feat(admin): add routed task evidence details

admin/README.md

@@ -12,6 +12,7 @@
 | `CMBUYER_AUTHORIZATION_TTL` | 一次性授权的正 Go duration，例如 `10m`。 |
 | `CMBUYER_MAX_TASK_QUANTITY` | 每条任务允许的正整数数量上限。 |
 | `CMBUYER_MAX_TOTAL_PRICE` | 每条任务允许的规范正数总价上限，例如 `999.99`。 |
+| `CMBUYER_EVIDENCE_DIR` | 内部原始截图的绝对私有目录；不得指向仓库或公开静态目录。 |
 
 示例仅展示变量名，不提供可运行凭据：
 
@@ -24,9 +25,16 @@ $env:CMBUYER_DATABASE_SOURCE = '<SQLite data source>'
 $env:CMBUYER_AUTHORIZATION_TTL = '10m'
 $env:CMBUYER_MAX_TASK_QUANTITY = '99'
 $env:CMBUYER_MAX_TOTAL_PRICE = '999.99'
+$env:CMBUYER_EVIDENCE_DIR = '<内部截图绝对目录>'
 go run ./cmd/migrate -database $env:CMBUYER_DATABASE_SOURCE up
 go run ./cmd/server
 ```
 
 采购服务会话仅保存在当前进程内；进程重启后既有登录会话会安全失效。
 管理员的“开始采购（只创建待付款订单）”只签发一次性授权并创建待付款订单的资格；服务不会自动付款，也不包含任何支付操作。
+
+`GET /tasks/{id}` 直接访问时渲染完整详情页，任务列表以同一 URL 加载详情抽屉。内部截图只通过
+`GET /evidence/{asset_id}` 向有效管理员会话提供，并始终返回 `no-store`；文件不在静态目录中。
+
+T-301 接入真实设备凭据之前，`POST /api/v1/tasks/{id}/evidence` 的生产认证器固定拒绝全部请求。
+测试可以注入 fake 设备主体验证上传契约，但不得用管理员会话、临时 token 或共享密钥绕过该边界。

admin/cmd/server/main.go

@@ -7,8 +7,11 @@ import (
 
 	"cmbuyer/admin/internal/auth"
 	"cmbuyer/admin/internal/config"
+	"cmbuyer/admin/internal/evidence"
 	"cmbuyer/admin/internal/server"
+	evidencestorage "cmbuyer/admin/internal/storage/evidence"
 	"cmbuyer/admin/internal/storage/sqlite"
+	"cmbuyer/admin/internal/taskdetail"
 	"cmbuyer/admin/internal/tasks"
 )
 
@@ -35,12 +38,23 @@ func run() error {
 		return err
 	}
 	taskStore.SetStartPolicy(tasks.StartPolicy{AuthorizationTTL: configuration.AuthorizationTTL, MaxQuantity: configuration.MaxTaskQuantity, MaxTotalPrice: configuration.MaxTotalPrice})
+	detailStore, err := taskdetail.NewSQLiteStore(database)
+	if err != nil {
+		return err
+	}
+	evidenceStore, err := evidencestorage.NewStore(database, configuration.EvidenceDirectory)
+	if err != nil {
+		return err
+	}
 
 	router, err := server.NewRouter(server.Options{
 		AdminUsername:       configuration.AdminUsername,
 		AdminPasswordBcrypt: configuration.AdminPasswordBcrypt,
 		Sessions:            auth.NewManager(configuration.SessionSecret, configuration.CookieSecure),
 		Tasks:               taskStore,
+		TaskDetails:         detailStore,
+		Evidence:            evidenceStore,
+		DeviceAuthenticator: evidence.RejectAllDeviceAuthenticator{},
 	})
 	if err != nil {
 		return err

admin/internal/config/config.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -21,6 +22,7 @@ const (
 	authorizationTTLEnv    = "CMBUYER_AUTHORIZATION_TTL"
 	maxTaskQuantityEnv     = "CMBUYER_MAX_TASK_QUANTITY"
 	maxTotalPriceEnv       = "CMBUYER_MAX_TOTAL_PRICE"
+	evidenceDirectoryEnv   = "CMBUYER_EVIDENCE_DIR"
 	minimumSecretLength    = 32
 )
 
@@ -34,6 +36,7 @@ type Config struct {
 	AuthorizationTTL    time.Duration
 	MaxTaskQuantity     int
 	MaxTotalPrice       string
+	EvidenceDirectory   string
 }
 
 // LoadFromEnv 从进程环境读取配置。错误只指出缺失或非法的变量名，绝不回显秘密。
@@ -102,6 +105,13 @@ func Load(lookup func(string) (string, bool)) (Config, error) {
 	if !canonicalMoney(maxPrice) {
 		return Config{}, fmt.Errorf("%s must be a canonical positive decimal", maxTotalPriceEnv)
 	}
+	evidenceDirectory, err := required(lookup, evidenceDirectoryEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if strings.TrimSpace(evidenceDirectory) != evidenceDirectory || !filepath.IsAbs(evidenceDirectory) {
+		return Config{}, fmt.Errorf("%s must be an absolute path without surrounding whitespace", evidenceDirectoryEnv)
+	}
 
 	return Config{
 		AdminUsername:       username,
@@ -110,6 +120,7 @@ func Load(lookup func(string) (string, bool)) (Config, error) {
 		CookieSecure:        cookieSecure,
 		DatabaseSource:      databaseSource,
 		AuthorizationTTL:    ttl, MaxTaskQuantity: maxQuantity, MaxTotalPrice: maxPrice,
+		EvidenceDirectory: evidenceDirectory,
 	}, nil
 }
 

admin/internal/config/config_test.go

@@ -24,6 +24,7 @@ func TestLoad(t *testing.T) {
 		"CMBUYER_AUTHORIZATION_TTL":     "10m",
 		"CMBUYER_MAX_TASK_QUANTITY":     "99",
 		"CMBUYER_MAX_TOTAL_PRICE":       "999.99",
+		"CMBUYER_EVIDENCE_DIR":          t.TempDir(),
 	}
 
 	got, err := config.Load(lookup(values))
@@ -49,6 +50,7 @@ func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) {
 		"CMBUYER_AUTHORIZATION_TTL":     "10m",
 		"CMBUYER_MAX_TASK_QUANTITY":     "99",
 		"CMBUYER_MAX_TOTAL_PRICE":       "999.99",
+		"CMBUYER_EVIDENCE_DIR":          t.TempDir(),
 	}
 
 	tests := []struct {
@@ -64,6 +66,8 @@ func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) {
 		{"invalid authorization ttl", func(values map[string]string) { values["CMBUYER_AUTHORIZATION_TTL"] = "0s" }, "CMBUYER_AUTHORIZATION_TTL"},
 		{"invalid maximum quantity", func(values map[string]string) { values["CMBUYER_MAX_TASK_QUANTITY"] = "0" }, "CMBUYER_MAX_TASK_QUANTITY"},
 		{"invalid maximum total price", func(values map[string]string) { values["CMBUYER_MAX_TOTAL_PRICE"] = "1" }, "CMBUYER_MAX_TOTAL_PRICE"},
+		{"missing evidence directory", func(values map[string]string) { delete(values, "CMBUYER_EVIDENCE_DIR") }, "CMBUYER_EVIDENCE_DIR"},
+		{"relative evidence directory", func(values map[string]string) { values["CMBUYER_EVIDENCE_DIR"] = "evidence" }, "CMBUYER_EVIDENCE_DIR"},
 	}
 
 	for _, test := range tests {

admin/internal/evidence/evidence.go

@@ -0,0 +1,88 @@
+// Package evidence defines the narrow internal screenshot contract shared by HTTP and storage.
+package evidence
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"time"
+)
+
+const (
+	KindSKUPanelGate1        = "SKU_PANEL_GATE_1"
+	PrivacyInternalRaw       = "INTERNAL_RAW"
+	PNGContentType           = "image/png"
+	MaxFileBytes       int64 = 10 << 20
+	MaxImageSide             = 8192
+	MaxImagePixels           = 16_777_216
+)
+
+var (
+	ErrInvalid  = errors.New("invalid evidence")
+	ErrConflict = errors.New("evidence upload key conflict")
+	ErrNotFound = errors.New("evidence not found")
+	ErrTooLarge = errors.New("evidence file too large")
+)
+
+// DevicePrincipal is the already-authenticated device identity used only for audit and idempotency.
+type DevicePrincipal struct {
+	ID string
+}
+
+// DeviceAuthenticator deliberately has no token implementation in T-204. T-301 will supply one.
+type DeviceAuthenticator interface {
+	Authenticate(*http.Request) (DevicePrincipal, bool)
+}
+
+// RejectAllDeviceAuthenticator keeps the production upload route fail closed until T-301 wires credentials.
+type RejectAllDeviceAuthenticator struct{}
+
+func (RejectAllDeviceAuthenticator) Authenticate(*http.Request) (DevicePrincipal, bool) {
+	return DevicePrincipal{}, false
+}
+
+type UploadMetadata struct {
+	UploadKey   string
+	TaskID      string
+	AttemptID   string
+	Kind        string
+	PrivacyTier string
+	SHA256      string
+	CapturedAt  time.Time
+}
+
+// StagedFile contains only server-generated state. Multipart filenames and client paths never enter this type.
+type StagedFile struct {
+	Path        string
+	SHA256      string
+	ByteSize    int64
+	ContentType string
+	Width       int
+	Height      int
+}
+
+type Asset struct {
+	ID                 string    `json:"asset_id"`
+	TaskID             string    `json:"task_id"`
+	AttemptID          string    `json:"attempt_id"`
+	Kind               string    `json:"kind"`
+	PrivacyTier        string    `json:"privacy_tier"`
+	SHA256             string    `json:"sha256"`
+	ByteSize           int64     `json:"byte_size"`
+	ContentType        string    `json:"content_type"`
+	Width              int       `json:"width_px"`
+	Height             int       `json:"height_px"`
+	CapturedAt         time.Time `json:"captured_at"`
+	UploadedByDeviceID string    `json:"-"`
+	StorageKey         string    `json:"-"`
+	CreatedAt          time.Time `json:"-"`
+}
+
+// Store separates bounded multipart staging from metadata commit so field order cannot weaken validation.
+type Store interface {
+	Stage(io.Reader, string) (StagedFile, error)
+	Discard(StagedFile)
+	Commit(context.Context, DevicePrincipal, UploadMetadata, StagedFile) (Asset, bool, error)
+	Open(context.Context, string) (Asset, io.ReadSeekCloser, error)
+}

admin/internal/migrations/migrations_test.go

@@ -26,18 +26,25 @@ func TestUpDownAndIdempotence(t *testing.T) {
 	if err := migrations.Up(context, database, directory); err != nil {
 		t.Fatalf("apply migrations: %v", err)
 	}
-	assertVersion(t, database, 2)
+	assertVersion(t, database, 3)
 	assertTableExists(t, database, "tasks", true)
 	assertTableExists(t, database, "spec_trials", false)
 	assertTableExists(t, database, "order_authorizations", true)
 	assertTableExists(t, database, "purchase_attempts", true)
 	assertTableExists(t, database, "order_submissions", true)
+	assertTableExists(t, database, "evidence_assets", true)
 	assertTableExists(t, database, "single_pass_upgrade_guard", false)
 
 	if err := migrations.Up(context, database, directory); err != nil {
 		t.Fatalf("reapply migrations: %v", err)
 	}
+	assertVersion(t, database, 3)
+
+	if err := migrations.Down(context, database, directory); err != nil {
+		t.Fatalf("roll back evidence migration: %v", err)
+	}
 	assertVersion(t, database, 2)
+	assertTableExists(t, database, "evidence_assets", false)
 
 	if err := migrations.Down(context, database, directory); err != nil {
 		t.Fatalf("roll back v2 migration: %v", err)
@@ -50,7 +57,7 @@ func TestUpDownAndIdempotence(t *testing.T) {
 	if err := migrations.Up(context, database, directory); err != nil {
 		t.Fatalf("reapply v2 after rollback: %v", err)
 	}
-	assertVersion(t, database, 2)
+	assertVersion(t, database, 3)
 }
 
 func TestUpgradePreservesManualDraftLosslessly(t *testing.T) {
@@ -69,7 +76,7 @@ func TestUpgradePreservesManualDraftLosslessly(t *testing.T) {
 	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
 		t.Fatalf("upgrade v1 draft: %v", err)
 	}
-	assertVersion(t, database, 2)
+	assertVersion(t, database, 3)
 	var got struct {
 		id, source, sourceRef, title, goodsID, color, size, maxPrice, assetID, status, created, updated string
 		quantity, version                                                                               int
@@ -218,6 +225,55 @@ func TestV2SchemaConstraintsAndRelationships(t *testing.T) {
 	}
 }
 
+func TestEvidenceSchemaConstraintsAndDowngradeGuard(t *testing.T) {
+	database := openTestDatabase(t)
+	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
+		t.Fatalf("apply migrations: %v", err)
+	}
+	insertV2Task(t, database, "task-one", "MANUAL", "DRAFT")
+	insertV2Authorization(t, database, "auth-one", "task-one", 1, "start-one")
+	insertV2Attempt(t, database, "attempt-one", "task-one", "auth-one", 1)
+	insertV2Task(t, database, "task-two", "MANUAL", "DRAFT")
+	insertV2Authorization(t, database, "auth-two", "task-two", 1, "start-two")
+	insertV2Attempt(t, database, "attempt-two", "task-two", "auth-two", 1)
+	hash := strings.Repeat("a", 64)
+	insert := `INSERT INTO evidence_assets (id, upload_key, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+	validArgs := []any{"asset-one", "upload-one", "task-one", "attempt-one", "SKU_PANEL_GATE_1", "INTERNAL_RAW", hash, 100, "image/png", 100, 100, "aa/" + hash + ".png", "device-one", migrationTime, migrationTime}
+	if _, err := database.Exec(insert, validArgs...); err != nil {
+		t.Fatalf("insert valid evidence: %v", err)
+	}
+	for name, mutate := range map[string]func([]any){
+		"attempt from another task": func(values []any) { values[0], values[1], values[3] = "bad-task", "upload-bad-task", "attempt-two" },
+		"unapproved kind":           func(values []any) { values[0], values[1], values[4] = "bad-kind", "upload-bad-kind", "ORDER_CONFIRM" },
+		"wrong privacy":             func(values []any) { values[0], values[1], values[5] = "bad-privacy", "upload-bad-privacy", "PUBLIC" },
+		"uppercase hash": func(values []any) {
+			values[0], values[1], values[6], values[11] = "bad-hash", "upload-bad-hash", strings.Repeat("A", 64), "AA/"+strings.Repeat("A", 64)+".png"
+		},
+		"too many pixels": func(values []any) {
+			values[0], values[1], values[9], values[10] = "bad-pixels", "upload-bad-pixels", 8192, 8192
+		},
+		"client path": func(values []any) { values[0], values[1], values[11] = "bad-path", "upload-bad-path", `..\secret.png` },
+	} {
+		t.Run(name, func(t *testing.T) {
+			values := append([]any(nil), validArgs...)
+			mutate(values)
+			if _, err := database.Exec(insert, values...); err == nil {
+				t.Fatal("invalid evidence row succeeded")
+			}
+		})
+	}
+
+	if err := migrations.Down(context.Background(), database, migrationDirectory(t)); err == nil {
+		t.Fatal("evidence-bearing schema downgraded successfully")
+	}
+	assertVersion(t, database, 3)
+	assertTableExists(t, database, "evidence_assets", true)
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 1 {
+		t.Fatalf("evidence after rejected downgrade = %d, err=%v", count, err)
+	}
+}
+
 func TestDowngradeRejectsV2BusinessDataAtomically(t *testing.T) {
 	tests := []struct {
 		name  string
@@ -244,9 +300,7 @@ func TestDowngradeRejectsV2BusinessDataAtomically(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			database := openTestDatabase(t)
-			if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
-				t.Fatalf("apply migrations: %v", err)
-			}
+			migrateToV2(t, database)
 			test.setup(t, database)
 			before := v2RowCount(t, database)
 			if err := migrations.Down(context.Background(), database, migrationDirectory(t)); err == nil {
@@ -271,6 +325,17 @@ func migrateToV1(t *testing.T, database *sql.DB) {
 	assertVersion(t, database, 1)
 }
 
+func migrateToV2(t *testing.T, database *sql.DB) {
+	t.Helper()
+	if err := migrations.Run(context.Background(), database, migrationDirectory(t), "up-by-one"); err != nil {
+		t.Fatalf("apply v1: %v", err)
+	}
+	if err := migrations.Run(context.Background(), database, migrationDirectory(t), "up-by-one"); err != nil {
+		t.Fatalf("apply v2: %v", err)
+	}
+	assertVersion(t, database, 2)
+}
+
 func insertV1Task(t *testing.T, database *sql.DB, id, source, status, price string) {
 	t.Helper()
 	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, created_at, updated_at) VALUES (?, ?, 'title', 'goods', 'white', 'XL', 1, ?, ?, ?, ?)`, id, source, price, status, migrationTime, migrationTime); err != nil {
@@ -390,12 +455,14 @@ func assertColumnType(t *testing.T, database *sql.DB, table, column, want string
 	}
 }
 
-func TestV2MigrationSQLDoesNotDisableForeignKeys(t *testing.T) {
-	contents, err := os.ReadFile(filepath.Join(migrationDirectory(t), "00002_single_pass_model.sql"))
-	if err != nil {
-		t.Fatalf("read migration: %v", err)
-	}
-	if strings.Contains(strings.ToUpper(string(contents)), "PRAGMA FOREIGN_KEYS = OFF") {
-		t.Fatal("migration disables foreign keys")
+func TestMigrationsDoNotDisableForeignKeys(t *testing.T) {
+	for _, name := range []string{"00002_single_pass_model.sql", "00003_evidence_assets.sql"} {
+		contents, err := os.ReadFile(filepath.Join(migrationDirectory(t), name))
+		if err != nil {
+			t.Fatalf("read %s: %v", name, err)
+		}
+		if strings.Contains(strings.ToUpper(string(contents)), "PRAGMA FOREIGN_KEYS = OFF") {
+			t.Fatalf("%s disables foreign keys", name)
+		}
 	}
 }

admin/internal/server/evidence.go

@@ -0,0 +1,193 @@
+package server
+
+import (
+	"errors"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"cmbuyer/admin/internal/evidence"
+
+	"github.com/gin-gonic/gin"
+)
+
+const (
+	maxEvidenceRequestBytes = evidence.MaxFileBytes + 64<<10
+	maxEvidenceFieldBytes   = 4 << 10
+)
+
+var evidenceFieldNames = map[string]struct{}{
+	"upload_key": {}, "attempt_id": {}, "kind": {}, "privacy_tier": {}, "sha256": {}, "captured_at": {},
+}
+
+func uploadEvidence(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		// Authentication deliberately precedes content-type parsing and every body read. A rejected
+		// device must not make the service spool or inspect a potentially sensitive upload.
+		principal, authenticated := options.DeviceAuthenticator.Authenticate(context.Request)
+		if !authenticated {
+			context.Status(http.StatusUnauthorized)
+			return
+		}
+
+		boundary, ok := multipartBoundary(context.GetHeader("Content-Type"))
+		if !ok {
+			context.Status(http.StatusUnsupportedMediaType)
+			return
+		}
+		context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxEvidenceRequestBytes)
+		reader := multipart.NewReader(context.Request.Body, boundary)
+		fields := make(map[string]string, len(evidenceFieldNames))
+		var staged evidence.StagedFile
+		hasFile := false
+		discard := func() {
+			if hasFile {
+				options.Evidence.Discard(staged)
+			}
+		}
+
+		for {
+			part, err := reader.NextPart()
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			if err != nil {
+				discard()
+				writeMultipartError(context, err)
+				return
+			}
+			name := part.FormName()
+			if name == "file" {
+				if hasFile || part.FileName() == "" || !exactPNGContentType(part.Header.Get("Content-Type")) {
+					_ = part.Close()
+					discard()
+					context.Status(http.StatusUnsupportedMediaType)
+					return
+				}
+				staged, err = options.Evidence.Stage(part, evidence.PNGContentType)
+				_ = part.Close()
+				if err != nil {
+					writeEvidenceStoreError(context, err)
+					return
+				}
+				hasFile = true
+				continue
+			}
+			if _, allowed := evidenceFieldNames[name]; !allowed || part.FileName() != "" {
+				_ = part.Close()
+				discard()
+				context.Status(http.StatusBadRequest)
+				return
+			}
+			if _, duplicate := fields[name]; duplicate {
+				_ = part.Close()
+				discard()
+				context.Status(http.StatusBadRequest)
+				return
+			}
+			value, err := io.ReadAll(io.LimitReader(part, maxEvidenceFieldBytes+1))
+			_ = part.Close()
+			if err != nil || len(value) == 0 || len(value) > maxEvidenceFieldBytes || !utf8.Valid(value) {
+				discard()
+				context.Status(http.StatusBadRequest)
+				return
+			}
+			fields[name] = string(value)
+		}
+		if !hasFile || len(fields) != len(evidenceFieldNames) {
+			discard()
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		captured, err := time.Parse(time.RFC3339Nano, fields["captured_at"])
+		if err != nil || !strings.HasSuffix(fields["captured_at"], "Z") {
+			discard()
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		asset, replayed, err := options.Evidence.Commit(context.Request.Context(), principal, evidence.UploadMetadata{
+			UploadKey: fields["upload_key"], TaskID: context.Param("id"), AttemptID: fields["attempt_id"],
+			Kind: fields["kind"], PrivacyTier: fields["privacy_tier"], SHA256: fields["sha256"], CapturedAt: captured.UTC(),
+		}, staged)
+		if err != nil {
+			writeEvidenceStoreError(context, err)
+			return
+		}
+		status := http.StatusCreated
+		if replayed {
+			status = http.StatusOK
+		}
+		context.JSON(status, asset)
+	}
+}
+
+func readEvidence(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Status(http.StatusUnauthorized)
+			return
+		}
+		asset, file, err := options.Evidence.Open(context.Request.Context(), context.Param("asset_id"))
+		if errors.Is(err, evidence.ErrNotFound) {
+			context.Status(http.StatusNotFound)
+			return
+		}
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		defer file.Close()
+		context.Header("Content-Type", evidence.PNGContentType)
+		context.Header("Content-Length", strconv.FormatInt(asset.ByteSize, 10))
+		context.Header("Content-Disposition", `inline; filename="evidence.png"`)
+		context.Header("Cache-Control", "no-store")
+		context.Header("X-Content-Type-Options", "nosniff")
+		context.Status(http.StatusOK)
+		if _, err := io.Copy(context.Writer, file); err != nil {
+			_ = context.Error(err)
+		}
+	}
+}
+
+func multipartBoundary(value string) (string, bool) {
+	mediaType, parameters, err := mime.ParseMediaType(value)
+	if err != nil || mediaType != "multipart/form-data" || len(parameters) != 1 || parameters["boundary"] == "" {
+		return "", false
+	}
+	return parameters["boundary"], true
+}
+
+func exactPNGContentType(value string) bool {
+	mediaType, parameters, err := mime.ParseMediaType(value)
+	return err == nil && mediaType == evidence.PNGContentType && len(parameters) == 0
+}
+
+func writeMultipartError(context *gin.Context, err error) {
+	var tooLarge *http.MaxBytesError
+	if errors.As(err, &tooLarge) {
+		context.Status(http.StatusRequestEntityTooLarge)
+		return
+	}
+	context.Status(http.StatusBadRequest)
+}
+
+func writeEvidenceStoreError(context *gin.Context, err error) {
+	var tooLarge *http.MaxBytesError
+	switch {
+	case errors.As(err, &tooLarge):
+		context.Status(http.StatusRequestEntityTooLarge)
+	case errors.Is(err, evidence.ErrTooLarge):
+		context.Status(http.StatusRequestEntityTooLarge)
+	case errors.Is(err, evidence.ErrInvalid):
+		context.Status(http.StatusBadRequest)
+	case errors.Is(err, evidence.ErrConflict):
+		context.Status(http.StatusConflict)
+	default:
+		context.Status(http.StatusInternalServerError)
+	}
+}

admin/internal/server/evidence_test.go

@@ -0,0 +1,290 @@
+package server_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"image"
+	"image/png"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"net/textproto"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/migrations"
+	evidencestorage "cmbuyer/admin/internal/storage/evidence"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const (
+	evidenceTaskID    = "63c9f507-7473-4fa6-8d71-8786c34c6301"
+	evidenceAuthID    = "73c9f507-7473-4fa6-8d71-8786c34c6301"
+	evidenceAttemptID = "83c9f507-7473-4fa6-8d71-8786c34c6301"
+	evidenceUploadKey = "93c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestEvidenceUploadAuthenticatesBeforeReadingBody(t *testing.T) {
+	authenticator := &fakeDeviceAuthenticator{}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, emptyDetailStore{}, emptyEvidenceStore{}, authenticator)
+	poison := &poisonBody{}
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+evidenceTaskID+"/evidence", nil)
+	request.Body = poison
+	request.Header.Set("Content-Type", "text/plain")
+	response := httptest.NewRecorder()
+
+	router.ServeHTTP(response, request)
+
+	if response.Code != http.StatusUnauthorized || poison.reads != 0 || authenticator.calls != 1 {
+		t.Fatalf("status/reads/auth calls = %d/%d/%d, want 401/0/1", response.Code, poison.reads, authenticator.calls)
+	}
+	assertSecurityHeaders(t, response)
+}
+
+func TestAdminSessionCannotActAsDeviceUploader(t *testing.T) {
+	router, _ := newRouter(t)
+	cookie := authenticate(t, router)
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+evidenceTaskID+"/evidence", nil)
+	request.Body = &poisonBody{}
+	request.AddCookie(cookie)
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusUnauthorized {
+		t.Fatalf("admin upload status = %d, want 401", response.Code)
+	}
+}
+
+func TestEvidenceUploadReplayConflictAndProtectedRead(t *testing.T) {
+	router, database := newEvidenceRouter(t, &fakeDeviceAuthenticator{allowed: true, principal: evidence.DevicePrincipal{ID: "device-one"}})
+	pngBytes := serverTestPNG(t, 6, 4)
+	fields := validEvidenceFields(pngBytes)
+
+	first := serveEvidenceUpload(t, router, evidenceTaskID, fields, pngBytes, evidence.PNGContentType, `..\private\original.png`, nil)
+	if first.Code != http.StatusCreated {
+		t.Fatalf("first upload status/body = %d/%q", first.Code, first.Body.String())
+	}
+	var asset evidence.Asset
+	if err := json.Unmarshal(first.Body.Bytes(), &asset); err != nil {
+		t.Fatalf("decode upload response: %v", err)
+	}
+	if asset.TaskID != evidenceTaskID || asset.AttemptID != evidenceAttemptID || asset.SHA256 != fields["sha256"] || strings.Contains(first.Body.String(), "private") || strings.Contains(first.Body.String(), "original.png") {
+		t.Fatalf("unsafe upload response = %s", first.Body.String())
+	}
+
+	replay := serveEvidenceUpload(t, router, evidenceTaskID, fields, pngBytes, evidence.PNGContentType, "again.png", nil)
+	if replay.Code != http.StatusOK {
+		t.Fatalf("replay status = %d, want 200", replay.Code)
+	}
+	var replayed evidence.Asset
+	if err := json.Unmarshal(replay.Body.Bytes(), &replayed); err != nil || replayed.ID != asset.ID {
+		t.Fatalf("replay asset = %#v, err %v", replayed, err)
+	}
+
+	conflicting := copyStringMap(fields)
+	conflicting["captured_at"] = "2026-08-04T09:01:01Z"
+	if response := serveEvidenceUpload(t, router, evidenceTaskID, conflicting, pngBytes, evidence.PNGContentType, "same.png", nil); response.Code != http.StatusConflict {
+		t.Fatalf("conflicting replay status = %d, want 409", response.Code)
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 1 {
+		t.Fatalf("asset count = %d, err %v", count, err)
+	}
+
+	if response := serve(router, http.MethodGet, "/evidence/"+asset.ID, nil, nil); response.Code != http.StatusUnauthorized || response.Body.Len() != 0 {
+		t.Fatalf("anonymous read = %d/%q", response.Code, response.Body.String())
+	}
+	adminCookie := authenticate(t, router)
+	read := serve(router, http.MethodGet, "/evidence/"+asset.ID, nil, adminCookie)
+	if read.Code != http.StatusOK || !bytes.Equal(read.Body.Bytes(), pngBytes) {
+		t.Fatalf("admin read = %d, bytes equal %t", read.Code, bytes.Equal(read.Body.Bytes(), pngBytes))
+	}
+	for header, want := range map[string]string{"Content-Type": "image/png", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", "Content-Disposition": `inline; filename="evidence.png"`} {
+		if got := read.Header().Get(header); got != want {
+			t.Fatalf("%s = %q, want %q", header, got, want)
+		}
+	}
+	missing := serve(router, http.MethodGet, "/evidence/not-a-uuid", nil, adminCookie)
+	if missing.Code != http.StatusNotFound || missing.Body.Len() != 0 {
+		t.Fatalf("missing evidence = %d/%q", missing.Code, missing.Body.String())
+	}
+}
+
+func TestEvidenceUploadRejectsStrictMultipartViolations(t *testing.T) {
+	router, database := newEvidenceRouter(t, &fakeDeviceAuthenticator{allowed: true, principal: evidence.DevicePrincipal{ID: "device-one"}})
+	pngBytes := serverTestPNG(t, 2, 2)
+	base := validEvidenceFields(pngBytes)
+	wrongHash := copyStringMap(base)
+	wrongHash["sha256"] = strings.Repeat("b", 64)
+	uppercaseHash := copyStringMap(base)
+	uppercaseHash["sha256"] = strings.ToUpper(uppercaseHash["sha256"])
+	wrongPrivacy := copyStringMap(base)
+	wrongPrivacy["privacy_tier"] = "PUBLIC"
+	wrongKind := copyStringMap(base)
+	wrongKind["kind"] = "ORDER_CONFIRM"
+	tests := []struct {
+		name        string
+		fields      map[string]string
+		file        []byte
+		contentType string
+		extra       func(*multipart.Writer) error
+		want        int
+	}{
+		{name: "attempt belongs to another task", fields: base, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "xml file", fields: base, file: []byte("<hierarchy/>"), contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "wrong hash", fields: wrongHash, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "uppercase hash", fields: uppercaseHash, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "wrong privacy", fields: wrongPrivacy, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "unapproved kind", fields: wrongKind, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "too large", fields: base, file: make([]byte, evidence.MaxFileBytes+1), contentType: evidence.PNGContentType, want: http.StatusRequestEntityTooLarge},
+		{name: "wrong file content type", fields: base, file: pngBytes, contentType: "application/xml", want: http.StatusUnsupportedMediaType},
+		{name: "unknown path field", fields: base, file: pngBytes, contentType: evidence.PNGContentType, extra: func(writer *multipart.Writer) error { return writer.WriteField("path", `C:\secret.xml`) }, want: http.StatusBadRequest},
+		{name: "duplicate metadata", fields: base, file: pngBytes, contentType: evidence.PNGContentType, extra: func(writer *multipart.Writer) error { return writer.WriteField("sha256", base["sha256"]) }, want: http.StatusBadRequest},
+		{name: "second file", fields: base, file: pngBytes, contentType: evidence.PNGContentType, extra: func(writer *multipart.Writer) error {
+			part, err := writer.CreateFormFile("file", "second.png")
+			if err == nil {
+				_, err = part.Write(pngBytes)
+			}
+			return err
+		}, want: http.StatusUnsupportedMediaType},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			taskID := evidenceTaskID
+			if test.name == "attempt belongs to another task" {
+				taskID = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+			}
+			response := serveEvidenceUpload(t, router, taskID, copyStringMap(test.fields), test.file, test.contentType, "file.png", test.extra)
+			if response.Code != test.want || response.Body.Len() != 0 {
+				t.Fatalf("status/body = %d/%q, want %d/empty", response.Code, response.Body.String(), test.want)
+			}
+		})
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 0 {
+		t.Fatalf("invalid requests created %d assets, err %v", count, err)
+	}
+}
+
+type fakeDeviceAuthenticator struct {
+	allowed   bool
+	principal evidence.DevicePrincipal
+	calls     int
+}
+
+func (authenticator *fakeDeviceAuthenticator) Authenticate(*http.Request) (evidence.DevicePrincipal, bool) {
+	authenticator.calls++
+	return authenticator.principal, authenticator.allowed
+}
+
+type poisonBody struct{ reads int }
+
+func (body *poisonBody) Read([]byte) (int, error) {
+	body.reads++
+	return 0, io.ErrUnexpectedEOF
+}
+func (*poisonBody) Close() error { return nil }
+
+func newEvidenceRouter(t *testing.T, authenticator evidence.DeviceAuthenticator) (http.Handler, *sql.DB) {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "server-evidence.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate migration directory")
+	}
+	if err := migrations.Up(context.Background(), database, filepath.Join(filepath.Dir(file), "..", "..", "migrations")); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	insertEvidenceAttempt(t, database)
+	store, err := evidencestorage.NewStore(database, filepath.Join(t.TempDir(), "assets"))
+	if err != nil {
+		t.Fatalf("new evidence store: %v", err)
+	}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, emptyDetailStore{}, store, authenticator)
+	return router, database
+}
+
+func insertEvidenceAttempt(t *testing.T, database *sql.DB) {
+	t.Helper()
+	timestamp := "2026-08-04T00:00:00Z"
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', 'task', '123', 'black', 'M', 1, '1.00', 'DRAFT', 1, ?, ?)`, evidenceTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert task: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, 1, 'start', '123', 'black', 'M', 1, '1.00', 'ACTIVE', 'admin', ?, ?)`, evidenceAuthID, evidenceTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert authorization: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES (?, ?, ?, 1, 'CLAIMED', ?)`, evidenceAttemptID, evidenceTaskID, evidenceAuthID, timestamp); err != nil {
+		t.Fatalf("insert attempt: %v", err)
+	}
+}
+
+func serveEvidenceUpload(t *testing.T, router http.Handler, taskID string, fields map[string]string, file []byte, fileContentType, filename string, extra func(*multipart.Writer) error) *httptest.ResponseRecorder {
+	t.Helper()
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	for _, name := range []string{"upload_key", "attempt_id", "kind", "privacy_tier", "sha256", "captured_at"} {
+		if err := writer.WriteField(name, fields[name]); err != nil {
+			t.Fatalf("write field %s: %v", name, err)
+		}
+	}
+	header := make(textproto.MIMEHeader)
+	header.Set("Content-Disposition", `form-data; name="file"; filename="`+filename+`"`)
+	header.Set("Content-Type", fileContentType)
+	part, err := writer.CreatePart(header)
+	if err != nil {
+		t.Fatalf("create file part: %v", err)
+	}
+	if _, err := part.Write(file); err != nil {
+		t.Fatalf("write file: %v", err)
+	}
+	if extra != nil {
+		if err := extra(writer); err != nil {
+			t.Fatalf("write extra part: %v", err)
+		}
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close multipart: %v", err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+taskID+"/evidence", bytes.NewReader(body.Bytes()))
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	return response
+}
+
+func validEvidenceFields(pngBytes []byte) map[string]string {
+	hash := sha256.Sum256(pngBytes)
+	return map[string]string{
+		"upload_key": evidenceUploadKey, "attempt_id": evidenceAttemptID,
+		"kind": evidence.KindSKUPanelGate1, "privacy_tier": evidence.PrivacyInternalRaw,
+		"sha256": hex.EncodeToString(hash[:]), "captured_at": "2026-08-04T09:01:00Z",
+	}
+}
+
+func serverTestPNG(t *testing.T, width, height int) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	if err := png.Encode(&buffer, image.NewNRGBA(image.Rect(0, 0, width, height))); err != nil {
+		t.Fatalf("encode PNG: %v", err)
+	}
+	return buffer.Bytes()
+}
+
+func copyStringMap(values map[string]string) map[string]string {
+	copy := make(map[string]string, len(values))
+	for key, value := range values {
+		copy[key] = value
+	}
+	return copy
+}

admin/internal/server/router.go

@@ -14,6 +14,8 @@ import (
 	"unicode/utf8"
 
 	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/taskdetail"
 	"cmbuyer/admin/internal/tasks"
 	"cmbuyer/admin/internal/transport/webui"
 
@@ -30,11 +32,14 @@ type Options struct {
 	AdminPasswordBcrypt string
 	Sessions            *auth.Manager
 	Tasks               tasks.Store
+	TaskDetails         taskdetail.Store
+	Evidence            evidence.Store
+	DeviceAuthenticator evidence.DeviceAuthenticator
 }
 
 // NewRouter 返回当前服务范围内的完整 HTTP 路由。
 func NewRouter(options Options) (*gin.Engine, error) {
-	if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil || options.Tasks == nil {
+	if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil || options.Tasks == nil || options.TaskDetails == nil || options.Evidence == nil || options.DeviceAuthenticator == nil {
 		return nil, errors.New("server authentication options are incomplete")
 	}
 
@@ -46,9 +51,12 @@ func NewRouter(options Options) (*gin.Engine, error) {
 	router.POST("/login", login(options))
 	router.POST("/logout", logout(options))
 	router.GET("/tasks", tasksPage(options))
+	router.GET("/tasks/:id", taskDetailPage(options))
 	router.GET("/tasks/new", newTaskPage(options))
 	router.POST("/tasks", createTask(options))
 	router.POST("/tasks/start-purchases", startPurchases(options))
+	router.POST("/api/v1/tasks/:id/evidence", uploadEvidence(options))
+	router.GET("/evidence/:asset_id", readEvidence(options))
 	router.GET("/static/tasks.js", func(context *gin.Context) {
 		context.Data(http.StatusOK, "application/javascript; charset=utf-8", webui.TasksScript())
 	})

admin/internal/server/router_test.go

@@ -2,6 +2,7 @@ package server_test
 
 import (
 	"context"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -11,7 +12,9 @@ import (
 	"time"
 
 	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/evidence"
 	"cmbuyer/admin/internal/server"
+	"cmbuyer/admin/internal/taskdetail"
 	"cmbuyer/admin/internal/tasks"
 
 	"github.com/gin-gonic/gin"
@@ -316,6 +319,10 @@ func TestTasksPageKeepsOriginalShellAndRendersFilteredWorkbench(t *testing.T) {
 		`创建时间（上海）`,
 		`https://mobile.yangkeduo.com/goods.html?goods_id=937122477375`,
 		`target="_blank" rel="noopener noreferrer"`,
+		`data-task-row data-detail-url="/tasks/b3c9f507-7473-4fa6-8d71-8786c34c6301" tabindex="0"`,
+		`data-open-detail>查看详情</button>`,
+		`.detail-link-button{display:block;min-height:44px`,
+		`data-detail-drawer aria-modal="true"`,
 		`待开始`,
 		`已授权待领取`,
 		`datetime="2026-08-04T09:02:03&#43;08:00">2026-08-04 09:02`,
@@ -481,6 +488,10 @@ func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
 }
 
 func newRouterWithStore(t *testing.T, store tasks.Store) (*gin.Engine, *auth.Manager) {
+	return newRouterWithDependencies(t, store, emptyDetailStore{}, emptyEvidenceStore{}, evidence.RejectAllDeviceAuthenticator{})
+}
+
+func newRouterWithDependencies(t *testing.T, store tasks.Store, details taskdetail.Store, evidenceStore evidence.Store, deviceAuthenticator evidence.DeviceAuthenticator) (*gin.Engine, *auth.Manager) {
 	t.Helper()
 	gin.SetMode(gin.TestMode)
 	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
@@ -493,6 +504,9 @@ func newRouterWithStore(t *testing.T, store tasks.Store) (*gin.Engine, *auth.Man
 		AdminPasswordBcrypt: string(hash),
 		Sessions:            manager,
 		Tasks:               store,
+		TaskDetails:         details,
+		Evidence:            evidenceStore,
+		DeviceAuthenticator: deviceAuthenticator,
 	})
 	if err != nil {
 		t.Fatalf("NewRouter: %v", err)
@@ -500,6 +514,25 @@ func newRouterWithStore(t *testing.T, store tasks.Store) (*gin.Engine, *auth.Man
 	return router, manager
 }
 
+type emptyDetailStore struct{}
+
+func (emptyDetailStore) Get(context.Context, string) (taskdetail.Detail, error) {
+	return taskdetail.Detail{}, taskdetail.ErrNotFound
+}
+
+type emptyEvidenceStore struct{}
+
+func (emptyEvidenceStore) Stage(io.Reader, string) (evidence.StagedFile, error) {
+	return evidence.StagedFile{}, evidence.ErrInvalid
+}
+func (emptyEvidenceStore) Discard(evidence.StagedFile) {}
+func (emptyEvidenceStore) Commit(context.Context, evidence.DevicePrincipal, evidence.UploadMetadata, evidence.StagedFile) (evidence.Asset, bool, error) {
+	return evidence.Asset{}, false, evidence.ErrInvalid
+}
+func (emptyEvidenceStore) Open(context.Context, string) (evidence.Asset, io.ReadSeekCloser, error) {
+	return evidence.Asset{}, nil, evidence.ErrNotFound
+}
+
 type memoryStore struct {
 	drafts          []tasks.Draft
 	rows            []tasks.TaskRow

admin/internal/server/task_detail.go

@@ -0,0 +1,84 @@
+package server
+
+import (
+	"errors"
+	"mime"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"cmbuyer/admin/internal/taskdetail"
+	"cmbuyer/admin/internal/transport/webui"
+
+	"github.com/gin-gonic/gin"
+)
+
+const detailViewHeader = "X-CMBuyer-View"
+const detailVaryHeader = "X-CMBuyer-View, Accept, Sec-Fetch-Site"
+
+func taskDetailPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		context.Header("Vary", detailVaryHeader)
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Redirect(http.StatusSeeOther, "/login?return_to="+url.QueryEscape(context.Request.URL.RequestURI()))
+			return
+		}
+		view := context.GetHeader(detailViewHeader)
+		if view != "" && view != "drawer" {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		if view == "drawer" {
+			if context.GetHeader("Sec-Fetch-Site") != "same-origin" {
+				context.Status(http.StatusForbidden)
+				return
+			}
+			if !acceptsHTML(context.GetHeader("Accept")) {
+				context.Status(http.StatusNotAcceptable)
+				return
+			}
+		}
+		detail, err := options.TaskDetails.Get(context.Request.Context(), context.Param("id"))
+		if errors.Is(err, taskdetail.ErrNotFound) {
+			context.Status(http.StatusNotFound)
+			return
+		}
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		context.Header("Content-Type", "text/html; charset=utf-8")
+		context.Status(http.StatusOK)
+		data := webui.TaskDetailData{Detail: detail}
+		if view == "drawer" {
+			if err := webui.RenderTaskDetailFragment(context.Writer, data); err != nil {
+				_ = context.Error(err)
+			}
+			return
+		}
+		if err := webui.RenderTaskDetailPage(context.Writer, data); err != nil {
+			_ = context.Error(err)
+		}
+	}
+}
+
+func acceptsHTML(header string) bool {
+	for _, value := range strings.Split(header, ",") {
+		mediaType, parameters, err := mime.ParseMediaType(strings.TrimSpace(value))
+		if err != nil || !strings.EqualFold(mediaType, "text/html") {
+			continue
+		}
+		quality := 1.0
+		if rawQuality, exists := parameters["q"]; exists {
+			quality, err = strconv.ParseFloat(rawQuality, 64)
+			if err != nil || quality < 0 || quality > 1 {
+				continue
+			}
+		}
+		if quality > 0 {
+			return true
+		}
+	}
+	return false
+}

admin/internal/server/task_detail_test.go

@@ -0,0 +1,110 @@
+package server_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/taskdetail"
+)
+
+const detailTaskID = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+
+func TestTaskDetailRequiresAdminBeforeLookup(t *testing.T) {
+	details := &recordingDetailStore{detail: taskDetailFixture()}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, details, emptyEvidenceStore{}, evidence.RejectAllDeviceAuthenticator{})
+	response := serve(router, http.MethodGet, "/tasks/"+detailTaskID, nil, nil)
+	if response.Code != http.StatusSeeOther || !strings.HasPrefix(response.Header().Get("Location"), "/login?return_to=") || details.calls != 0 {
+		t.Fatalf("anonymous detail = %d/%q, calls=%d", response.Code, response.Header().Get("Location"), details.calls)
+	}
+}
+
+func TestTaskDetailFullPageAndDrawerShareAuditContent(t *testing.T) {
+	details := &recordingDetailStore{detail: taskDetailFixture()}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, details, emptyEvidenceStore{}, evidence.RejectAllDeviceAuthenticator{})
+	cookie := authenticate(t, router)
+	full := serve(router, http.MethodGet, "/tasks/"+detailTaskID, nil, cookie)
+	if full.Code != http.StatusOK || !strings.Contains(full.Body.String(), "<!doctype html>") || !strings.Contains(full.Body.String(), `data-task-detail-content`) {
+		t.Fatalf("full detail = %d/%q", full.Code, full.Body.String())
+	}
+	request := httptest.NewRequest(http.MethodGet, "/tasks/"+detailTaskID, nil)
+	request.AddCookie(cookie)
+	request.Header.Set("X-CMBuyer-View", "drawer")
+	request.Header.Set("Accept", "text/html")
+	request.Header.Set("Sec-Fetch-Site", "same-origin")
+	fragment := httptest.NewRecorder()
+	router.ServeHTTP(fragment, request)
+	if fragment.Code != http.StatusOK || strings.Contains(fragment.Body.String(), "<!doctype html>") || !strings.Contains(fragment.Body.String(), `data-task-detail-content`) {
+		t.Fatalf("fragment detail = %d/%q", fragment.Code, fragment.Body.String())
+	}
+	for _, text := range []string{"测试&lt;script&gt;", "订单已创建，系统尚未付款", "SKU_PANEL_GATE_1", "/evidence/b3c9f507-7473-4fa6-8d71-8786c34c6301", "暂无规格、价格或数量读数", "本页没有重试、再次提交或付款动作"} {
+		if !strings.Contains(full.Body.String(), text) || !strings.Contains(fragment.Body.String(), text) {
+			t.Fatalf("shared detail missing %q", text)
+		}
+	}
+	if strings.Contains(full.Body.String(), "<script>") || strings.Contains(fragment.Body.String(), "<script>") {
+		t.Fatal("task title was not HTML escaped")
+	}
+	if got := fragment.Header().Get("Vary"); got != "X-CMBuyer-View, Accept, Sec-Fetch-Site" {
+		t.Fatalf("fragment Vary = %q", got)
+	}
+	if details.calls != 2 {
+		t.Fatalf("detail store calls = %d, want 2", details.calls)
+	}
+}
+
+func TestTaskDetailRejectsForgedFragmentAndMissingTask(t *testing.T) {
+	details := &recordingDetailStore{err: taskdetail.ErrNotFound}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, details, emptyEvidenceStore{}, evidence.RejectAllDeviceAuthenticator{})
+	cookie := authenticate(t, router)
+	for name, headers := range map[string]map[string]string{
+		"unknown view":        {"X-CMBuyer-View": "xml", "Accept": "text/html"},
+		"missing fetch site":  {"X-CMBuyer-View": "drawer", "Accept": "text/html"},
+		"cross-site drawer":   {"X-CMBuyer-View": "drawer", "Accept": "text/html", "Sec-Fetch-Site": "cross-site"},
+		"wrong accept":        {"X-CMBuyer-View": "drawer", "Accept": "application/json", "Sec-Fetch-Site": "same-origin"},
+		"html quality zero":   {"X-CMBuyer-View": "drawer", "Accept": "text/html;q=0, application/json", "Sec-Fetch-Site": "same-origin"},
+		"html substring mime": {"X-CMBuyer-View": "drawer", "Accept": "application/nottext/html", "Sec-Fetch-Site": "same-origin"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			request := httptest.NewRequest(http.MethodGet, "/tasks/"+detailTaskID, nil)
+			request.AddCookie(cookie)
+			for key, value := range headers {
+				request.Header.Set(key, value)
+			}
+			response := httptest.NewRecorder()
+			router.ServeHTTP(response, request)
+			if response.Code < 400 || response.Code >= 500 || response.Body.Len() != 0 {
+				t.Fatalf("forged fragment = %d/%q", response.Code, response.Body.String())
+			}
+		})
+	}
+	missing := serve(router, http.MethodGet, "/tasks/not-a-uuid", nil, cookie)
+	if missing.Code != http.StatusNotFound || missing.Body.Len() != 0 {
+		t.Fatalf("missing detail = %d/%q", missing.Code, missing.Body.String())
+	}
+}
+
+type recordingDetailStore struct {
+	detail taskdetail.Detail
+	err    error
+	calls  int
+}
+
+func (store *recordingDetailStore) Get(context.Context, string) (taskdetail.Detail, error) {
+	store.calls++
+	return store.detail, store.err
+}
+
+func taskDetailFixture() taskdetail.Detail {
+	started := time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)
+	return taskdetail.Detail{
+		Task:           taskdetail.Task{ID: detailTaskID, Source: "MANUAL", Title: "测试<script>", GoodsID: "937122477375", SKUColor: "黑色", SKUSize: "M", Quantity: 2, MaxTotalPrice: "30.00", Status: "WAITING_PAYMENT", Version: 3, CreatedAt: started, UpdatedAt: started},
+		Authorizations: []taskdetail.Authorization{{ID: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Status: "FENCED", CreatedBy: "admin", TotalPriceCap: "30.00", TaskVersion: 2, CreatedAt: started, ExpiresAt: started.Add(time.Hour)}},
+		Attempts:       []taskdetail.Attempt{{ID: "d3c9f507-7473-4fa6-8d71-8786c34c6301", AuthorizationID: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Status: "CLAIMED", ClaimGeneration: 1, StartedAt: started}},
+		Evidence:       []taskdetail.Evidence{{ID: "b3c9f507-7473-4fa6-8d71-8786c34c6301", AttemptID: "d3c9f507-7473-4fa6-8d71-8786c34c6301", Kind: "SKU_PANEL_GATE_1", PrivacyTier: "INTERNAL_RAW", SHA256: strings.Repeat("a", 64), ByteSize: 100, ContentType: "image/png", Width: 100, Height: 200, CapturedAt: started}},
+	}
+}

admin/internal/storage/evidence/durability_unix.go

@@ -0,0 +1,20 @@
+//go:build !windows
+
+package evidence
+
+import (
+	"fmt"
+	"os"
+)
+
+func syncDirectory(path string) error {
+	directory, err := os.Open(path)
+	if err != nil {
+		return fmt.Errorf("open directory for durability sync: %w", err)
+	}
+	defer directory.Close()
+	if err := directory.Sync(); err != nil {
+		return fmt.Errorf("sync directory metadata: %w", err)
+	}
+	return nil
+}

admin/internal/storage/evidence/durability_windows.go

@@ -0,0 +1,35 @@
+//go:build windows
+
+package evidence
+
+import (
+	"fmt"
+	"syscall"
+)
+
+// syncDirectory uses an explicit directory handle because os.Open(...).Sync is not a portable
+// Windows directory durability boundary. Any unsupported filesystem or access failure is fatal:
+// callers must not make the corresponding evidence row visible in SQLite.
+func syncDirectory(path string) error {
+	pathPointer, err := syscall.UTF16PtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("encode directory path for durability sync: %w", err)
+	}
+	handle, err := syscall.CreateFile(
+		pathPointer,
+		syscall.GENERIC_WRITE,
+		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+		nil,
+		syscall.OPEN_EXISTING,
+		syscall.FILE_FLAG_BACKUP_SEMANTICS,
+		0,
+	)
+	if err != nil {
+		return fmt.Errorf("open directory for durability sync: %w", err)
+	}
+	defer syscall.CloseHandle(handle)
+	if err := syscall.FlushFileBuffers(handle); err != nil {
+		return fmt.Errorf("flush directory metadata: %w", err)
+	}
+	return nil
+}

admin/internal/storage/evidence/store.go

@@ -0,0 +1,553 @@
+// Package evidence stores INTERNAL_RAW PNG assets outside the public web tree.
+package evidence
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"image/png"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+
+	core "cmbuyer/admin/internal/evidence"
+)
+
+var pngSignature = []byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a}
+
+type Store struct {
+	database      *sql.DB
+	root          string
+	now           func() time.Time
+	random        io.Reader
+	syncDirectory func(string) error
+	syncFile      func(*os.File) error
+	renameFile    func(string, string) error
+	commitTx      func(*sql.Tx) error
+	mu            sync.Mutex
+}
+
+func NewStore(database *sql.DB, root string) (*Store, error) {
+	return newStore(database, root, syncDirectory)
+}
+
+func newStore(database *sql.DB, root string, directorySync func(string) error) (*Store, error) {
+	if database == nil {
+		return nil, errors.New("evidence database is required")
+	}
+	if directorySync == nil {
+		return nil, errors.New("evidence directory sync is required")
+	}
+	if root == "" || !filepath.IsAbs(root) {
+		return nil, errors.New("evidence root must be an absolute path")
+	}
+	absolute, err := filepath.Abs(filepath.Clean(root))
+	if err != nil {
+		return nil, fmt.Errorf("resolve evidence root: %w", err)
+	}
+	if filepath.Dir(absolute) == absolute {
+		return nil, errors.New("evidence root cannot be a filesystem root")
+	}
+	if err := ensureDurableDirectory(absolute, 0o700, directorySync); err != nil {
+		return nil, fmt.Errorf("create evidence root: %w", err)
+	}
+	// A prior startup may have created the root and then failed its parent sync.
+	// Existence is therefore never accepted as proof that the directory entry is durable.
+	if err := directorySync(filepath.Dir(absolute)); err != nil {
+		return nil, fmt.Errorf("persist evidence root directory: %w", err)
+	}
+	if err := os.Chmod(absolute, 0o700); err != nil {
+		return nil, fmt.Errorf("protect evidence root: %w", err)
+	}
+	staging := filepath.Join(absolute, ".staging")
+	if err := ensureDurableDirectory(staging, 0o700, directorySync); err != nil {
+		return nil, fmt.Errorf("create evidence staging directory: %w", err)
+	}
+	if err := directorySync(absolute); err != nil {
+		return nil, fmt.Errorf("persist evidence staging directory: %w", err)
+	}
+	if err := os.Chmod(staging, 0o700); err != nil {
+		return nil, fmt.Errorf("protect evidence staging directory: %w", err)
+	}
+	if _, err := database.Exec("SELECT storage_key FROM evidence_assets LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("evidence migration is not available: %w", err)
+	}
+	return &Store{
+		database:      database,
+		root:          absolute,
+		now:           time.Now,
+		random:        rand.Reader,
+		syncDirectory: directorySync,
+		syncFile:      func(file *os.File) error { return file.Sync() },
+		renameFile:    os.Rename,
+		commitTx:      func(transaction *sql.Tx) error { return transaction.Commit() },
+	}, nil
+}
+
+func (store *Store) Stage(reader io.Reader, contentType string) (staged core.StagedFile, resultErr error) {
+	if reader == nil || contentType != core.PNGContentType {
+		return core.StagedFile{}, core.ErrInvalid
+	}
+	temporary, err := os.CreateTemp(filepath.Join(store.root, ".staging"), "upload-*.png")
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+	staged.Path = temporary.Name()
+	defer func() {
+		if resultErr != nil {
+			_ = temporary.Close()
+			_ = os.Remove(staged.Path)
+		}
+	}()
+	if err := temporary.Chmod(0o600); err != nil {
+		return core.StagedFile{}, err
+	}
+	hasher := sha256.New()
+	written, err := io.Copy(io.MultiWriter(temporary, hasher), io.LimitReader(reader, core.MaxFileBytes+1))
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+	if written > core.MaxFileBytes {
+		return core.StagedFile{}, core.ErrTooLarge
+	}
+	if written == 0 {
+		return core.StagedFile{}, core.ErrInvalid
+	}
+	if err := temporary.Sync(); err != nil {
+		return core.StagedFile{}, err
+	}
+	if err := temporary.Close(); err != nil {
+		return core.StagedFile{}, err
+	}
+
+	imageFile, err := os.Open(staged.Path)
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+	defer imageFile.Close()
+	width, height, err := validatePNG(imageFile)
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+
+	staged.SHA256 = hex.EncodeToString(hasher.Sum(nil))
+	staged.ByteSize = written
+	staged.ContentType = core.PNGContentType
+	staged.Width = width
+	staged.Height = height
+	return staged, nil
+}
+
+func (store *Store) Discard(staged core.StagedFile) {
+	if store.isStagedPath(staged.Path) {
+		_ = os.Remove(staged.Path)
+	}
+}
+
+func (store *Store) Commit(ctx context.Context, principal core.DevicePrincipal, metadata core.UploadMetadata, staged core.StagedFile) (core.Asset, bool, error) {
+	if !store.isStagedPath(staged.Path) || !validPrincipal(principal) || !validMetadata(metadata) || metadata.SHA256 != staged.SHA256 || staged.ContentType != core.PNGContentType || staged.ByteSize < 1 || staged.ByteSize > core.MaxFileBytes || staged.Width < 1 || staged.Height < 1 || staged.Width > core.MaxImageSide || staged.Height > core.MaxImageSide || int64(staged.Width)*int64(staged.Height) > core.MaxImagePixels {
+		store.Discard(staged)
+		return core.Asset{}, false, core.ErrInvalid
+	}
+	defer store.Discard(staged)
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	transaction, err := store.database.BeginTx(ctx, nil)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	defer transaction.Rollback()
+
+	existing, found, err := findByUploadKey(ctx, transaction, principal.ID, metadata.UploadKey)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	if found {
+		if !sameUpload(existing, principal, metadata, staged) {
+			return core.Asset{}, false, core.ErrConflict
+		}
+		if err := store.verifyStoredFile(existing); err != nil {
+			return core.Asset{}, false, err
+		}
+		if err := store.commitTx(transaction); err != nil {
+			return core.Asset{}, false, err
+		}
+		return existing, true, nil
+	}
+
+	var attemptCount int
+	if err := transaction.QueryRowContext(ctx, "SELECT COUNT(*) FROM purchase_attempts WHERE task_id = ? AND id = ?", metadata.TaskID, metadata.AttemptID).Scan(&attemptCount); err != nil {
+		return core.Asset{}, false, err
+	}
+	if attemptCount != 1 {
+		return core.Asset{}, false, core.ErrInvalid
+	}
+
+	storageKey := storageKey(metadata.SHA256)
+	finalPath, err := store.pathForKey(storageKey)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	finalDirectory := filepath.Dir(finalPath)
+	if err := ensureDurableDirectory(finalDirectory, 0o700, store.syncDirectory); err != nil {
+		return core.Asset{}, false, err
+	}
+	// Always repeat the shard-parent boundary. If an earlier attempt created this
+	// directory and its parent sync failed, a retry must not trust mere existence.
+	if err := store.syncDirectory(store.root); err != nil {
+		return core.Asset{}, false, fmt.Errorf("persist evidence shard directory: %w", err)
+	}
+	if err := os.Chmod(finalDirectory, 0o700); err != nil {
+		return core.Asset{}, false, err
+	}
+	if info, statErr := os.Stat(finalPath); statErr == nil {
+		if !info.Mode().IsRegular() || info.Size() != staged.ByteSize || fileSHA256(finalPath) != staged.SHA256 {
+			return core.Asset{}, false, errors.New("stored evidence content does not match its key")
+		}
+	} else if !errors.Is(statErr, os.ErrNotExist) {
+		return core.Asset{}, false, statErr
+	} else {
+		publishPath, err := store.preparePublishFile(staged, finalDirectory)
+		if err != nil {
+			return core.Asset{}, false, err
+		}
+		defer os.Remove(publishPath)
+		if err := store.renameFile(publishPath, finalPath); err != nil {
+			return core.Asset{}, false, err
+		}
+	}
+	// The publication file was fsynced in this shard before its same-directory rename.
+	// Persist the final directory entry before SQLite can expose a referencing row.
+	// A directory sync failure is deliberately fatal; the unreachable file may remain
+	// as an orphan, but no evidence_assets row may be committed for it.
+	if err := store.syncDirectory(finalDirectory); err != nil {
+		return core.Asset{}, false, fmt.Errorf("persist evidence directory entry: %w", err)
+	}
+
+	id, err := newUUID(store.random)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	now := store.now().UTC()
+	asset := core.Asset{
+		ID: id, TaskID: metadata.TaskID, AttemptID: metadata.AttemptID,
+		Kind: metadata.Kind, PrivacyTier: metadata.PrivacyTier, SHA256: staged.SHA256,
+		ByteSize: staged.ByteSize, ContentType: staged.ContentType, Width: staged.Width, Height: staged.Height,
+		CapturedAt: metadata.CapturedAt.UTC(), UploadedByDeviceID: principal.ID,
+		StorageKey: storageKey, CreatedAt: now,
+	}
+	_, err = transaction.ExecContext(ctx, `INSERT INTO evidence_assets
+		(id, upload_key, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		asset.ID, metadata.UploadKey, asset.TaskID, asset.AttemptID, asset.Kind, asset.PrivacyTier,
+		asset.SHA256, asset.ByteSize, asset.ContentType, asset.Width, asset.Height, asset.StorageKey,
+		asset.UploadedByDeviceID, asset.CapturedAt.Format(time.RFC3339Nano), asset.CreatedAt.Format(time.RFC3339Nano))
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	if err := store.commitTx(transaction); err != nil {
+		return core.Asset{}, false, err
+	}
+	return asset, false, nil
+}
+
+func (store *Store) Open(ctx context.Context, id string) (core.Asset, io.ReadSeekCloser, error) {
+	if !validUUID(id) {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	asset, found, err := findByID(ctx, store.database, id)
+	if err != nil {
+		return core.Asset{}, nil, err
+	}
+	if !found || asset.StorageKey != storageKey(asset.SHA256) {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	path, err := store.pathForKey(asset.StorageKey)
+	if err != nil {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	file, err := os.Open(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	if err != nil {
+		return core.Asset{}, nil, err
+	}
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() != asset.ByteSize {
+		_ = file.Close()
+		if err != nil {
+			return core.Asset{}, nil, err
+		}
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	return asset, file, nil
+}
+
+func (store *Store) verifyStoredFile(asset core.Asset) error {
+	path, err := store.pathForKey(asset.StorageKey)
+	if err != nil {
+		return err
+	}
+	info, err := os.Stat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Size() != asset.ByteSize || fileSHA256(path) != asset.SHA256 {
+		if err != nil {
+			return err
+		}
+		return errors.New("stored evidence file is invalid")
+	}
+	return nil
+}
+
+func (store *Store) isStagedPath(path string) bool {
+	if path == "" {
+		return false
+	}
+	relative, err := filepath.Rel(filepath.Join(store.root, ".staging"), filepath.Clean(path))
+	return err == nil && relative != "." && relative != "" && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator)) && !filepath.IsAbs(relative)
+}
+
+func (store *Store) pathForKey(key string) (string, error) {
+	path := filepath.Join(store.root, filepath.FromSlash(key))
+	relative, err := filepath.Rel(store.root, path)
+	if err != nil || relative == "." || relative == "" || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) || filepath.IsAbs(relative) {
+		return "", errors.New("invalid evidence storage key")
+	}
+	return path, nil
+}
+
+func (store *Store) preparePublishFile(staged core.StagedFile, directory string) (path string, resultErr error) {
+	source, err := os.Open(staged.Path)
+	if err != nil {
+		return "", err
+	}
+	defer source.Close()
+
+	temporary, err := os.CreateTemp(directory, ".publish-*.png")
+	if err != nil {
+		return "", err
+	}
+	temporaryPath := temporary.Name()
+	path = temporaryPath
+	defer func() {
+		if resultErr != nil {
+			_ = temporary.Close()
+			_ = os.Remove(temporaryPath)
+		}
+	}()
+	if err := temporary.Chmod(0o600); err != nil {
+		return "", err
+	}
+	hasher := sha256.New()
+	written, err := io.Copy(io.MultiWriter(temporary, hasher), source)
+	if err != nil {
+		return "", err
+	}
+	if written != staged.ByteSize || hex.EncodeToString(hasher.Sum(nil)) != staged.SHA256 {
+		return "", errors.New("staged evidence changed before publication")
+	}
+	width, height, err := validatePNG(temporary)
+	if err != nil {
+		return "", err
+	}
+	if width != staged.Width || height != staged.Height {
+		return "", errors.New("staged evidence dimensions changed before publication")
+	}
+	if err := store.syncFile(temporary); err != nil {
+		return "", fmt.Errorf("sync evidence publication file: %w", err)
+	}
+	if err := temporary.Close(); err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
+func validatePNG(reader io.ReadSeeker) (int, int, error) {
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return 0, 0, err
+	}
+	signature := make([]byte, len(pngSignature))
+	if _, err := io.ReadFull(reader, signature); err != nil || string(signature) != string(pngSignature) {
+		return 0, 0, core.ErrInvalid
+	}
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return 0, 0, err
+	}
+	configuration, err := png.DecodeConfig(reader)
+	if err != nil || configuration.Width < 1 || configuration.Height < 1 || configuration.Width > core.MaxImageSide || configuration.Height > core.MaxImageSide || int64(configuration.Width)*int64(configuration.Height) > core.MaxImagePixels {
+		return 0, 0, core.ErrInvalid
+	}
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return 0, 0, err
+	}
+	if _, err := png.Decode(reader); err != nil {
+		return 0, 0, core.ErrInvalid
+	}
+	var trailing [1]byte
+	if count, err := reader.Read(trailing[:]); count != 0 || !errors.Is(err, io.EOF) {
+		return 0, 0, core.ErrInvalid
+	}
+	return configuration.Width, configuration.Height, nil
+}
+
+func ensureDurableDirectory(path string, mode os.FileMode, syncParent func(string) error) error {
+	info, err := os.Stat(path)
+	if err == nil {
+		if !info.IsDir() {
+			return fmt.Errorf("path exists but is not a directory: %s", path)
+		}
+		return nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+
+	parent := filepath.Dir(path)
+	if parent == path {
+		return fmt.Errorf("cannot create filesystem root as a managed directory: %s", path)
+	}
+	if err := ensureDurableDirectory(parent, mode, syncParent); err != nil {
+		return err
+	}
+	if err := os.Mkdir(path, mode); err != nil && !errors.Is(err, os.ErrExist) {
+		return err
+	}
+	info, err = os.Stat(path)
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("path exists but is not a directory: %s", path)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		return err
+	}
+	// Syncing the parent makes creation of this directory durable. This also covers
+	// a concurrent creator: returning success without the parent sync could otherwise
+	// allow the following database transaction to outrun the directory entry.
+	if err := syncParent(parent); err != nil {
+		return fmt.Errorf("persist directory creation for %s: %w", path, err)
+	}
+	return nil
+}
+
+func storageKey(hash string) string { return hash[:2] + "/" + hash + ".png" }
+
+func validMetadata(metadata core.UploadMetadata) bool {
+	return validUUID(metadata.UploadKey) && validUUID(metadata.TaskID) && validUUID(metadata.AttemptID) && metadata.Kind == core.KindSKUPanelGate1 && metadata.PrivacyTier == core.PrivacyInternalRaw && validSHA256(metadata.SHA256) && !metadata.CapturedAt.IsZero() && metadata.CapturedAt.Location() == time.UTC
+}
+
+func validPrincipal(principal core.DevicePrincipal) bool {
+	if principal.ID == "" || strings.TrimSpace(principal.ID) != principal.ID || len(principal.ID) > 128 {
+		return false
+	}
+	for _, character := range principal.ID {
+		if unicode.IsControl(character) {
+			return false
+		}
+	}
+	return true
+}
+
+func validSHA256(value string) bool {
+	if len(value) != 64 {
+		return false
+	}
+	for _, character := range value {
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return true
+}
+
+func validUUID(value string) bool {
+	if len(value) != 36 {
+		return false
+	}
+	for index, character := range value {
+		if index == 8 || index == 13 || index == 18 || index == 23 {
+			if character != '-' {
+				return false
+			}
+			continue
+		}
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b')
+}
+
+func newUUID(reader io.Reader) (string, error) {
+	bytes := make([]byte, 16)
+	if _, err := io.ReadFull(reader, bytes); err != nil {
+		return "", err
+	}
+	bytes[6] = (bytes[6] & 0x0f) | 0x40
+	bytes[8] = (bytes[8] & 0x3f) | 0x80
+	encoded := hex.EncodeToString(bytes)
+	return encoded[:8] + "-" + encoded[8:12] + "-" + encoded[12:16] + "-" + encoded[16:20] + "-" + encoded[20:], nil
+}
+
+func fileSHA256(path string) string {
+	file, err := os.Open(path)
+	if err != nil {
+		return ""
+	}
+	defer file.Close()
+	hasher := sha256.New()
+	if _, err := io.Copy(hasher, file); err != nil {
+		return ""
+	}
+	return hex.EncodeToString(hasher.Sum(nil))
+}
+
+type rowScanner interface{ Scan(...any) error }
+
+func findByUploadKey(ctx context.Context, query interface {
+	QueryRowContext(context.Context, string, ...any) *sql.Row
+}, deviceID, uploadKey string) (core.Asset, bool, error) {
+	return scanAsset(query.QueryRowContext(ctx, `SELECT id, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at FROM evidence_assets WHERE uploaded_by_device_id = ? AND upload_key = ?`, deviceID, uploadKey))
+}
+
+func findByID(ctx context.Context, query interface {
+	QueryRowContext(context.Context, string, ...any) *sql.Row
+}, id string) (core.Asset, bool, error) {
+	return scanAsset(query.QueryRowContext(ctx, `SELECT id, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at FROM evidence_assets WHERE id = ?`, id))
+}
+
+func scanAsset(row rowScanner) (core.Asset, bool, error) {
+	var asset core.Asset
+	var captured, created string
+	err := row.Scan(&asset.ID, &asset.TaskID, &asset.AttemptID, &asset.Kind, &asset.PrivacyTier, &asset.SHA256, &asset.ByteSize, &asset.ContentType, &asset.Width, &asset.Height, &asset.StorageKey, &asset.UploadedByDeviceID, &captured, &created)
+	if errors.Is(err, sql.ErrNoRows) {
+		return core.Asset{}, false, nil
+	}
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	asset.CapturedAt, err = time.Parse(time.RFC3339Nano, captured)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	asset.CreatedAt, err = time.Parse(time.RFC3339Nano, created)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	return asset, true, nil
+}
+
+func sameUpload(asset core.Asset, principal core.DevicePrincipal, metadata core.UploadMetadata, staged core.StagedFile) bool {
+	return asset.TaskID == metadata.TaskID && asset.AttemptID == metadata.AttemptID && asset.Kind == metadata.Kind && asset.PrivacyTier == metadata.PrivacyTier && asset.SHA256 == metadata.SHA256 && asset.ByteSize == staged.ByteSize && asset.ContentType == staged.ContentType && asset.Width == staged.Width && asset.Height == staged.Height && asset.UploadedByDeviceID == principal.ID && asset.CapturedAt.Equal(metadata.CapturedAt)
+}

admin/internal/storage/evidence/store_test.go

@@ -0,0 +1,552 @@
+package evidence
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"image"
+	"image/color"
+	"image/png"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	core "cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const (
+	testTaskID    = "13c9f507-7473-4fa6-8d71-8786c34c6301"
+	testAuthID    = "23c9f507-7473-4fa6-8d71-8786c34c6301"
+	testAttemptID = "33c9f507-7473-4fa6-8d71-8786c34c6301"
+	testUploadKey = "43c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestStageCommitReplayAndOpen(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 8, 6)
+	hash := sha256Hex(pngBytes)
+	metadata := core.UploadMetadata{UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID, Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: hash, CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)}
+	principal := core.DevicePrincipal{ID: "device-one"}
+
+	staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("Stage: %v", err)
+	}
+	asset, replayed, err := store.Commit(context.Background(), principal, metadata, staged)
+	if err != nil || replayed {
+		t.Fatalf("Commit = replayed %t, err %v", replayed, err)
+	}
+	if asset.SHA256 != hash || asset.ByteSize != int64(len(pngBytes)) || asset.Width != 8 || asset.Height != 6 || asset.StorageKey != hash[:2]+"/"+hash+".png" {
+		t.Fatalf("asset = %#v", asset)
+	}
+	opened, reader, err := store.Open(context.Background(), asset.ID)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	got, err := io.ReadAll(reader)
+	_ = reader.Close()
+	if err != nil || !bytes.Equal(got, pngBytes) || opened.ID != asset.ID {
+		t.Fatalf("opened asset changed: bytes=%t asset=%#v err=%v", bytes.Equal(got, pngBytes), opened, err)
+	}
+
+	replayStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("stage replay: %v", err)
+	}
+	replayedAsset, replayed, err := store.Commit(context.Background(), principal, metadata, replayStage)
+	if err != nil || !replayed || replayedAsset.ID != asset.ID {
+		t.Fatalf("replay = %#v, %t, %v", replayedAsset, replayed, err)
+	}
+
+	conflictStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("stage conflict: %v", err)
+	}
+	conflicting := metadata
+	conflicting.CapturedAt = conflicting.CapturedAt.Add(time.Second)
+	if _, _, err := store.Commit(context.Background(), principal, conflicting, conflictStage); !errors.Is(err, core.ErrConflict) {
+		t.Fatalf("conflicting replay error = %v", err)
+	}
+}
+
+func TestConcurrentReplayCreatesOneAsset(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 3, 2)
+	metadata := core.UploadMetadata{UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID, Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: sha256Hex(pngBytes), CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)}
+	staged := make([]core.StagedFile, 2)
+	for index := range staged {
+		var err error
+		staged[index], err = store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+		if err != nil {
+			t.Fatalf("Stage %d: %v", index, err)
+		}
+	}
+	var wait sync.WaitGroup
+	wait.Add(2)
+	assets := make([]core.Asset, 2)
+	replays := make([]bool, 2)
+	errorsSeen := make([]error, 2)
+	for index := range staged {
+		go func(index int) {
+			defer wait.Done()
+			assets[index], replays[index], errorsSeen[index] = store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, metadata, staged[index])
+		}(index)
+	}
+	wait.Wait()
+	if errorsSeen[0] != nil || errorsSeen[1] != nil || assets[0].ID != assets[1].ID || replays[0] == replays[1] {
+		t.Fatalf("concurrent commits assets=%#v replays=%#v errors=%#v", assets, replays, errorsSeen)
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 1 {
+		t.Fatalf("asset count = %d, err %v", count, err)
+	}
+}
+
+func TestPlatformDirectorySync(t *testing.T) {
+	if err := syncDirectory(t.TempDir()); err != nil {
+		t.Fatalf("syncDirectory must either establish the durability boundary or fail closed: %v", err)
+	}
+}
+
+func TestNewStoreRetriesRootParentSyncWhenRootAlreadyExists(t *testing.T) {
+	database, _ := newTestStore(t)
+	parent := t.TempDir()
+	root := filepath.Join(parent, "retry-root")
+	injected := errors.New("injected root parent sync failure")
+	if _, err := newStore(database, root, func(string) error { return injected }); !errors.Is(err, injected) {
+		t.Fatalf("first newStore error = %v, want injected root sync failure", err)
+	}
+	if info, err := os.Stat(root); err != nil || !info.IsDir() {
+		t.Fatalf("failed parent sync must leave root for retry: info=%v err=%v", info, err)
+	}
+
+	var paths []string
+	store, err := newStore(database, root, func(path string) error {
+		paths = append(paths, path)
+		return syncDirectory(path)
+	})
+	if err != nil {
+		t.Fatalf("retry newStore: %v", err)
+	}
+	if store == nil || len(paths) == 0 || paths[0] != parent {
+		t.Fatalf("retry sync paths = %#v, want root parent %q first", paths, parent)
+	}
+}
+
+func TestCommitSyncsShardAndRenameBeforeDatabaseWrite(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 4, 3)
+	hash := sha256Hex(pngBytes)
+	metadata := testMetadata(hash)
+	staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("Stage: %v", err)
+	}
+	finalPath, err := store.pathForKey(storageKey(hash))
+	if err != nil {
+		t.Fatalf("final path: %v", err)
+	}
+	finalDirectory := filepath.Dir(finalPath)
+	var events []string
+	store.syncDirectory = func(path string) error {
+		var count int
+		if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil {
+			t.Fatalf("count evidence before directory sync: %v", err)
+		}
+		if count != 0 {
+			t.Fatalf("database row became visible before directory sync: %d", count)
+		}
+		switch path {
+		case store.root:
+			events = append(events, "sync-root")
+			if path != store.root {
+				t.Fatalf("shard parent sync path = %q, want evidence root %q", path, store.root)
+			}
+			if info, err := os.Stat(finalDirectory); err != nil || !info.IsDir() {
+				t.Fatalf("shard directory must exist before parent sync: info=%v err=%v", info, err)
+			}
+			if _, err := os.Stat(finalPath); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("final file exists before publication: %v", err)
+			}
+		case finalDirectory:
+			events = append(events, "sync-shard")
+			if info, err := os.Stat(finalPath); err != nil || !info.Mode().IsRegular() {
+				t.Fatalf("renamed file must exist before shard sync: info=%v err=%v", info, err)
+			}
+		default:
+			t.Fatalf("unexpected extra directory sync: %q", path)
+		}
+		return syncDirectory(path)
+	}
+	store.syncFile = func(file *os.File) error {
+		if filepath.Dir(file.Name()) != finalDirectory || !strings.HasPrefix(filepath.Base(file.Name()), ".publish-") {
+			t.Fatalf("publication temp is not inside shard: %q", file.Name())
+		}
+		events = append(events, "sync-file")
+		return file.Sync()
+	}
+	store.renameFile = func(oldPath, newPath string) error {
+		if filepath.Dir(oldPath) != filepath.Dir(newPath) || newPath != finalPath {
+			t.Fatalf("rename is not same-directory publication: %q -> %q", oldPath, newPath)
+		}
+		events = append(events, "rename")
+		return os.Rename(oldPath, newPath)
+	}
+
+	if _, replayed, err := store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, metadata, staged); err != nil || replayed {
+		t.Fatalf("Commit = replayed %t, err %v", replayed, err)
+	}
+	if got, want := strings.Join(events, ","), "sync-root,sync-root,sync-file,rename,sync-shard"; got != want {
+		t.Fatalf("durability order = %q, want %q", got, want)
+	}
+	assertEvidenceCount(t, database, 1)
+	assertNoPublishTemps(t, finalDirectory)
+}
+
+func TestCommitDirectorySyncFailuresNeverWriteDatabase(t *testing.T) {
+	for _, failAt := range []int{1, 2, 3} {
+		t.Run(map[int]string{1: "new shard parent", 2: "unconditional shard parent", 3: "rename target"}[failAt], func(t *testing.T) {
+			database, store := newTestStore(t)
+			insertAttemptFixture(t, database)
+			pngBytes := makePNG(t, 4, 3)
+			hash := sha256Hex(pngBytes)
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			finalPath, err := store.pathForKey(storageKey(hash))
+			if err != nil {
+				t.Fatalf("final path: %v", err)
+			}
+			injected := errors.New("injected directory sync failure")
+			calls := 0
+			store.syncDirectory = func(path string) error {
+				calls++
+				if calls == failAt {
+					return injected
+				}
+				return syncDirectory(path)
+			}
+
+			if _, _, err := store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, testMetadata(hash), staged); !errors.Is(err, injected) {
+				t.Fatalf("Commit error = %v, want injected sync failure", err)
+			}
+			if calls != failAt {
+				t.Fatalf("sync calls = %d, want %d", calls, failAt)
+			}
+			assertEvidenceCount(t, database, 0)
+			_, statErr := os.Stat(finalPath)
+			if failAt < 3 && !errors.Is(statErr, os.ErrNotExist) {
+				t.Fatalf("file exists before rename durability boundary: %v", statErr)
+			}
+			if failAt == 3 && statErr != nil {
+				t.Fatalf("post-rename sync failure may leave an orphan file, stat error = %v", statErr)
+			}
+			assertNoPublishTemps(t, filepath.Dir(finalPath))
+		})
+	}
+}
+
+func TestCommitRetriesShardParentSyncAfterPriorFailure(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 4, 3)
+	hash := sha256Hex(pngBytes)
+	finalPath, err := store.pathForKey(storageKey(hash))
+	if err != nil {
+		t.Fatalf("final path: %v", err)
+	}
+	firstStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("first Stage: %v", err)
+	}
+	injected := errors.New("injected first shard parent sync failure")
+	store.syncDirectory = func(string) error { return injected }
+	if _, _, err := store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, testMetadata(hash), firstStage); !errors.Is(err, injected) {
+		t.Fatalf("first Commit error = %v", err)
+	}
+	if info, err := os.Stat(filepath.Dir(finalPath)); err != nil || !info.IsDir() {
+		t.Fatalf("failed first sync must leave the created shard for retry: info=%v err=%v", info, err)
+	}
+	assertEvidenceCount(t, database, 0)
+
+	secondStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("second Stage: %v", err)
+	}
+	var paths []string
+	store.syncDirectory = func(path string) error {
+		paths = append(paths, path)
+		return syncDirectory(path)
+	}
+	if _, replayed, err := store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, testMetadata(hash), secondStage); err != nil || replayed {
+		t.Fatalf("retry Commit = replayed %t, err %v", replayed, err)
+	}
+	if len(paths) != 2 || paths[0] != store.root || paths[1] != filepath.Dir(finalPath) {
+		t.Fatalf("retry sync paths = %#v, want root then shard", paths)
+	}
+	assertEvidenceCount(t, database, 1)
+	assertNoPublishTemps(t, filepath.Dir(finalPath))
+}
+
+func TestCommitPublicationFailuresCleanTempAndNeverWriteDatabase(t *testing.T) {
+	for _, name := range []string{"file sync", "rename"} {
+		t.Run(name, func(t *testing.T) {
+			database, store := newTestStore(t)
+			insertAttemptFixture(t, database)
+			pngBytes := makePNG(t, 4, 3)
+			hash := sha256Hex(pngBytes)
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			finalPath, err := store.pathForKey(storageKey(hash))
+			if err != nil {
+				t.Fatalf("final path: %v", err)
+			}
+			injected := errors.New("injected publication failure")
+			if name == "file sync" {
+				store.syncFile = func(*os.File) error { return injected }
+			} else {
+				store.renameFile = func(string, string) error { return injected }
+			}
+			if _, _, err := store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, testMetadata(hash), staged); !errors.Is(err, injected) {
+				t.Fatalf("Commit error = %v, want injected publication failure", err)
+			}
+			if _, err := os.Stat(finalPath); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("final file exists after failed publication: %v", err)
+			}
+			assertNoPublishTemps(t, filepath.Dir(finalPath))
+			assertEvidenceCount(t, database, 0)
+		})
+	}
+}
+
+func TestCommitDatabaseFailuresAfterDurableRenameLeaveOnlyOrphan(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		inject func(*testing.T, *sql.DB, *Store, error)
+	}{
+		{
+			name: "insert",
+			inject: func(t *testing.T, database *sql.DB, _ *Store, _ error) {
+				t.Helper()
+				if _, err := database.Exec(`CREATE TRIGGER fail_evidence_insert BEFORE INSERT ON evidence_assets BEGIN SELECT RAISE(ABORT, 'injected insert failure'); END`); err != nil {
+					t.Fatalf("create insert failure trigger: %v", err)
+				}
+			},
+		},
+		{
+			name: "commit",
+			inject: func(_ *testing.T, _ *sql.DB, store *Store, injected error) {
+				store.commitTx = func(*sql.Tx) error { return injected }
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			database, store := newTestStore(t)
+			insertAttemptFixture(t, database)
+			pngBytes := makePNG(t, 4, 3)
+			hash := sha256Hex(pngBytes)
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			finalPath, err := store.pathForKey(storageKey(hash))
+			if err != nil {
+				t.Fatalf("final path: %v", err)
+			}
+			injected := errors.New("injected database failure")
+			test.inject(t, database, store, injected)
+			syncCalls := 0
+			store.syncDirectory = func(path string) error {
+				syncCalls++
+				return syncDirectory(path)
+			}
+
+			if _, _, err := store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, testMetadata(hash), staged); err == nil {
+				t.Fatal("Commit unexpectedly succeeded")
+			}
+			if syncCalls != 3 {
+				t.Fatalf("database failure occurred before both durability syncs: sync calls = %d", syncCalls)
+			}
+			if info, err := os.Stat(finalPath); err != nil || !info.Mode().IsRegular() {
+				t.Fatalf("durable rename may leave only an orphan file: info=%v err=%v", info, err)
+			}
+			assertNoPublishTemps(t, filepath.Dir(finalPath))
+			assertEvidenceCount(t, database, 0)
+		})
+	}
+}
+
+func TestStageRejectsUnsafeContent(t *testing.T) {
+	_, store := newTestStore(t)
+	largePNG := makePNG(t, core.MaxImageSide+1, 1)
+	pngWithXML := append(makePNG(t, 1, 1), []byte("<hierarchy/>")...)
+	for name, test := range map[string]struct {
+		reader      io.Reader
+		contentType string
+	}{
+		"wrong content type": {reader: bytes.NewReader(makePNG(t, 1, 1)), contentType: "application/octet-stream"},
+		"xml":                {reader: bytes.NewBufferString("<hierarchy/>"), contentType: core.PNGContentType},
+		"png with xml tail":  {reader: bytes.NewReader(pngWithXML), contentType: core.PNGContentType},
+		"truncated png":      {reader: bytes.NewReader(pngSignature), contentType: core.PNGContentType},
+		"too wide":           {reader: bytes.NewReader(largePNG), contentType: core.PNGContentType},
+		"too many bytes":     {reader: io.LimitReader(zeroReader{}, core.MaxFileBytes+1), contentType: core.PNGContentType},
+	} {
+		t.Run(name, func(t *testing.T) {
+			staged, err := store.Stage(test.reader, test.contentType)
+			if !errors.Is(err, core.ErrInvalid) && !errors.Is(err, core.ErrTooLarge) {
+				store.Discard(staged)
+				t.Fatalf("Stage error = %v", err)
+			}
+		})
+	}
+}
+
+func TestCommitRequiresAttemptOwnedByTaskAndLowercaseHash(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 2, 2)
+	base := core.UploadMetadata{UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID, Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: sha256Hex(pngBytes), CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)}
+	for name, mutate := range map[string]func(*core.UploadMetadata){
+		"unknown attempt": func(value *core.UploadMetadata) { value.AttemptID = "53c9f507-7473-4fa6-8d71-8786c34c6301" },
+		"uppercase hash": func(value *core.UploadMetadata) {
+			value.SHA256 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+		},
+		"wrong kind": func(value *core.UploadMetadata) { value.Kind = "ORDER_CONFIRM" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			metadata := base
+			mutate(&metadata)
+			if _, _, err := store.Commit(context.Background(), core.DevicePrincipal{ID: "device"}, metadata, staged); !errors.Is(err, core.ErrInvalid) {
+				t.Fatalf("Commit error = %v", err)
+			}
+		})
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 0 {
+		t.Fatalf("invalid commits created %d assets, err %v", count, err)
+	}
+}
+
+func TestNewStoreRejectsRelativeAndFilesystemRootPaths(t *testing.T) {
+	database, _ := newTestStore(t)
+	if _, err := NewStore(database, "relative-evidence"); err == nil {
+		t.Fatal("relative evidence root succeeded")
+	}
+	volumeRoot := filepath.VolumeName(t.TempDir()) + string(filepath.Separator)
+	if _, err := NewStore(database, volumeRoot); err == nil {
+		t.Fatal("filesystem root succeeded")
+	}
+}
+
+type zeroReader struct{}
+
+func (zeroReader) Read(buffer []byte) (int, error) {
+	for index := range buffer {
+		buffer[index] = 0
+	}
+	return len(buffer), nil
+}
+
+func newTestStore(t *testing.T) (*sql.DB, *Store) {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "evidence.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate test")
+	}
+	directory := filepath.Join(filepath.Dir(file), "..", "..", "..", "migrations")
+	if err := migrations.Up(context.Background(), database, directory); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	store, err := NewStore(database, filepath.Join(t.TempDir(), "assets"))
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+	return database, store
+}
+
+func insertAttemptFixture(t *testing.T, database *sql.DB) {
+	t.Helper()
+	timestamp := "2026-08-04T00:00:00Z"
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', 'task', '123', 'black', 'M', 1, '1.00', 'DRAFT', 1, ?, ?)`, testTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert task: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, 1, 'start', '123', 'black', 'M', 1, '1.00', 'ACTIVE', 'admin', ?, ?)`, testAuthID, testTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert authorization: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES (?, ?, ?, 1, 'CLAIMED', ?)`, testAttemptID, testTaskID, testAuthID, timestamp); err != nil {
+		t.Fatalf("insert attempt: %v", err)
+	}
+}
+
+func testMetadata(hash string) core.UploadMetadata {
+	return core.UploadMetadata{
+		UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID,
+		Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: hash,
+		CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC),
+	}
+}
+
+func assertEvidenceCount(t *testing.T, database *sql.DB, want int) {
+	t.Helper()
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil {
+		t.Fatalf("count evidence assets: %v", err)
+	}
+	if count != want {
+		t.Fatalf("evidence asset count = %d, want %d", count, want)
+	}
+}
+
+func assertNoPublishTemps(t *testing.T, directory string) {
+	t.Helper()
+	entries, err := os.ReadDir(directory)
+	if err != nil {
+		t.Fatalf("read shard directory: %v", err)
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), ".publish-") {
+			t.Fatalf("publication temp leaked: %q", entry.Name())
+		}
+	}
+}
+
+func makePNG(t *testing.T, width, height int) []byte {
+	t.Helper()
+	imageData := image.NewNRGBA(image.Rect(0, 0, width, height))
+	imageData.Set(0, 0, color.NRGBA{R: 12, G: 34, B: 56, A: 255})
+	var buffer bytes.Buffer
+	if err := png.Encode(&buffer, imageData); err != nil {
+		t.Fatalf("encode PNG: %v", err)
+	}
+	return buffer.Bytes()
+}
+
+func sha256Hex(value []byte) string {
+	hash := sha256.Sum256(value)
+	return hex.EncodeToString(hash[:])
+}

admin/internal/taskdetail/detail.go

@@ -0,0 +1,60 @@
+// Package taskdetail provides a read-only audit projection for one task.
+package taskdetail
+
+import (
+	"context"
+	"errors"
+	"time"
+)
+
+var ErrNotFound = errors.New("task detail not found")
+
+type Store interface {
+	Get(context.Context, string) (Detail, error)
+}
+
+type Detail struct {
+	Task           Task
+	Authorizations []Authorization
+	Attempts       []Attempt
+	Submissions    []Submission
+	Evidence       []Evidence
+}
+
+type Task struct {
+	ID, Source, Title, GoodsID, SKUColor, SKUSize, MaxTotalPrice, Status string
+	Quantity, Version                                                    int
+	CreatedAt, UpdatedAt                                                 time.Time
+}
+
+type Authorization struct {
+	ID, Status, CreatedBy, TotalPriceCap string
+	TaskVersion                          int
+	CreatedAt, ExpiresAt                 time.Time
+}
+
+type Attempt struct {
+	ID, AuthorizationID, Status string
+	ClaimGeneration             int
+	Gate1UnitPrice              *string
+	Gate2UnitPrice              *string
+	QuantityRead                *int
+	ConfirmAmount               *string
+	FailureCode                 *string
+	StartedAt                   time.Time
+	FinishedAt                  *time.Time
+}
+
+type Submission struct {
+	ID, AuthorizationID, AttemptID, Status        string
+	Gate1UnitPrice, Gate2UnitPrice, ConfirmAmount string
+	QuantityRead                                  int
+	CreatedAt                                     time.Time
+	ResolvedAt                                    *time.Time
+}
+
+type Evidence struct {
+	ID, AttemptID, Kind, PrivacyTier, SHA256, ContentType string
+	ByteSize, Width, Height                               int64
+	CapturedAt                                            time.Time
+}

admin/internal/taskdetail/store.go

@@ -0,0 +1,204 @@
+package taskdetail
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+type SQLiteStore struct{ database *sql.DB }
+
+func NewSQLiteStore(database *sql.DB) (*SQLiteStore, error) {
+	if database == nil {
+		return nil, errors.New("task detail database is required")
+	}
+	if _, err := database.Exec("SELECT storage_key FROM evidence_assets LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("task detail migration is not available: %w", err)
+	}
+	return &SQLiteStore{database: database}, nil
+}
+
+func (store *SQLiteStore) Get(ctx context.Context, id string) (Detail, error) {
+	if !validUUID(id) {
+		return Detail{}, ErrNotFound
+	}
+	tx, err := store.database.BeginTx(ctx, &sql.TxOptions{ReadOnly: true})
+	if err != nil {
+		return Detail{}, err
+	}
+	defer tx.Rollback()
+
+	var detail Detail
+	var created, updated string
+	err = tx.QueryRowContext(ctx, `SELECT id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at FROM tasks WHERE id = ?`, id).Scan(
+		&detail.Task.ID, &detail.Task.Source, &detail.Task.Title, &detail.Task.GoodsID, &detail.Task.SKUColor, &detail.Task.SKUSize,
+		&detail.Task.Quantity, &detail.Task.MaxTotalPrice, &detail.Task.Status, &detail.Task.Version, &created, &updated,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Detail{}, ErrNotFound
+	}
+	if err != nil {
+		return Detail{}, err
+	}
+	if detail.Task.CreatedAt, err = parseTime(created); err != nil {
+		return Detail{}, err
+	}
+	if detail.Task.UpdatedAt, err = parseTime(updated); err != nil {
+		return Detail{}, err
+	}
+	if detail.Authorizations, err = readAuthorizations(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if detail.Attempts, err = readAttempts(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if detail.Submissions, err = readSubmissions(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if detail.Evidence, err = readEvidence(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if err := tx.Commit(); err != nil {
+		return Detail{}, err
+	}
+	return detail, nil
+}
+
+func readAuthorizations(ctx context.Context, tx *sql.Tx, taskID string) ([]Authorization, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, task_version, total_price_cap, status, created_by, created_at, expires_at FROM order_authorizations WHERE task_id = ? ORDER BY created_at DESC, id DESC`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Authorization{}
+	for rows.Next() {
+		var item Authorization
+		var created, expires string
+		if err := rows.Scan(&item.ID, &item.TaskVersion, &item.TotalPriceCap, &item.Status, &item.CreatedBy, &created, &expires); err != nil {
+			return nil, err
+		}
+		if item.CreatedAt, err = parseTime(created); err != nil {
+			return nil, err
+		}
+		if item.ExpiresAt, err = parseTime(expires); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func readAttempts(ctx context.Context, tx *sql.Tx, taskID string) ([]Attempt, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, authorization_id, claim_generation, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, failure_code, started_at, finished_at FROM purchase_attempts WHERE task_id = ? ORDER BY started_at DESC, id DESC`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Attempt{}
+	for rows.Next() {
+		var item Attempt
+		var gate1, gate2, confirm, failure, finished sql.NullString
+		var quantity sql.NullInt64
+		var started string
+		if err := rows.Scan(&item.ID, &item.AuthorizationID, &item.ClaimGeneration, &item.Status, &gate1, &gate2, &quantity, &confirm, &failure, &started, &finished); err != nil {
+			return nil, err
+		}
+		item.Gate1UnitPrice, item.Gate2UnitPrice, item.ConfirmAmount, item.FailureCode = stringPointer(gate1), stringPointer(gate2), stringPointer(confirm), stringPointer(failure)
+		if quantity.Valid {
+			value := int(quantity.Int64)
+			item.QuantityRead = &value
+		}
+		if item.StartedAt, err = parseTime(started); err != nil {
+			return nil, err
+		}
+		if finished.Valid {
+			value, parseErr := parseTime(finished.String)
+			if parseErr != nil {
+				return nil, parseErr
+			}
+			item.FinishedAt = &value
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func readSubmissions(ctx context.Context, tx *sql.Tx, taskID string) ([]Submission, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at, resolved_at FROM order_submissions WHERE task_id = ? ORDER BY created_at DESC, id DESC`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Submission{}
+	for rows.Next() {
+		var item Submission
+		var created string
+		var resolved sql.NullString
+		if err := rows.Scan(&item.ID, &item.AuthorizationID, &item.AttemptID, &item.Status, &item.Gate1UnitPrice, &item.Gate2UnitPrice, &item.QuantityRead, &item.ConfirmAmount, &created, &resolved); err != nil {
+			return nil, err
+		}
+		if item.CreatedAt, err = parseTime(created); err != nil {
+			return nil, err
+		}
+		if resolved.Valid {
+			value, parseErr := parseTime(resolved.String)
+			if parseErr != nil {
+				return nil, parseErr
+			}
+			item.ResolvedAt = &value
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func readEvidence(ctx context.Context, tx *sql.Tx, taskID string) ([]Evidence, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, captured_at FROM evidence_assets WHERE task_id = ? ORDER BY captured_at, created_at, id`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Evidence{}
+	for rows.Next() {
+		var item Evidence
+		var captured string
+		if err := rows.Scan(&item.ID, &item.AttemptID, &item.Kind, &item.PrivacyTier, &item.SHA256, &item.ByteSize, &item.ContentType, &item.Width, &item.Height, &captured); err != nil {
+			return nil, err
+		}
+		if item.CapturedAt, err = parseTime(captured); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func parseTime(value string) (time.Time, error) { return time.Parse(time.RFC3339Nano, value) }
+
+func stringPointer(value sql.NullString) *string {
+	if !value.Valid {
+		return nil
+	}
+	copy := value.String
+	return &copy
+}
+
+func validUUID(value string) bool {
+	if len(value) != 36 {
+		return false
+	}
+	for index, character := range value {
+		if index == 8 || index == 13 || index == 18 || index == 23 {
+			if character != '-' {
+				return false
+			}
+			continue
+		}
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b')
+}

admin/internal/taskdetail/store_test.go

@@ -0,0 +1,82 @@
+package taskdetail
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const (
+	detailTask = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+	detailAuth = "b3c9f507-7473-4fa6-8d71-8786c34c6301"
+	detailTry  = "c3c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestSQLiteStoreReturnsOnlyPersistedAuditFacts(t *testing.T) {
+	database := openDetailDatabase(t)
+	timestamp := "2026-08-04T00:00:00Z"
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', 'shirt', '123', 'black', 'M', 2, '30.00', 'CLAIMED', 3, ?, ?)`, detailTask, timestamp, timestamp); err != nil {
+		t.Fatalf("insert task: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, 2, 'start', '123', 'black', 'M', 2, '30.00', 'CLAIMED', 'admin', ?, ?)`, detailAuth, detailTask, timestamp, timestamp); err != nil {
+		t.Fatalf("insert authorization: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES (?, ?, ?, 1, 'CLAIMED', ?)`, detailTry, detailTask, detailAuth, timestamp); err != nil {
+		t.Fatalf("insert attempt: %v", err)
+	}
+	hash := strings.Repeat("a", 64)
+	if _, err := database.Exec(`INSERT INTO evidence_assets (id, upload_key, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at) VALUES ('d3c9f507-7473-4fa6-8d71-8786c34c6301', 'upload', ?, ?, 'SKU_PANEL_GATE_1', 'INTERNAL_RAW', ?, 100, 'image/png', 10, 20, ?, 'device', ?, ?)`, detailTask, detailTry, hash, "aa/"+hash+".png", timestamp, timestamp); err != nil {
+		t.Fatalf("insert evidence: %v", err)
+	}
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	detail, err := store.Get(context.Background(), detailTask)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if detail.Task.ID != detailTask || detail.Task.Status != "CLAIMED" || len(detail.Authorizations) != 1 || len(detail.Attempts) != 1 || len(detail.Evidence) != 1 || len(detail.Submissions) != 0 {
+		t.Fatalf("detail = %#v", detail)
+	}
+	if detail.Attempts[0].Gate1UnitPrice != nil || detail.Attempts[0].FailureCode != nil {
+		t.Fatalf("missing attempt facts were fabricated: %#v", detail.Attempts[0])
+	}
+}
+
+func TestSQLiteStoreFailsClosedForMalformedAndMissingIDs(t *testing.T) {
+	database := openDetailDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	for _, id := range []string{"../database", "not-a-uuid", "a3c9f507-7473-1fa6-8d71-8786c34c6301"} {
+		if _, err := store.Get(context.Background(), id); !errors.Is(err, ErrNotFound) {
+			t.Fatalf("Get(%q) error = %v", id, err)
+		}
+	}
+}
+
+func openDetailDatabase(t *testing.T) *sql.DB {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "details.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate migration directory")
+	}
+	if err := migrations.Up(context.Background(), database, filepath.Join(filepath.Dir(file), "..", "..", "migrations")); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	return database
+}

admin/internal/transport/webui/static/drawer.test.js

@@ -0,0 +1,211 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+
+const source = fs.readFileSync(path.join(__dirname, "tasks.js"), "utf8");
+
+test("visible button opens the same routed detail and close restores list state", async () => {
+  const harness = createDrawerHarness();
+
+  harness.button.listeners.click();
+  await harness.flush();
+
+  assert.equal(harness.requests.length, 1);
+  assert.equal(harness.requests[0].url, "/tasks/a3c9f507-7473-4fa6-8d71-8786c34c6301");
+  assert.equal(harness.requests[0].options.headers["X-CMBuyer-View"], "drawer");
+  assert.equal(harness.drawer.open, true);
+  assert.equal(harness.closeButton.focused, true);
+  assert.equal(harness.history.pushes.length, 1);
+  assert.equal(harness.history.pushes[0].url, harness.requests[0].url);
+  assert.equal(harness.history.pushes[0].state.focusTarget, "button");
+
+  harness.closeButton.listeners.click();
+  assert.equal(harness.history.backCalls, 1);
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  assert.equal(harness.button.focused, true);
+  assert.equal(harness.row.focused, false);
+  assert.equal(harness.scrolls.length, 1);
+  assert.equal(harness.scrolls[0].top, 275);
+  assert.equal(harness.scrolls[0].behavior, "auto");
+});
+
+test("button focus target survives back, forward, and back again", async () => {
+  const harness = createDrawerHarness();
+  harness.button.listeners.click();
+  await harness.flush();
+  const drawerState = harness.history.pushes[0].state;
+
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.button.focusCalls, 1);
+  assert.equal(harness.row.focusCalls, 0);
+
+  harness.popstate({state: drawerState});
+  await harness.flush();
+  assert.equal(harness.drawer.open, true);
+  assert.equal(harness.history.pushes.length, 1);
+
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  assert.equal(harness.button.focusCalls, 2);
+  assert.equal(harness.row.focusCalls, 0);
+});
+
+test("failed forward retry reuses history and closes back to button in one step", async () => {
+  const harness = createDrawerHarness();
+  harness.button.listeners.click();
+  await harness.flush();
+  const drawerState = harness.history.pushes[0].state;
+  harness.popstate({state: {cmbuyerList: true}});
+
+  harness.failNextRequest();
+  harness.popstate({state: drawerState});
+  await harness.flush();
+  const retry = harness.body.children[1].children[0];
+  retry.listeners.click();
+  await harness.flush();
+
+  assert.equal(harness.history.pushes.length, 1);
+  assert.equal(harness.drawer.open, true);
+  harness.closeButton.listeners.click();
+  assert.equal(harness.history.backCalls, 1);
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  assert.equal(harness.button.focusCalls, 2);
+  assert.equal(harness.row.focusCalls, 0);
+});
+
+test("double click and Enter open rows but nested controls never do", async () => {
+  const harness = createDrawerHarness();
+  const ignored = {closest: () => ({})};
+  const rowTarget = {closest: () => null};
+
+  harness.row.listeners.dblclick({target: ignored});
+  harness.row.listeners.dblclick({target: rowTarget});
+  await harness.flush();
+  assert.equal(harness.requests.length, 1);
+
+  harness.popstate({state: {cmbuyerList: true}});
+  let prevented = false;
+  harness.row.listeners.keydown({key: "Enter", target: harness.row, preventDefault: () => { prevented = true; }});
+  await harness.flush();
+  assert.equal(prevented, true);
+  assert.equal(harness.requests.length, 2);
+
+  harness.row.listeners.keydown({key: "Enter", target: ignored, preventDefault: () => assert.fail("nested control Enter was intercepted")});
+  assert.equal(harness.requests.length, 2);
+});
+
+test("browser back and forward close and reopen without duplicating history", async () => {
+  const harness = createDrawerHarness();
+  harness.row.listeners.keydown({key: "Enter", target: harness.row, preventDefault() {}});
+  await harness.flush();
+  assert.equal(harness.history.pushes.length, 1);
+
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  harness.popstate({state: {cmbuyerDrawer: true, detailURL: harness.row.dataset.detailUrl}});
+  await harness.flush();
+
+  assert.equal(harness.drawer.open, true);
+  assert.equal(harness.requests.length, 2);
+  assert.equal(harness.history.pushes.length, 1);
+});
+
+test("Escape follows browser history and does not mutate list URL", async () => {
+  const harness = createDrawerHarness();
+  harness.button.listeners.click();
+  await harness.flush();
+  let prevented = false;
+
+  harness.drawer.listeners.cancel({preventDefault: () => { prevented = true; }});
+
+  assert.equal(prevented, true);
+  assert.equal(harness.history.backCalls, 1);
+  assert.equal(harness.history.replaces[0].url, "/tasks?status=DRAFT");
+});
+
+function createDrawerHarness() {
+  class FakeElement {
+    constructor() {
+      this.listeners = {};
+      this.dataset = {};
+      this.open = false;
+      this.focused = false;
+      this.focusCalls = 0;
+      this.children = [];
+      this._innerHTML = "";
+    }
+    addEventListener(type, listener) { this.listeners[type] = listener; }
+    focus() { this.focused = true; this.focusCalls++; }
+    showModal() { this.open = true; }
+    close() { this.open = false; }
+    replaceChildren(...children) { this.children = children; this._innerHTML = ""; }
+    append(...children) { this.children.push(...children); }
+    setAttribute() {}
+    closest() { return null; }
+    set innerHTML(value) { this._innerHTML = value; }
+    get innerHTML() { return this._innerHTML; }
+  }
+
+  const body = new FakeElement();
+  const closeButton = new FakeElement();
+  const button = new FakeElement();
+  const row = new FakeElement();
+  row.dataset.detailUrl = "/tasks/a3c9f507-7473-4fa6-8d71-8786c34c6301";
+  row.querySelector = (selector) => selector === "[data-open-detail]" ? button : null;
+  const drawer = new FakeElement();
+  drawer.querySelector = (selector) => ({"[data-detail-body]": body, "[data-close-detail]": closeButton})[selector] || null;
+
+  const requests = [];
+  const popstateListeners = [];
+  const scrolls = [];
+  let failNext = false;
+  const history = {
+    state: null,
+    pushes: [],
+    replaces: [],
+    backCalls: 0,
+    pushState(state, _title, url) { this.state = state; this.pushes.push({state, url}); },
+    replaceState(state, _title, url) { this.state = state; this.replaces.push({state, url}); },
+    back() { this.backCalls++; },
+  };
+  const document = {
+    querySelector: (selector) => selector === "[data-start-purchases]" ? null : selector === "[data-detail-drawer]" ? drawer : null,
+    querySelectorAll: (selector) => selector === "[data-task-row]" ? [row] : [],
+    createElement: () => new FakeElement(),
+    contains: (element) => element === row || element === button,
+  };
+  const window = {
+    location: {pathname: "/tasks", search: "?status=DRAFT"},
+    history,
+    scrollY: 275,
+    scrollTo: (value) => scrolls.push(value),
+    addEventListener(type, listener) { if (type === "popstate") popstateListeners.push(listener); },
+  };
+  const context = {
+    AbortController,
+    document,
+    window,
+    fetch: async (url, options) => {
+      requests.push({url, options});
+      if (failNext) {
+        failNext = false;
+        return {ok: false, headers: {get: () => "text/html"}, text: async () => ""};
+      }
+      return {ok: true, headers: {get: () => "text/html; charset=utf-8"}, text: async () => '<article data-task-detail-content>详情</article>'};
+    },
+  };
+  vm.runInNewContext(source, context, {filename: "tasks.js"});
+
+  return {
+    body, button, closeButton, drawer, history, requests, row, scrolls,
+    failNextRequest: () => { failNext = true; },
+    popstate: (event) => { history.state = event.state; popstateListeners.forEach((listener) => listener(event)); },
+    flush: () => new Promise((resolve) => setImmediate(resolve)),
+  };
+}

admin/internal/transport/webui/static/tasks.js

@@ -58,3 +58,110 @@
   });
   refresh();
 })();
+
+(() => {
+  "use strict";
+  const drawer = document.querySelector("[data-detail-drawer]");
+  if (!drawer) return;
+  const body = drawer.querySelector("[data-detail-body]");
+  const closeButton = drawer.querySelector("[data-close-detail]");
+  const rows = [...document.querySelectorAll("[data-task-row]")];
+  const initialURL = window.location.pathname + window.location.search;
+  let focusTrigger = null;
+  let scrollPosition = window.scrollY;
+  let activeRequest = null;
+
+  const isInteractive = (target) => Boolean(target && typeof target.closest === "function" && target.closest("a,button,input,select,textarea,label,[contenteditable=true]"));
+  const showDrawer = () => {
+    if (!drawer.open) drawer.showModal();
+  };
+  const restoreList = () => {
+    if (activeRequest) {
+      activeRequest.abort();
+      activeRequest = null;
+    }
+    if (drawer.open) drawer.close();
+    window.scrollTo({top: scrollPosition, behavior: "auto"});
+    if (focusTrigger && document.contains(focusTrigger)) focusTrigger.focus({preventScroll: true});
+  };
+  const showError = (url, row, requestedFocus, pushHistory) => {
+    body.replaceChildren();
+    const message = document.createElement("p");
+    message.className = "drawer-feedback";
+    message.setAttribute("role", "alert");
+    message.textContent = "任务详情加载失败。请重试，或在完整页打开。";
+    const actions = document.createElement("p");
+    const retry = document.createElement("button");
+    retry.className = "button primary";
+    retry.type = "button";
+    retry.textContent = "重试";
+    retry.addEventListener("click", () => loadDetail(url, row, requestedFocus, pushHistory));
+    const fallback = document.createElement("a");
+    fallback.className = "button";
+    fallback.href = url;
+    fallback.textContent = "在完整页打开";
+    actions.className = "actions";
+    actions.append(retry, fallback);
+    body.append(message, actions);
+  };
+  const loadDetail = async (url, row, requestedFocus, pushHistory) => {
+    if (activeRequest) activeRequest.abort();
+    const requestController = new AbortController();
+    activeRequest = requestController;
+    focusTrigger = requestedFocus || focusTrigger;
+    if (pushHistory) scrollPosition = window.scrollY;
+    body.innerHTML = '<p class="drawer-feedback" role="status">正在加载任务详情…</p>';
+    showDrawer();
+    try {
+      const response = await fetch(url, {headers: {"X-CMBuyer-View": "drawer", "Accept": "text/html"}, credentials: "same-origin", signal: requestController.signal});
+      if (!response.ok || !String(response.headers.get("Content-Type") || "").toLowerCase().startsWith("text/html")) throw new Error("detail request rejected");
+      const fragment = await response.text();
+      if (!fragment.includes("data-task-detail-content")) throw new Error("detail fragment missing");
+      body.innerHTML = fragment;
+      if (pushHistory) window.history.pushState({cmbuyerDrawer: true, detailURL: url, focusTarget: requestedFocus === row ? "row" : "button"}, "", url);
+      closeButton.focus();
+    } catch (error) {
+      if (error.name !== "AbortError") showError(url, row, requestedFocus, pushHistory);
+    } finally {
+      if (activeRequest === requestController) activeRequest = null;
+    }
+  };
+  const requestClose = () => {
+    if (window.history.state && window.history.state.cmbuyerDrawer) window.history.back();
+    else restoreList();
+  };
+
+  window.history.replaceState({cmbuyerList: true, listURL: initialURL}, "", initialURL);
+  rows.forEach((row) => {
+    const url = row.dataset.detailUrl;
+    row.addEventListener("dblclick", (event) => {
+      if (!isInteractive(event.target)) loadDetail(url, row, row, true);
+    });
+    row.addEventListener("keydown", (event) => {
+      if (event.key === "Enter" && event.target === row) {
+        event.preventDefault();
+        loadDetail(url, row, row, true);
+      }
+    });
+    const button = row.querySelector("[data-open-detail]");
+    if (button) button.addEventListener("click", () => loadDetail(url, row, button, true));
+  });
+  closeButton.addEventListener("click", requestClose);
+  drawer.addEventListener("cancel", (event) => {
+    event.preventDefault();
+    requestClose();
+  });
+  window.addEventListener("popstate", (event) => {
+    if (event.state && event.state.cmbuyerDrawer) {
+      const row = rows.find((candidate) => candidate.dataset.detailUrl === event.state.detailURL);
+      if (!row) {
+        restoreList();
+        return;
+      }
+      const requestedFocus = event.state.focusTarget === "button" ? row.querySelector("[data-open-detail]") || row : row;
+      loadDetail(event.state.detailURL, row, requestedFocus, false);
+      return;
+    }
+    restoreList();
+  });
+})();

admin/internal/transport/webui/templates/task-detail.html

@@ -0,0 +1,38 @@
+{{define "task-detail-page.html"}}
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{{.Detail.Task.Title}} · 任务详情 · 采购服务</title>
+  <style>
+    :root{--bg:#f4f7fb;--surface:#fff;--text:#172033;--muted:#526079;--border:#cfd8e6;--primary:#155eef;--danger:#b42318;--success:#067647;--focus:#ffbf47;font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif}*{box-sizing:border-box}body{margin:0;color:var(--text);background:var(--bg);font-size:16px;line-height:1.55}a{color:#124cc5;text-underline-offset:3px}:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.skip{position:fixed;z-index:100;top:8px;left:8px;padding:10px;color:#fff;background:#172033;transform:translateY(-160%)}.skip:focus{transform:translateY(0)}.topbar{display:flex;align-items:center;justify-content:space-between;gap:16px;min-height:64px;padding:10px clamp(16px,4vw,40px);border-bottom:1px solid var(--border);background:var(--surface)}.brand{color:var(--text);font-weight:700;text-decoration:none}.brand b{display:inline-grid;place-items:center;width:32px;height:32px;margin-right:8px;border-radius:8px;background:var(--primary);color:#fff;font-size:.82rem}.button{display:inline-flex;align-items:center;justify-content:center;min-height:44px;padding:9px 14px;border:1px solid var(--border);border-radius:8px;color:var(--text);background:#fff;font-weight:700;text-decoration:none}.detail-page{width:min(100% - 32px,1120px);margin:28px auto 48px}.detail-shell{display:grid;gap:16px}.detail-head{display:flex;align-items:flex-start;justify-content:space-between;gap:16px}.detail-head h1{margin:0;font-size:clamp(1.45rem,3vw,2rem)}.detail-head p{margin:4px 0;color:var(--muted)}.status{display:inline-block;padding:4px 10px;border-radius:999px;background:#eaf1ff;color:#173d8f;font-size:.88rem;font-weight:700;white-space:nowrap}.safety{margin:0;padding:13px 15px;border:1px solid #a9c3f7;border-left:5px solid var(--primary);border-radius:10px;background:#edf3ff}.detail-grid{display:grid;grid-template-columns:minmax(0,1fr) minmax(250px,320px);gap:16px}.detail-card{overflow:hidden;border:1px solid var(--border);border-radius:12px;background:var(--surface)}.detail-card>header,.detail-card>.detail-body{padding:16px 18px}.detail-card>header{border-bottom:1px solid var(--border)}.detail-card h2,.detail-card h3{margin:0}.detail-card header p,.empty-note{margin:4px 0 0;color:var(--muted)}.facts{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px;margin:0}.facts div{min-width:0;padding:11px;border:1px solid var(--border);border-radius:8px;background:#f8fafc}.facts dt{font-size:.82rem;color:var(--muted);font-weight:700}.facts dd{margin:3px 0 0;overflow-wrap:anywhere;font-weight:650}.audit-list{display:grid;gap:10px;margin:0;padding:0;list-style:none}.audit-list li{padding:12px;border:1px solid var(--border);border-radius:8px}.audit-list p{margin:4px 0}.mono{font-family:Consolas,"SFMono-Regular",monospace;overflow-wrap:anywhere}.evidence-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px}.evidence{margin:0}.evidence img{display:block;width:100%;height:auto;max-height:520px;object-fit:contain;border:1px solid var(--border);border-radius:8px;background:#eef2f7}.evidence figcaption{margin-top:7px;color:var(--muted);font-size:.85rem}.section-stack{display:grid;gap:16px}.privacy-note{margin:12px 0 0;color:var(--muted);font-size:.88rem}@media(max-width:760px){.detail-grid{grid-template-columns:1fr}.detail-head{display:grid}.facts{grid-template-columns:1fr}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{scroll-behavior:auto!important;transition-duration:.01ms!important;animation-duration:.01ms!important}}
+  </style>
+</head>
+<body>
+  <a class="skip" href="#main">跳到主要内容</a>
+  <header class="topbar"><a class="brand" href="/tasks"><b aria-hidden="true">采</b>采购服务</a><a class="button" href="/tasks">返回任务列表</a></header>
+  <main class="detail-page" id="main">{{template "task-detail-content" .}}</main>
+</body>
+</html>
+{{end}}
+
+{{define "task-detail-content"}}
+<article class="detail-shell" data-task-detail-content data-task-id="{{.Detail.Task.ID}}">
+  <header class="detail-head"><div><h1>{{.Detail.Task.Title}}</h1><p>任务 <span class="mono">{{.Detail.Task.ID}}</span> · 版本 {{.Detail.Task.Version}}</p></div><span class="status">{{statusLabel .Detail.Task.Status}}</span></header>
+  <p class="safety"><strong>{{taskSafetyTitle .Detail.Task.Status}}</strong> {{taskSafetyText .Detail.Task.Status}}</p>
+  <div class="detail-grid">
+    <div class="section-stack">
+      <section class="detail-card" aria-labelledby="task-facts-title"><header><h2 id="task-facts-title">任务要求</h2><p>管理员锁定的采购边界；详情页不会触发设备动作。</p></header><div class="detail-body"><dl class="facts"><div><dt>商品</dt><dd><a href="{{canonicalURL .Detail.Task.GoodsID}}" target="_blank" rel="noopener noreferrer">goods_id {{.Detail.Task.GoodsID}}</a></dd></div><div><dt>目标规格</dt><dd>{{.Detail.Task.SKUColor}} / {{.Detail.Task.SKUSize}}</dd></div><div><dt>数量</dt><dd>{{.Detail.Task.Quantity}} 件</dd></div><div><dt>最高总价</dt><dd>¥{{.Detail.Task.MaxTotalPrice}}</dd></div><div><dt>创建时间（上海）</dt><dd><time datetime="{{shanghaiDateTime .Detail.Task.CreatedAt}}">{{shanghaiTime .Detail.Task.CreatedAt}}</time></dd></div><div><dt>更新时间（上海）</dt><dd><time datetime="{{shanghaiDateTime .Detail.Task.UpdatedAt}}">{{shanghaiTime .Detail.Task.UpdatedAt}}</time></dd></div></dl></div></section>
+
+      <section class="detail-card" aria-labelledby="execution-title"><header><h2 id="execution-title">设备执行事实</h2><p>只展示数据库中已存在的 attempt；T-204 不创建执行记录。</p></header><div class="detail-body">{{if .Detail.Attempts}}<ol class="audit-list">{{range .Detail.Attempts}}<li><h3>Attempt <span class="mono">{{.ID}}</span></h3><p>状态：{{attemptStatusLabel .Status}} · 领取代次 {{.ClaimGeneration}}</p><p>开始：<time datetime="{{shanghaiDateTime .StartedAt}}">{{shanghaiTime .StartedAt}}</time>{{with .FinishedAt}} · 结束：<time datetime="{{shanghaiDateTime .}}">{{shanghaiTime .}}</time>{{end}}</p>{{with .FailureCode}}<p>失败码：<span class="mono">{{.}}</span></p>{{end}}{{if or .Gate1UnitPrice .Gate2UnitPrice .QuantityRead .ConfirmAmount}}<p>已有读数：{{with .Gate1UnitPrice}}闸门一 ¥{{.}}；{{end}}{{with .Gate2UnitPrice}}闸门二 ¥{{.}}；{{end}}{{with .QuantityRead}}数量 {{.}}；{{end}}{{with .ConfirmAmount}}确认页 ¥{{.}}{{end}}</p>{{else}}<p class="empty-note">暂无规格、价格或数量读数。</p>{{end}}</li>{{end}}</ol>{{else}}<p class="empty-note">暂无设备执行记录。</p>{{end}}</div></section>
+
+      <section class="detail-card" aria-labelledby="evidence-title"><header><h2 id="evidence-title">内部截图</h2><p>INTERNAL_RAW 仅供已登录管理员审计，不代表价格闸门通过或人工批准。</p></header><div class="detail-body">{{if .Detail.Evidence}}<div class="evidence-grid">{{range .Detail.Evidence}}<figure class="evidence"><img src="/evidence/{{.ID}}" width="{{.Width}}" height="{{.Height}}" loading="lazy" alt="规格面板内部审计截图，采集于 {{shanghaiTime .CapturedAt}}"><figcaption>{{evidenceKindLabel .Kind}}（<span class="mono">{{.Kind}}</span>）· {{formatBytes .ByteSize}} · <time datetime="{{shanghaiDateTime .CapturedAt}}">{{shanghaiTime .CapturedAt}}</time><br>Attempt <span class="mono">{{.AttemptID}}</span></figcaption></figure>{{end}}</div>{{else}}<p class="empty-note">暂无内部截图。只有已认证设备显式上传的 PNG 会出现在这里。</p>{{end}}<p class="privacy-note">截图可能包含页面已显示的地址或手机号；系统不提取、索引或写入日志。完整 XML、外部支付页和支付凭据不会上传。</p></div></section>
+
+      <section class="detail-card" aria-labelledby="submission-title"><header><h2 id="submission-title">提交围栏与结果</h2><p>只读审计；本页没有重试、再次提交或付款动作。</p></header><div class="detail-body">{{if .Detail.Submissions}}<ol class="audit-list">{{range .Detail.Submissions}}<li><h3>Submission <span class="mono">{{.ID}}</span></h3><p>状态：{{submissionStatusLabel .Status}}</p><p>闸门一 ¥{{.Gate1UnitPrice}}；闸门二 ¥{{.Gate2UnitPrice}}；数量 {{.QuantityRead}}；确认页 ¥{{.ConfirmAmount}}</p><p>建立：<time datetime="{{shanghaiDateTime .CreatedAt}}">{{shanghaiTime .CreatedAt}}</time>{{with .ResolvedAt}} · 调和：<time datetime="{{shanghaiDateTime .}}">{{shanghaiTime .}}</time>{{end}}</p></li>{{end}}</ol>{{else}}<p class="empty-note">尚未建立提交围栏；详情页不会创建或释放围栏。</p>{{end}}</div></section>
+    </div>
+
+    <aside class="section-stack" aria-label="任务状态摘要"><section class="detail-card"><header><h2>开始采购授权</h2><p>锁定任务字段和最高总价，不授权付款。</p></header><div class="detail-body">{{if .Detail.Authorizations}}<ol class="audit-list">{{range .Detail.Authorizations}}<li><h3>{{authorizationStatusLabel .Status}}</h3><p class="mono">{{.ID}}</p><p>任务版本 {{.TaskVersion}} · 上限 ¥{{.TotalPriceCap}}</p><p>授权人：{{.CreatedBy}}</p><p><time datetime="{{shanghaiDateTime .CreatedAt}}">{{shanghaiTime .CreatedAt}}</time> 至 <time datetime="{{shanghaiDateTime .ExpiresAt}}">{{shanghaiTime .ExpiresAt}}</time></p></li>{{end}}</ol>{{else}}<p class="empty-note">尚未开始采购，没有授权记录。</p>{{end}}</div></section><section class="detail-card"><header><h2>固定边界</h2></header><div class="detail-body"><ul><li>系统只创建待付款订单，不自动付款。</li><li>截图仅供审计，不替代实时三道价格闸门。</li><li>围栏后只能调和同一提交，禁止再次点击。</li></ul></div></section></aside>
+  </div>
+</article>
+{{end}}

admin/internal/transport/webui/webui.go

@@ -3,10 +3,12 @@ package webui
 
 import (
 	"embed"
+	"fmt"
 	"html/template"
 	"io"
 	"time"
 
+	"cmbuyer/admin/internal/taskdetail"
 	"cmbuyer/admin/internal/tasks"
 )
 
@@ -19,10 +21,18 @@ var tasksScript []byte
 var shanghaiLocation = time.FixedZone("Asia/Shanghai", 8*60*60)
 
 var templates = template.Must(template.New("webui").Funcs(template.FuncMap{
-	"list":             func(values ...any) []any { return values },
-	"statusLabel":      statusLabel,
-	"shanghaiDateTime": func(value time.Time) string { return value.In(shanghaiLocation).Format(time.RFC3339) },
-	"shanghaiTime":     func(value time.Time) string { return value.In(shanghaiLocation).Format("2006-01-02 15:04") },
+	"list":                     func(values ...any) []any { return values },
+	"statusLabel":              statusLabel,
+	"shanghaiDateTime":         func(value time.Time) string { return value.In(shanghaiLocation).Format(time.RFC3339) },
+	"shanghaiTime":             func(value time.Time) string { return value.In(shanghaiLocation).Format("2006-01-02 15:04") },
+	"canonicalURL":             tasks.CanonicalURL,
+	"formatBytes":              formatBytes,
+	"taskSafetyTitle":          taskSafetyTitle,
+	"taskSafetyText":           taskSafetyText,
+	"authorizationStatusLabel": authorizationStatusLabel,
+	"attemptStatusLabel":       attemptStatusLabel,
+	"submissionStatusLabel":    submissionStatusLabel,
+	"evidenceKindLabel":        evidenceKindLabel,
 }).ParseFS(templateFiles, "templates/*.html"))
 
 // LoginData 是登录页面所需的非敏感展示数据。
@@ -49,6 +59,8 @@ type TasksData struct {
 	Success      bool
 }
 
+type TaskDetailData struct{ Detail taskdetail.Detail }
+
 // RenderLogin 写入登录页。
 func RenderLogin(writer io.Writer, data LoginData) error {
 	return templates.ExecuteTemplate(writer, "login.html", data)
@@ -59,6 +71,14 @@ func RenderTasks(writer io.Writer, data TasksData) error {
 	return templates.ExecuteTemplate(writer, "tasks.html", data)
 }
 
+func RenderTaskDetailPage(writer io.Writer, data TaskDetailData) error {
+	return templates.ExecuteTemplate(writer, "task-detail-page.html", data)
+}
+
+func RenderTaskDetailFragment(writer io.Writer, data TaskDetailData) error {
+	return templates.ExecuteTemplate(writer, "task-detail-content", data)
+}
+
 func TasksScript() []byte { return tasksScript }
 
 func statusLabel(status string) string {
@@ -79,3 +99,64 @@ func statusLabel(status string) string {
 	}
 	return "未知状态"
 }
+
+func taskSafetyTitle(status string) string {
+	if status == "WAITING_PAYMENT" {
+		return "订单已创建，系统尚未付款。"
+	}
+	if status == "RECONCILIATION_REQUIRED" {
+		return "订单可能已创建，只能调和同一提交。"
+	}
+	return "系统只创建待付款订单，不会自动付款。"
+}
+
+func taskSafetyText(status string) string {
+	if status == "DRAFT" {
+		return "创建任务不构成授权；请回到列表勾选后开始采购。"
+	}
+	if status == "RECONCILIATION_REQUIRED" {
+		return "围栏保持占用，禁止重新授权、再次提交或释放。"
+	}
+	return "截图只供内部审计，不替代实时价格闸门，也不会触发设备动作。"
+}
+
+func authorizationStatusLabel(status string) string {
+	labels := map[string]string{"ACTIVE": "授权有效", "CLAIMED": "已被领取", "FENCED": "提交围栏已建立", "CONSUMED": "授权已消费", "EXPIRED": "授权已过期", "ABANDONED": "授权已关闭"}
+	if value, ok := labels[status]; ok {
+		return value
+	}
+	return "未知授权状态"
+}
+
+func attemptStatusLabel(status string) string {
+	labels := map[string]string{"CLAIMED": "已领取", "ORDERING": "执行中", "FAILED": "围栏前失败", "FENCED": "已建立围栏", "ABANDONED": "已安全停止"}
+	if value, ok := labels[status]; ok {
+		return value
+	}
+	return "未知执行状态"
+}
+
+func submissionStatusLabel(status string) string {
+	labels := map[string]string{"FENCED": "围栏已建立", "SUBMITTED": "已创建待付款订单", "RECONCILIATION_REQUIRED": "结果待调和", "MANUAL_RESOLVED": "已人工调和"}
+	if value, ok := labels[status]; ok {
+		return value
+	}
+	return "未知提交状态"
+}
+
+func evidenceKindLabel(kind string) string {
+	if kind == "SKU_PANEL_GATE_1" {
+		return "规格面板 · 闸门一"
+	}
+	return "内部截图"
+}
+
+func formatBytes(value int64) string {
+	if value >= 1<<20 {
+		return fmt.Sprintf("%.1f MiB", float64(value)/(1<<20))
+	}
+	if value >= 1<<10 {
+		return fmt.Sprintf("%.1f KiB", float64(value)/(1<<10))
+	}
+	return fmt.Sprintf("%d B", value)
+}

admin/migrations/00003_evidence_assets.sql

@@ -0,0 +1,53 @@
+-- +goose Up
+CREATE TABLE evidence_assets (
+  id TEXT PRIMARY KEY,
+  upload_key TEXT NOT NULL,
+  task_id TEXT NOT NULL,
+  attempt_id TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind = 'SKU_PANEL_GATE_1'),
+  privacy_tier TEXT NOT NULL CHECK (privacy_tier = 'INTERNAL_RAW'),
+  sha256 TEXT NOT NULL CHECK (
+    length(sha256) = 64
+    AND sha256 NOT GLOB '*[^0-9a-f]*'
+  ),
+  byte_size INTEGER NOT NULL CHECK (
+    typeof(byte_size) = 'integer'
+    AND byte_size > 0
+    AND byte_size <= 10485760
+  ),
+  content_type TEXT NOT NULL CHECK (content_type = 'image/png'),
+  width_px INTEGER NOT NULL CHECK (
+    typeof(width_px) = 'integer'
+    AND width_px > 0
+    AND width_px <= 8192
+  ),
+  height_px INTEGER NOT NULL CHECK (
+    typeof(height_px) = 'integer'
+    AND height_px > 0
+    AND height_px <= 8192
+  ),
+  storage_key TEXT NOT NULL CHECK (
+    storage_key = substr(sha256, 1, 2) || '/' || sha256 || '.png'
+  ),
+  uploaded_by_device_id TEXT NOT NULL CHECK (trim(uploaded_by_device_id) <> ''),
+  captured_at TEXT NOT NULL CHECK (trim(captured_at) <> ''),
+  created_at TEXT NOT NULL CHECK (trim(created_at) <> ''),
+  CHECK (width_px * height_px <= 16777216),
+  UNIQUE (uploaded_by_device_id, upload_key),
+  FOREIGN KEY (task_id, attempt_id) REFERENCES purchase_attempts(task_id, id)
+);
+
+CREATE INDEX evidence_assets_task_time_idx
+ON evidence_assets (task_id, captured_at, created_at, id);
+
+-- +goose Down
+-- 已写入的内部原图是审计事实，回滚迁移不得静默删除它们。
+CREATE TABLE evidence_downgrade_guard (
+  valid INTEGER NOT NULL CHECK (valid = 1)
+);
+
+INSERT INTO evidence_downgrade_guard (valid)
+SELECT CASE WHEN (SELECT COUNT(*) FROM evidence_assets) = 0 THEN 1 ELSE 0 END;
+
+DROP TABLE evidence_downgrade_guard;
+DROP TABLE evidence_assets;

docs/04-architecture.md

@@ -246,6 +246,27 @@ CREATE TABLE order_submissions (
   UNIQUE (authorization_id),
   UNIQUE (attempt_id)
 );
+
+-- INTERNAL_RAW 原始截图；原文件名和客户端路径不进入数据库
+CREATE TABLE evidence_assets (
+  id                    TEXT PRIMARY KEY,
+  upload_key            TEXT NOT NULL,
+  task_id               TEXT NOT NULL,
+  attempt_id            TEXT NOT NULL,
+  kind                  TEXT NOT NULL,          -- T-204 仅 SKU_PANEL_GATE_1
+  privacy_tier          TEXT NOT NULL,          -- 仅 INTERNAL_RAW
+  sha256                TEXT NOT NULL,          -- 64 位小写十六进制
+  byte_size             INTEGER NOT NULL,
+  content_type          TEXT NOT NULL,          -- 仅 image/png
+  width_px              INTEGER NOT NULL,
+  height_px             INTEGER NOT NULL,
+  storage_key           TEXT NOT NULL,          -- 由 SHA-256 唯一派生
+  uploaded_by_device_id TEXT NOT NULL,
+  captured_at           TEXT NOT NULL,
+  created_at            TEXT NOT NULL,
+  UNIQUE (uploaded_by_device_id, upload_key),
+  FOREIGN KEY (task_id, attempt_id) REFERENCES purchase_attempts(task_id, id)
+);
 ```
 
 MVP 不再用 `spec_trials` 作为审批记录，也不存在 `authorized_unit_price`。实际读价属于
@@ -306,6 +327,19 @@ DRAFT / PENDING / NEEDS_MANUAL ─管理员取消（围栏前）→ CANCELED
 截图上传器只能接收调用方显式指定的截图，不能枚举证据目录或顺带上传 XML/manifest。证据响应
 使用 `Cache-Control: no-store`，不能暴露为免登录静态目录。
 
+内部截图存储采用以下固定边界：
+
+- 单个 PNG 最大 10 MiB、单边最大 8192 px、总像素最大 16,777,216；同时验证 multipart MIME、
+  PNG 魔数、完整解码、字节数、尺寸和调用方声明的 SHA-256。
+- 上传 handler 必须先通过设备认证，再解析 Content-Type 或读取 body。T-301 前生产认证器固定拒绝，
+  不创建临时 token，也不把管理员 session 当设备身份。
+- 文件写入显式配置的私有证据根目录：同目录随机临时文件 → 流式 hash → 校验 → `fsync` → 原子
+  rename 到 SHA-256 内容地址 → 最后事务写数据库。数据库永远不指向半文件或缺失文件。
+- SQLite 与文件系统不能组成跨资源事务；极端故障最多留下不可达孤儿文件。不得为清理孤儿而删除
+  可能被其他资产记录并发复用的内容文件，自动保留/删除策略留给部署任务。
+- SHA-256 只用于物理内容寻址，不是业务资产唯一键；不同合法证据可以引用相同内容。同设备主体与
+  `upload_key` 同载荷重放原资产，任一规范字段变化即冲突。
+
 ## 六、关键技术难点
 
 | 难点 | 风险 | 应对 |

docs/api.md

@@ -53,6 +53,14 @@
 | `POST` | `/tasks/{id}/mark-paid` | 人工确认已付款并完成核对 |
 | `GET` | `/evidence/{asset_id}` | 登录后读取内部截图；`Cache-Control: no-store` |
 
+`GET /tasks/{id}` 的完整页与列表抽屉共享同一服务端数据模型和详情模板。列表只可用同源请求携带
+`X-CMBuyer-View: drawer` 获取 HTML fragment；其他非空 view、跨站 fragment 请求或不接受
+`text/html` 的 fragment 请求均拒绝。直接导航同一 URL 始终返回完整页。
+
+`GET /evidence/{asset_id}` 不经静态目录：未登录先返回 `401`，不查询和泄露资产是否存在；登录后
+缺失或畸形 id 返回空 `404`。成功只返回存储的 PNG，包含 `Content-Length`、固定安全文件名、
+`Cache-Control: no-store` 与 `X-Content-Type-Options: nosniff`，不返回原文件名或服务端路径。
+
 ### `POST /tasks`
 
 核心字段：
@@ -190,17 +198,30 @@
 
 ```json
 {
-  "attempt_id": "018f-attempt",
+  "upload_key": "43c9f507-7473-4fa6-8d71-8786c34c6301",
+  "attempt_id": "33c9f507-7473-4fa6-8d71-8786c34c6301",
   "kind": "SKU_PANEL_GATE_1",
   "privacy_tier": "INTERNAL_RAW",
-  "sha256": "64-lowercase-hex",
+  "sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
   "captured_at": "2026-08-04T09:01:00Z"
 }
 ```
 
 - 允许规格面板和确认页截图保留页面已显示的地址/手机号；不要求遮罩或裁剪。
 - 不接受 XML、目录、manifest、本机绝对路径、外部支付页截图或支付凭据。
-- MIME、尺寸、字节数和 SHA-256 必须校验；资产只经管理员鉴权端点读取。
+- T-204 只开放 `kind=SKU_PANEL_GATE_1`；后续 kind 必须由对应真机证据任务收紧扩展。
+- `privacy_tier` 只能是 `INTERNAL_RAW`；时间必须是以 `Z` 结尾的 UTC RFC 3339。
+- URL 中的 task id、`upload_key` 与 `attempt_id` 都必须是规范的小写 UUIDv4；`sha256` 必须是
+  恰好 64 位小写十六进制字符。
+- 恰好一个带 `Content-Type: image/png` 的显式文件；除上述六个元数据字段外，未知或重复字段均拒绝。
+- 单文件最多 10 MiB、单边最多 8192 px、总像素最多 16,777,216；服务端校验 PNG 魔数、完整解码、
+  字节数、尺寸与调用方声明的 64 位小写 SHA-256。
+- `attempt_id` 必须由数据库复合外键证明属于 URL 中的 task。认证必须先于 Content-Type 解析和请求体读取。
+- 同一设备主体和 `upload_key` 的同载荷重放返回原资产；任务、attempt、截图或元数据变化返回 `409`。
+- 首次成功返回 `201`，幂等重放返回 `200`。响应只含资产 id、关联 id、kind/tier、hash、字节数、
+  MIME、宽高和采集时间，不含设备 token、原文件名或存储路径。
+- T-301 接入真实设备 Bearer 身份前，生产 `DeviceAuthenticator` 固定拒绝全部上传；不得使用管理员
+  session、临时 token 或共享密钥代替设备身份。
 
 ### `POST /api/v1/purchase-attempts/{aid}/submission-fence`
 
@@ -310,6 +331,6 @@ T-103 只实现隔离的 `SkuSelectionFlow`：前四项加安全退出。它的
 ## 四、实现前仍需定值
 
 - 授权有效期、领取租约时长、心跳/轮询间隔和连续失败停止阈值；
-- 截图大小上限和内部保留期限；
+- 内部截图保留期限；截图大小上限已固定为 10 MiB / 8192 px 单边 / 16,777,216 像素；
 - 可配置单任务数量与最高总价系统上限；
 - 首次真实提交真机任务的人工授权和待付款订单处置步骤。

docs/routes.md

@@ -47,7 +47,9 @@
 | 创建时间 | 本地时区显示，数据按 UTC 保存 |
 
 没有操作列。双击非控件区域或键盘 Enter 打开 `/tasks/{id}` 路由化详情抽屉；新 tab 直接访问同 URL
-则显示完整详情页。关闭抽屉或浏览器返回恢复筛选、滚动和触发行焦点。
+则显示完整详情页。标题下方同时提供可见“查看详情”按钮，双击不是唯一入口。商品外链、checkbox、
+输入和按钮本身不触发行双击。抽屉成功加载后才把 URL 推进 `/tasks/{id}`；关闭、Esc 或浏览器返回
+恢复筛选、滚动和触发行焦点，浏览器前进重新打开同一详情且不重复写 history。
 
 ### 批量开始采购
 
@@ -91,6 +93,14 @@
 
 详情中不出现 `WAITING_CONFIRMATION`、“确认机器选对了吗”、“签发第二趟授权”或“重新试选”。
 
+完整页与抽屉执行同一 `task-detail-content` 模板和只读查询。直接导航返回完整 SSR 文档；列表 JS 对
+同一 URL 发出同源 `X-CMBuyer-View: drawer` 请求，只取得 HTML fragment。加载失败时抽屉提供重试和
+“在完整页打开”，不会把失败请求伪装成已打开详情。
+
+T-204 只显示数据库中当前实际存在的任务、授权、attempt、submission 和内部截图，缺少事实就显示
+明确空态；它不创建 attempt/event，不计算闸门，也不提供重置、调和、标记付款或任何设备动作。
+截图以服务端记录的宽高预留布局并延迟加载，alt 只描述证据种类和采集时间，不转录截图中的地址或手机号。
+
 ## 四、采购工具界面结构
 
 应用名：**采购工具**。顶部固定 tab：