cron与参数摘要前后一致。
+- Server SHA256 `ae7e479e94db0485661665306d0d0306ca5c3cd4019694991c29b64d113eb637`，运行进程二进制一致；新Web入口SHA256 `242158568fb3ee9c51e2e16574abf0a1b6b5b692ae167ec78bcb957cdf5e7434`。根入口、index、login、syb-products入口、10项JS/CSS、健康与验证码通过。Nginx实际读取用户可读性切换前确认；保留旧hashed资源与config/static/temp/var。没有更改Nginx配置；未认证诊断接口401、现有非管理员凭据403。
+- 本次自动化验证为Android 274项受影响测试、Server任务/采购/商品/规格/权限/中间件/迁移相关包、Web 6项模拟API页面测试及三端构建。未执行真实采购或付款；管理员真实诊断下载及完整失败现场上传仍待业务验收。#366仅环节②，#370仅第一阶段诊断，不能视为剩余根因修复已完成。
+- Android集成APK保持 `0.9.69-370-diag1 / versionCode 82`，不能只凭版本号区分旧包；本次最终APK SHA256 `68d7caf9ae7ee5808783056f4f1591266746197b520048fa64c89365723edef7`。2026-10-09已覆盖安装到用户指定手机，安装后文件哈希一致、配置及设备身份前后摘要一致、进程启动存在，没有卸载或清数据。
+- 换机生成的调试签名与旧机不同会导致 `INSTALL_FAILED_UPDATE_INCOMPATIBLE`；不可为更新擅自卸载。用户提供的原调试签名已与手机证书核对一致，私有文件位于 `D:/OPC/goauto/debug.keystore`，仅在本地Git排除规则中忽略，绝不提交。应另行私密备份，不能重新生成替代。
+- 当前Windows用户级 `C:/Users/Qiu/.gradle/init.d/goauto-debug-signing.gradle` 使用Android Components的 `finalizeDsl`，仅对applicationId `cn.ilapage.goauto.agent` 的debug签名指定原文件；其他项目及release配置不变。普通Gradle调试构建自动生效，文件缺失则明确失败，不退回新签名。更换电脑或GRADLE_USER_HOME时需带入相同私有文件及配置；不要把本机设置当作仓库内或其他电脑已配置。构建后用signingReport与apksigner复核，再以install -r更新。
+
+
+## Android 商品导航诊断（#373，诊断阶段）
+
+- 分支实现 `2c58d58`，调试包 `0.9.69-373-nav-diag3`；尚未合并 main，不代表旧商品页复用或旧页排除已修复。正式采购打开路径保持原样，新增 `PRODUCT_NAVIGATION` 结构诊断至既有 SQLite `agent_diagnostic`，区分 DIRECT/BROWSER 的 ACCEPTED/REJECTED/EXCEPTION，仅记录异常类名及耗时，沿用任务、attempt、device、phase、rule hash 关联和原50条/7天保留规则，无数据库升级。ACCEPTED只表示startActivity返回，不表示目标商品已加载。
+- 仅debug包包含 `cn.ilapage.goauto.agent/.diagnostics.NavigationProbeReceiver`，要求发送者具有 `android.permission.DUMP`（ADB shell/system），release清单不含该入口。输入仅数字goodsId及direct/browser，不接受任意URL、脚本或购买动作。必须先获得指定设备覆盖安装及只打开商品页的授权，确认无业务任务运行；保留原签名用install -r，禁止为安装清数据或卸载。
+- Agent主界面启动前台服务且无障碍就绪后，通过ADB执行 `adb -s <设备地址> shell am broadcast -n cn.ilapage.goauto.agent/.diagnostics.NavigationProbeReceiver --es goodsId <数字商品ID> --es mode direct`；浏览器对照使用 `--es mode browser`。忙碌/服务未就绪时拒绝、不排队，不能用取消或重置业务任务强行取得设备。
+- 探针占用现有设备互斥锁，预算20秒/最多201轮；耗时Binder读取可能越过观察预算，但其后不再派发导航/点击，不能声称能强制中断系统读取。服务或无障碍实例失效、线程中断、登录/风控/验证码时停止。只打开商品链接，在浏览器中最多尝试3次唯一的精确“打开拼多多APP”/“打开拼多多 App”且节点自身可点击的入口；实际派发前再次校验包、窗口、节点与存活条件，无祖先/坐标/手势兜底。PDD内只读，不调用采购执行器、不进入规格选择/改地址/下单/付款，不创建/重试服务器任务。
+- 临时探针输出通过 `adb -s <设备地址> logcat -d -s GoAutoNavProbe:I '*:S'` 读取；只包含随机runId、路径/固定结果、相对毫秒、节点计数、窗口id、布尔证据及仅在内存比较所得标题same/different/unknown，不保存标题/哈希/URL/页面原文/原始树/截图，不写业务数据库。别用logcat -t的全局最后几行冒充完整诊断；若缓冲已覆盖须如实记录。禁止导出完整无过滤系统日志。
+- `legacy_would_accept`模拟现有两次商品结构命中，始终标注identityVerified=false；窗口变化、标题变化、商品结构成立都不是目标goodsId证明。shell触发探针与后台任务的系统启动许可可能不同；人工指定browser只验证浏览器路径，不证明当时自动回退的异常原因。正常/失败对照及真实后台时序仍须以任务绑定诊断和人工确认核验。
+- 自动化验证应包含debug专用探针单测与 `:app:compileReleaseUnitTestKotlin`；探针测试放 `src/testDebug`，不得在共享 `src/test` 引用debug-only类。构建使用原私有签名，安装后回读包版本和APK哈希，并比较设置/设备身份摘要。
+
+## #373 v4 修复版构建与验证（2026-10-09）
+
+- 源码分支 `fix/373-navigation-diagnostics`，实现提交 `dbf9a5f4606529189e57b6c266449070d5001340`。APK版本 `0.9.69-373-fix1 / code82`，与前一导航诊断版不同；未安装修复版、未合并main、未发布线上，不需要Admin迁移或服务重启。
+- APK SHA256 `171f4b12395e2940ce873b62ea394799f521d1a0997f6aaf7582a123c24795e8`；仍使用用户原签名，证书SHA256 `bf86d7465c6092be74ce9c4187eb30c9a7d045c3b91891a547e2598429766dec`。后续经安装授权用install -r保留数据，不能为覆盖擅自卸载。相同versionCode不能证明文件相同，应核对完整版本和哈希。
+- 主Agent独立执行相关测试451项（23套件）零失败/错误，compileReleaseUnitTestKotlin与assembleDebug通过；规格及代码质量两轮独立只读审查通过。覆盖一次性交接/首传回放/上传标记失败/慢读取过期、浏览器出现前旧帧、diag3时序、3秒缓冲/1秒稳定、慢Binder点击冷却与超时零后续动作，以及采购、采集、原诊断相关回归。不是全量测试或真机采购验收。
+- 修复版的真实采购/重购未执行，页面身份识别限制见业务规则。原debug导航探针依然用于旧判据时序取证，不把其legacy_would_accept日志冒充新版执行器通过证据；新版导航就绪由实际采购执行器及其纯策略判断。
+- 诊断仍沿用已有本地记录；无需新schema、服务端权限或接口。运维排查先分清实际DIRECT/BROWSER路径、是否发生浏览器前旧页抢跑、是否缓冲/稳定超时，以及复用凭证是否有效；不能仅因startActivity接受就认定商品已加载。
+
+## #373 + #374 合并 main 与集成构建（2026-10-09）
+
+- 按用户授权的顺序先合并 #373（`1e924fa41195281a3223003a69c8c16ae37f8aa5`），再合并 #374（`555a954605a83c12457ed1ada86eb732fe3bb023`），保留两单提交历史；main已推送。源码无冲突，三份Wiki镜像选择包含两单内容的较新已导出版本，未手改规则正文解决冲突。
+- 集成验证25套件478项通过，0失败/错误/跳过；compileReleaseUnitTestKotlin与assembleDebug通过。不是全量单测结论；#374记录的未修改图搜返回测试忙循环未在本次重跑。未进行真机采购。
+- 集成APK位于本机 `D:/OPC/goauto-worktrees/release-373-374/android/app/build/outputs/apk/debug/app-debug.apk`，版本仍为 `0.9.69-373-fix1 / code82`，**已同时包含#374，不能只靠版本文字区分前一#373单独包**。SHA256 `6e2d0e0ed1eb943b3f168bb16d628d2c2bb4ce3b7c7c8b9e567dcdf8259150f8`；apksigner校验通过，沿用原签名证书 `bf86d7465c6092be74ce9c4187eb30c9a7d045c3b91891a547e2598429766dec`。
+- 本次仅合并、验证和推送，未覆盖安装、未执行真实采购/付款、未发布或重启服务；不需要业务库迁移。手机仍使用此前安装版本。后续装机须另行授权，保留原签名及用户数据。

server/app/goauto/access/purchaser.go

@@ -116,6 +116,8 @@ var AdminAPIs = []APIPermission{
 	{"回填SYB采购单号", "/api/admin/v1/purchase-tasks/syb-order-writeback", "POST", true},
 	{"创建备货采购任务", "/api/admin/v1/purchase-tasks/stock", "POST", true},
 	{"查看采购任务详情", "/api/admin/v1/purchase-tasks/:taskId", "GET", true},
+	{"查看采购失败现场摘要", "/api/admin/v1/purchase-tasks/:taskId/failure-snapshots", "GET", false},
+	{"下载采购失败现场", "/api/admin/v1/purchase-tasks/:taskId/attempts/:attemptId/failure-snapshot/download", "GET", false},
 	{"创建采购任务", "/api/admin/v1/purchase-tasks", "POST", true},
 	{"处理采购规格", "/api/admin/v1/purchase-tasks/:taskId/spec-decision", "POST", true},
 	{"查看采购规格匹配", "/api/admin/v1/purchase-tasks/:taskId/matching", "GET", true},

server/app/goauto/migrations/migrate.go

@@ -62,6 +62,7 @@ func MigratedModels() []any {
 		&models.PDDAccount{},
 		&models.PurchaseTask{},
 		&models.PurchaseTaskAttempt{},
+		&models.PurchaseFailureSnapshot{},
 		&models.PurchaseOrderWriteback{},
 		&models.PurchaseOrderWritebackLease{},
 		&models.PurchaseOrderWritebackCommand{},

server/app/goauto/models/purchase_failure_snapshot.go

@@ -0,0 +1,31 @@
+package models
+
+import "time"
+
+// PurchaseFailureSnapshot is deliberately never embedded in a business API DTO.
+// Private manifest and archive may contain personal information.
+type PurchaseFailureSnapshot struct {
+	ID               uint64     `json:"-" gorm:"primaryKey;autoIncrement"`
+	TaskID           uint64     `json:"-" gorm:"not null;index"`
+	AttemptID        string     `json:"-" gorm:"size:36;not null;uniqueIndex:ux_purchase_failure_snapshot_attempt"`
+	DeviceID         uint64     `json:"-" gorm:"not null"`
+	Phase            string     `json:"-" gorm:"size:16;not null"`
+	RuleSnapshotHash string     `json:"-" gorm:"size:64;not null"`
+	Status           string     `json:"-" gorm:"size:16;not null"`
+	Source           string     `json:"-" gorm:"size:16;not null"`
+	ErrorCode        string     `json:"-" gorm:"size:64;not null"`
+	AgentVersion     string     `json:"-" gorm:"size:64;not null"`
+	CapturedAt       *time.Time `json:"-"`
+	RecordedAt       time.Time  `json:"-" gorm:"not null"`
+	ExpiresAt        time.Time  `json:"-" gorm:"not null;index"`
+	ReasonsJSON      string     `json:"-" gorm:"type:text;not null"`
+	ManifestJSON     string     `json:"-" gorm:"type:longtext;not null"`
+	ZIPData          []byte     `json:"-" gorm:"column:zip_data;type:longblob"`
+	PayloadSHA256    string     `json:"-" gorm:"size:64;not null"`
+	ZIPSize          int64      `json:"-" gorm:"column:zip_size;not null"`
+	ExpandedSize     int64      `json:"-" gorm:"not null"`
+	CreatedAt        time.Time  `json:"-"`
+	UpdatedAt        time.Time  `json:"-"`
+}
+
+func (PurchaseFailureSnapshot) TableName() string { return "purchase_failure_snapshot" }

server/app/goauto/purchase/failure_snapshot.go

@@ -0,0 +1,237 @@
+package purchase
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"regexp"
+	"time"
+
+	"github.com/google/uuid"
+	"go-admin/app/goauto/device"
+	"go-admin/app/goauto/models"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"gorm.io/gorm/logger"
+)
+
+const (
+	FailureSnapshotMetadataLimit = 64 << 10
+	FailureSnapshotZIPLimit      = 2 << 20
+	FailureSnapshotExpandedLimit = 8 << 20
+	FailureSnapshotRetention     = 30 * 24 * time.Hour
+)
+
+type FailureSnapshotMetadata struct {
+	SchemaVersion         int               `json:"schemaVersion"`
+	AttributeVersion      int               `json:"attributeVersion"`
+	TaskID                uint64            `json:"taskId"`
+	DeviceID              uint64            `json:"deviceId"`
+	TaskAttemptID         string            `json:"taskAttemptId"`
+	Phase                 string            `json:"phase"`
+	RuleSnapshotHash      *string           `json:"ruleSnapshotHash"`
+	RuleSnapshotHashValid bool              `json:"ruleSnapshotHashValid"`
+	ErrorCode             string            `json:"errorCode"`
+	AgentVersion          string            `json:"agentVersion"`
+	RecordedAt            time.Time         `json:"recordedAt"`
+	CapturedAt            *time.Time        `json:"capturedAt"`
+	Source                string            `json:"source"`
+	Status                string            `json:"status"`
+	Reasons               []string          `json:"reasons"`
+	Windows               []json.RawMessage `json:"windows"`
+}
+
+type FailureSnapshotSummary struct {
+	AttemptID         string     `json:"attemptId"`
+	Phase             string     `json:"phase"`
+	Status            string     `json:"status"`
+	Source            string     `json:"source"`
+	ErrorCode         string     `json:"errorCode"`
+	AgentVersion      string     `json:"agentVersion"`
+	CapturedAt        *time.Time `json:"capturedAt"`
+	RecordedAt        time.Time  `json:"recordedAt"`
+	ExpiresAt         time.Time  `json:"expiresAt"`
+	Partial           bool       `json:"partial"`
+	Reasons           []string   `json:"reasons"`
+	DownloadAvailable bool       `json:"downloadAvailable"`
+	ZIPSize           int64      `json:"zipSize"`
+}
+
+type snapshotError struct {
+	status int
+	code   string
+}
+
+func (e *snapshotError) Error() string              { return e.code }
+func snapshotFailure(status int, code string) error { return &snapshotError{status, code} }
+func invalidSnapshot() error                        { return snapshotFailure(422, "FAILURE_SNAPSHOT_INVALID") }
+
+// Keep private content out of SQL logging, including failures in tests/debug mode.
+func (s *Service) snapshotDB(ctx context.Context) *gorm.DB {
+	return s.DB.WithContext(ctx).Session(&gorm.Session{Logger: logger.Default.LogMode(logger.Silent)})
+}
+
+var snapshotCodePattern = regexp.MustCompile(`^[A-Z][A-Z0-9_]{0,63}$`)
+var snapshotVersionPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$`)
+var snapshotHashPattern = regexp.MustCompile(`^[a-f0-9]{64}$`)
+
+func decodeSnapshotMetadata(raw []byte) (FailureSnapshotMetadata, error) {
+	var m FailureSnapshotMetadata
+	if len(raw) == 0 || len(raw) > FailureSnapshotMetadataLimit {
+		return m, invalidSnapshot()
+	}
+	if err := uniqueSnapshotJSON(raw); err != nil {
+		return m, err
+	}
+	var fields map[string]json.RawMessage
+	if json.Unmarshal(raw, &fields) != nil {
+		return m, invalidSnapshot()
+	}
+	for _, name := range []string{"schemaVersion", "attributeVersion", "taskId", "deviceId", "taskAttemptId", "phase", "ruleSnapshotHash", "ruleSnapshotHashValid", "errorCode", "agentVersion", "recordedAt", "capturedAt", "source", "status", "reasons", "windows"} {
+		if _, present := fields[name]; !present {
+			return m, invalidSnapshot()
+		}
+	}
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.DisallowUnknownFields()
+	if err := d.Decode(&m); err != nil {
+		return m, invalidSnapshot()
+	}
+	if err := d.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return m, invalidSnapshot()
+	}
+	return m, nil
+}
+
+func (s *Service) UploadFailureSnapshot(ctx context.Context, taskID uint64, attemptID, token string, raw, archive []byte) (string, bool, error) {
+	d, err := device.NewService(s.snapshotDB(ctx)).Authenticate(ctx, token)
+	if err != nil {
+		return "", false, err
+	}
+	m, err := decodeSnapshotMetadata(raw)
+	if err != nil {
+		return "", false, err
+	}
+	parsed, err := uuid.Parse(attemptID)
+	if err != nil || parsed.String() != attemptID || m.TaskID != taskID || m.TaskAttemptID != attemptID || m.DeviceID != d.ID {
+		return "", false, invalidSnapshot()
+	}
+	if err = validateSnapshotMetadata(m, s.Now()); err != nil {
+		return "", false, err
+	}
+	if !m.RecordedAt.Add(FailureSnapshotRetention).After(s.Now()) {
+		return "", false, snapshotFailure(410, "FAILURE_SNAPSHOT_EXPIRED")
+	}
+	expanded, err := validateFailureArchive(m, raw, archive)
+	if err != nil {
+		return "", false, err
+	}
+	canonical, err := canonicalSnapshotJSON(raw)
+	if err != nil {
+		return "", false, invalidSnapshot()
+	}
+	digest := sha256.New()
+	digest.Write(canonical)
+	digest.Write([]byte{0})
+	digest.Write(archive)
+	hash := hex.EncodeToString(digest.Sum(nil))
+	replayed := false
+	err = s.snapshotDB(ctx).Transaction(func(tx *gorm.DB) error {
+		var a models.PurchaseTaskAttempt
+		if e := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("task_id = ? AND attempt_id = ? AND device_id = ?", taskID, attemptID, d.ID).First(&a).Error; e != nil {
+			if errors.Is(e, gorm.ErrRecordNotFound) {
+				return snapshotFailure(404, "FAILURE_SNAPSHOT_NOT_FOUND")
+			}
+			return e
+		}
+		if a.Phase != m.Phase || (m.RuleSnapshotHashValid && (m.RuleSnapshotHash == nil || *m.RuleSnapshotHash != a.RuleSnapshotHash)) {
+			return invalidSnapshot()
+		}
+		if a.Status == models.PurchaseAttemptStatusPending {
+			return snapshotFailure(409, "FAILURE_SNAPSHOT_ATTEMPT_NOT_STARTED")
+		}
+		if a.StartedAt != nil && m.RecordedAt.Before(a.StartedAt.Add(-5*time.Minute)) {
+			return invalidSnapshot()
+		}
+		var old models.PurchaseFailureSnapshot
+		e := tx.Where("attempt_id = ?", attemptID).First(&old).Error
+		if e == nil {
+			if old.PayloadSHA256 == hash {
+				replayed = true
+				return nil
+			}
+			if old.ZIPSize > 0 || len(archive) == 0 || m.Source != "recovery" {
+				return snapshotFailure(409, "FAILURE_SNAPSHOT_CONFLICT")
+			}
+			if !old.ExpiresAt.After(s.Now()) {
+				return snapshotFailure(410, "FAILURE_SNAPSHOT_EXPIRED")
+			}
+		} else if !errors.Is(e, gorm.ErrRecordNotFound) {
+			return e
+		}
+		if a.Status == models.PurchaseAttemptStatusCompleted && a.ResultType != nil && (*a.ResultType == "order_created" || *a.ResultType == "spec_probe_completed" || *a.ResultType == "spec_rematch_completed" || *a.ResultType == "rehearsal_completed") {
+			return snapshotFailure(409, "FAILURE_SNAPSHOT_SUCCESSFUL_ATTEMPT")
+		}
+		reasons, _ := json.Marshal(m.Reasons)
+		row := models.PurchaseFailureSnapshot{TaskID: taskID, AttemptID: attemptID, DeviceID: d.ID, Phase: m.Phase, RuleSnapshotHash: a.RuleSnapshotHash, Status: m.Status, Source: m.Source, ErrorCode: m.ErrorCode, AgentVersion: m.AgentVersion, CapturedAt: m.CapturedAt, RecordedAt: m.RecordedAt, ExpiresAt: m.RecordedAt.Add(FailureSnapshotRetention), ReasonsJSON: string(reasons), ManifestJSON: string(canonical), ZIPData: archive, PayloadSHA256: hash, ZIPSize: int64(len(archive)), ExpandedSize: expanded}
+		if old.ID != 0 {
+			row.ID = old.ID
+			row.CreatedAt = old.CreatedAt
+			return tx.Save(&row).Error
+		}
+		return tx.Create(&row).Error
+	})
+	return m.Status, replayed, err
+}
+
+func (s *Service) FailureSnapshotSummaries(ctx context.Context, taskID uint64) ([]FailureSnapshotSummary, error) {
+	var rows []models.PurchaseFailureSnapshot
+	err := s.snapshotDB(ctx).Omit("zip_data", "manifest_json").Where("task_id = ? AND expires_at > ?", taskID, s.Now()).Order("id ASC").Find(&rows).Error
+	out := make([]FailureSnapshotSummary, 0, len(rows))
+	for _, r := range rows {
+		var reasons []string
+		_ = json.Unmarshal([]byte(r.ReasonsJSON), &reasons)
+		out = append(out, FailureSnapshotSummary{AttemptID: r.AttemptID, Phase: r.Phase, Status: r.Status, Source: r.Source, ErrorCode: r.ErrorCode, AgentVersion: r.AgentVersion, CapturedAt: r.CapturedAt, RecordedAt: r.RecordedAt, ExpiresAt: r.ExpiresAt, Partial: r.Status == "partial", Reasons: reasons, DownloadAvailable: r.ZIPSize > 0, ZIPSize: r.ZIPSize})
+	}
+	return out, err
+}
+
+func (s *Service) DownloadFailureSnapshot(ctx context.Context, taskID uint64, attemptID string) ([]byte, error) {
+	var row models.PurchaseFailureSnapshot
+	err := s.snapshotDB(ctx).Select("zip_data").Where("task_id = ? AND attempt_id = ? AND expires_at > ? AND zip_size > 0", taskID, attemptID, s.Now()).First(&row).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, snapshotFailure(404, "FAILURE_SNAPSHOT_NOT_FOUND")
+	}
+	return row.ZIPData, err
+}
+
+func (s *Service) CleanupFailureSnapshots(ctx context.Context) error {
+	return s.snapshotDB(ctx).Where("expires_at <= ?", s.Now()).Delete(&models.PurchaseFailureSnapshot{}).Error
+}
+
+// Starts independently of task execution, including on servers with no new work.
+func RunFailureSnapshotCleanup(ctx context.Context, s *Service, interval time.Duration, onError func(error)) {
+	if interval <= 0 {
+		interval = time.Hour
+	}
+	clean := func() {
+		if err := s.CleanupFailureSnapshots(ctx); err != nil && ctx.Err() == nil && onError != nil {
+			onError(errors.New("failure snapshot cleanup failed"))
+		}
+	}
+	clean()
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			clean()
+		}
+	}
+}

server/app/goauto/purchase/failure_snapshot_android_contract_test.go

@@ -0,0 +1,35 @@
+package purchase
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// The Android JVM exporter writes only synthetic data when this opt-in path is
+// set. Consume its actual bytes rather than reconstructing a second Go fixture.
+func TestFailureSnapshotAndroidExporterContract(t *testing.T) {
+	dir := os.Getenv("GOAUTO_DIAGNOSTIC_FIXTURE_DIR")
+	if dir == "" {
+		t.Skip("set GOAUTO_DIAGNOSTIC_FIXTURE_DIR to the Android synthetic fixture output")
+	}
+	raw, err := os.ReadFile(filepath.Join(dir, "manifest.json"))
+	if err != nil {
+		t.Fatal("Android manifest fixture unavailable")
+	}
+	archive, err := os.ReadFile(filepath.Join(dir, "archive.zip"))
+	if err != nil {
+		t.Fatal("Android archive fixture unavailable")
+	}
+	metadata, err := decodeSnapshotMetadata(raw)
+	if err != nil {
+		t.Fatalf("Android metadata rejected: %v", err)
+	}
+	if err := validateSnapshotMetadata(metadata, metadata.RecordedAt.Add(time.Second)); err != nil {
+		t.Fatalf("Android metadata contract rejected: %v", err)
+	}
+	if _, err := validateFailureArchive(metadata, raw, archive); err != nil {
+		t.Fatalf("Android generated archive rejected: %v", err)
+	}
+}

server/app/goauto/purchase/failure_snapshot_archive.go

@@ -0,0 +1,371 @@
+package purchase
+
+import (
+	"archive/zip"
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/xml"
+	"errors"
+	"io"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var snapshotReasons = map[string]bool{
+	"rule_hash_invalid": true, "execution_not_entered": true, "accessibility_unavailable": true, "process_interrupted": true,
+	"windows_unavailable": true, "windows_unsupported": true, "window_root_null": true, "window_disappeared": true,
+	"window_read_error": true, "node_read_error": true, "attribute_unsupported": true, "node_limit": true, "time_limit": true,
+	"expanded_size_limit": true, "archive_size_limit": true, "capture_failed": true,
+}
+
+func validateSnapshotMetadata(m FailureSnapshotMetadata, now time.Time) error {
+	if m.SchemaVersion != 1 || m.AttributeVersion != 1 || m.TaskID == 0 || m.DeviceID == 0 || (m.Phase != "purchase" && m.Phase != "spec_probe") || (m.Source != "execution" && m.Source != "recovery") || !snapshotCodePattern.MatchString(m.ErrorCode) || !snapshotVersionPattern.MatchString(m.AgentVersion) {
+		return invalidSnapshot()
+	}
+	if m.RecordedAt.IsZero() || m.RecordedAt.After(now.Add(5*time.Minute)) {
+		return invalidSnapshot()
+	}
+	_, offset := m.RecordedAt.Zone()
+	if offset != 0 {
+		return invalidSnapshot()
+	}
+	if m.CapturedAt != nil {
+		_, offset = m.CapturedAt.Zone()
+		if offset != 0 || m.CapturedAt.IsZero() || m.CapturedAt.After(m.RecordedAt) || m.CapturedAt.Before(m.RecordedAt.Add(-5*time.Minute)) {
+			return invalidSnapshot()
+		}
+	}
+	seen := map[string]bool{}
+	for _, r := range m.Reasons {
+		if !snapshotReasons[r] || seen[r] {
+			return invalidSnapshot()
+		}
+		seen[r] = true
+	}
+	if m.Reasons == nil || m.Windows == nil || len(m.Windows) > 128 {
+		return invalidSnapshot()
+	}
+	if m.RuleSnapshotHashValid {
+		if m.RuleSnapshotHash == nil || !snapshotHashPattern.MatchString(*m.RuleSnapshotHash) {
+			return invalidSnapshot()
+		}
+	} else if m.RuleSnapshotHash != nil || m.Status != "not_captured" || !seen["rule_hash_invalid"] {
+		return invalidSnapshot()
+	}
+	switch m.Status {
+	case "complete":
+		if m.CapturedAt == nil || len(m.Reasons) > 0 {
+			return invalidSnapshot()
+		}
+	case "partial":
+		if m.CapturedAt == nil || len(m.Reasons) == 0 {
+			return invalidSnapshot()
+		}
+	case "not_captured":
+		if m.CapturedAt != nil || len(m.Reasons) == 0 {
+			return invalidSnapshot()
+		}
+	default:
+		return invalidSnapshot()
+	}
+	for _, raw := range m.Windows {
+		var w snapshotWindow
+		if json.Unmarshal(raw, &w) != nil || (m.Status == "complete" && (w.Status != "complete" || w.FileName == nil || len(w.Reasons) > 0)) {
+			return invalidSnapshot()
+		}
+	}
+	return nil
+}
+
+type snapshotWindow struct {
+	ID       *int     `json:"id"`
+	FileName *string  `json:"fileName"`
+	Status   string   `json:"status"`
+	Reasons  []string `json:"reasons"`
+}
+
+func snapshotWindowFiles(m FailureSnapshotMetadata) (map[string]bool, error) {
+	files := map[string]bool{}
+	ids := map[int]bool{}
+	for _, raw := range m.Windows {
+		var w snapshotWindow
+		if json.Unmarshal(raw, &w) != nil || (w.Status != "complete" && w.Status != "partial") {
+			return nil, invalidSnapshot()
+		}
+		if w.ID != nil {
+			if ids[*w.ID] {
+				return nil, invalidSnapshot()
+			}
+			ids[*w.ID] = true
+		}
+		for _, reason := range w.Reasons {
+			if !snapshotReasons[reason] {
+				return nil, invalidSnapshot()
+			}
+		}
+		if w.FileName == nil {
+			continue
+		}
+		if w.ID == nil || *w.FileName != "window-"+strconv.Itoa(*w.ID)+".xml" || files[*w.FileName] {
+			return nil, invalidSnapshot()
+		}
+		files[*w.FileName] = true
+	}
+	return files, nil
+}
+
+func validateFailureArchive(m FailureSnapshotMetadata, raw, archive []byte) (int64, error) {
+	files, err := snapshotWindowFiles(m)
+	if err != nil {
+		return 0, err
+	}
+	if len(archive) == 0 {
+		if m.Status != "not_captured" || len(files) > 0 {
+			return 0, invalidSnapshot()
+		}
+		return 0, nil
+	}
+	if m.Status == "not_captured" || len(files) == 0 || len(archive) > FailureSnapshotZIPLimit {
+		return 0, invalidSnapshot()
+	}
+	zr, err := zip.NewReader(bytes.NewReader(archive), int64(len(archive)))
+	if err != nil {
+		return 0, invalidSnapshot()
+	}
+	if len(zr.File) != len(files)+1 {
+		return 0, invalidSnapshot()
+	}
+	seen := map[string]bool{}
+	total := int64(0)
+	for _, f := range zr.File {
+		if seen[f.Name] || (f.Name != "manifest.json" && !files[f.Name]) || !f.Mode().IsRegular() || f.Flags&1 != 0 || (f.Method != zip.Store && f.Method != zip.Deflate) {
+			return 0, invalidSnapshot()
+		}
+		seen[f.Name] = true
+		if f.UncompressedSize64 > FailureSnapshotExpandedLimit || f.UncompressedSize64 > uint64(FailureSnapshotExpandedLimit-total) {
+			return 0, invalidSnapshot()
+		}
+		stream, e := f.Open()
+		if e != nil {
+			return 0, invalidSnapshot()
+		}
+		limit := int64(FailureSnapshotExpandedLimit) - total
+		if f.Name == "manifest.json" && limit > FailureSnapshotMetadataLimit {
+			limit = FailureSnapshotMetadataLimit
+		}
+		content, e := io.ReadAll(io.LimitReader(stream, limit+1))
+		closeErr := stream.Close()
+		if e != nil || closeErr != nil || int64(len(content)) > limit || uint64(len(content)) != f.UncompressedSize64 {
+			return 0, invalidSnapshot()
+		}
+		total += int64(len(content))
+		if f.Name == "manifest.json" {
+			if _, e = decodeSnapshotMetadata(content); e != nil {
+				return 0, invalidSnapshot()
+			}
+			left, le := canonicalSnapshotJSON(raw)
+			right, re := canonicalSnapshotJSON(content)
+			if le != nil || re != nil || !bytes.Equal(left, right) {
+				return 0, invalidSnapshot()
+			}
+		} else if e = validateFailureXML(content); e != nil {
+			return 0, e
+		}
+	}
+	if !seen["manifest.json"] {
+		return 0, invalidSnapshot()
+	}
+	return total, nil
+}
+
+func canonicalSnapshotJSON(raw []byte) ([]byte, error) {
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.UseNumber()
+	var v any
+	if err := d.Decode(&v); err != nil {
+		return nil, err
+	}
+	return json.Marshal(v)
+}
+
+// encoding/json otherwise accepts duplicate keys, allowing conflicting identity
+// or password-related metadata to be interpreted differently by other readers.
+func uniqueSnapshotJSON(raw []byte) error {
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.UseNumber()
+	var value func(int) error
+	value = func(depth int) error {
+		if depth > 64 {
+			return invalidSnapshot()
+		}
+		tok, err := d.Token()
+		if err != nil {
+			return invalidSnapshot()
+		}
+		delim, ok := tok.(json.Delim)
+		if !ok {
+			return nil
+		}
+		switch delim {
+		case '{':
+			seen := map[string]bool{}
+			for d.More() {
+				key, e := d.Token()
+				if e != nil {
+					return invalidSnapshot()
+				}
+				name, ok := key.(string)
+				if !ok || seen[name] {
+					return invalidSnapshot()
+				}
+				seen[name] = true
+				if e = value(depth + 1); e != nil {
+					return e
+				}
+			}
+		case '[':
+			for d.More() {
+				if e := value(depth + 1); e != nil {
+					return e
+				}
+			}
+		default:
+			return invalidSnapshot()
+		}
+		_, err = d.Token()
+		return err
+	}
+	if err := value(0); err != nil {
+		return invalidSnapshot()
+	}
+	if _, err := d.Token(); !errors.Is(err, io.EOF) {
+		return invalidSnapshot()
+	}
+	return nil
+}
+
+var snapshotXMLAttribute = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_-]*$`)
+var snapshotSecretAttributes = map[string]bool{"text": true, "content-desc": true, "contentDescription": true, "hint": true, "state-description": true, "stateDescription": true, "tooltip": true, "label": true}
+
+func validateFailureXML(raw []byte) error {
+	d := xml.NewDecoder(bytes.NewReader(raw))
+	d.Strict = true
+	type frame struct {
+		name     string
+		password bool
+	}
+	stack := []frame{}
+	roots := 0
+	nodes := 0
+	for {
+		token, err := d.Token()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return invalidSnapshot()
+		}
+		switch v := token.(type) {
+		case xml.Directive:
+			return invalidSnapshot()
+		case xml.ProcInst:
+			if v.Target != "xml" || roots != 0 {
+				return invalidSnapshot()
+			}
+		case xml.Comment:
+			return invalidSnapshot()
+		case xml.CharData:
+			if strings.TrimSpace(string(v)) != "" {
+				return invalidSnapshot()
+			}
+		case xml.StartElement:
+			if v.Name.Space != "" || len(stack) > 256 {
+				return invalidSnapshot()
+			}
+			if len(stack) == 0 {
+				roots++
+				if roots != 1 || v.Name.Local != "hierarchy" {
+					return invalidSnapshot()
+				}
+			} else {
+				parent := stack[len(stack)-1].name
+				if (v.Name.Local != "node" && v.Name.Local != "action") || parent == "action" || (v.Name.Local == "action" && parent != "node") {
+					return invalidSnapshot()
+				}
+			}
+			if v.Name.Local == "node" {
+				nodes++
+				if nodes > 5000 {
+					return invalidSnapshot()
+				}
+			}
+			// A missing/unreadable password flag cannot establish that content is
+			// safe to retain. Only an explicit false on the node opens that gate.
+			secret := v.Name.Local == "node"
+			if len(stack) > 0 && v.Name.Local == "action" {
+				secret = stack[len(stack)-1].password
+			}
+			passwordState := false
+			for _, a := range v.Attr {
+				if v.Name.Local == "node" && a.Name.Local == "password" && a.Value == "false" {
+					secret = false
+				}
+				if a.Name.Local == "password" && strings.EqualFold(a.Value, "true") {
+					secret = true
+				}
+				if a.Name.Local == "password-state" {
+					passwordState = true
+				}
+				if a.Name.Local == "password-base64" || (a.Name.Local == "password" && a.Value != "true" && a.Value != "false") {
+					return invalidSnapshot()
+				}
+			}
+			secret = secret || passwordState
+			attrs := map[string]string{}
+			for _, a := range v.Attr {
+				if a.Name.Space != "" || !snapshotXMLAttribute.MatchString(a.Name.Local) {
+					return invalidSnapshot()
+				}
+				name := a.Name.Local
+				if _, ok := attrs[name]; ok {
+					return invalidSnapshot()
+				}
+				attrs[name] = a.Value
+				base := strings.TrimSuffix(strings.TrimSuffix(name, "-state"), "-base64")
+				if secret && snapshotSecretAttributes[base] {
+					return invalidSnapshot()
+				}
+				if strings.HasSuffix(name, "-state") && a.Value != "null" && a.Value != "unsupported" && a.Value != "read_error" {
+					return invalidSnapshot()
+				}
+				if strings.HasSuffix(name, "-base64") {
+					decoded, e := base64.StdEncoding.Strict().DecodeString(a.Value)
+					if e != nil || len(decoded)%2 != 0 {
+						return invalidSnapshot()
+					}
+				}
+			}
+			for name := range attrs {
+				if strings.HasSuffix(name, "-base64") || strings.HasSuffix(name, "-state") {
+					base := strings.TrimSuffix(strings.TrimSuffix(name, "-state"), "-base64")
+					if _, ok := attrs[base]; ok {
+						return invalidSnapshot()
+					}
+				}
+			}
+			stack = append(stack, frame{v.Name.Local, secret})
+		case xml.EndElement:
+			if len(stack) == 0 {
+				return invalidSnapshot()
+			}
+			stack = stack[:len(stack)-1]
+		}
+	}
+	if roots != 1 || len(stack) != 0 {
+		return invalidSnapshot()
+	}
+	return nil
+}

server/app/goauto/purchase/failure_snapshot_handler.go

@@ -0,0 +1,158 @@
+package purchase
+
+import (
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
+	"github.com/google/uuid"
+	"go-admin/app/goauto/device"
+	"go-admin/common/clientprincipal"
+)
+
+func (h Handler) UploadFailureSnapshot(c *gin.Context) {
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	// Authenticate before reading an untrusted archive.
+	if _, err := device.NewService(s.snapshotDB(c.Request.Context())).Authenticate(c.Request.Context(), bearer(c.GetHeader("Authorization"))); err != nil {
+		writeError(c, err)
+		return
+	}
+	taskID, ok := pathID(c)
+	if !ok {
+		return
+	}
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, FailureSnapshotZIPLimit+FailureSnapshotMetadataLimit+(16<<10))
+	reader, err := c.Request.MultipartReader()
+	if err != nil {
+		writeSnapshotError(c, invalidSnapshot())
+		return
+	}
+	var metadata, archive []byte
+	seen := map[string]bool{}
+	for {
+		part, e := reader.NextPart()
+		if errors.Is(e, io.EOF) {
+			break
+		}
+		if e != nil {
+			var tooLarge *http.MaxBytesError
+			if errors.As(e, &tooLarge) {
+				writeSnapshotError(c, snapshotFailure(413, "FAILURE_SNAPSHOT_TOO_LARGE"))
+			} else {
+				writeSnapshotError(c, invalidSnapshot())
+			}
+			return
+		}
+		name := part.FormName()
+		limit := int64(FailureSnapshotMetadataLimit)
+		if name == "archive" {
+			limit = FailureSnapshotZIPLimit
+		} else if name != "metadata" {
+			part.Close()
+			writeSnapshotError(c, invalidSnapshot())
+			return
+		}
+		if seen[name] {
+			part.Close()
+			writeSnapshotError(c, invalidSnapshot())
+			return
+		}
+		seen[name] = true
+		raw, e := io.ReadAll(io.LimitReader(part, limit+1))
+		part.Close()
+		if e != nil || int64(len(raw)) > limit {
+			writeSnapshotError(c, snapshotFailure(413, "FAILURE_SNAPSHOT_TOO_LARGE"))
+			return
+		}
+		if name == "metadata" {
+			metadata = raw
+		} else {
+			archive = raw
+		}
+	}
+	if seen["archive"] && len(archive) == 0 {
+		writeSnapshotError(c, invalidSnapshot())
+		return
+	}
+	status, replayed, err := s.UploadFailureSnapshot(c.Request.Context(), taskID, c.Param("attemptId"), bearer(c.GetHeader("Authorization")), metadata, archive)
+	if err != nil {
+		writeSnapshotError(c, err)
+		return
+	}
+	c.Header("Cache-Control", "no-store")
+	c.JSON(200, gin.H{"data": gin.H{"taskAttemptId": c.Param("attemptId"), "status": status, "replayed": replayed}})
+}
+
+func snapshotAdminOnly(c *gin.Context) bool {
+	_, client := clientprincipal.Get(c)
+	role, _ := jwt.ExtractClaims(c)["rolekey"].(string)
+	if !client && role == "admin" {
+		return true
+	}
+	c.AbortWithStatusJSON(403, gin.H{"code": "FORBIDDEN", "message": "仅管理员可访问现场诊断"})
+	return false
+}
+
+func (h Handler) FailureSnapshotSummaries(c *gin.Context) {
+	if !snapshotAdminOnly(c) {
+		return
+	}
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	items, err := s.FailureSnapshotSummaries(c.Request.Context(), id)
+	if err != nil {
+		writeSnapshotError(c, err)
+		return
+	}
+	c.Header("Cache-Control", "no-store")
+	writeAdminData(c, gin.H{"items": items})
+}
+
+func (h Handler) DownloadFailureSnapshot(c *gin.Context) {
+	if !snapshotAdminOnly(c) {
+		return
+	}
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	attempt, err := uuid.Parse(c.Param("attemptId"))
+	if err != nil || attempt.String() != c.Param("attemptId") {
+		writeSnapshotError(c, invalidSnapshot())
+		return
+	}
+	s, ok := h.service(c)
+	if !ok {
+		return
+	}
+	raw, err := s.DownloadFailureSnapshot(c.Request.Context(), id, attempt.String())
+	if err != nil {
+		writeSnapshotError(c, err)
+		return
+	}
+	c.Header("Cache-Control", "no-store")
+	c.Header("X-Content-Type-Options", "nosniff")
+	c.Header("Content-Disposition", `attachment; filename="purchase-`+strconv.FormatUint(id, 10)+`-`+attempt.String()+`.zip"`)
+	c.Data(200, "application/zip", raw)
+}
+
+func writeSnapshotError(c *gin.Context, err error) {
+	var e *snapshotError
+	if errors.As(err, &e) {
+		c.JSON(e.status, gin.H{"code": e.code, "message": "现场诊断请求未被接受", "retryable": false})
+		return
+	}
+	writeError(c, err)
+}

server/app/goauto/purchase/failure_snapshot_quality_test.go

@@ -0,0 +1,133 @@
+package purchase
+
+import (
+	"archive/zip"
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestFailureSnapshotMissingPasswordFlagRejectsContents(t *testing.T) {
+	for _, raw := range []string{
+		`<hierarchy><node text="secret"/></hierarchy>`,
+		`<hierarchy><node text-base64="AHMAZQBjAHIAZQB0"/></hierarchy>`,
+		`<hierarchy><node><action id="1" label="secret"/></node></hierarchy>`,
+		`<hierarchy><node><action id="1" password="false" label="secret"/></node></hierarchy>`,
+	} {
+		if validateFailureXML([]byte(raw)) == nil {
+			t.Errorf("missing password flag retained content: %s", raw)
+		}
+	}
+	for _, raw := range []string{
+		`<hierarchy><node password="false" text="public"><action id="1" label="public"/></node></hierarchy>`,
+		`<hierarchy><node password="false" text-base64="AGE="/></hierarchy>`,
+		`<hierarchy><node path="0" child-count-state="read_error" actions-state="read_error"><action id="1"/></node></hierarchy>`,
+	} {
+		if err := validateFailureXML([]byte(raw)); err != nil {
+			t.Fatalf("safe structure or explicit non-password rejected: %v", err)
+		}
+	}
+}
+
+func exactSnapshotZIP(t *testing.T, m FailureSnapshotMetadata, size int) []byte {
+	t.Helper()
+	makeZIP := func(padding int) []byte {
+		var b bytes.Buffer
+		w := zip.NewWriter(&b)
+		raw, _ := json.Marshal(m)
+		for _, entry := range []struct {
+			name string
+			data []byte
+		}{{"manifest.json", raw}, {"window-1.xml", []byte(`<hierarchy><node password="false" text="` + strings.Repeat("x", padding) + `"/></hierarchy>`)}} {
+			part, err := w.CreateHeader(&zip.FileHeader{Name: entry.name, Method: zip.Store})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if _, err = part.Write(entry.data); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := w.Close(); err != nil {
+			t.Fatal(err)
+		}
+		return b.Bytes()
+	}
+	base := makeZIP(0)
+	if size < len(base) {
+		t.Fatal("requested archive size too small")
+	}
+	result := makeZIP(size - len(base))
+	if len(result) != size {
+		t.Fatalf("ZIP fixture size=%d want=%d", len(result), size)
+	}
+	return result
+}
+
+func TestFailureSnapshotHTTPMultipartLimits(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	for _, tc := range []struct {
+		name                      string
+		metadataSize, archiveSize int
+		oversizedPreamble         bool
+		want                      int
+	}{
+		{name: "metadata_exact_64KiB", metadataSize: FailureSnapshotMetadataLimit, want: 200},
+		{name: "metadata_64KiB_plus_one", metadataSize: FailureSnapshotMetadataLimit + 1, want: 413},
+		{name: "archive_exact_2MiB", archiveSize: FailureSnapshotZIPLimit, want: 200},
+		{name: "archive_2MiB_plus_one", archiveSize: FailureSnapshotZIPLimit + 1, want: 413},
+		{name: "whole_body_exceeded_in_next_part", oversizedPreamble: true, want: 413},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s, f, a, m := snapshotFixture(t)
+			m.RecordedAt = time.Now().UTC()
+			var archive []byte
+			if tc.archiveSize > 0 {
+				m = capturedMetadata(m)
+				archive = exactSnapshotZIP(t, m, tc.archiveSize)
+			}
+			raw, _ := json.Marshal(m)
+			if tc.metadataSize > 0 {
+				raw = append(raw, bytes.Repeat([]byte(" "), tc.metadataSize-len(raw))...)
+			}
+			var body bytes.Buffer
+			mw := multipart.NewWriter(&body)
+			if tc.oversizedPreamble {
+				limit := FailureSnapshotMetadataLimit + FailureSnapshotZIPLimit + (16 << 10)
+				body.WriteString(strings.Repeat("ignored-preamble\r\n", limit/18+2))
+			}
+			if err := mw.WriteField("metadata", string(raw)); err != nil {
+				t.Fatal(err)
+			}
+			if archive != nil {
+				part, err := mw.CreateFormFile("archive", "synthetic.zip")
+				if err != nil {
+					t.Fatal(err)
+				}
+				if _, err = io.Copy(part, bytes.NewReader(archive)); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if err := mw.Close(); err != nil {
+				t.Fatal(err)
+			}
+			r := gin.New()
+			r.POST("/:taskId/attempts/:attemptId/failure-snapshot", (Handler{DB: s.DB}).UploadFailureSnapshot)
+			req := httptest.NewRequest("POST", fmt.Sprintf("/%d/attempts/%s/failure-snapshot", a.TaskID, a.AttemptID), &body)
+			req.Header.Set("Content-Type", mw.FormDataContentType())
+			req.Header.Set("Authorization", "Bearer "+f.token)
+			w := httptest.NewRecorder()
+			r.ServeHTTP(w, req)
+			if w.Code != tc.want {
+				t.Fatalf("status=%d want=%d body=%s", w.Code, tc.want, w.Body.String())
+			}
+		})
+	}
+}

server/app/goauto/purchase/failure_snapshot_test.go

@@ -0,0 +1,507 @@
+package purchase
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"github.com/gin-gonic/gin"
+	jwt "github.com/go-admin-team/go-admin-core/sdk/pkg/jwtauth"
+	"github.com/google/uuid"
+	"go-admin/app/goauto/access"
+	"go-admin/app/goauto/models"
+	"go-admin/common/clientprincipal"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+	"log"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestFailureSnapshotDedicatedRoutesAndPrivateSchema(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	InitRouter(r, &jwt.GinJWTMiddleware{})
+	expected := map[string]bool{
+		"POST /api/agent/v1/purchase-tasks/:taskId/attempts/:attemptId/failure-snapshot":         false,
+		"GET /api/admin/v1/purchase-tasks/:taskId/failure-snapshots":                             false,
+		"GET /api/admin/v1/purchase-tasks/:taskId/attempts/:attemptId/failure-snapshot/download": false,
+	}
+	for _, route := range r.Routes() {
+		key := route.Method + " " + route.Path
+		if _, ok := expected[key]; ok {
+			expected[key] = true
+		}
+	}
+	for route, found := range expected {
+		if !found {
+			t.Errorf("dedicated snapshot route missing: %s", route)
+		}
+	}
+	for _, path := range []string{"/api/admin/v1/purchase-tasks/:taskId/failure-snapshots", "/api/admin/v1/purchase-tasks/:taskId/attempts/:attemptId/failure-snapshot/download"} {
+		found := false
+		for _, p := range access.AdminAPIs {
+			if p.Path == path && p.Method == "GET" {
+				found = true
+				if p.Purchaser {
+					t.Error("snapshot permission leaked to purchaser")
+				}
+			}
+		}
+		if !found {
+			t.Errorf("admin-only permission missing: %s", path)
+		}
+	}
+	db := testDB(t)
+	if !db.Migrator().HasTable("purchase_failure_snapshot") {
+		t.Error("private snapshot table missing from fresh schema")
+	}
+}
+
+func snapshotFixture(t *testing.T) (*Service, fixture, models.PurchaseTaskAttempt, FailureSnapshotMetadata) {
+	t.Helper()
+	db := testDB(t)
+	f := seed(t, db, liveCaps(), true)
+	s := testService(db)
+	task := backfillTask(t, db, f, models.PurchaseTaskStatusFailed)
+	hash := strings.Repeat("a", 64)
+	a := models.PurchaseTaskAttempt{TaskID: task.ID, AttemptID: uuid.NewString(), AttemptNumber: 1, Phase: "purchase", Status: "failed", DeviceID: &f.device.ID, RuleSnapshotHash: hash, SpecDecisionSnapshot: "{}"}
+	if err := db.Create(&a).Error; err != nil {
+		t.Fatal(err)
+	}
+	m := FailureSnapshotMetadata{SchemaVersion: 1, AttributeVersion: 1, TaskID: task.ID, DeviceID: f.device.ID, TaskAttemptID: a.AttemptID, Phase: a.Phase, RuleSnapshotHash: &hash, RuleSnapshotHashValid: true, ErrorCode: "PURCHASE_ORDER_CONTEXT_NOT_FOUND", AgentVersion: "0.9.65", RecordedAt: s.Now(), Source: "execution", Status: "not_captured", Reasons: []string{"process_interrupted"}, Windows: []json.RawMessage{}}
+	return s, f, a, m
+}
+
+func uploadSnapshot(t *testing.T, s *Service, f fixture, m FailureSnapshotMetadata, archive []byte) (bool, error) {
+	t.Helper()
+	raw, _ := json.Marshal(m)
+	_, replay, err := s.UploadFailureSnapshot(context.Background(), m.TaskID, m.TaskAttemptID, f.token, raw, archive)
+	return replay, err
+}
+
+func snapshotZIP(t *testing.T, m FailureSnapshotMetadata, xml string, extra map[string]string) []byte {
+	t.Helper()
+	var b bytes.Buffer
+	w := zip.NewWriter(&b)
+	raw, _ := json.Marshal(m)
+	p, _ := w.Create("manifest.json")
+	p.Write(raw)
+	if xml != "" {
+		p, _ = w.Create("window-1.xml")
+		p.Write([]byte(xml))
+	}
+	for n, v := range extra {
+		p, _ = w.Create(n)
+		p.Write([]byte(v))
+	}
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return b.Bytes()
+}
+
+func capturedMetadata(m FailureSnapshotMetadata) FailureSnapshotMetadata {
+	m.Status = "complete"
+	m.Source = "recovery"
+	m.CapturedAt = &m.RecordedAt
+	m.Reasons = []string{}
+	m.Windows = []json.RawMessage{json.RawMessage(`{"id":1,"fileName":"window-1.xml","status":"complete","reasons":[]}`)}
+	return m
+}
+
+func TestFailureSnapshotNoCaptureReplayUpgradeAndImmutableZIP(t *testing.T) {
+	s, f, a, m := snapshotFixture(t)
+	if replay, err := uploadSnapshot(t, s, f, m, nil); err != nil || replay {
+		t.Fatalf("initial: replay=%v err=%v", replay, err)
+	}
+	if replay, err := uploadSnapshot(t, s, f, m, nil); err != nil || !replay {
+		t.Fatalf("replay: replay=%v err=%v", replay, err)
+	}
+	// Current task ownership/hash may change after reset; attempt remains authority.
+	if err := s.DB.Table("purchase_task").Where("id = ?", a.TaskID).Updates(map[string]any{"device_id": nil, "rule_snapshot": "{}"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	m = capturedMetadata(m)
+	archive := snapshotZIP(t, m, `<hierarchy><node password="false" text="SYNTHETIC_PRIVATE"/></hierarchy>`, nil)
+	if _, err := uploadSnapshot(t, s, f, m, archive); err != nil {
+		t.Fatal(err)
+	}
+	if replay, err := uploadSnapshot(t, s, f, m, archive); err != nil || !replay {
+		t.Fatalf("ZIP replay: %v %v", replay, err)
+	}
+	other := snapshotZIP(t, m, `<hierarchy><node password="false" text="OTHER"/></hierarchy>`, nil)
+	if _, err := uploadSnapshot(t, s, f, m, other); err == nil {
+		t.Fatal("ZIP overwritten")
+	}
+	raw, err := s.DownloadFailureSnapshot(context.Background(), a.TaskID, a.AttemptID)
+	if err != nil || !bytes.Equal(raw, archive) {
+		t.Fatalf("original lost: err=%v bytes=%d expected=%d", err, len(raw), len(archive))
+	}
+	views, err := s.FailureSnapshotSummaries(context.Background(), a.TaskID)
+	if err != nil || len(views) != 1 || !views[0].DownloadAvailable {
+		t.Fatal("summary missing")
+	}
+	out, _ := json.Marshal(views)
+	if bytes.Contains(out, []byte("SYNTHETIC_PRIVATE")) || bytes.Contains(out, []byte("windows")) {
+		t.Fatal("summary leak")
+	}
+	var row models.PurchaseFailureSnapshot
+	s.DB.First(&row)
+	out, _ = json.Marshal(row)
+	if string(out) != "{}" {
+		t.Fatal("model has public fields")
+	}
+}
+
+func TestFailureSnapshotOwnershipHashPhaseAndSuccessfulAttempt(t *testing.T) {
+	for _, kind := range []string{"device", "task", "attempt", "phase", "hash", "success", "expired", "future", "invalid_hash_zip"} {
+		t.Run(kind, func(t *testing.T) {
+			s, f, a, m := snapshotFixture(t)
+			switch kind {
+			case "device":
+				m.DeviceID++
+			case "task":
+				m.TaskID++
+			case "attempt":
+				m.TaskAttemptID = uuid.NewString()
+			case "phase":
+				m.Phase = "spec_probe"
+			case "hash":
+				h := strings.Repeat("b", 64)
+				m.RuleSnapshotHash = &h
+			case "success":
+				s.DB.Model(&a).Updates(map[string]any{"result_type": "order_created", "status": "completed"})
+			case "expired":
+				m.RecordedAt = m.RecordedAt.Add(-FailureSnapshotRetention)
+			case "future":
+				m.RecordedAt = m.RecordedAt.Add(time.Hour)
+			case "invalid_hash_zip":
+				m = capturedMetadata(m)
+				m.RuleSnapshotHashValid = false
+				m.RuleSnapshotHash = nil
+			}
+			if _, err := uploadSnapshot(t, s, f, m, nil); err == nil {
+				t.Fatalf("accepted %s", kind)
+			}
+			var count int64
+			s.DB.Model(&models.PurchaseFailureSnapshot{}).Count(&count)
+			if count != 0 {
+				t.Fatal("rejected request persisted")
+			}
+		})
+	}
+}
+
+func TestFailureSnapshotDedicatedAdminGuard(t *testing.T) {
+	for _, role := range []string{"admin", "purchaser", "after_sales", ""} {
+		w := httptest.NewRecorder()
+		c, _ := gin.CreateTestContext(w)
+		c.Set("JWT_PAYLOAD", jwt.MapClaims{"rolekey": role})
+		if got := snapshotAdminOnly(c); got != (role == "admin") {
+			t.Fatalf("role %s", role)
+		}
+	}
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Set("JWT_PAYLOAD", jwt.MapClaims{"rolekey": "admin"})
+	clientprincipal.Set(c, clientprincipal.Identity{KeyID: 1})
+	if snapshotAdminOnly(c) {
+		t.Fatal("client key accepted")
+	}
+}
+
+func TestFailureSnapshotServerDemotionStillAcceptsDiagnostic(t *testing.T) {
+	s, f, a, m := snapshotFixture(t)
+	s.DB.Model(&a).Update("result_type", "order_created")
+	if _, err := uploadSnapshot(t, s, f, m, nil); err != nil {
+		t.Fatalf("demoted failed attempt rejected: %v", err)
+	}
+}
+
+func TestFailureSnapshotSemanticReplayAndDuplicateJSON(t *testing.T) {
+	s, f, _, m := snapshotFixture(t)
+	m = capturedMetadata(m)
+	archive := snapshotZIP(t, m, `<hierarchy/>`, nil)
+	if _, err := uploadSnapshot(t, s, f, m, archive); err != nil {
+		t.Fatal(err)
+	}
+	m.Windows = []json.RawMessage{json.RawMessage(`{"status":"complete","fileName":"window-1.xml","id":1,"reasons":[]}`)}
+	if replay, err := uploadSnapshot(t, s, f, m, archive); err != nil || !replay {
+		t.Fatalf("semantic replay: %v %v", replay, err)
+	}
+	raw, _ := json.Marshal(m)
+	raw = append([]byte(`{"status":"not_captured",`), raw[1:]...)
+	if _, err := decodeSnapshotMetadata(raw); err == nil {
+		t.Fatal("duplicate JSON key accepted")
+	}
+}
+
+func TestFailureSnapshotHTTPIsolationMultipartAndDownload(t *testing.T) {
+	s, f, a, m := snapshotFixture(t)
+	m.RecordedAt = time.Now().UTC()
+	m = capturedMetadata(m)
+	archive := snapshotZIP(t, m, `<hierarchy><node password="false" text="PRIVATE_FIXTURE"/></hierarchy>`, nil)
+	h := Handler{DB: s.DB}
+	r := gin.New()
+	r.POST("/:taskId/attempts/:attemptId/failure-snapshot", h.UploadFailureSnapshot)
+	for _, tc := range []struct {
+		name, token string
+		duplicate   bool
+		want        int
+	}{{"missing_token", "", false, 401}, {"ok", f.token, false, 200}, {"duplicate", f.token, true, 422}} {
+		t.Run(tc.name, func(t *testing.T) {
+			var b bytes.Buffer
+			mw := multipart.NewWriter(&b)
+			raw, _ := json.Marshal(m)
+			mw.WriteField("metadata", string(raw))
+			if tc.duplicate {
+				mw.WriteField("metadata", string(raw))
+			}
+			p, _ := mw.CreateFormFile("archive", "snapshot.zip")
+			p.Write(archive)
+			mw.Close()
+			req := httptest.NewRequest("POST", fmt.Sprintf("/%d/attempts/%s/failure-snapshot", a.TaskID, a.AttemptID), &b)
+			req.Header.Set("Content-Type", mw.FormDataContentType())
+			req.Header.Set("Authorization", "Bearer "+tc.token)
+			w := httptest.NewRecorder()
+			r.ServeHTTP(w, req)
+			if w.Code != tc.want {
+				t.Fatalf("status %d body %s", w.Code, w.Body.String())
+			}
+			if strings.Contains(w.Body.String(), "PRIVATE_FIXTURE") {
+				t.Fatal("HTTP leak")
+			}
+		})
+	}
+	for _, role := range []string{"admin", "purchaser", "after_sales"} {
+		router := gin.New()
+		router.Use(func(c *gin.Context) { c.Set("JWT_PAYLOAD", jwt.MapClaims{"rolekey": role}) })
+		router.GET("/:taskId/failure-snapshots", h.FailureSnapshotSummaries)
+		router.GET("/:taskId/attempts/:attemptId/download", h.DownloadFailureSnapshot)
+		for _, suffix := range []string{"failure-snapshots", "attempts/" + a.AttemptID + "/download"} {
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, httptest.NewRequest(http.MethodGet, fmt.Sprintf("/%d/%s", a.TaskID, suffix), nil))
+			if role != "admin" {
+				if w.Code != 403 {
+					t.Fatalf("%s: %d", role, w.Code)
+				}
+			} else {
+				if w.Code != 200 {
+					t.Fatalf("admin %s: %d %s", suffix, w.Code, w.Body.String())
+				}
+				if strings.HasSuffix(suffix, "download") {
+					if w.Header().Get("Content-Type") != "application/zip" || !bytes.Equal(w.Body.Bytes(), archive) || w.Header().Get("Cache-Control") != "no-store" {
+						t.Fatal("download contract")
+					}
+				} else if strings.Contains(w.Body.String(), "PRIVATE_FIXTURE") || strings.Contains(w.Body.String(), "manifest") {
+					t.Fatal("metadata leak")
+				}
+			}
+		}
+	}
+}
+
+func TestFailureSnapshotArchiveValidation(t *testing.T) {
+	_, _, _, base := snapshotFixture(t)
+	m := capturedMetadata(base)
+	raw, _ := json.Marshal(m)
+	for _, tc := range []struct {
+		name, xml string
+		extra     map[string]string
+	}{
+		{"doctype", `<!DOCTYPE hierarchy [<!ENTITY x "private">]><hierarchy/>`, nil},
+		{"multiple_roots", `<hierarchy/><hierarchy/>`, nil},
+		{"password_text", `<hierarchy><node password="true" text="secret"/></hierarchy>`, nil},
+		{"password_description", `<hierarchy><node password="true" content-desc="secret"/></hierarchy>`, nil},
+		{"password_action", `<hierarchy><node password="true"><action id="1" label="secret"/></node></hierarchy>`, nil},
+		{"traversal", `<hierarchy/>`, map[string]string{"../outside.xml": "x"}},
+		{"unknown_file", `<hierarchy/>`, map[string]string{"extra.xml": "x"}},
+		{"expanded_limit", "<hierarchy>" + strings.Repeat(" ", FailureSnapshotExpandedLimit) + "</hierarchy>", nil},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			archive := snapshotZIP(t, m, tc.xml, tc.extra)
+			if _, err := validateFailureArchive(m, raw, archive); err == nil {
+				t.Fatal("unsafe archive accepted")
+			}
+		})
+	}
+	valid := snapshotZIP(t, m, `<hierarchy><node text="a&amp;b😀" password="false"/></hierarchy>`, nil)
+	if _, err := validateFailureArchive(m, raw, valid); err != nil {
+		t.Fatal(err)
+	}
+	wrong := m
+	wrong.TaskID++
+	bad := snapshotZIP(t, wrong, `<hierarchy/>`, nil)
+	if _, err := validateFailureArchive(m, raw, bad); err == nil {
+		t.Fatal("wrong manifest accepted")
+	}
+}
+
+func TestFailureSnapshotExpiryAndIdleCleanup(t *testing.T) {
+	s, f, a, m := snapshotFixture(t)
+	if _, err := uploadSnapshot(t, s, f, m, nil); err != nil {
+		t.Fatal(err)
+	}
+	now := s.Now().Add(FailureSnapshotRetention)
+	s.Now = func() time.Time { return now }
+	if _, err := uploadSnapshot(t, s, f, m, nil); err == nil {
+		t.Fatal("expired replay accepted")
+	} else {
+		var e *snapshotError
+		if !errors.As(err, &e) || e.status != 410 {
+			t.Fatal(err)
+		}
+	}
+	views, err := s.FailureSnapshotSummaries(context.Background(), a.TaskID)
+	if err != nil || len(views) != 0 {
+		t.Fatal("expired summary visible")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	RunFailureSnapshotCleanup(ctx, s, time.Millisecond, nil)
+	// Exercise actual idle ticker independently of upload traffic.
+	ctx, cancel = context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() { RunFailureSnapshotCleanup(ctx, s, time.Millisecond, nil); close(done) }()
+	deadline := time.Now().Add(time.Second)
+	for time.Now().Before(deadline) {
+		var count int64
+		s.DB.Model(&models.PurchaseFailureSnapshot{}).Count(&count)
+		if count == 0 {
+			cancel()
+			<-done
+			return
+		}
+		time.Sleep(time.Millisecond)
+	}
+	cancel()
+	<-done
+	t.Fatal("idle cleanup did not run")
+}
+
+func TestFailureSnapshotSQLAndOrdinaryViewsDoNotLeak(t *testing.T) {
+	s, f, a, m := snapshotFixture(t)
+	var logs bytes.Buffer
+	s.DB = s.DB.Session(&gorm.Session{Logger: logger.New(log.New(&logs, "", 0), logger.Config{LogLevel: logger.Info})})
+	if _, err := uploadSnapshot(t, s, f, m, nil); err != nil {
+		t.Fatal(err)
+	}
+	m = capturedMetadata(m)
+	m.Windows = []json.RawMessage{json.RawMessage(`{"id":1,"fileName":"window-1.xml","status":"complete","reasons":[],"title":"PRIVATE_WINDOW_SENTINEL"}`)}
+	archive := snapshotZIP(t, m, `<hierarchy><node password="false" text="PRIVATE_NODE_SENTINEL"/></hierarchy>`, nil)
+	// Force a private-table persistence error after validation. The SQL must stay silent.
+	s.DB.Exec("CREATE TRIGGER reject_snapshot_update BEFORE UPDATE ON purchase_failure_snapshot BEGIN SELECT RAISE(FAIL, 'synthetic'); END")
+	if _, err := uploadSnapshot(t, s, f, m, archive); err == nil {
+		t.Fatal("synthetic write failure did not happen")
+	}
+	s.DB.Exec("DROP TRIGGER reject_snapshot_update")
+	if _, err := uploadSnapshot(t, s, f, m, archive); err != nil {
+		t.Fatal(err)
+	}
+	detail, err := s.AdminDetail(context.Background(), a.TaskID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := json.Marshal(detail)
+	if bytes.Contains(raw, []byte("PRIVATE_")) || bytes.Contains(raw, []byte("manifest")) || strings.Contains(logs.String(), "PRIVATE_") {
+		t.Fatal("private data leaked")
+	}
+}
+
+func TestFailureSnapshotZIPRejectsDuplicateCorruptionAndEmptyArchive(t *testing.T) {
+	_, _, _, base := snapshotFixture(t)
+	m := capturedMetadata(base)
+	raw, _ := json.Marshal(m)
+	var b bytes.Buffer
+	w := zip.NewWriter(&b)
+	for _, name := range []string{"manifest.json", "window-1.xml", "window-1.xml"} {
+		p, _ := w.Create(name)
+		if name == "manifest.json" {
+			p.Write(raw)
+		} else {
+			p.Write([]byte("<hierarchy/>"))
+		}
+	}
+	w.Close()
+	if _, err := validateFailureArchive(m, raw, b.Bytes()); err == nil {
+		t.Fatal("duplicate entry accepted")
+	}
+	if _, err := validateFailureArchive(m, raw, nil); err == nil {
+		t.Fatal("empty captured archive accepted")
+	}
+	bad := snapshotZIP(t, m, `<hierarchy/>`, nil)
+	bad[len(bad)/2] ^= 0xff
+	if _, err := validateFailureArchive(m, raw, bad); err == nil {
+		t.Fatal("corruption accepted")
+	}
+}
+
+func TestFailureSnapshotPasswordVariantsAndReversibleAttributes(t *testing.T) {
+	for _, name := range []string{"text", "content-desc", "hint", "state-description", "tooltip"} {
+		for _, suffix := range []string{"", "-state", "-base64"} {
+			value := "private"
+			if suffix == "-state" {
+				value = "null"
+			}
+			if suffix == "-base64" {
+				value = "AGE="
+			}
+			raw := []byte(`<hierarchy><node password="true" ` + name + suffix + `="` + value + `"/></hierarchy>`)
+			if validateFailureXML(raw) == nil {
+				t.Fatalf("password %s leaked", name+suffix)
+			}
+		}
+	}
+	for _, raw := range []string{`<hierarchy><node text-base64="2AA=" password="false" hint-state="unsupported"/></hierarchy>`, `<hierarchy><node password="true" path="0" child-count="0"><action id="1"/></node></hierarchy>`, `<hierarchy><node password="false" text="line&#10;two&#9;&amp;😀" collection-row-count="2" range-current="1.5"/></hierarchy>`} {
+		if err := validateFailureXML([]byte(raw)); err != nil {
+			t.Fatalf("valid XML rejected: %v", err)
+		}
+	}
+	for _, raw := range []string{`<hierarchy><node text="x" text-base64="AGE="/></hierarchy>`, `<hierarchy><node hint-state="invalid"/></hierarchy>`, `<hierarchy><node text-base64="YQ=="/></hierarchy>`} {
+		if validateFailureXML([]byte(raw)) == nil {
+			t.Fatal("ambiguous/invalid attribute accepted")
+		}
+	}
+}
+
+func TestFailureSnapshotUnreadablePasswordFlagFailsClosed(t *testing.T) {
+	for _, raw := range []string{`<hierarchy><node password-state="read_error" text="secret"/></hierarchy>`, `<hierarchy><node password-base64="AHQAcgB1AGU=" text="secret"/></hierarchy>`, `<hierarchy><node password="maybe" text="secret"/></hierarchy>`} {
+		if validateFailureXML([]byte(raw)) == nil {
+			t.Error("unreliable password flag accepted with content")
+		}
+	}
+}
+
+func TestFailureSnapshotRejectsPendingAttemptAndContradictoryWindow(t *testing.T) {
+	s, f, a, m := snapshotFixture(t)
+	s.DB.Model(&a).Update("status", "pending")
+	if _, err := uploadSnapshot(t, s, f, m, nil); err == nil {
+		t.Error("pending attempt accepted")
+	}
+	m = capturedMetadata(m)
+	m.Windows = append(m.Windows, json.RawMessage(`{"id":2,"fileName":null,"status":"partial","reasons":["window_root_null"]}`))
+	if err := validateSnapshotMetadata(m, s.Now()); err == nil {
+		t.Error("incomplete windows declared complete")
+	}
+}
+
+func TestFailureSnapshotMetadataRequiresExplicitValidityAndNullCapture(t *testing.T) {
+	_, _, _, m := snapshotFixture(t)
+	m.RuleSnapshotHash = nil
+	m.RuleSnapshotHashValid = false
+	m.Reasons = []string{"rule_hash_invalid"}
+	raw, _ := json.Marshal(m)
+	for _, field := range []string{`"ruleSnapshotHashValid":false,`, `"capturedAt":null,`, `"ruleSnapshotHash":null,`} {
+		missing := bytes.Replace(raw, []byte(field), nil, 1)
+		if _, err := decodeSnapshotMetadata(missing); err == nil {
+			t.Errorf("missing explicit field accepted: %s", field)
+		}
+	}
+}

server/app/goauto/purchase/router.go

@@ -26,6 +26,7 @@ func InitRouter(engine *gin.Engine, auth *jwt.GinJWTMiddleware) {
 	agent.POST("/:taskId/start", h.Start)
 	agent.POST("/:taskId/order-submit-started", h.OrderSubmitStarted)
 	agent.POST("/:taskId/result", h.Result)
+	agent.POST("/:taskId/attempts/:attemptId/failure-snapshot", h.UploadFailureSnapshot)
 	admin := engine.Group("/api/admin/v1/purchase-tasks").Use(auth.MiddlewareFunc()).Use(middleware.AuthCheckRole())
 	admin.GET("", h.AdminList)
 	admin.POST("/batch-preview", h.AdminBatchPreview)
@@ -35,6 +36,8 @@ func InitRouter(engine *gin.Engine, auth *jwt.GinJWTMiddleware) {
 	admin.POST("/syb-order-writeback", h.AdminOrderWriteback)
 	admin.POST("/stock", h.AdminCreateStock)
 	admin.GET("/:taskId", h.AdminDetail)
+	admin.GET("/:taskId/failure-snapshots", h.FailureSnapshotSummaries)
+	admin.GET("/:taskId/attempts/:attemptId/failure-snapshot/download", h.DownloadFailureSnapshot)
 	admin.POST("", h.AdminCreate)
 	admin.POST("/:taskId/spec-decision", h.SpecDecision)
 	admin.GET("/:taskId/matching", h.MatchingDetail)

server/app/goauto/task/image_search_link.go

@@ -2,6 +2,7 @@ package task
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log"
@@ -15,8 +16,8 @@ import (
 )
 
 // autoLinkImageSearch is deliberately a narrow post-result hook. It only
-// writes an association when the task was a complete collection, the frozen
-// original association is unchanged, and the target product is active. Manual
+// writes an association when the collection is complete or missing only optional
+// metadata, the frozen original association is unchanged, and the target product is active. Manual
 // changes made while the Agent was running win by the CAS predicate.
 // autoLinkedImageSearch 汇报本次是否确实写入了关联，以及关联覆盖了哪些 SYB 明细。
 // 只有确实写入时才值得触发后续的规格匹配（#287）。
@@ -32,7 +33,7 @@ func (service *Service) autoLinkImageSearch(ctx context.Context, taskID uint64)
 	if err := service.DB.WithContext(ctx).First(&task, taskID).Error; err != nil {
 		return autoLinkedImageSearch{}, internalError(err)
 	}
-	if task.Source != models.CollectionTaskSourceImageSearch || task.Status != models.TaskStatusCompleted || task.PDDProductID == nil || task.ImageSearchSnapshot == nil {
+	if task.Source != models.CollectionTaskSourceImageSearch || !imageSearchResultAllowsAutoLink(task) || task.PDDProductID == nil || task.ImageSearchSnapshot == nil {
 		return autoLinkedImageSearch{}, nil
 	}
 	snapshot, err := loadImageSearchSnapshot(task)
@@ -94,6 +95,31 @@ func (service *Service) autoLinkImageSearch(ctx context.Context, taskID uint64)
 	}, nil
 }
 
+// #368: Keep completed behavior unchanged. A partial result is eligible only
+// with explicit, nonempty evidence that every missing field is optional.
+// Unknown/malformed missing data must not silently widen this whitelist.
+func imageSearchResultAllowsAutoLink(task models.CollectionTask) bool {
+	if task.Status == models.TaskStatusCompleted {
+		return true
+	}
+	if task.Status != models.TaskStatusCompletedPartial || task.MissingJSON == nil {
+		return false
+	}
+	var missing []string
+	if err := json.Unmarshal([]byte(*task.MissingJSON), &missing); err != nil || len(missing) == 0 {
+		return false
+	}
+	for _, field := range missing {
+		switch field {
+		case "reviewCount", "salesText", "shopName":
+			// Optional descriptive metadata; never colors, sizes or prices.
+		default:
+			return false
+		}
+	}
+	return true
+}
+
 // matchSpecsAfterImageSearch triggers the existing SYB batch spec match for the
 // details the image-search task just linked (#287).
 //

server/app/goauto/task/image_search_partial_test.go

@@ -0,0 +1,324 @@
+package task
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"sync/atomic"
+	"testing"
+
+	"go-admin/app/goauto/models"
+	"go-admin/app/goauto/shopeeproduct"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+// This fixture leaves the hook uncalled so tests can change the submitted
+// status, missing fields and association independently of the assertions.
+func seedPartialImageSearch(t *testing.T, db *gorm.DB, deviceID *uint64) (models.CollectionTask, models.ShopeeProduct) {
+	t.Helper()
+	record := createTask(t, db, deviceID)
+	if err := db.Model(&models.PDDProduct{}).Where("id = ?", *record.PDDProductID).Update("status", "active").Error; err != nil {
+		t.Fatal(err)
+	}
+	shopee := models.ShopeeProduct{
+		ShopeeItemID: "test-item", Title: "test", Currency: "TWD",
+		SpecsJSON: `[{"name":"颜色","role":"color","values":[{"name":"黑色","source":"import"}]},{"name":"尺码","role":"size","values":[{"name":"M","source":"import"}]}]`,
+	}
+	if err := db.Create(&shopee).Error; err != nil {
+		t.Fatal(err)
+	}
+	syb := models.SYBProduct{
+		OrderCode: "TEST-ORDER", DetailID: 1, StockID: 1, ShopeeItemID: shopee.ShopeeItemID,
+		ShopeeProductID: &shopee.ID, TargetColor: "黑色", TargetSize: "M",
+		Quantity: 1, UnitPriceCent: 1000, ParseStatus: "success", RawJSON: "{}",
+	}
+	if err := db.Create(&syb).Error; err != nil {
+		t.Fatal(err)
+	}
+	snapshot := ImageSearchSnapshot{
+		ShopeeProductID: shopee.ID, RepresentativeSYBProductID: syb.ID, SYBProductIDs: []uint64{syb.ID},
+		ReferenceCurrency: "TWD", ReferencePriceCent: 1000, MaxPriceRatio: 3, PriceGuardSkipped: true,
+		ImageSearchImage: ImageSearchImage{ImageURL: "https://example.invalid/a.jpg", MediaType: "image/jpeg", SizeBytes: 1, SHA256: "0123456789012345678901234567890101234567890123456789012345678901"},
+	}
+	raw, err := json.Marshal(snapshot)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Model(&record).Updates(map[string]any{"source": models.CollectionTaskSourceImageSearch, "image_search_snapshot": string(raw)}).Error; err != nil {
+		t.Fatal(err)
+	}
+	return record, shopee
+}
+
+func TestAutoLinkImageSearchPartialMissingWhitelist(t *testing.T) {
+	cases := []struct {
+		name, status, missing string
+		nilMissing, want      bool
+	}{
+		{name: "completed_empty", status: models.TaskStatusCompleted, missing: "[]", want: true},
+		{name: "completed_nil", status: models.TaskStatusCompleted, nilMissing: true, want: true},
+		{name: "nil", nilMissing: true},
+		{name: "blank"},
+		{name: "null", missing: "null"},
+		{name: "empty", missing: "[]"},
+		{name: "malformed", missing: `["reviewCount"`},
+		{name: "object", missing: `{ "reviewCount": true }`},
+		{name: "scalar", missing: `"reviewCount"`},
+		{name: "number_entry", missing: `["reviewCount",1]`},
+		{name: "null_entry", missing: `["reviewCount",null]`},
+		{name: "blank_entry", missing: `[""]`},
+		{name: "unknown", missing: `["reviewCount","futureField"]`},
+		{name: "case_mismatch", missing: `["ReviewCount"]`},
+		{name: "whitespace", missing: `[" reviewCount "]`},
+		{name: "color", missing: `["reviewCount","color"]`},
+		{name: "size", missing: `["size"]`},
+		{name: "price", missing: `["price"]`},
+		{name: "color_price", missing: `["reviewCount","price:黑色"]`},
+		{name: "unsupported_dimension", missing: `["unsupportedDimension:款式"]`},
+		{name: "invalid_dimension", missing: `["spec_dimension_invalid:size"]`},
+		{name: "pending", status: models.TaskStatusPending, missing: `["reviewCount"]`},
+		{name: "failed", status: models.TaskStatusFailed, missing: `["reviewCount"]`},
+		{name: "duplicate_optional", missing: `["reviewCount","reviewCount"]`, want: true},
+	}
+	fields := []string{"reviewCount", "salesText", "shopName"}
+	for mask := 1; mask < 8; mask++ {
+		var missing []string
+		for i, field := range fields {
+			if mask&(1<<i) != 0 {
+				missing = append(missing, field)
+			}
+		}
+		raw, _ := json.Marshal(missing)
+		cases = append(cases, struct {
+			name, status, missing string
+			nilMissing, want      bool
+		}{name: fmt.Sprintf("allowed_%d", mask), missing: string(raw), want: true})
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			db := openTaskDatabase(t)
+			record, shopee := seedPartialImageSearch(t, db, nil)
+			status := tc.status
+			if status == "" {
+				status = models.TaskStatusCompletedPartial
+			}
+			var missing *string
+			if !tc.nilMissing {
+				missing = &tc.missing
+			}
+			if err := record.SetStatus(status); err != nil {
+				t.Fatal(err)
+			}
+			if err := db.Model(&record).Updates(map[string]any{"status": status, "missing_json": missing, "active_slot": record.ActiveSlot, "device_run_slot": record.DeviceRunSlot}).Error; err != nil {
+				t.Fatal(err)
+			}
+			linked, err := NewService(db).autoLinkImageSearch(context.Background(), record.ID)
+			if err != nil || linked.Linked != tc.want {
+				t.Fatalf("Linked=%v want=%v error=%v", linked.Linked, tc.want, err)
+			}
+			if err := db.First(&shopee, shopee.ID).Error; err != nil {
+				t.Fatal(err)
+			}
+			if shopee.ImageSearchLinked != tc.want || (shopee.PDDProductID != nil) != tc.want {
+				t.Fatalf("association/marker mismatch: %+v", shopee)
+			}
+			if tc.want && (*shopee.PDDProductID != *record.PDDProductID || len(linked.SYBProductIDs) != 1) {
+				t.Fatal("linked target or downstream SYB identifiers lost")
+			}
+			if err := db.First(&record, record.ID).Error; err != nil {
+				t.Fatal(err)
+			}
+			if record.Status != status || !reflect.DeepEqual(record.MissingJSON, missing) {
+				t.Fatal("eligibility must not rewrite collection status or missing fields")
+			}
+		})
+	}
+}
+
+func TestSubmitImageSearchPartialLinkAndMatch(t *testing.T) {
+	for _, scenario := range []string{"optional_partial", "completed", "critical_missing", "admin_source", "current_page_source", "disabled_pdd", "association_changed", "snapshot_missing", "ai_unavailable", "request_cancelled_during_match"} {
+		t.Run(scenario, func(t *testing.T) {
+			requestContext, cancelRequest := context.WithCancel(context.Background())
+			defer cancelRequest()
+			var syncCalls atomic.Int32
+			erp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				syncCalls.Add(1)
+				if scenario == "request_cancelled_during_match" {
+					// Cancel only after the real post-result matching hook has
+					// started. Its detached context must still persist mappings.
+					cancelRequest()
+				}
+				if scenario == "ai_unavailable" {
+					w.WriteHeader(http.StatusServiceUnavailable)
+					return
+				}
+				w.Header().Set("Content-Type", "application/json")
+				fmt.Fprint(w, `{"data":{"color":["黑色"],"size":["M"]}}`)
+			}))
+			defer erp.Close()
+			t.Setenv("GOAUTO_ERPGO_BASE_URL", erp.URL)
+			t.Setenv("GOAUTO_ERPGO_APIKEY", "synthetic-test-key")
+			db := openTaskDatabase(t)
+			device, token := registerTaskDevice(t, db, "partial-image-search")
+			record, shopee := seedPartialImageSearch(t, db, &device.ID)
+			service := newTaskService(db)
+			// Execution is outside this test's scope; submit through the real
+			// authenticated running-owner path with a persisted image-search snapshot.
+			if err := db.Model(&record).Update("status", models.TaskStatusRunning).Error; err != nil {
+				t.Fatal(err)
+			}
+			title, shop, sales, reviews := "商品", "店铺", "已拼100件", int64(12)
+			request := ResultRequest{
+				RequestID: uuid.NewString(), Status: models.TaskStatusCompletedPartial,
+				Product:     ResultProduct{PDDGoodsID: record.GoodsIDSnapshot, Title: &title, ShopName: &shop, SalesText: &sales},
+				Dimensions:  []ResultDimension{{Key: "color", Name: "颜色", Values: []string{"黑色"}}, {Key: "size", Name: "尺码", Values: []string{"M"}}},
+				ColorPrices: []ResultColorPrice{{Color: "黑色", PriceCent: 1000}},
+				SKUs:        []ResultSKU{{Specs: map[string]string{"color": "黑色", "size": "M"}, PriceCent: 1000, Available: true}},
+				Missing:     []string{"reviewCount"},
+			}
+			wantLinked, wantMapped := true, true
+			var unchangedPDD *uint64
+			switch scenario {
+			case "completed":
+				request.Status, request.Missing, request.Product.ReviewCount = models.TaskStatusCompleted, []string{}, &reviews
+			case "critical_missing":
+				request.Missing = append(request.Missing, "size")
+				wantLinked, wantMapped = false, false
+			case "admin_source", "current_page_source":
+				source := models.CollectionTaskSourceAdmin
+				if scenario == "current_page_source" {
+					source = models.CollectionTaskSourceAgentCurrentPage
+				}
+				if err := db.Model(&record).Update("source", source).Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "disabled_pdd":
+				if err := db.Model(&models.PDDProduct{}).Where("id = ?", *record.PDDProductID).Update("status", "disabled").Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "association_changed":
+				manual := seedAutoLinkPDD(t, db, "manual-pdd")
+				unchangedPDD = &manual.ID
+				if err := db.Model(&shopee).Update("pdd_product_id", manual.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "snapshot_missing":
+				if err := db.Model(&record).Update("image_search_snapshot", nil).Error; err != nil {
+					t.Fatal(err)
+				}
+				wantLinked, wantMapped = false, false
+			case "ai_unavailable":
+				// No exact match and no configured AI provider: the existing
+				// matching path must not invent mappings or undo successful collection.
+				request.Dimensions[0].Values = []string{"白色"}
+				request.Dimensions[1].Values = []string{"L"}
+				request.ColorPrices[0].Color = "白色"
+				request.SKUs[0].Specs = map[string]string{"color": "白色", "size": "L"}
+				wantMapped = false
+			}
+			for attempt := 0; attempt < 2; attempt++ {
+				ctx := context.Background()
+				if attempt == 0 {
+					ctx = requestContext
+				}
+				detail, err := service.SubmitResult(ctx, record.ID, request, token)
+				if scenario == "request_cancelled_during_match" && attempt == 0 {
+					// Detail still uses the original request context. Preserve that
+					// existing return behavior, then inspect the committed state
+					// independently; do not pretend the disconnected client got OK.
+					if requestContext.Err() != context.Canceled || err == nil {
+						t.Fatalf("expected cancelled response read, got %v", err)
+					}
+					detail, err = service.Detail(context.Background(), record.ID)
+				}
+				if err != nil {
+					t.Fatalf("submit attempt %d: %v", attempt, err)
+				}
+				if detail.Task.Status != request.Status || !reflect.DeepEqual(detail.Missing, request.Missing) || detail.Replayed != (attempt == 1) {
+					t.Fatalf("submission/replay changed result: status=%s missing=%v replayed=%v", detail.Task.Status, detail.Missing, detail.Replayed)
+				}
+				if len(detail.SKUs) != 1 || len(detail.Dimensions) != 2 {
+					t.Fatal("result children missing or duplicated")
+				}
+				if err := db.First(&shopee, shopee.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				if shopee.ImageSearchLinked != wantLinked {
+					t.Fatalf("image search marker=%v", shopee.ImageSearchLinked)
+				}
+				wantPDD := unchangedPDD
+				if wantLinked {
+					wantPDD = record.PDDProductID
+				}
+				if !reflect.DeepEqual(shopee.PDDProductID, wantPDD) {
+					t.Fatal("wrong association or concurrent change overwritten")
+				}
+				wantCalls := int32(0)
+				if wantLinked {
+					wantCalls = 1
+				}
+				if syncCalls.Load() != wantCalls {
+					t.Fatalf("matching hook calls=%d want=%d", syncCalls.Load(), wantCalls)
+				}
+				specs, err := shopeeproduct.Unmarshal(shopee.SpecsJSON)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if len(specs) != 2 {
+					t.Fatalf("unexpected archive dimensions: %d", len(specs))
+				}
+				for _, dimension := range specs {
+					for _, value := range dimension.Values {
+						if wantMapped {
+							if value.Mapping == nil || value.Mapping.Status != shopeeproduct.MappingStatusConfirmed || value.Mapping.PDDValue != value.Name {
+								t.Fatalf("matching not persisted: %+v", value)
+							}
+						} else if value.Mapping != nil {
+							t.Fatalf("unexpected mapping: %+v", value)
+						}
+					}
+				}
+			}
+			if scenario == "optional_partial" {
+				// A second result for the same image carries the same original
+				// association snapshot. The first committed link wins; no fallback
+				// to another result or a second matching pass is introduced.
+				if err := db.First(&record, record.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				second := createTask(t, db, &device.ID)
+				if err := db.Model(&second).Updates(map[string]any{
+					"source": models.CollectionTaskSourceImageSearch, "image_search_snapshot": record.ImageSearchSnapshot,
+					"status": models.TaskStatusRunning,
+				}).Error; err != nil {
+					t.Fatal(err)
+				}
+				request.RequestID, request.Product.PDDGoodsID = uuid.NewString(), second.GoodsIDSnapshot
+				if _, err := service.SubmitResult(context.Background(), second.ID, request, token); err != nil {
+					t.Fatal(err)
+				}
+				if err := db.First(&shopee, shopee.ID).Error; err != nil {
+					t.Fatal(err)
+				}
+				if !reflect.DeepEqual(shopee.PDDProductID, record.PDDProductID) || syncCalls.Load() != 1 {
+					t.Fatal("competing image-search result replaced association or retriggered matching")
+				}
+			}
+			var purchases int64
+			if err := db.Model(&models.PurchaseTask{}).Count(&purchases).Error; err != nil {
+				t.Fatal(err)
+			}
+			if purchases != 0 {
+				t.Fatal("matching must not create a purchase task")
+			}
+		})
+	}
+}

server/cmd/api/server.go

@@ -129,6 +129,10 @@ func run() error {
 	defer stopOfflineMonitors()
 	for _, db := range sdk.Runtime.GetDb() {
 		service := goautodevice.NewService(db)
+		go goautopurchase.RunFailureSnapshotCleanup(
+			offlineMonitorContext, goautopurchase.NewService(db), time.Hour,
+			func(err error) { log.Error("purchase failure snapshot cleanup failed") },
+		)
 		go goautodevice.RunOfflineMonitor(
 			offlineMonitorContext, service, goautodevice.DefaultOfflineScan, goautodevice.DefaultOfflineThreshold,
 			func(err error) { log.Errorf("device offline monitor failed: %v", err) },

server/cmd/migrate/migration/version-local/1791400000000_purchase_failure_snapshot.go

@@ -0,0 +1,26 @@
+package version_local
+
+import (
+	"go-admin/app/goauto/models"
+	"go-admin/cmd/migrate/migration"
+	common "go-admin/common/models"
+	"gorm.io/gorm"
+	"runtime"
+)
+
+func init() {
+	_, file, _, _ := runtime.Caller(0)
+	migration.Migrate.SetVersion(migration.GetFilename(file), MigratePurchaseFailureSnapshot)
+}
+
+// MigratePurchaseFailureSnapshot applies only the reviewed #364 table migration.
+func MigratePurchaseFailureSnapshot(db *gorm.DB, version string) error {
+	return db.Transaction(func(tx *gorm.DB) error {
+		if !tx.Migrator().HasTable(&models.PurchaseFailureSnapshot{}) {
+			if err := tx.Migrator().CreateTable(&models.PurchaseFailureSnapshot{}); err != nil {
+				return err
+			}
+		}
+		return tx.Where("version = ?", version).FirstOrCreate(&common.Migration{Version: version}).Error
+	})
+}

server/cmd/migrate/migration/version-local/1791400000000_purchase_failure_snapshot_mysql_test.go

@@ -0,0 +1,93 @@
+package version_local
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	drivermysql "github.com/go-sql-driver/mysql"
+	"go-admin/app/goauto/access"
+	"go-admin/app/goauto/models"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+// Explicit opt-in for the user-authorized newly initialized local database.
+// Never accepts a remote host and never starts a worker or creates an order.
+func TestFailureSnapshotAuthorizedLocalMySQL(t *testing.T) {
+	dsn := os.Getenv("GOAUTO_364_LOCAL_MYSQL_DSN")
+	if dsn == "" {
+		t.Skip("local MySQL verification requires explicit opt-in")
+	}
+	cfg, err := drivermysql.ParseDSN(dsn)
+	if err != nil || cfg.Net != "tcp" || cfg.Addr != "127.0.0.1:3308" || cfg.DBName != "goauto" {
+		t.Fatal("unexpected local database target")
+	}
+	db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
+	if err != nil {
+		t.Fatal("local database unavailable")
+	}
+	sqlDB, _ := db.DB()
+	defer sqlDB.Close()
+	var orders int64
+	if err := db.Model(&models.PurchaseTask{}).Count(&orders).Error; err != nil || orders != 0 {
+		t.Fatal("requires newly initialized local database with no purchase tasks")
+	}
+	for i := 0; i < 2; i++ {
+		if err := MigratePurchaseFailureSnapshot(db, "1791400000000"); err != nil {
+			t.Fatal("local additive migration failed")
+		}
+	}
+	if err := access.ReconcilePurchaserPermissions(db); err != nil {
+		t.Fatal("local permission reconciliation failed")
+	}
+	var catalog, ordinary int64
+	if err := db.Table("sys_api").Where("path LIKE ?", "%failure-snapshot%").Count(&catalog).Error; err != nil || catalog != 2 {
+		t.Fatal("dedicated API catalogue is incomplete")
+	}
+	if err := db.Table("casbin_rule").Where("v1 LIKE ? AND v0 <> ?", "%failure-snapshot%", "admin").Count(&ordinary).Error; err != nil || ordinary != 0 {
+		t.Fatal("ordinary roles received private diagnostic grants")
+	}
+	var columns []struct {
+		Name string `gorm:"column:column_name"`
+		Kind string `gorm:"column:data_type"`
+	}
+	if err := db.Raw("SELECT column_name,data_type FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='purchase_failure_snapshot'").Scan(&columns).Error; err != nil {
+		t.Fatal("column inspection failed")
+	}
+	kinds := map[string]string{}
+	for _, col := range columns {
+		kinds[col.Name] = col.Kind
+	}
+	if kinds["manifest_json"] != "longtext" || kinds["zip_data"] != "longblob" {
+		t.Fatal("private payload columns cannot hold the contract limit")
+	}
+	rollbackFixture := errors.New("rollback synthetic fixture")
+	err = db.Transaction(func(tx *gorm.DB) error {
+		row := models.PurchaseFailureSnapshot{TaskID: 1, AttemptID: "36400000-0000-4000-8000-000000000001", DeviceID: 1, Phase: "purchase", RuleSnapshotHash: strings.Repeat("a", 64), Status: "partial", Source: "execution", ErrorCode: "SYNTHETIC_TEST", AgentVersion: "test", RecordedAt: time.Now(), ExpiresAt: time.Now().Add(time.Hour), ReasonsJSON: "[]", ManifestJSON: strings.Repeat("x", 64*1024), ZIPData: bytes.Repeat([]byte{0x41}, 2*1024*1024), PayloadSHA256: strings.Repeat("b", 64), ZIPSize: 2 * 1024 * 1024}
+		if e := tx.Create(&row).Error; e != nil {
+			return errors.New("MySQL contract-limit insert failed")
+		}
+		var readback models.PurchaseFailureSnapshot
+		if e := tx.First(&readback, row.ID).Error; e != nil || !bytes.Equal(readback.ZIPData, row.ZIPData) || readback.ManifestJSON != row.ManifestJSON {
+			return errors.New("MySQL private payload readback failed")
+		}
+		duplicate := row
+		duplicate.ID = 0
+		if e := tx.Create(&duplicate).Error; e == nil {
+			return errors.New("attempt uniqueness is missing")
+		}
+		return rollbackFixture
+	})
+	if !errors.Is(err, rollbackFixture) {
+		t.Fatal(err)
+	}
+	var fixtures int64
+	if err := db.Model(&models.PurchaseFailureSnapshot{}).Where("attempt_id=?", "36400000-0000-4000-8000-000000000001").Count(&fixtures).Error; err != nil || fixtures != 0 {
+		t.Fatal("synthetic fixture was not rolled back")
+	}
+}

server/cmd/migrate/migration/version-local/1791400000000_purchase_failure_snapshot_test.go

@@ -0,0 +1,65 @@
+package version_local
+
+import (
+	"encoding/json"
+	"go-admin/app/goauto/models"
+	common "go-admin/common/models"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+	"testing"
+	"time"
+)
+
+func TestMigratePurchaseFailureSnapshotPreservesBusinessAndIsIdempotent(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn, _ := db.DB()
+	defer conn.Close()
+	if err = db.AutoMigrate(&common.Migration{}); err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Exec("CREATE TABLE purchase_task (id integer primary key, status text NOT NULL)").Error; err != nil {
+		t.Fatal(err)
+	}
+	if err = db.Exec("INSERT INTO purchase_task(id,status) VALUES(1,'failed')").Error; err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 2; i++ {
+		if err = MigratePurchaseFailureSnapshot(db, "test_364"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	row := models.PurchaseFailureSnapshot{TaskID: 1, AttemptID: "00000000-0000-4000-8000-000000000001", DeviceID: 2, Phase: "purchase", RuleSnapshotHash: "hash", Status: "not_captured", Source: "execution", ErrorCode: "TEST", AgentVersion: "1", RecordedAt: time.Now(), ExpiresAt: time.Now().Add(time.Hour), ReasonsJSON: "[]", ManifestJSON: "{}", PayloadSHA256: "digest"}
+	if err = db.Create(&row).Error; err != nil {
+		t.Fatal(err)
+	}
+	duplicate := row
+	duplicate.ID = 0
+	if db.Create(&duplicate).Error == nil {
+		t.Fatal("attempt unique index missing")
+	}
+	if err = MigratePurchaseFailureSnapshot(db, "test_364"); err != nil {
+		t.Fatal(err)
+	}
+	var status string
+	db.Table("purchase_task").Select("status").Where("id=1").Scan(&status)
+	if status != "failed" {
+		t.Fatal("business row changed")
+	}
+	cols, err := db.Migrator().ColumnTypes("purchase_task")
+	if err != nil || len(cols) != 2 {
+		t.Fatal("business schema changed")
+	}
+	var count int64
+	db.Model(&common.Migration{}).Where("version = ?", "test_364").Count(&count)
+	if count != 1 {
+		t.Fatal("version not idempotent")
+	}
+	raw, _ := json.Marshal(row)
+	if string(raw) != "{}" {
+		t.Fatal("private row can be serialized")
+	}
+}

server/common/middleware/failure_snapshot_logger_test.go

@@ -0,0 +1,45 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+type snapshotBodySpy struct {
+	reads int
+	body  io.Reader
+}
+
+func (s *snapshotBodySpy) Read(p []byte) (int, error) { s.reads++; return s.body.Read(p) }
+func (s *snapshotBodySpy) Close() error               { return nil }
+
+func TestFailureSnapshotLoggerNeverReadsOrRecordsBody(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	for _, path := range []string{
+		"/api/agent/v1/purchase-tasks/1/attempts/00000000-0000-4000-8000-000000000001/failure-snapshot",
+		"/api/admin/v1/purchase-tasks/1/failure-snapshots",
+		"/api/admin/v1/purchase-tasks/1/attempts/00000000-0000-4000-8000-000000000001/failure-snapshot/download",
+	} {
+		t.Run(path, func(t *testing.T) {
+			spy := &snapshotBodySpy{body: strings.NewReader("SYNTHETIC_PRIVATE_CONTENT")}
+			r := gin.New()
+			r.Use(LoggerToFile())
+			r.POST(path, func(c *gin.Context) {
+				if spy.reads != 0 {
+					t.Error("logger consumed private body before handler")
+				}
+				c.Status(http.StatusNoContent)
+			})
+			req := httptest.NewRequest(http.MethodPost, path, nil)
+			req.Body = spy
+			r.ServeHTTP(httptest.NewRecorder(), req)
+			if spy.reads != 0 {
+				t.Error("logger consumed private body")
+			}
+		})
+	}
+}

server/common/middleware/logger.go

@@ -26,7 +26,7 @@ func LoggerToFile() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		// #237: client request/response bodies and one-time credentials must never
 		// enter the legacy operation logger. The client gateway keeps metadata-only audit.
-		if strings.HasPrefix(c.Request.URL.Path, "/api/client/") || strings.HasPrefix(c.Request.URL.Path, "/api/admin/v1/client-keys") {
+		if strings.HasPrefix(c.Request.URL.Path, "/api/client/") || strings.HasPrefix(c.Request.URL.Path, "/api/admin/v1/client-keys") || isPrivateFailureSnapshotPath(c.Request.URL.Path) {
 			c.Next()
 			return
 		}
@@ -111,6 +111,22 @@ func LoggerToFile() gin.HandlerFunc {
 	}
 }
 
+// #364: these dedicated endpoints carry private accessibility diagnostics.
+// Skip before reading the body; their handlers enforce authentication and limits.
+func isPrivateFailureSnapshotPath(path string) bool {
+	parts := strings.Split(strings.Trim(path, "/"), "/")
+	if len(parts) < 6 || parts[0] != "api" || parts[2] != "v1" || parts[3] != "purchase-tasks" {
+		return false
+	}
+	if parts[1] == "admin" && len(parts) == 6 && parts[5] == "failure-snapshots" {
+		return true
+	}
+	if len(parts) >= 8 && parts[5] == "attempts" && parts[7] == "failure-snapshot" {
+		return (parts[1] == "agent" && len(parts) == 8) || (parts[1] == "admin" && len(parts) == 9 && parts[8] == "download")
+	}
+	return false
+}
+
 // SetDBOperLog 写入操作日志表 fixme 该方法后续即将弃用
 func SetDBOperLog(c *gin.Context, clientIP string, statusCode int, reqUri string, reqMethod string, latencyTime time.Duration, body string, result string, status int) {
 

web/src/api/goauto/purchase-failure-snapshots.js

@@ -0,0 +1,19 @@
+import request from '@/utils/request'
+
+export function listFailureSnapshots(taskId) {
+  return request({ url: `/api/admin/v1/purchase-tasks/${encodeURIComponent(taskId)}/failure-snapshots`, method: 'get', suppressErrorMessage: true })
+}
+
+export async function downloadFailureSnapshot(taskId, attemptId) {
+  const response = await request({
+    url: `/api/admin/v1/purchase-tasks/${encodeURIComponent(taskId)}/attempts/${encodeURIComponent(attemptId)}/failure-snapshot/download`,
+    method: 'get', responseType: 'blob', suppressErrorMessage: true,
+    // Adapt only this endpoint to the existing JSON-envelope interceptor.
+    transformResponse: [data => ({ code: 200, data })]
+  })
+  const blob = response.data
+  if (!(blob instanceof Blob) || blob.type.split(';')[0] !== 'application/zip') throw new Error('下载失败，请重试')
+  const signature = new Uint8Array(await blob.slice(0, 4).arrayBuffer())
+  if (signature.length !== 4 || signature[0] !== 80 || signature[1] !== 75 || signature[2] !== 3 || signature[3] !== 4) throw new Error('下载失败，请重试')
+  return blob
+}

web/src/views/goauto/purchase-tasks/FailureSnapshotCell.vue

@@ -0,0 +1,55 @@
+<template>
+  <div class="snapshot-cell">
+    <span v-if="loading" class="muted">加载中…</span>
+    <el-button v-else-if="error" type="primary" link @click="$emit('retry')">读取失败，重试</el-button>
+    <template v-else-if="snapshot?.downloadAvailable">
+      <div><el-tag size="small" :type="snapshot.partial ? 'warning' : 'success'">{{ snapshot.partial ? '部分' : '完整' }}</el-tag></div>
+      <div v-if="snapshot.partial" class="muted">{{ reasonText }}</div>
+      <el-button type="primary" link :loading="downloading" :disabled="downloading" @click="download">下载控件树</el-button>
+      <div v-if="downloadError" role="alert" class="download-error">下载失败，请重试</div>
+    </template>
+    <span v-else-if="snapshot?.status === 'not_captured'" class="muted">未保存：{{ reasonText }}</span>
+    <span v-else class="muted">暂无现场数据</span>
+  </div>
+</template>
+
+<script>
+import { downloadFailureSnapshot } from '@/api/goauto/purchase-failure-snapshots'
+
+const reasons = {
+  rule_hash_invalid: '规则哈希无效', execution_not_entered: '未进入设备执行', accessibility_unavailable: '无障碍不可用',
+  process_interrupted: '进程中断，原现场未保存', windows_unavailable: '无法获取窗口', windows_unsupported: '系统不支持窗口读取',
+  window_root_null: '窗口根节点为空', window_disappeared: '窗口已消失', window_read_error: '窗口读取失败',
+  node_read_error: '节点读取失败', attribute_unsupported: '系统不支持部分属性', node_limit: '已达到节点上限',
+  time_limit: '已达到截取耗时上限', expanded_size_limit: '已达到解压大小上限', archive_size_limit: '已达到压缩大小上限', capture_failed: '截取失败'
+}
+
+export default {
+  name: 'FailureSnapshotCell',
+  props: { taskId: { type: [Number, String], required: true }, attemptId: { type: String, required: true }, snapshot: { type: Object, default: null }, loading: Boolean, error: Boolean },
+  emits: ['retry'],
+  data() { return { downloading: false, downloadError: false, active: true } },
+  computed: { reasonText() { return [...new Set((this.snapshot?.reasons || []).map(reason => Object.hasOwn(reasons, reason) ? reasons[reason] : '未能截取现场'))].join('；') || '未能截取现场' } },
+  beforeUnmount() { this.active = false },
+  methods: {
+    async download() {
+      if (this.downloading || !this.snapshot?.downloadAvailable) return
+      this.downloading = true; this.downloadError = false
+      try {
+        const blob = await downloadFailureSnapshot(this.taskId, this.attemptId)
+        if (!this.active) return
+        const url = URL.createObjectURL(blob)
+        const anchor = document.createElement('a')
+        anchor.href = url
+        const safe = value => String(value).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 80)
+        anchor.download = `purchase-${safe(this.taskId)}-attempt-${safe(this.attemptId)}.zip`
+        try { document.body.appendChild(anchor); anchor.click() } finally { anchor.remove(); setTimeout(() => URL.revokeObjectURL(url), 0) }
+      } catch { if (this.active) this.downloadError = true } finally { if (this.active) this.downloading = false }
+    }
+  }
+}
+</script>
+
+<style scoped>
+.snapshot-cell{display:flex;flex-direction:column;align-items:flex-start;gap:4px}.muted{color:#909399;font-size:12px;line-height:1.5}.download-error{color:#f56c6c;font-size:12px}
+</style>

web/src/views/goauto/purchase-tasks/index.vue

@@ -73,6 +73,7 @@
 
             <section><h3>执行记录</h3><el-table :data="detail.attempts" border size="small" empty-text="暂无执行记录">
               <el-table-column label="次数" width="70"><template #default="{ row }">#{{ row.attemptNumber }}</template></el-table-column><el-table-column label="阶段" prop="phase" min-width="120" /><el-table-column label="状态" prop="status" min-width="110" /><el-table-column label="结果" min-width="150"><template #default="{ row }">{{ row.resultType || row.errorCode || '—' }}</template></el-table-column><el-table-column label="说明" min-width="220"><template #default="{ row }">{{ row.errorMessage || '—' }}</template></el-table-column><el-table-column label="开始时间" width="170"><template #default="{ row }">{{ formatTime(row.startedAt || row.createdAt) }}</template></el-table-column>
+              <el-table-column v-if="isSnapshotAdmin" label="现场诊断" width="200"><template #default="{ row }"><FailureSnapshotCell v-if="detail.open" :key="`${detailSession}-${row.attemptId}`" :task-id="detail.task.id" :attempt-id="row.attemptId" :snapshot="snapshots.items[row.attemptId]" :loading="snapshots.loading" :error="snapshots.error" @retry="loadSnapshots" /></template></el-table-column>
             </el-table></section>
 
             <el-alert v-if="detail.task.errorCode" :title="`${detail.task.errorCode}：${detail.task.errorMessage || '任务执行失败'}`" type="error" :closable="false" show-icon class="notice" />
@@ -153,6 +154,8 @@ import { ElMessage, ElMessageBox } from 'element-plus'
 import { RefreshLeft, Search } from '@element-plus/icons-vue'
 import { authorizeRepurchase, cancelPurchaseTask, choosePurchaseMatching, getPurchaseTask, listPurchaseTasks, requeuePurchaseMatching, resolveUnknownPurchaseTask, retryPurchaseTasksBatch, reviewPurchasePayment, selectPurchaseWriteback, writebackPurchaseOrderNumbers } from '@/api/goauto/purchase-tasks'
 import { createRequestId } from '@/utils/request-id'
+import { listFailureSnapshots } from '@/api/goauto/purchase-failure-snapshots'
+import FailureSnapshotCell from './FailureSnapshotCell.vue'
 
 const statusOptions = [
   ['pending', '待执行'], ['spec_probe_pending', '待探测规格'], ['running', '执行中'], ['rehearsal_completed', '演练完成'],
@@ -161,10 +164,12 @@ const statusOptions = [
 
 export default {
   name: 'GoAutoPurchaseTasks',
+  components: { FailureSnapshotCell },
   setup() { return { RefreshLeft, Search } },
   data() {
     return {
       loading: false, loadError: '', tasks: [], total: 0, statuses: [...statusOptions, { value: 'syb_writeback_succeeded', label: '已回填 SYB' }],
+      detailSession: 0, snapshots: { items: {}, loading: false, error: false },
       orderWriteback: { open: false, saving: false, items: [] },
       query: { page: 1, pageSize: 20, taskId: '', taskType: '', shopeeOrderNo: '', status: '', executionMode: 'live', sybProductId: '', pddOrderNo: '' },
 	  detail: { open: false, loading: false, task: null, attempts: [], matching: null },
@@ -178,6 +183,7 @@ export default {
     }
   },
   computed: {
+    isSnapshotAdmin() { return (this.$store.getters.roles || []).includes('admin') },
     orderFilter() { return parsePurchaseOrderFilter(this.query.shopeeOrderNo) },
     retryCandidates() { return this.retrySelection.filter(this.isRetrySelectable) },
     orderWritebackCandidates() { return this.retrySelection.filter(this.canOrderWriteback) },
@@ -197,6 +203,12 @@ export default {
 	canSubmitMatching() { const m = this.detail.matching || {}; return (!m.targetColor || this.matchingDialog.color) && (!m.targetSize || this.matchingDialog.size) },
     firstRetriedTask() { return this.retryResult.items.find(item => item.created && item.taskId) || null }
   },
+  watch: {
+    'detail.open'(open) { if (!open) this.clearSnapshots() },
+    isSnapshotAdmin(admin) { if (!admin) this.clearSnapshots() }
+  },
+  beforeUnmount() { this.clearSnapshots() },
+  deactivated() { this.detail.open = false; this.clearSnapshots() },
   created() {
     const taskId = Number(this.$route.query.taskId)
     if (Number.isInteger(taskId) && taskId > 0) {
@@ -223,8 +235,20 @@ export default {
     },
     search() { this.query.page = 1; this.load() },
     reset() { this.query = { page: 1, pageSize: 20, taskId: '', taskType: '', shopeeOrderNo: '', status: '', executionMode: 'live', sybProductId: '', pddOrderNo: '' }; this.load() },
-	async openDetail(row) { this.detail = { open: true, loading: true, task: null, attempts: [], matching: null }; try { await this.refreshDetail(row.id) } finally { this.detail.loading = false } },
-	async refreshDetail(id = this.detail.task?.id) { const r = await getPurchaseTask(id); this.detail.task = r.data.task; this.detail.attempts = r.data.attempts || []; this.detail.matching = r.data.matching || r.data.task?.matching || null },
+    clearSnapshots() { this.detailSession++; this.snapshots = { items: {}, loading: false, error: false } },
+    async loadSnapshots() {
+      if (!this.isSnapshotAdmin || !this.detail.open || !this.detail.task || this.snapshots.loading) return
+      const session = this.detailSession
+      this.snapshots = { items: {}, loading: true, error: false }
+      const state = this.snapshots
+      try {
+        const r = await listFailureSnapshots(this.detail.task.id)
+        if (session !== this.detailSession || !this.detail.open || !this.isSnapshotAdmin) return
+        state.items = Object.fromEntries((r.data.items || []).map(item => [item.attemptId, item]))
+      } catch { if (session === this.detailSession) state.error = true } finally { if (session === this.detailSession) state.loading = false }
+    },
+    async openDetail(row) { this.clearSnapshots(); const session = this.detailSession; this.detail = { open: true, loading: true, task: null, attempts: [], matching: null }; try { await this.refreshDetail(row.id) } finally { if (session === this.detailSession) this.detail.loading = false } },
+    async refreshDetail(id = this.detail.task?.id) { const session = this.detailSession; const r = await getPurchaseTask(id); if (session !== this.detailSession || !this.detail.open) return; this.detail.task = r.data.task; this.detail.attempts = r.data.attempts || []; this.detail.matching = r.data.matching || r.data.task?.matching || null; this.loadSnapshots() },
     statusLabel(value) { return statusOptions.find(item => item.value === value)?.label || value || '—' },
     statusType(value) { return { pending: 'info', spec_probe_pending: 'warning', running: 'warning', rehearsal_completed: 'success', order_submit_started: 'warning', order_created: 'success', order_result_unknown: 'danger', failed: 'danger', cancelled: 'info' }[value] || 'info' },
 	matchingLabel(value) { return { pending: '等待匹配', running: '匹配中', retry_wait: '等待重试', matched: '已匹配', manual_required: '需要人工处理', cancelled: '输入已失效', unresolved: '执行时探测' }[value] || '未记录' },

web/tests/e2e/purchase-failure-snapshots.spec.ts

@@ -0,0 +1,108 @@
+import { expect, test } from '@playwright/test'
+
+const menu = [{ path: '/collection-purchase', component: 'Layout', menuName: 'GoAutoCollectionPurchase', title: '采集采购', visible: '0', children: [{ path: '/purchase-tasks/index', component: '/goauto/purchase-tasks/index', menuName: 'GoAutoPurchaseTasks', title: '采购管理', visible: '0' }] }]
+async function setup(page: any, roles = ['admin']) {
+  const state = { reads: 0, downloads: 0, failRead: false, failDownload: false, delay: 0, downloadDelay: 0 }
+  await page.context().addCookies([{ name: 'Admin-Token', value: 'synthetic-test-token', domain: 'localhost', path: '/' }])
+  await page.route('**/api/**', async route => {
+    const path = new URL(route.request().url()).pathname
+    if (path.startsWith('/src/api/')) return route.continue()
+    const ok = data => route.fulfill({ json: { code: 200, data } })
+    if (path.endsWith('/getinfo')) return ok({ roles, name: '测试用户', avatar: '', permissions: [] })
+    if (path.endsWith('/menurole')) return ok(menu)
+    if (path.endsWith('/failure-snapshot/download')) {
+      state.downloads++
+      if (state.downloadDelay) await new Promise(resolve => setTimeout(resolve, state.downloadDelay))
+      if (state.failDownload) return route.fulfill({ json: { code: 403, msg: 'synthetic-private-error' } })
+      return route.fulfill({ contentType: 'application/zip', body: Buffer.from([80, 75, 3, 4, 0, 0]) })
+    }
+    if (path.endsWith('/failure-snapshots')) {
+      state.reads++
+      const delayed = state.delay
+      if (delayed) await new Promise(resolve => setTimeout(resolve, delayed))
+      if (state.failRead) return route.fulfill({ status: 500, json: { code: 500 } })
+      if (path.includes('/12/')) return ok({ items: [] })
+      return ok({ items: [
+        { attemptId: 'a-1', phase: 'purchase', status: 'captured', partial: false, reasons: [], downloadAvailable: true },
+        { attemptId: 'a-2', phase: 'purchase', status: 'captured', partial: true, reasons: ['node_limit'], downloadAvailable: true },
+        { attemptId: 'a-3', phase: 'purchase', status: 'not_captured', partial: false, reasons: ['synthetic-private-reason'], downloadAvailable: false }
+      ] })
+    }
+    const tasks = [11, 12].map(id => ({ id, status: 'failed', executionMode: 'live', taskType: 'stock', errorCode: 'TEST_FAILURE' }))
+    if (/purchase-tasks\/\d+$/.test(path)) return ok({ task: tasks.find(t => path.endsWith('/' + t.id)), attempts: [1, 2, 3, 4].map(n => ({ attemptId: 'a-' + n, attemptNumber: n, phase: 'purchase', status: 'failed' })) })
+    if (path.endsWith('/purchase-tasks')) return ok({ items: tasks, total: 2 })
+    return ok([])
+  })
+  await page.goto('/#/purchase-tasks/index')
+  await page.getByRole('button', { name: '详情', exact: true }).first().click()
+  return state
+}
+
+test('管理员现场列显示完整、部分、未截取和空状态，并安全下载与重试', async ({ page }) => {
+  const state = await setup(page)
+  await expect(page.getByText('现场诊断', { exact: true })).toBeVisible()
+  const buttons = page.getByRole('button', { name: '下载控件树', exact: true })
+  await expect(buttons).toHaveCount(2)
+  await expect(page.getByText('完整', { exact: true })).toBeVisible()
+  await expect(page.getByText('部分', { exact: true })).toBeVisible()
+  await expect(page.getByText('已达到节点上限')).toBeVisible()
+  await expect(page.getByText('未保存：未能截取现场')).toBeVisible()
+  await expect(page.getByText('暂无现场数据')).toBeVisible()
+  state.failDownload = true
+  const downloads: string[] = []
+  page.on('download', d => downloads.push(d.suggestedFilename()))
+  await buttons.first().click()
+  await expect(page.getByText('下载失败，请重试')).toBeVisible()
+  expect(downloads).toEqual([])
+  await expect(page.getByText('synthetic-private-error')).toHaveCount(0)
+  state.failDownload = false
+  const download = page.waitForEvent('download')
+  await buttons.first().click()
+  expect((await download).suggestedFilename()).toBe('purchase-11-attempt-a-1.zip')
+})
+
+for (const roles of [['purchaser'], ['after_sales'], ['api_key']]) {
+  test(`非管理员 ${roles[0]} 不显示诊断且不请求专用接口`, async ({ page }) => {
+    const state = await setup(page, roles)
+    await expect(page.getByText('执行记录', { exact: true })).toBeVisible()
+    await expect(page.getByText('现场诊断', { exact: true })).toHaveCount(0)
+    expect(state.reads).toBe(0)
+    expect(state.downloads).toBe(0)
+  })
+}
+
+test('元信息失败可重试；关闭再切换任务丢弃旧响应', async ({ page }) => {
+  const state = await setup(page)
+  await expect(page.getByRole('button', { name: '下载控件树', exact: true })).toHaveCount(2)
+  await page.locator('.el-drawer__close-btn').click()
+  state.failRead = true
+  await page.getByRole('button', { name: '详情', exact: true }).first().click()
+  await expect(page.getByRole('button', { name: '读取失败，重试' }).first()).toBeVisible()
+  state.failRead = false
+  await page.getByRole('button', { name: '读取失败，重试' }).first().click()
+  await expect(page.getByRole('button', { name: '下载控件树', exact: true })).toHaveCount(2)
+  await page.locator('.el-drawer__close-btn').click()
+  state.delay = 1200
+  await page.getByRole('button', { name: '详情', exact: true }).first().click()
+  await expect(page.getByText('加载中…').first()).toBeVisible()
+  await page.locator('.el-drawer__close-btn').click()
+  state.delay = 0
+  await page.getByRole('button', { name: '详情', exact: true }).nth(1).click()
+  await expect(page.getByText('暂无现场数据')).toHaveCount(4)
+  await page.waitForTimeout(1400)
+  await expect(page.getByRole('button', { name: '下载控件树', exact: true })).toHaveCount(0)
+})
+
+test('下载期间禁用按钮，离开详情后不触发旧下载', async ({ page }) => {
+  const state = await setup(page)
+  state.downloadDelay = 1500
+  const downloads: string[] = []
+  page.on('download', d => downloads.push(d.suggestedFilename()))
+  const button = page.getByRole('button', { name: '下载控件树', exact: true }).first()
+  await button.click()
+  await expect(button).toBeDisabled()
+  expect(state.downloads).toBe(1)
+  await page.locator('.el-drawer__close-btn').click()
+  await page.waitForTimeout(1800)
+  expect(downloads).toEqual([])
+})