feat(client): add T-106 confirmation evidence capture

client/scripts/capture_order_confirm_spike.py

@@ -0,0 +1,112 @@
+"""采集 T-106 人工准备的确认页四态证据；不执行页面操作。"""
+
+from __future__ import annotations
+
+import argparse
+from math import isfinite
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
+from cmbuyer_client.pdd.order_confirm_spike import (
+    Android16ForegroundReader,
+    DECLARED_STATES,
+    EXPECTED_GOODS_ID,
+    OrderConfirmEvidenceCapturer,
+    OrderConfirmEvidenceError,
+)
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="采集 T-106 人工准备的确认页四态本机证据。")
+    parser.add_argument("--serial", required=True, help="ADB device serial；禁止自动选择。")
+    parser.add_argument("--goods-id", required=True, help="T-106 已批准的目标商品标识。")
+    parser.add_argument(
+        "--state",
+        required=True,
+        choices=DECLARED_STATES,
+        help=(
+            "人工声明状态：Gate2 后导航来源、确认页 Gate3、最终控件可见、"
+            "人工一次返回后的安全页。"
+        ),
+    )
+    parser.add_argument("--output-dir", required=True, type=Path, help="全新本机证据目录；不得覆盖。")
+    parser.add_argument("--timeout", type=float, default=10.0, help="ADB 与只读设备 RPC 超时（秒）。")
+    parser.add_argument("--adb", default="adb", help="adb 可执行文件路径。")
+    return parser.parse_args(argv)
+
+
+def validate_arguments(arguments: argparse.Namespace) -> None:
+    if (
+        type(arguments.serial) is not str
+        or not arguments.serial.strip()
+        or arguments.serial != arguments.serial.strip()
+    ):
+        raise ValueError("必须显式提供非空 --serial。")
+    if type(arguments.goods_id) is not str or arguments.goods_id != EXPECTED_GOODS_ID:
+        raise ValueError("--goods-id 不是 T-106 已批准目标。")
+    if type(arguments.state) is not str or arguments.state not in DECLARED_STATES:
+        raise ValueError("--state 必须是批准的人工声明状态。")
+    if not isinstance(arguments.output_dir, Path) or not arguments.output_dir.name:
+        raise ValueError("--output-dir 必须是明确的全新目录。")
+    if (
+        not isinstance(arguments.timeout, (int, float))
+        or isinstance(arguments.timeout, bool)
+        or arguments.timeout <= 0
+        or not isfinite(arguments.timeout)
+    ):
+        raise ValueError("--timeout 必须是大于 0 的有限数值。")
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        validate_arguments(arguments)
+    except ValueError as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少 uiautomator2；请在采购工具虚拟环境中运行。", file=sys.stderr)
+        return 2
+
+    adb_runner = SubprocessAdbRunner(arguments.adb)
+    capturer = OrderConfirmEvidenceCapturer(
+        AdbClient(adb_runner, timeout_seconds=arguments.timeout),
+        NoReconnectUiautomatorConnector(
+            adbutils.AdbClient(socket_timeout=arguments.timeout).device_list,
+            u2.connect,
+        ),
+        Android16ForegroundReader(adb_runner, arguments.timeout),
+        timeout_seconds=arguments.timeout,
+    )
+    try:
+        capturer.capture(
+            arguments.serial,
+            arguments.goods_id,
+            arguments.state,
+            arguments.output_dir,
+        )
+    except (DeviceConnectionError, OrderConfirmEvidenceError):
+        # 第三方异常可能带设备、页面正文或本机目录，命令行只输出固定摘要。
+        print("确认页四态只读取证失败：已停止，未发布本机证据目录。", file=sys.stderr)
+        return 1
+    except OSError:
+        print("确认页四态只读取证失败：无法发布本机证据目录。", file=sys.stderr)
+        return 1
+
+    print("确认页四态只读取证完成。")
+    print("人工复核：请在指定目录检查截图、XML、应用摘要和 manifest。")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/scripts/capture_quantity_gate2_spike.py

@@ -0,0 +1,120 @@
+"""采集 T-105 人工准备的数量 1/2 两态证据；不执行页面操作。"""
+
+from __future__ import annotations
+
+import argparse
+from math import isfinite
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
+from cmbuyer_client.pdd.quantity_gate2_spike import (
+    Android16TopResumedForegroundReader,
+    DECLARED_QUANTITIES,
+    EXPECTED_GOODS_ID,
+    QuantityGate2EvidenceCapturer,
+    QuantityGate2EvidenceError,
+)
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="采集 T-105 人工准备的数量两态本机证据。")
+    parser.add_argument("--serial", required=True, help="ADB device serial；禁止自动选择。")
+    parser.add_argument("--goods-id", required=True, help="T-105 已批准的目标商品标识。")
+    parser.add_argument(
+        "--state",
+        required=True,
+        choices=sorted(DECLARED_QUANTITIES),
+        help="人工声明状态：initial=数量1，target=数量2。",
+    )
+    parser.add_argument(
+        "--declared-quantity",
+        required=True,
+        type=int,
+        help="人工看到的数量；必须与状态一致。",
+    )
+    parser.add_argument("--output-dir", required=True, type=Path, help="全新本机证据目录；不得覆盖。")
+    parser.add_argument("--timeout", type=float, default=10.0, help="ADB 与只读设备 RPC 超时（秒）。")
+    parser.add_argument("--adb", default="adb", help="adb 可执行文件路径。")
+    return parser.parse_args(argv)
+
+
+def validate_arguments(arguments: argparse.Namespace) -> None:
+    if (
+        type(arguments.serial) is not str
+        or not arguments.serial.strip()
+        or arguments.serial != arguments.serial.strip()
+    ):
+        raise ValueError("必须显式提供非空 --serial。")
+    if type(arguments.goods_id) is not str or arguments.goods_id != EXPECTED_GOODS_ID:
+        raise ValueError("--goods-id 不是 T-105 已批准目标。")
+    if type(arguments.state) is not str or arguments.state not in DECLARED_QUANTITIES:
+        raise ValueError("--state 必须是批准的人工声明状态。")
+    if type(arguments.declared_quantity) is not int or (
+        arguments.declared_quantity != DECLARED_QUANTITIES[arguments.state]
+    ):
+        raise ValueError("--declared-quantity 必须与人工声明状态一致。")
+    if not isinstance(arguments.output_dir, Path) or not arguments.output_dir.name:
+        raise ValueError("--output-dir 必须是明确的全新目录。")
+    if (
+        not isinstance(arguments.timeout, (int, float))
+        or isinstance(arguments.timeout, bool)
+        or arguments.timeout <= 0
+        or not isfinite(arguments.timeout)
+    ):
+        raise ValueError("--timeout 必须是大于 0 的有限数值。")
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        validate_arguments(arguments)
+    except ValueError as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少 uiautomator2；请在采购工具虚拟环境中运行。", file=sys.stderr)
+        return 2
+
+    adb_runner = SubprocessAdbRunner(arguments.adb)
+    capturer = QuantityGate2EvidenceCapturer(
+        AdbClient(adb_runner, timeout_seconds=arguments.timeout),
+        NoReconnectUiautomatorConnector(
+            adbutils.AdbClient(socket_timeout=arguments.timeout).device_list,
+            u2.connect,
+        ),
+        Android16TopResumedForegroundReader(adb_runner, arguments.timeout),
+        timeout_seconds=arguments.timeout,
+    )
+    try:
+        capturer.capture(
+            arguments.serial,
+            arguments.goods_id,
+            arguments.state,
+            arguments.declared_quantity,
+            arguments.output_dir,
+        )
+    except (DeviceConnectionError, QuantityGate2EvidenceError):
+        # 第三方异常可能含 serial、Activity、本机路径或页面正文，CLI 只输出固定摘要。
+        print("数量两态只读取证失败：已停止，未发布本机证据目录。", file=sys.stderr)
+        return 1
+    except OSError:
+        print("数量两态只读取证失败：无法发布本机证据目录。", file=sys.stderr)
+        return 1
+
+    print("数量两态只读取证完成。")
+    print("人工复核：请在指定目录检查截图、XML、应用摘要和 manifest。")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/scripts/capture_sku_exit_spike.py

@@ -0,0 +1,85 @@
+"""采集 T-104 阶段 A 的一次 Back 后本机证据。"""
+
+from __future__ import annotations
+
+import argparse
+from math import isfinite
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
+from cmbuyer_client.pdd.sku_selection import SkuSelectionError
+from cmbuyer_client.pdd.sku_selection_runner import (
+    SkuExitSpikeCapturer,
+    SkuSelectionRunError,
+)
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="采集 T-104 阶段 A 的一次 Back 后本机证据。")
+    parser.add_argument("--serial", required=True, help="ADB device serial；禁止自动选择。")
+    parser.add_argument("--output-dir", required=True, type=Path, help="全新本机证据目录；不得覆盖。")
+    parser.add_argument("--timeout", type=float, default=10.0, help="ADB 与设备 RPC 超时（秒）。")
+    parser.add_argument("--adb", default="adb", help="adb 可执行文件路径。")
+    return parser.parse_args(argv)
+
+
+def validate_arguments(arguments: argparse.Namespace) -> None:
+    if type(arguments.serial) is not str or not arguments.serial.strip():
+        raise ValueError("必须显式提供非空 --serial。")
+    if not isinstance(arguments.output_dir, Path) or not arguments.output_dir.name:
+        raise ValueError("--output-dir 必须是明确的全新目录。")
+    if (
+        not isinstance(arguments.timeout, (int, float))
+        or isinstance(arguments.timeout, bool)
+        or arguments.timeout <= 0
+        or not isfinite(arguments.timeout)
+    ):
+        raise ValueError("--timeout 必须是大于 0 的有限数值。")
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        validate_arguments(arguments)
+    except ValueError as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少 uiautomator2；请在采购工具虚拟环境中运行。", file=sys.stderr)
+        return 2
+
+    capturer = SkuExitSpikeCapturer(
+        AdbClient(SubprocessAdbRunner(arguments.adb), timeout_seconds=arguments.timeout),
+        NoReconnectUiautomatorConnector(
+            adbutils.AdbClient(socket_timeout=arguments.timeout).device_list,
+            u2.connect,
+        ),
+        timeout_seconds=arguments.timeout,
+    )
+    try:
+        capturer.capture(arguments.serial, arguments.output_dir)
+    except (DeviceConnectionError, SkuSelectionError, SkuSelectionRunError):
+        # 不回显第三方异常、serial、页面正文或本机路径。
+        print("规格安全退出取证失败：已停止，未发布本地证据目录。", file=sys.stderr)
+        return 1
+    except OSError:
+        print("规格安全退出取证失败：无法发布本地证据目录。", file=sys.stderr)
+        return 1
+
+    print("规格安全退出取证完成。")
+    print("人工复核：请在指定目录检查退出后截图、XML、应用摘要和 manifest。")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/scripts/capture_sku_reveal_spike.py

@@ -13,8 +13,16 @@ sys.path.insert(0, str(CLIENT_ROOT / "src"))
 
 from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
 from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
-from cmbuyer_client.pdd.sku_reveal_spike import SkuRevealSpikeCapturer, SkuRevealSpikeError
-from cmbuyer_client.pdd.sku_selection import EXPECTED_GOODS_ID, SkuSelectionError
+from cmbuyer_client.pdd.sku_reveal_spike import (
+    safe_reveal_failure_stage,
+    SkuRevealSpikeCapturer,
+    SkuRevealSpikeError,
+)
+from cmbuyer_client.pdd.sku_selection import (
+    EXPECTED_GOODS_ID,
+    _safe_sku_entry_failure_stage,
+    SkuSelectionError,
+)
 from cmbuyer_client.pdd.sku_selection_runner import SkuSelectionRunError
 
 
@@ -42,6 +50,14 @@ def validate_arguments(arguments: argparse.Namespace) -> None:
         raise ValueError("--timeout 必须是大于 0 的有限数值。")
 
 
+def _safe_capture_failure_stage(error: BaseException) -> str:
+    # 入口与 reveal 各有不可伪造的正式 marker；入口优先，不能被外层 reveal 标注覆盖。
+    entry_stage = _safe_sku_entry_failure_stage(error)
+    if entry_stage is not None:
+        return entry_stage
+    return safe_reveal_failure_stage(error) or "unknown"
+
+
 def main(argv: list[str] | None = None) -> int:
     arguments = parse_arguments(argv)
     try:
@@ -71,9 +87,12 @@ def main(argv: list[str] | None = None) -> int:
             arguments.goods_id,
             arguments.output_dir,
         )
-    except (DeviceConnectionError, SkuSelectionError, SkuSelectionRunError, SkuRevealSpikeError):
+    except (DeviceConnectionError, SkuSelectionError, SkuSelectionRunError, SkuRevealSpikeError) as error:
         # 不回显页面正文、节点、serial、坐标、路径或第三方异常。
-        print("规格 reveal 取证失败：已停止，未发布本地证据目录。", file=sys.stderr)
+        print(
+            f"规格 reveal 取证失败：stage={_safe_capture_failure_stage(error)}；已停止，未发布本地证据目录。",
+            file=sys.stderr,
+        )
         return 1
     except OSError:
         print("规格 reveal 取证失败：无法创建或发布本地证据目录。", file=sys.stderr)

client/scripts/run_t105_quantity_gate2.py

@@ -0,0 +1,132 @@
+"""运行 T-105 数量 1→2、Gate2 截图与一次安全退出。"""
+
+from __future__ import annotations
+
+import argparse
+from datetime import datetime
+from math import isfinite
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
+from cmbuyer_client.pdd.quantity_gate2 import (
+    EXPECTED_GATE1_UNIT_PRICE,
+    EXPECTED_GOODS_ID,
+    TASK_COLOR,
+    TASK_SIZE,
+    Gate1Observation,
+    QuantityGate2Error,
+)
+from cmbuyer_client.pdd.quantity_gate2_runner import QuantityGate2Runner
+from cmbuyer_client.pdd.quantity_gate2_spike import Android16TopResumedForegroundReader
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="运行 T-105 已取证数量与 Gate2 闭环。")
+    parser.add_argument("--serial", required=True, help="显式 ADB serial；禁止自动选择。")
+    parser.add_argument("--goods-id", required=True)
+    parser.add_argument("--color", required=True)
+    parser.add_argument("--size", required=True)
+    parser.add_argument("--target-quantity", required=True, type=int)
+    parser.add_argument("--gate1-unit-price", required=True)
+    parser.add_argument("--gate1-screenshot", required=True, type=Path)
+    parser.add_argument("--gate1-captured-at", required=True)
+    parser.add_argument("--max-total-price", required=True)
+    parser.add_argument("--output-dir", required=True, type=Path)
+    parser.add_argument("--timeout", type=float, default=10.0)
+    parser.add_argument("--adb", default="adb")
+    return parser.parse_args(argv)
+
+
+def validate_arguments(arguments: argparse.Namespace) -> datetime:
+    if type(arguments.serial) is not str or not arguments.serial.strip() or arguments.serial != arguments.serial.strip():
+        raise ValueError("必须显式提供非空 --serial。")
+    if arguments.goods_id != EXPECTED_GOODS_ID:
+        raise ValueError("--goods-id 不是 T-105 已批准目标。")
+    if arguments.color != TASK_COLOR or arguments.size != TASK_SIZE:
+        raise ValueError("颜色或尺码不是 T-105 已批准目标。")
+    if type(arguments.target_quantity) is not int or arguments.target_quantity != 2:
+        raise ValueError("本次真机验收只批准 --target-quantity 2。")
+    if arguments.gate1_unit_price != EXPECTED_GATE1_UNIT_PRICE:
+        raise ValueError("--gate1-unit-price 与已确认 Gate1 不一致。")
+    if not isinstance(arguments.gate1_screenshot, Path) or not arguments.gate1_screenshot.is_file():
+        raise ValueError("--gate1-screenshot 必须是现有显式文件。")
+    try:
+        captured_at = datetime.fromisoformat(arguments.gate1_captured_at)
+    except (TypeError, ValueError) as error:
+        raise ValueError("--gate1-captured-at 必须是带时区 ISO 时间。") from error
+    if captured_at.utcoffset() is None:
+        raise ValueError("--gate1-captured-at 必须带时区。")
+    if arguments.max_total_price != "40.00":
+        raise ValueError("本次真机验收固定 --max-total-price 40.00。")
+    if not isinstance(arguments.output_dir, Path) or not arguments.output_dir.name or arguments.output_dir.exists():
+        raise ValueError("--output-dir 必须是不存在的明确新目录。")
+    if (
+        not isinstance(arguments.timeout, (int, float))
+        or isinstance(arguments.timeout, bool)
+        or arguments.timeout <= 0
+        or not isfinite(arguments.timeout)
+    ):
+        raise ValueError("--timeout 必须是大于 0 的有限数值。")
+    return captured_at
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        captured_at = validate_arguments(arguments)
+    except ValueError as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少采购工具真机依赖。", file=sys.stderr)
+        return 2
+
+    adb_runner = SubprocessAdbRunner(arguments.adb)
+    runner = QuantityGate2Runner(
+        AdbClient(adb_runner, timeout_seconds=arguments.timeout),
+        NoReconnectUiautomatorConnector(
+            adbutils.AdbClient(socket_timeout=arguments.timeout).device_list,
+            u2.connect,
+        ),
+        Android16TopResumedForegroundReader(adb_runner, arguments.timeout),
+        timeout_seconds=arguments.timeout,
+    )
+    gate1 = Gate1Observation(
+        color=arguments.color,
+        size=arguments.size,
+        quantity=1,
+        gate1_unit_price=arguments.gate1_unit_price,
+        screenshot_path=arguments.gate1_screenshot,
+        captured_at=captured_at,
+    )
+    try:
+        runner.run(
+            arguments.serial,
+            arguments.goods_id,
+            gate1,
+            arguments.target_quantity,
+            arguments.max_total_price,
+            arguments.output_dir,
+        )
+    except (DeviceConnectionError, QuantityGate2Error, OSError):
+        # 不回显第三方异常、serial、本机路径或页面正文。
+        print("T-105 数量/Gate2 运行失败：已停止，未发布证据目录。", file=sys.stderr)
+        return 1
+
+    print("T-105 数量/Gate2 运行完成。")
+    print("人工复核：数量 2、目标规格、12.88/32.76、原始截图和一次安全退出。")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/src/cmbuyer_client/pdd/order_confirm_spike.py

@@ -0,0 +1,345 @@
+"""T-106 确认页四态的纯只读取证；页面对应性只由人工确认。"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from hashlib import sha256
+import json
+from math import isfinite
+import os
+from pathlib import Path
+import re
+import shutil
+from typing import Any, Protocol
+from uuid import uuid4
+
+from adbutils.errors import AdbTimeout
+from PIL import Image, UnidentifiedImageError
+from uiautomator2.exceptions import HTTPTimeoutError
+
+from ..device.adb import AdbClient, CommandRunner, DeviceConnectionError, DeviceInspection
+from ..device.baseline import (
+    HIERARCHY_PARAMS,
+    PDD_PACKAGE,
+    SCREENSHOT_PARAMS,
+    _save_base64_screenshot,
+    _sha256_file,
+    _validate_hierarchy,
+)
+from .product_open import EXPECTED_PDD_VERSION
+from .product_url import parse_product_url
+
+
+EXPECTED_GOODS_ID = "937122477375"
+EXPECTED_DEVICE_MODEL = "PKG110"
+EXPECTED_ANDROID_VERSION = "16"
+EXPECTED_SCREEN_SIZE = (1080, 2376)
+DECLARED_STATES = (
+    "gate2-navigation-source",
+    "confirm-gate3",
+    "submit-control-visible",
+    "returned-safe-page",
+)
+
+
+class OrderConfirmEvidenceError(RuntimeError):
+    """T-106 四态证据未形成完整原子产物。"""
+
+
+class OrderConfirmEvidenceTimeoutError(OrderConfirmEvidenceError):
+    """只读取证设备调用超时。"""
+
+
+class OrderConfirmReadDevice(Protocol):
+    """T-106 唯一设备边界；故意只有读取能力。"""
+
+    def app_info(self, package_name: str) -> dict[str, Any]: ...
+
+    def window_size(self) -> tuple[int, int]: ...
+
+    def jsonrpc_call(self, method: str, params: Any = None, timeout: float = 10) -> Any: ...
+
+
+class OrderConfirmForegroundReader(Protocol):
+    """读取 Android 前台摘要，不暴露通用命令执行。"""
+
+    def read(self, serial: str) -> dict[str, str]: ...
+
+
+class Android16ForegroundReader:
+    """读取 Android 16 的唯一 top-resumed Activity。"""
+
+    _TOP_RESUMED_PATTERN = re.compile(
+        r"(?m)^\s*topResumedActivity=ActivityRecord\{[^\r\n}]*?\s+u\d+\s+"
+        r"(?P<package>[^/\s]+)/(?P<activity>[^\s}]+)\s+t\d+\}\s*$"
+    )
+
+    def __init__(self, runner: CommandRunner, timeout_seconds: float) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._runner = runner
+        self._timeout_seconds = timeout_seconds
+
+    def read(self, serial: str) -> dict[str, str]:
+        if type(serial) is not str or not serial.strip() or serial != serial.strip():
+            raise OrderConfirmEvidenceError("必须显式提供非空设备通道。")
+        result = self._runner.run(
+            ("-s", serial, "shell", "dumpsys", "activity", "activities"),
+            self._timeout_seconds,
+        )
+        if result.returncode != 0:
+            raise OrderConfirmEvidenceError("Android 前台摘要读取失败，未发布证据。")
+        matches = list(self._TOP_RESUMED_PATTERN.finditer(result.stdout))
+        if len(matches) != 1:
+            raise OrderConfirmEvidenceError("Android 前台摘要不唯一，未发布证据。")
+        match = matches[0]
+        return {"package": match.group("package"), "activity": match.group("activity")}
+
+
+@dataclass(frozen=True)
+class OrderConfirmEvidenceResult:
+    output_directory: Path
+    manifest_path: Path
+    screenshot_path: Path
+    hierarchy_path: Path
+    app_path: Path
+
+
+class OrderConfirmEvidenceCapturer:
+    """采集人工准备的单个稳定状态，不解析页面业务字段。"""
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], OrderConfirmReadDevice],
+        foreground_reader: OrderConfirmForegroundReader,
+        timeout_seconds: float,
+    ) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._foreground_reader = foreground_reader
+        self._timeout_seconds = timeout_seconds
+        self._started = False
+
+    def capture(
+        self,
+        serial: str,
+        goods_id: str,
+        human_declared_state: str,
+        output_directory: Path,
+    ) -> OrderConfirmEvidenceResult:
+        if self._started:
+            raise OrderConfirmEvidenceError("同一取证器不可重复调用。")
+        self._started = True
+        _validate_inputs(serial, goods_id, human_declared_state)
+        target = Path(output_directory)
+        _validate_new_target(target)
+
+        staging: Path | None = None
+        try:
+            inspection = self._adb_client.inspect(serial)
+            _require_expected_device(inspection)
+            device = self._connector(serial)
+            initial_app = _require_read_precondition(
+                device,
+                self._foreground_reader.read(serial),
+            )
+
+            target.parent.mkdir(parents=True, exist_ok=True)
+            staging = target.parent / f".{target.name}.staging-{uuid4().hex}"
+            staging.mkdir()
+
+            screenshot_path = staging / "screenshot.png"
+            screenshot_payload = _read_rpc(
+                device,
+                "takeScreenshot",
+                SCREENSHOT_PARAMS,
+                self._timeout_seconds,
+            )
+            if not isinstance(screenshot_payload, str):
+                raise OrderConfirmEvidenceError("页面截图无效，未发布证据。")
+            _save_base64_screenshot(screenshot_payload, screenshot_path)
+            _require_screenshot(screenshot_path)
+
+            hierarchy = _read_rpc(
+                device,
+                "dumpWindowHierarchy",
+                HIERARCHY_PARAMS,
+                self._timeout_seconds,
+            )
+            _validate_hierarchy(hierarchy)
+            hierarchy_path = staging / "hierarchy.xml"
+            hierarchy_path.write_text(hierarchy, encoding="utf-8")
+
+            final_app = _require_read_precondition(
+                device,
+                self._foreground_reader.read(serial),
+            )
+            if final_app != initial_app:
+                raise OrderConfirmEvidenceError("取证期间前台页面漂移，未发布证据。")
+
+            app_path = staging / "app.json"
+            app_path.write_text(
+                json.dumps(final_app, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
+                encoding="utf-8",
+            )
+            manifest_path = staging / "manifest.json"
+            manifest_path.write_text(
+                json.dumps(
+                    _manifest(
+                        inspection,
+                        serial,
+                        goods_id,
+                        human_declared_state,
+                        screenshot_path,
+                        hierarchy_path,
+                        app_path,
+                    ),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            os.rename(staging, target)
+            staging = None
+        except (DeviceConnectionError, OrderConfirmEvidenceError):
+            _clean_staging(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            _clean_staging(staging)
+            raise OrderConfirmEvidenceTimeoutError("确认页四态只读取证超时，未发布证据。") from error
+        except (OSError, UnidentifiedImageError, ValueError) as error:
+            _clean_staging(staging)
+            raise OrderConfirmEvidenceError("确认页四态证据无法原子发布，未发布证据。") from error
+        except Exception as error:
+            _clean_staging(staging)
+            raise OrderConfirmEvidenceError("确认页四态只读取证未完成，未发布证据。") from error
+
+        return OrderConfirmEvidenceResult(
+            output_directory=target,
+            manifest_path=target / "manifest.json",
+            screenshot_path=target / "screenshot.png",
+            hierarchy_path=target / "hierarchy.xml",
+            app_path=target / "app.json",
+        )
+
+
+def _is_positive_finite(value: object) -> bool:
+    return (
+        isinstance(value, (int, float))
+        and not isinstance(value, bool)
+        and value > 0
+        and isfinite(value)
+    )
+
+
+def _validate_inputs(serial: object, goods_id: object, state: object) -> None:
+    if type(serial) is not str or not serial.strip() or serial != serial.strip():
+        raise OrderConfirmEvidenceError("必须显式提供非空设备通道。")
+    if type(goods_id) is not str or goods_id != EXPECTED_GOODS_ID:
+        raise OrderConfirmEvidenceError("商品不是 T-106 已批准取证目标。")
+    parse_product_url(f"https://mobile.yangkeduo.com/goods.html?goods_id={goods_id}")
+    if type(state) is not str or state not in DECLARED_STATES:
+        raise OrderConfirmEvidenceError("人工声明状态无效。")
+
+
+def _validate_new_target(target: Path) -> None:
+    if target.exists() or not target.name:
+        raise OrderConfirmEvidenceError("输出目录必须是不存在的明确新目录。")
+
+
+def _require_expected_device(inspection: DeviceInspection) -> None:
+    if inspection.model != EXPECTED_DEVICE_MODEL or inspection.android_version != EXPECTED_ANDROID_VERSION:
+        raise OrderConfirmEvidenceError("设备不是已批准取证组合。")
+
+
+def _require_read_precondition(
+    device: OrderConfirmReadDevice,
+    current: object,
+) -> dict[str, str]:
+    info = device.app_info(PDD_PACKAGE)
+    version = (info.get("versionName") or info.get("version_name")) if isinstance(info, dict) else None
+    if version != EXPECTED_PDD_VERSION:
+        raise OrderConfirmEvidenceError("拼多多版本不是已批准取证版本。")
+    if not isinstance(current, dict) or current.get("package") != PDD_PACKAGE:
+        raise OrderConfirmEvidenceError("拼多多不在前台。")
+    activity = current.get("activity")
+    if not isinstance(activity, str) or not activity.strip():
+        raise OrderConfirmEvidenceError("前台应用摘要不完整。")
+    if device.window_size() != EXPECTED_SCREEN_SIZE:
+        raise OrderConfirmEvidenceError("屏幕坐标空间不是已批准尺寸。")
+    return {"package": PDD_PACKAGE, "activity": activity, "pdd_version": EXPECTED_PDD_VERSION}
+
+
+def _read_rpc(
+    device: OrderConfirmReadDevice,
+    method: str,
+    params: object,
+    timeout_seconds: float,
+) -> object:
+    return device.jsonrpc_call(method, params, timeout=timeout_seconds)
+
+
+def _require_screenshot(path: Path) -> None:
+    with Image.open(path) as image:
+        image.load()
+        if image.size != EXPECTED_SCREEN_SIZE or image.format != "PNG":
+            raise OrderConfirmEvidenceError("页面截图格式或尺寸无效。")
+
+
+def _clean_staging(staging: Path | None) -> None:
+    if staging is not None and staging.exists():
+        shutil.rmtree(staging)
+
+
+def _manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    goods_id: str,
+    state: str,
+    screenshot_path: Path,
+    hierarchy_path: Path,
+    app_path: Path,
+) -> dict[str, Any]:
+    return {
+        "schema_version": 1,
+        "operation": "t106-order-confirm-readonly-evidence",
+        "captured_at": datetime.now(UTC).isoformat(),
+        "product": {
+            "goods_id": goods_id,
+            "canonical_url": f"https://mobile.yangkeduo.com/goods.html?goods_id={goods_id}",
+        },
+        "human_declared_state": state,
+        "review_status": "human_review_required",
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": EXPECTED_PDD_VERSION,
+        },
+        "artifacts": [
+            {
+                "path": screenshot_path.name,
+                "role": "human_prepared_state_raw_screenshot",
+                "sha256": _sha256_file(screenshot_path),
+            },
+            {
+                "path": hierarchy_path.name,
+                "role": "human_prepared_state_raw_hierarchy_local_only",
+                "sha256": _sha256_file(hierarchy_path),
+            },
+            {
+                "path": app_path.name,
+                "role": "human_prepared_state_app_identity",
+                "sha256": _sha256_file(app_path),
+            },
+        ],
+    }

client/src/cmbuyer_client/pdd/quantity_gate2.py

@@ -0,0 +1,605 @@
+"""T-105：证据绑定的数量读回与 Gate2 面板总额。
+
+本模块只允许数量 1 保持不变，或从数量 1 对唯一加号点击一次到数量 2。
+它不包含确认页、提交围栏、提交订单或付款能力。
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime
+from decimal import Decimal
+from functools import partial
+from math import isfinite
+from pathlib import Path
+import re
+from time import monotonic, sleep
+from typing import Any, Callable, Protocol
+from xml.etree import ElementTree
+
+from ..core.errors import ValidationError
+from ..core.validation import require_money
+from ..device.baseline import PDD_PACKAGE
+from .product_open import EXPECTED_PDD_VERSION
+from .sku_selection import SkuSelectionError, _parse_nodes as _parse_sku_nodes
+from .sku_selection import _product_exit_projection
+
+
+EXPECTED_DEVICE_MODEL = "PKG110"
+EXPECTED_ANDROID_VERSION = "16"
+EXPECTED_SCREEN_SIZE = (1080, 2376)
+EXPECTED_GOODS_ID = "937122477375"
+TASK_COLOR = "黑色CHA(纯棉)"
+TASK_SIZE = "M(建议100-115)"
+UI_COLOR = "黑色 CHA (纯棉）"
+UI_SIZE = "M（建议100-115）"
+EXPECTED_GATE1_UNIT_PRICE = "12.88"
+
+_PDD_ID = "com.xunmeng.pinduoduo:id/pdd"
+_QUANTITY_CONTAINER_ID = "com.xunmeng.pinduoduo:id/gnl"
+_COLOR_ID = "com.xunmeng.pinduoduo:id/tv_content"
+_TARGET_SUMMARY = f"已选： {UI_COLOR} {UI_SIZE}"
+_AMOUNT_TEXT = re.compile(r"^快卖完 ¥(?P<amount>(?:0|[1-9]\d*)\.\d{2})$")
+_BOUNDS = re.compile(r"^\[(\d+),(\d+)\]\[(\d+),(\d+)\]$")
+
+
+class QuantityGate2Error(RuntimeError):
+    """数量/Gate2 判据不成立时的脱敏安全停止。"""
+
+
+class QuantityGate2TimeoutError(QuantityGate2Error):
+    """设备调用或后置条件等待超时。"""
+
+
+class QuantityGate2OverCapError(QuantityGate2Error):
+    """目标数量面板总额超过管理员授权上限。"""
+
+
+class QuantityGate2Device(Protocol):
+    """T-105 的窄设备能力；没有通用页面动作。"""
+
+    def app_info(self, package_name: str) -> dict[str, Any]: ...
+
+    def current_foreground(self) -> dict[str, str]: ...
+
+    def display_size(self) -> tuple[int, int]: ...
+
+    def dump_window_hierarchy(self) -> str: ...
+
+    def increment_quantity_once(self, bounds: str) -> None: ...
+
+    def capture_screenshot(self) -> str: ...
+
+    def leave_sku_panel_once(self) -> None: ...
+
+
+@dataclass(frozen=True)
+class Gate1Observation:
+    color: str
+    size: str
+    quantity: int
+    gate1_unit_price: str
+    screenshot_path: Path
+    captured_at: datetime
+
+    def __post_init__(self) -> None:
+        if self.color != TASK_COLOR or self.size != TASK_SIZE or type(self.quantity) is not int or self.quantity != 1:
+            raise QuantityGate2Error("Gate1 规格或数量不是已取证前置，已停止操作。")
+        if _money(self.gate1_unit_price) != EXPECTED_GATE1_UNIT_PRICE:
+            raise QuantityGate2Error("Gate1 单价不是已取证值，已停止操作。")
+        if not isinstance(self.screenshot_path, Path) or not self.screenshot_path.name:
+            raise QuantityGate2Error("Gate1 截图路径无效，已停止操作。")
+        if not isinstance(self.captured_at, datetime) or self.captured_at.utcoffset() is None:
+            raise QuantityGate2Error("Gate1 采集时间必须带时区，已停止操作。")
+
+
+@dataclass(frozen=True)
+class Gate2Observation:
+    requested_color: str
+    requested_size: str
+    actual_color: str
+    actual_size: str
+    requested_quantity: int
+    quantity_read: int
+    gate1_unit_price: str
+    gate2_panel_total_price: str
+    max_total_price: str
+    screenshot_path: Path
+    captured_at: datetime
+
+
+@dataclass(frozen=True)
+class _PanelProfile:
+    quantity: int
+    panel_bounds: str
+    price_row_bounds: str
+    price_bounds: str
+    price_text: str
+    summary_bounds: str
+    quantity_bounds: str
+    minus_bounds: str
+    value_bounds: str
+    plus_bounds: str
+    color_bounds: str
+
+
+_INITIAL = _PanelProfile(
+    1,
+    "[0,474][1080,863]",
+    "[396,498][895,570]",
+    "[396,503][712,570]",
+    "快卖完 ¥12.88",
+    "[396,654][1053,716]",
+    "[396,752][645,827]",
+    "[396,752][474,827]",
+    "[480,752][561,827]",
+    "[567,752][645,827]",
+    "[126,1000][438,1024]",
+)
+_TARGET = _PanelProfile(
+    2,
+    "[0,474][1080,861]",
+    "[396,498][740,570]",
+    "[396,503][722,570]",
+    "快卖完 ¥32.76",
+    "[396,582][1053,644]",
+    "[396,750][645,825]",
+    "[396,750][474,825]",
+    "[480,750][561,825]",
+    "[567,750][645,825]",
+    "[126,998][438,1024]",
+)
+_PROFILES = {1: _INITIAL, 2: _TARGET}
+
+
+@dataclass(frozen=True)
+class _Node:
+    element: ElementTree.Element
+    parent: "_Node | None"
+
+    @property
+    def text(self) -> str:
+        return self.element.get("text", "")
+
+    @property
+    def desc(self) -> str:
+        return self.element.get("content-desc", "")
+
+    @property
+    def bounds(self) -> str:
+        return self.element.get("bounds", "")
+
+
+@dataclass(frozen=True)
+class _VerifiedPanel:
+    quantity: int
+    panel_total_price: str
+    plus_bounds: str
+    projection: tuple[object, ...]
+
+
+class QuantityGate2Flow:
+    """从已确认数量 1 面板推进至获准数量，并安全退出同一商品。"""
+
+    def __init__(
+        self,
+        device: QuantityGate2Device,
+        wait_timeout_seconds: float = 1.0,
+        poll_interval_seconds: float = 0.2,
+        monotonic_clock: Callable[[], float] = monotonic,
+        sleep_function: Callable[[float], None] = sleep,
+    ) -> None:
+        if not _positive_finite(wait_timeout_seconds) or not _positive_finite(poll_interval_seconds):
+            raise ValueError("等待参数必须是大于 0 的有限数值。")
+        self._device = device
+        self._timeout = float(wait_timeout_seconds)
+        self._poll = float(poll_interval_seconds)
+        self._clock = monotonic_clock
+        self._sleep = sleep_function
+        self._increment_attempted = False
+        self._pending: tuple[str, Callable[[list[_Node]], _VerifiedPanel]] | None = None
+        self._terminal = False
+        self._verified_quantity: int | None = None
+        self._verified_total: str | None = None
+        self._exited = False
+
+    @property
+    def increment_attempts(self) -> int:
+        return int(self._increment_attempted)
+
+    @property
+    def exited(self) -> bool:
+        return self._exited
+
+    @property
+    def can_exit_safely(self) -> bool:
+        return self._pending is None and self._verified_quantity in _PROFILES and not self._exited
+
+    def set_quantity_and_verify(
+        self,
+        gate1: Gate1Observation,
+        target_quantity: int,
+        max_total_price: str,
+    ) -> _VerifiedPanel:
+        self._require_active()
+        _validate_request(gate1, target_quantity, max_total_price)
+        initial = self._read_verified(_INITIAL)
+        if initial.panel_total_price != gate1.gate1_unit_price:
+            raise QuantityGate2Error("Gate1 当前面板事实已漂移，已停止操作。")
+
+        if target_quantity == 1:
+            verified = initial
+        else:
+            # 动作前 fresh 读取，不能使用上一次节点或缓存 bounds。
+            before = self._read_hierarchy()
+            precondition = _verified_panel(_parse_nodes(before), _INITIAL)
+            _require_unique_action_occupants(_parse_nodes(before), precondition.plus_bounds)
+            self._pending = (before, partial(_verified_panel, profile=_TARGET))
+            self._increment_attempted = True
+            try:
+                self._device.increment_quantity_once(precondition.plus_bounds)
+                verified = self._wait_for_pending()
+            except BaseException:
+                # 点击超时可能已送达；封存后不允许本 Flow 重试或继续。
+                self._terminal = True
+                raise
+
+        self._verified_quantity = verified.quantity
+        self._verified_total = verified.panel_total_price
+        if Decimal(verified.panel_total_price) > Decimal(max_total_price):
+            raise QuantityGate2OverCapError("Gate2 面板总额超过授权最高总价，已停止操作。")
+        return verified
+
+    def build_observation(
+        self,
+        gate1: Gate1Observation,
+        target_quantity: int,
+        max_total_price: str,
+        screenshot_path: Path,
+        captured_at: datetime,
+    ) -> Gate2Observation:
+        self._require_active()
+        _validate_request(gate1, target_quantity, max_total_price)
+        if not isinstance(screenshot_path, Path) or not screenshot_path.name:
+            raise QuantityGate2Error("Gate2 截图路径无效，已停止操作。")
+        if not isinstance(captured_at, datetime) or captured_at.utcoffset() is None:
+            raise QuantityGate2Error("Gate2 采集时间必须带时区，已停止操作。")
+        verified = self._read_verified(_PROFILES[target_quantity])
+        if (
+            self._verified_quantity != verified.quantity
+            or self._verified_total != verified.panel_total_price
+            or Decimal(verified.panel_total_price) > Decimal(max_total_price)
+        ):
+            raise QuantityGate2Error("截图后 Gate2 事实漂移，已停止操作。")
+        return Gate2Observation(
+            requested_color=gate1.color,
+            requested_size=gate1.size,
+            actual_color=TASK_COLOR,
+            actual_size=TASK_SIZE,
+            requested_quantity=target_quantity,
+            quantity_read=verified.quantity,
+            gate1_unit_price=gate1.gate1_unit_price,
+            gate2_panel_total_price=verified.panel_total_price,
+            max_total_price=max_total_price,
+            screenshot_path=screenshot_path,
+            captured_at=captured_at,
+        )
+
+    def exit_sku_panel_safely(self) -> None:
+        self._require_active()
+        if self._verified_quantity not in _PROFILES:
+            raise QuantityGate2Error("没有可用于安全退出的数量事实，已停止操作。")
+        current = self._read_verified(_PROFILES[self._verified_quantity])
+        if current.panel_total_price != self._verified_total:
+            raise QuantityGate2Error("安全退出前 Gate2 事实漂移，已停止操作。")
+        try:
+            self._device.leave_sku_panel_once()
+        except BaseException:
+            self._terminal = True
+            raise
+
+        deadline = self._clock() + self._timeout
+        stable: tuple[object, ...] | None = None
+        try:
+            while True:
+                self._require_environment()
+                raw = self._read_hierarchy()
+                try:
+                    projection = _product_exit_projection(_parse_sku_nodes(raw))
+                except SkuSelectionError:
+                    stable = None
+                else:
+                    self._require_environment()
+                    if stable == projection:
+                        self._exited = True
+                        self._terminal = True
+                        return
+                    stable = projection
+                remaining = deadline - self._clock()
+                if remaining <= 0:
+                    raise QuantityGate2TimeoutError("安全退出未达到连续稳定同商品判据，未重试返回。")
+                self._sleep(min(self._poll, remaining))
+        except BaseException:
+            self._terminal = True
+            raise
+
+    def reconcile_pending_action(self) -> _VerifiedPanel | None:
+        """结果不明时只读一次待定后置条件；绝不重发加号。"""
+
+        if self._pending is None:
+            return None
+        return self._wait_for_pending()
+
+    def _wait_for_pending(self) -> _VerifiedPanel:
+        if self._pending is None:
+            raise QuantityGate2Error("没有可调和的数量动作。")
+        previous, condition = self._pending
+        deadline = self._clock() + self._timeout
+        while True:
+            self._require_environment()
+            raw = self._read_hierarchy()
+            if raw != previous:
+                try:
+                    verified = condition(_parse_nodes(raw))
+                except QuantityGate2Error:
+                    pass
+                else:
+                    self._pending = None
+                    return verified
+            remaining = deadline - self._clock()
+            if remaining <= 0:
+                raise QuantityGate2TimeoutError("数量动作后置条件未确认，未重试加号。")
+            self._sleep(min(self._poll, remaining))
+
+    def _read_verified(self, profile: _PanelProfile) -> _VerifiedPanel:
+        self._require_environment()
+        return _verified_panel(_parse_nodes(self._read_hierarchy()), profile)
+
+    def _require_environment(self) -> None:
+        info = self._device.app_info(PDD_PACKAGE)
+        version = (info.get("versionName") or info.get("version_name")) if isinstance(info, dict) else None
+        if version != EXPECTED_PDD_VERSION:
+            raise QuantityGate2Error("拼多多版本与 T-105 证据不一致，已停止操作。")
+        foreground = self._device.current_foreground()
+        if (
+            not isinstance(foreground, dict)
+            or foreground.get("package") != PDD_PACKAGE
+            or not isinstance(foreground.get("activity"), str)
+            or not foreground["activity"].strip()
+        ):
+            raise QuantityGate2Error("拼多多不是唯一前台应用，已停止操作。")
+        if self._device.display_size() != EXPECTED_SCREEN_SIZE:
+            raise QuantityGate2Error("屏幕坐标空间与 T-105 证据不一致，已停止操作。")
+
+    def _read_hierarchy(self) -> str:
+        value = self._device.dump_window_hierarchy()
+        if not isinstance(value, str) or not value:
+            raise QuantityGate2Error("节点树读取失败，已停止操作。")
+        return value
+
+    def _require_active(self) -> None:
+        if self._terminal:
+            raise QuantityGate2Error("数量流程已进入不可重入终止态。")
+
+
+def _positive_finite(value: object) -> bool:
+    return isinstance(value, (int, float)) and not isinstance(value, bool) and value > 0 and isfinite(value)
+
+
+def _validate_request(gate1: object, target_quantity: object, max_total_price: object) -> None:
+    if not isinstance(gate1, Gate1Observation):
+        raise QuantityGate2Error("缺少可信 Gate1Observation，已停止操作。")
+    if type(target_quantity) is not int or target_quantity not in _PROFILES:
+        raise QuantityGate2Error("目标数量没有本项目真机证据，已停止操作。")
+    _money(max_total_price)
+
+
+def _money(value: object) -> str:
+    try:
+        return require_money(value, "invalid_money")
+    except ValidationError as error:
+        raise QuantityGate2Error("金额不是规范十进制字符串，已停止操作。") from error
+
+
+def _parse_nodes(raw: str) -> list[_Node]:
+    try:
+        root = ElementTree.fromstring(raw)
+    except ElementTree.ParseError as error:
+        raise QuantityGate2Error("节点树格式无效，已停止操作。") from error
+    if root.tag != "hierarchy":
+        raise QuantityGate2Error("节点树根节点无效，已停止操作。")
+    result: list[_Node] = []
+
+    def visit(element: ElementTree.Element, parent: _Node | None) -> None:
+        node = _Node(element, parent)
+        result.append(node)
+        for child in element:
+            visit(child, node)
+
+    visit(root, None)
+    return result
+
+
+def _verified_panel(nodes: list[_Node], profile: _PanelProfile) -> _VerifiedPanel:
+    panel = _one(
+        node for node in nodes
+        if _exact(node, "android.view.ViewGroup", profile.panel_bounds, resource_id=_PDD_ID, clickable="false")
+    )
+    price_frame = _one(
+        node for node in nodes
+        if node.parent is panel and _exact(node, "android.widget.FrameLayout", "[396,498][1053,570]", resource_id=_PDD_ID, clickable="false")
+    )
+    price_row = _one(
+        node for node in nodes
+        if node.parent is price_frame and _exact(node, "android.widget.LinearLayout", profile.price_row_bounds, resource_id=_PDD_ID, clickable="false")
+    )
+    price = _one(
+        node for node in nodes
+        if node.parent is price_row
+        and _exact(node, "android.widget.TextView", profile.price_bounds, resource_id=_PDD_ID, clickable="false")
+        and node.text == profile.price_text
+        and not node.desc
+    )
+    match = _AMOUNT_TEXT.fullmatch(price.text)
+    if match is None:
+        raise QuantityGate2Error("Gate2 面板总额角色不可读。")
+    amount = _money(match.group("amount"))
+
+    _one(
+        node for node in nodes
+        if node.parent is panel
+        and _exact(node, "android.widget.TextView", profile.summary_bounds, resource_id=_PDD_ID, clickable="false")
+        and node.text == _TARGET_SUMMARY
+        and not node.desc
+    )
+    quantity_outer = _one(
+        node for node in nodes
+        if node.parent is panel
+        and _exact(node, "android.widget.LinearLayout", profile.quantity_bounds, resource_id=_QUANTITY_CONTAINER_ID, clickable="false")
+    )
+    quantity_inner = _one(
+        node for node in nodes
+        if node.parent is quantity_outer
+        and _exact(node, "android.widget.LinearLayout", profile.quantity_bounds, resource_id="", clickable="false")
+    )
+    _one(
+        node for node in nodes
+        if node.parent is quantity_inner
+        and _exact(node, "android.widget.ImageView", profile.minus_bounds, resource_id=_PDD_ID, clickable="true")
+        and node.desc == "减少数量"
+        and not node.text
+    )
+    quantity = _one(
+        node for node in nodes
+        if node.parent is quantity_inner
+        and _exact(node, "android.widget.EditText", profile.value_bounds, resource_id=_PDD_ID, clickable="true")
+        and node.text == str(profile.quantity)
+        and not node.desc
+    )
+    plus = _one(
+        node for node in nodes
+        if node.parent is quantity_inner
+        and _exact(node, "android.widget.ImageView", profile.plus_bounds, resource_id=_PDD_ID, clickable="true")
+        and node.desc == "增加数量"
+        and not node.text
+    )
+    if quantity.element.get("selected") != "false" or plus.element.get("selected") != "false":
+        raise QuantityGate2Error("数量控件选中属性漂移。")
+
+    _require_selected_target(nodes, profile)
+    projection = (
+        "quantity_gate2_8_17_0",
+        profile.quantity,
+        amount,
+        tuple(_projection(node) for node in (panel, price_frame, price_row, price, quantity_outer, quantity_inner, quantity, plus)),
+    )
+    return _VerifiedPanel(profile.quantity, amount, plus.bounds, projection)
+
+
+def _require_selected_target(nodes: list[_Node], profile: _PanelProfile) -> None:
+    color = _one(
+        node for node in nodes
+        if _exact(node, "android.widget.TextView", profile.color_bounds, resource_id=_COLOR_ID, clickable="true", selected="true")
+        and node.text == UI_COLOR
+        and not node.desc
+    )
+    if color.parent is None or color.parent.element.get("selected") != "true":
+        raise QuantityGate2Error("目标颜色没有精确选中。")
+    size = _one(
+        node for node in nodes
+        if _exact(node, "android.widget.TextView", "[439,1582][831,1667]", resource_id=_PDD_ID, clickable="true", selected="true")
+        and node.text == UI_SIZE
+        and not node.desc
+    )
+    if size.parent is None or size.parent.element.get("clickable") != "true":
+        raise QuantityGate2Error("目标尺码结构漂移。")
+
+
+def _exact(
+    node: _Node,
+    class_name: str,
+    bounds: str,
+    *,
+    resource_id: str,
+    clickable: str,
+    selected: str = "false",
+) -> bool:
+    element = node.element
+    return (
+        element.get("package") == PDD_PACKAGE
+        and element.get("class") == class_name
+        and node.bounds == bounds
+        and element.get("resource-id", "") == resource_id
+        and element.get("clickable") == clickable
+        and element.get("selected") == selected
+        and element.get("enabled") == "true"
+        and element.get("visible-to-user") == "true"
+        and element.get("scrollable") == "false"
+    )
+
+
+def _one(values: Any) -> _Node:
+    matches = list(values)
+    if len(matches) != 1:
+        raise QuantityGate2Error("T-105 页面证据角色缺失或不唯一。")
+    return matches[0]
+
+
+def _projection(node: _Node) -> tuple[str, ...]:
+    return (
+        node.element.tag,
+        node.element.get("package", ""),
+        node.element.get("class", ""),
+        node.bounds,
+        node.element.get("resource-id", ""),
+        node.element.get("clickable", ""),
+        node.element.get("selected", ""),
+        node.text,
+        node.desc,
+    )
+
+
+def _bounds_center(bounds: str) -> tuple[int, int]:
+    match = _BOUNDS.fullmatch(bounds)
+    if match is None:
+        raise QuantityGate2Error("数量控件坐标无效。")
+    left, top, right, bottom = (int(value) for value in match.groups())
+    if not (0 <= left < right <= EXPECTED_SCREEN_SIZE[0] and 0 <= top < bottom <= EXPECTED_SCREEN_SIZE[1]):
+        raise QuantityGate2Error("数量控件坐标超出已取证屏幕。")
+    return left + (right - left) // 2, top + (bottom - top) // 2
+
+
+def _require_unique_action_occupants(nodes: list[_Node], bounds: str) -> None:
+    target = _one(node for node in nodes if node.bounds == bounds and node.desc == "增加数量")
+    x, y = _bounds_center(bounds)
+    occupants = [
+        node for node in nodes
+        if node.element.get("clickable") == "true"
+        and node.element.get("enabled") == "true"
+        and node.element.get("visible-to-user") == "true"
+        and _contains(node.bounds, x, y)
+    ]
+    if not occupants or any(not _same_branch(node, target) for node in occupants):
+        raise QuantityGate2Error("数量加号中心存在未知可点击覆盖层，已停止操作。")
+
+
+def _contains(bounds: str, x: int, y: int) -> bool:
+    match = _BOUNDS.fullmatch(bounds)
+    if match is None:
+        return False
+    left, top, right, bottom = (int(value) for value in match.groups())
+    return left <= x < right and top <= y < bottom
+
+
+def _same_branch(candidate: _Node, target: _Node) -> bool:
+    current: _Node | None = target
+    while current is not None:
+        if current.element is candidate.element:
+            return True
+        current = current.parent
+    current = candidate
+    while current is not None:
+        if current.element is target.element:
+            return True
+        current = current.parent
+    return False

client/src/cmbuyer_client/pdd/quantity_gate2_runner.py

@@ -0,0 +1,397 @@
+"""T-105 真机运行边界：一次数量加号、Gate2 原图与一次安全退出。"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass, replace
+from datetime import UTC, datetime
+from hashlib import sha256
+import json
+from math import isfinite
+import os
+from pathlib import Path
+import shutil
+from time import monotonic
+from typing import Any, Protocol
+from uuid import uuid4
+
+from adbutils.errors import AdbTimeout
+from PIL import Image, UnidentifiedImageError
+from uiautomator2.exceptions import HTTPTimeoutError
+
+from ..device.adb import AdbClient, DeviceConnectionError, DeviceInspection
+from ..device.baseline import PDD_PACKAGE, SCREENSHOT_PARAMS, _save_base64_screenshot, _sha256_file
+from .product_open import EXPECTED_PDD_VERSION
+from .quantity_gate2 import (
+    EXPECTED_ANDROID_VERSION,
+    EXPECTED_DEVICE_MODEL,
+    EXPECTED_GOODS_ID,
+    EXPECTED_SCREEN_SIZE,
+    Gate1Observation,
+    Gate2Observation,
+    QuantityGate2Device,
+    QuantityGate2Error,
+    QuantityGate2Flow,
+    QuantityGate2TimeoutError,
+    _bounds_center,
+    _money,
+)
+
+
+class ForegroundReader(Protocol):
+    def read(self, serial: str) -> dict[str, str]: ...
+
+
+class QuantityGate2AdapterError(QuantityGate2Error):
+    """第三方设备接口失败后的脱敏映射。"""
+
+
+@dataclass(frozen=True)
+class QuantityGate2RunResult:
+    output_directory: Path
+    screenshot_path: Path
+    manifest_path: Path
+    observation: Gate2Observation
+
+
+class UiautomatorQuantityGate2Adapter(QuantityGate2Device):
+    """只暴露 T-105 已批准的一个加号和一个 Back。"""
+
+    def __init__(
+        self,
+        device: Any,
+        foreground_reader: ForegroundReader,
+        serial: str,
+        timeout_seconds: float,
+    ) -> None:
+        if type(serial) is not str or not serial.strip() or serial != serial.strip():
+            raise ValueError("serial 必须显式且非空。")
+        if not _positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值。")
+        self._device = device
+        self._foreground_reader = foreground_reader
+        self._serial = serial
+        self._timeout = float(timeout_seconds)
+        self._increment_attempted = False
+        self._increment_bounds: str | None = None
+        self._increment_outcome = "not_attempted"
+        self._back_attempted = False
+        self._back_outcome = "not_attempted"
+
+    @property
+    def increment_attempts(self) -> int:
+        return int(self._increment_attempted)
+
+    @property
+    def increment_bounds(self) -> str | None:
+        return self._increment_bounds
+
+    @property
+    def increment_outcome(self) -> str:
+        return self._increment_outcome
+
+    @property
+    def back_attempts(self) -> int:
+        return int(self._back_attempted)
+
+    @property
+    def back_outcome(self) -> str:
+        return self._back_outcome
+
+    def app_info(self, package_name: str) -> dict[str, Any]:
+        value = self._call("app_info", package_name)
+        if not isinstance(value, dict):
+            raise QuantityGate2AdapterError("无法读取应用版本，已停止操作。")
+        return value
+
+    def current_foreground(self) -> dict[str, str]:
+        try:
+            value = self._foreground_reader.read(self._serial)
+        except QuantityGate2Error:
+            raise
+        except Exception as error:
+            raise QuantityGate2AdapterError("无法读取 Android 前台摘要，已停止操作。") from error
+        if not isinstance(value, dict):
+            raise QuantityGate2AdapterError("Android 前台摘要无效，已停止操作。")
+        return value
+
+    def display_size(self) -> tuple[int, int]:
+        value = self._call("window_size")
+        if not isinstance(value, tuple) or len(value) != 2 or any(type(item) is not int for item in value):
+            raise QuantityGate2AdapterError("无法读取屏幕坐标空间，已停止操作。")
+        return value
+
+    def dump_window_hierarchy(self) -> str:
+        value = self._call("jsonrpc_call", "dumpWindowHierarchy", [False, 50], timeout=self._timeout)
+        if not isinstance(value, str):
+            raise QuantityGate2AdapterError("节点树读取失败，已停止操作。")
+        return value
+
+    def increment_quantity_once(self, bounds: str) -> None:
+        if self._increment_attempted:
+            raise QuantityGate2AdapterError("数量加号已尝试过，拒绝重试。")
+        center_x, center_y = _bounds_center(bounds)
+        # RPC 超时无法证明事件未送达，动作机会必须先持久在内存审计状态中。
+        self._increment_attempted = True
+        self._increment_bounds = bounds
+        self._increment_outcome = "ambiguous"
+        self._call("jsonrpc_call", "click", [center_x, center_y], timeout=self._timeout)
+        self._increment_outcome = "completed"
+
+    def capture_screenshot(self) -> str:
+        value = self._call("jsonrpc_call", "takeScreenshot", SCREENSHOT_PARAMS, timeout=self._timeout)
+        if not isinstance(value, str):
+            raise QuantityGate2AdapterError("Gate2 原始截图读取失败，已停止操作。")
+        return value
+
+    def leave_sku_panel_once(self) -> None:
+        if self._back_attempted:
+            raise QuantityGate2AdapterError("安全返回已尝试过，拒绝重试。")
+        self._back_attempted = True
+        self._back_outcome = "ambiguous"
+        self._call("jsonrpc_call", "pressKey", ["back"], timeout=self._timeout)
+        self._back_outcome = "completed"
+
+    def _call(self, method: str, *args: Any, **kwargs: Any) -> Any:
+        try:
+            return getattr(self._device, method)(*args, **kwargs)
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            raise QuantityGate2TimeoutError("T-105 设备调用超时，已停止操作。") from error
+        except QuantityGate2Error:
+            raise
+        except Exception as error:
+            raise QuantityGate2AdapterError("T-105 设备调用失败，已停止操作。") from error
+
+
+class QuantityGate2Runner:
+    """从人工停驻的数量 1 目标面板执行 T-105 已取证闭环。"""
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], Any],
+        foreground_reader: ForegroundReader,
+        timeout_seconds: float,
+        monotonic_clock: Callable[[], float] = monotonic,
+    ) -> None:
+        if not _positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值。")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._foreground_reader = foreground_reader
+        self._timeout = float(timeout_seconds)
+        self._clock = monotonic_clock
+
+    def run(
+        self,
+        serial: str,
+        goods_id: str,
+        gate1: Gate1Observation,
+        target_quantity: int,
+        max_total_price: str,
+        output_directory: Path,
+    ) -> QuantityGate2RunResult:
+        target = Path(output_directory)
+        staging: Path | None = None
+        adapter: UiautomatorQuantityGate2Adapter | None = None
+        flow: QuantityGate2Flow | None = None
+        try:
+            _validate_preflight(serial, goods_id, gate1, target_quantity, max_total_price, target)
+            staging = _prepare_staging(target)
+            inspection = self._adb_client.inspect(serial)
+            _require_expected_device(inspection)
+            adapter = UiautomatorQuantityGate2Adapter(
+                self._connector(serial),
+                self._foreground_reader,
+                serial,
+                self._timeout,
+            )
+            flow = QuantityGate2Flow(
+                adapter,
+                wait_timeout_seconds=self._timeout,
+                monotonic_clock=self._clock,
+            )
+            flow.set_quantity_and_verify(gate1, target_quantity, max_total_price)
+
+            screenshot_path = staging / "gate2_screenshot.png"
+            _save_base64_screenshot(adapter.capture_screenshot(), screenshot_path)
+            captured_at = datetime.now(UTC)
+            _require_screenshot_size(screenshot_path)
+            observation = flow.build_observation(
+                gate1,
+                target_quantity,
+                max_total_price,
+                screenshot_path,
+                captured_at,
+            )
+            flow.exit_sku_panel_safely()
+            _require_action_audit(adapter, target_quantity)
+
+            manifest_path = staging / "manifest.json"
+            manifest_path.write_text(
+                json.dumps(
+                    _manifest(inspection, serial, gate1, observation, screenshot_path, adapter),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            os.rename(staging, target)
+            staging = None
+        except (DeviceConnectionError, QuantityGate2Error):
+            _attempt_known_safe_exit(flow)
+            _clean_staging(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            _attempt_known_safe_exit(flow)
+            _clean_staging(staging)
+            raise QuantityGate2TimeoutError("T-105 真机运行超时，未发布证据。") from error
+        except OSError as error:
+            _attempt_known_safe_exit(flow)
+            _clean_staging(staging)
+            raise QuantityGate2Error("T-105 证据无法原子发布。") from error
+        except Exception as error:
+            _attempt_known_safe_exit(flow)
+            _clean_staging(staging)
+            raise QuantityGate2Error("T-105 真机运行未完成。") from error
+
+        published_observation = replace(
+            observation,
+            screenshot_path=target / "gate2_screenshot.png",
+        )
+        return QuantityGate2RunResult(
+            output_directory=target,
+            screenshot_path=target / "gate2_screenshot.png",
+            manifest_path=target / "manifest.json",
+            observation=published_observation,
+        )
+
+
+def _positive_finite(value: object) -> bool:
+    return isinstance(value, (int, float)) and not isinstance(value, bool) and value > 0 and isfinite(value)
+
+
+def _validate_preflight(
+    serial: object,
+    goods_id: object,
+    gate1: object,
+    target_quantity: object,
+    max_total_price: object,
+    target: Path,
+) -> None:
+    if type(serial) is not str or not serial.strip() or serial != serial.strip():
+        raise QuantityGate2Error("必须显式提供非空设备通道。")
+    if type(goods_id) is not str or goods_id != EXPECTED_GOODS_ID:
+        raise QuantityGate2Error("商品不是 T-105 已批准目标。")
+    if not isinstance(gate1, Gate1Observation) or not gate1.screenshot_path.is_file():
+        raise QuantityGate2Error("Gate1 原始截图不存在，已停止操作。")
+    if type(target_quantity) is not int or target_quantity not in {1, 2}:
+        raise QuantityGate2Error("目标数量没有 T-105 真机证据。")
+    _money(max_total_price)
+    if target.exists() or not target.name:
+        raise QuantityGate2Error("输出目录必须是不存在的明确新目录。")
+
+
+def _prepare_staging(target: Path) -> Path:
+    staging: Path | None = None
+    try:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        staging = target.parent / f".{target.name}.staging-{uuid4().hex}"
+        staging.mkdir()
+        return staging
+    except OSError as error:
+        _clean_staging(staging)
+        raise QuantityGate2Error("输出目录不可写，已停止操作。") from error
+
+
+def _clean_staging(staging: Path | None) -> None:
+    if staging is not None and staging.exists():
+        shutil.rmtree(staging)
+
+
+def _require_expected_device(inspection: DeviceInspection) -> None:
+    if inspection.model != EXPECTED_DEVICE_MODEL or inspection.android_version != EXPECTED_ANDROID_VERSION:
+        raise QuantityGate2Error("设备型号或 Android 版本与 T-105 证据不一致。")
+
+
+def _require_screenshot_size(path: Path) -> None:
+    try:
+        with Image.open(path) as image:
+            image.load()
+            if image.size != EXPECTED_SCREEN_SIZE:
+                raise QuantityGate2Error("Gate2 截图尺寸与 T-105 证据不一致。")
+    except QuantityGate2Error:
+        raise
+    except (OSError, UnidentifiedImageError) as error:
+        raise QuantityGate2Error("Gate2 截图不是有效图像。") from error
+
+
+def _require_action_audit(adapter: UiautomatorQuantityGate2Adapter, target_quantity: int) -> None:
+    expected_increment = int(target_quantity == 2)
+    if (
+        adapter.increment_attempts != expected_increment
+        or (expected_increment and adapter.increment_outcome != "completed")
+        or (expected_increment and adapter.increment_bounds != "[567,752][645,827]")
+        or (not expected_increment and adapter.increment_outcome != "not_attempted")
+        or adapter.back_attempts != 1
+        or adapter.back_outcome != "completed"
+    ):
+        raise QuantityGate2Error("T-105 动作审计链不完整，拒绝发布。")
+
+
+def _attempt_known_safe_exit(flow: QuantityGate2Flow | None) -> None:
+    if flow is None or not flow.can_exit_safely:
+        return
+    try:
+        flow.exit_sku_panel_safely()
+    except Exception:
+        pass
+
+
+def _manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    gate1: Gate1Observation,
+    observation: Gate2Observation,
+    screenshot_path: Path,
+    adapter: UiautomatorQuantityGate2Adapter,
+) -> dict[str, Any]:
+    return {
+        "schema_version": 1,
+        "operation": "t105-quantity-gate2",
+        "captured_at": observation.captured_at.isoformat(),
+        "product": {"goods_id": EXPECTED_GOODS_ID},
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": EXPECTED_PDD_VERSION,
+        },
+        "selection": {"color": observation.actual_color, "size": observation.actual_size},
+        "quantity": {"requested": observation.requested_quantity, "read": observation.quantity_read},
+        "prices": {
+            "gate1_unit_price": observation.gate1_unit_price,
+            "gate2_panel_total_price": observation.gate2_panel_total_price,
+            "max_total_price": observation.max_total_price,
+        },
+        "gate1_evidence": {
+            "captured_at": gate1.captured_at.isoformat(),
+            "screenshot_sha256": _sha256_file(gate1.screenshot_path),
+        },
+        "gate2_evidence": {
+            "path": screenshot_path.name,
+            "sha256": _sha256_file(screenshot_path),
+        },
+        "action_audit": {
+            "increment_attempts": adapter.increment_attempts,
+            "increment_rpc_outcome": adapter.increment_outcome,
+            "back_attempts": adapter.back_attempts,
+            "back_rpc_outcome": adapter.back_outcome,
+        },
+        "safe_exit": "completed",
+        "review_status": "human_review_required",
+    }

client/src/cmbuyer_client/pdd/quantity_gate2_spike.py

@@ -0,0 +1,351 @@
+"""T-105 数量两态的纯只读取证；人工确认前不识别或操作数量控件。"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from hashlib import sha256
+import json
+from math import isfinite
+import os
+from pathlib import Path
+import re
+import shutil
+from typing import Any, Protocol
+from uuid import uuid4
+
+from adbutils.errors import AdbTimeout
+from PIL import Image, UnidentifiedImageError
+from uiautomator2.exceptions import HTTPTimeoutError
+
+from ..device.adb import AdbClient, CommandRunner, DeviceConnectionError, DeviceInspection
+from ..device.baseline import (
+    HIERARCHY_PARAMS,
+    PDD_PACKAGE,
+    SCREENSHOT_PARAMS,
+    _save_base64_screenshot,
+    _sha256_file,
+    _validate_hierarchy,
+)
+from .product_open import EXPECTED_PDD_VERSION
+from .product_url import parse_product_url
+
+
+EXPECTED_GOODS_ID = "937122477375"
+EXPECTED_DEVICE_MODEL = "PKG110"
+EXPECTED_ANDROID_VERSION = "16"
+EXPECTED_SCREEN_SIZE = (1080, 2376)
+TARGET_SELECTION = {"color": "黑色CHA(纯棉)", "size": "M(建议100-115)"}
+DECLARED_QUANTITIES = {"initial": 1, "target": 2}
+
+
+class QuantityGate2EvidenceError(RuntimeError):
+    """T-105 两态证据未形成完整原子产物。"""
+
+
+class QuantityGate2EvidenceTimeoutError(QuantityGate2EvidenceError):
+    """只读取证设备调用超时。"""
+
+
+class QuantityGate2ReadDevice(Protocol):
+    """阶段一唯一设备边界；故意不暴露任何页面动作。"""
+
+    def app_info(self, package_name: str) -> dict[str, Any]: ...
+
+    def window_size(self) -> tuple[int, int]: ...
+
+    def jsonrpc_call(self, method: str, params: Any = None, timeout: float = 10) -> Any: ...
+
+
+class QuantityGate2ForegroundReader(Protocol):
+    """只读取 Android 16 的唯一 resumed activity，不暴露通用 shell。"""
+
+    def read(self, serial: str) -> dict[str, str]: ...
+
+
+class Android16TopResumedForegroundReader:
+    """绕开 adbutils 2.12.0 对 Android 16 ``topResumedActivity`` 的误解析。"""
+
+    _TOP_RESUMED_PATTERN = re.compile(
+        r"(?m)^\s*topResumedActivity=ActivityRecord\{[^\r\n}]*?\s+u\d+\s+"
+        r"(?P<package>[^/\s]+)/(?P<activity>[^\s}]+)\s+t\d+\}\s*$"
+    )
+
+    def __init__(self, runner: CommandRunner, timeout_seconds: float) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._runner = runner
+        self._timeout_seconds = timeout_seconds
+
+    def read(self, serial: str) -> dict[str, str]:
+        if type(serial) is not str or not serial.strip() or serial != serial.strip():
+            raise QuantityGate2EvidenceError("必须显式提供非空设备通道。")
+        result = self._runner.run(
+            ("-s", serial, "shell", "dumpsys", "activity", "activities"),
+            self._timeout_seconds,
+        )
+        if result.returncode != 0:
+            raise QuantityGate2EvidenceError("Android 前台摘要读取失败，未发布证据。")
+        matches = list(self._TOP_RESUMED_PATTERN.finditer(result.stdout))
+        if len(matches) != 1:
+            raise QuantityGate2EvidenceError("Android 前台摘要不唯一，未发布证据。")
+        match = matches[0]
+        return {
+            "package": match.group("package"),
+            "activity": match.group("activity"),
+        }
+
+
+@dataclass(frozen=True)
+class QuantityGate2EvidenceResult:
+    output_directory: Path
+    manifest_path: Path
+    screenshot_path: Path
+    hierarchy_path: Path
+    app_path: Path
+
+
+class QuantityGate2EvidenceCapturer:
+    """记录人工准备的数量状态，不从页面推断声明是否正确。"""
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], QuantityGate2ReadDevice],
+        foreground_reader: QuantityGate2ForegroundReader,
+        timeout_seconds: float,
+    ) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._foreground_reader = foreground_reader
+        self._timeout_seconds = timeout_seconds
+        self._started = False
+
+    def capture(
+        self,
+        serial: str,
+        goods_id: str,
+        human_declared_state: str,
+        human_declared_quantity: int,
+        output_directory: Path,
+    ) -> QuantityGate2EvidenceResult:
+        if self._started:
+            raise QuantityGate2EvidenceError("同一取证器不可重复调用。")
+        self._started = True
+        _validate_inputs(serial, goods_id, human_declared_state, human_declared_quantity)
+        target = Path(output_directory)
+        _validate_new_target(target)
+
+        staging: Path | None = None
+        try:
+            inspection = self._adb_client.inspect(serial)
+            _require_expected_device(inspection)
+            device = self._connector(serial)
+            initial_app = _require_read_precondition(
+                device,
+                self._foreground_reader.read(serial),
+            )
+
+            target.parent.mkdir(parents=True, exist_ok=True)
+            staging = target.parent / f".{target.name}.staging-{uuid4().hex}"
+            staging.mkdir()
+
+            screenshot_path = staging / "screenshot.png"
+            screenshot_payload = _read_rpc(
+                device,
+                "takeScreenshot",
+                SCREENSHOT_PARAMS,
+                self._timeout_seconds,
+            )
+            if not isinstance(screenshot_payload, str):
+                raise QuantityGate2EvidenceError("数量状态截图无效，未发布证据。")
+            _save_base64_screenshot(screenshot_payload, screenshot_path)
+            _require_screenshot_size(screenshot_path)
+
+            hierarchy = _read_rpc(
+                device,
+                "dumpWindowHierarchy",
+                HIERARCHY_PARAMS,
+                self._timeout_seconds,
+            )
+            _validate_hierarchy(hierarchy)
+            hierarchy_path = staging / "hierarchy.xml"
+            hierarchy_path.write_text(hierarchy, encoding="utf-8")
+
+            final_app = _require_read_precondition(
+                device,
+                self._foreground_reader.read(serial),
+            )
+            if final_app != initial_app:
+                raise QuantityGate2EvidenceError("数量状态取证期间前台页面漂移，未发布证据。")
+            app_path = staging / "app.json"
+            app_path.write_text(
+                json.dumps(final_app, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
+                encoding="utf-8",
+            )
+
+            manifest_path = staging / "manifest.json"
+            manifest_path.write_text(
+                json.dumps(
+                    _manifest(
+                        inspection,
+                        serial,
+                        goods_id,
+                        human_declared_state,
+                        human_declared_quantity,
+                        screenshot_path,
+                        hierarchy_path,
+                        app_path,
+                    ),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            os.rename(staging, target)
+            staging = None
+        except (DeviceConnectionError, QuantityGate2EvidenceError):
+            _clean_staging(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            _clean_staging(staging)
+            raise QuantityGate2EvidenceTimeoutError("数量两态只读取证超时，未发布证据。") from error
+        except (OSError, UnidentifiedImageError, ValueError) as error:
+            _clean_staging(staging)
+            raise QuantityGate2EvidenceError("数量两态证据无法原子发布，未发布证据。") from error
+        except Exception as error:
+            _clean_staging(staging)
+            raise QuantityGate2EvidenceError("数量两态只读取证未完成，未发布证据。") from error
+
+        return QuantityGate2EvidenceResult(
+            output_directory=target,
+            manifest_path=target / "manifest.json",
+            screenshot_path=target / "screenshot.png",
+            hierarchy_path=target / "hierarchy.xml",
+            app_path=target / "app.json",
+        )
+
+
+def _is_positive_finite(value: object) -> bool:
+    return (
+        isinstance(value, (int, float))
+        and not isinstance(value, bool)
+        and value > 0
+        and isfinite(value)
+    )
+
+
+def _validate_inputs(serial: object, goods_id: object, state: object, quantity: object) -> None:
+    if type(serial) is not str or not serial.strip() or serial != serial.strip():
+        raise QuantityGate2EvidenceError("必须显式提供非空设备通道。")
+    if type(goods_id) is not str or goods_id != EXPECTED_GOODS_ID:
+        raise QuantityGate2EvidenceError("商品不是 T-105 已批准取证目标。")
+    parse_product_url(f"https://mobile.yangkeduo.com/goods.html?goods_id={goods_id}")
+    if type(state) is not str or state not in DECLARED_QUANTITIES:
+        raise QuantityGate2EvidenceError("人工声明状态无效。")
+    if type(quantity) is not int or quantity != DECLARED_QUANTITIES[state]:
+        raise QuantityGate2EvidenceError("人工声明数量与批准状态不一致。")
+
+
+def _validate_new_target(target: Path) -> None:
+    if target.exists() or not target.name:
+        raise QuantityGate2EvidenceError("输出目录必须是不存在的明确新目录。")
+
+
+def _require_expected_device(inspection: DeviceInspection) -> None:
+    if inspection.model != EXPECTED_DEVICE_MODEL or inspection.android_version != EXPECTED_ANDROID_VERSION:
+        raise QuantityGate2EvidenceError("设备不是已批准取证组合。")
+
+
+def _require_read_precondition(
+    device: QuantityGate2ReadDevice,
+    current: object,
+) -> dict[str, str]:
+    info = device.app_info(PDD_PACKAGE)
+    version = (info.get("versionName") or info.get("version_name")) if isinstance(info, dict) else None
+    if version != EXPECTED_PDD_VERSION:
+        raise QuantityGate2EvidenceError("拼多多版本不是已批准取证版本。")
+    if not isinstance(current, dict) or current.get("package") != PDD_PACKAGE:
+        raise QuantityGate2EvidenceError("拼多多不在前台。")
+    activity = current.get("activity")
+    if not isinstance(activity, str) or not activity.strip():
+        raise QuantityGate2EvidenceError("前台应用摘要不完整。")
+    if device.window_size() != EXPECTED_SCREEN_SIZE:
+        raise QuantityGate2EvidenceError("屏幕坐标空间不是已批准尺寸。")
+    return {"package": PDD_PACKAGE, "activity": activity, "pdd_version": EXPECTED_PDD_VERSION}
+
+
+def _read_rpc(
+    device: QuantityGate2ReadDevice,
+    method: str,
+    params: object,
+    timeout_seconds: float,
+) -> object:
+    return device.jsonrpc_call(method, params, timeout=timeout_seconds)
+
+
+def _require_screenshot_size(path: Path) -> None:
+    with Image.open(path) as image:
+        image.load()
+        if image.size != EXPECTED_SCREEN_SIZE or image.format != "PNG":
+            raise QuantityGate2EvidenceError("数量状态截图格式或尺寸无效。")
+
+
+def _clean_staging(staging: Path | None) -> None:
+    if staging is not None and staging.exists():
+        shutil.rmtree(staging)
+
+
+def _manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    goods_id: str,
+    state: str,
+    quantity: int,
+    screenshot_path: Path,
+    hierarchy_path: Path,
+    app_path: Path,
+) -> dict[str, Any]:
+    return {
+        "schema_version": 1,
+        "operation": "t105-quantity-gate2-readonly-evidence",
+        "captured_at": datetime.now(UTC).isoformat(),
+        "product": {
+            "goods_id": goods_id,
+            "canonical_url": f"https://mobile.yangkeduo.com/goods.html?goods_id={goods_id}",
+        },
+        "human_declared_state": state,
+        "human_declared_quantity": quantity,
+        "human_declared_selection": TARGET_SELECTION,
+        "review_status": "human_review_required",
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": EXPECTED_PDD_VERSION,
+        },
+        "artifacts": [
+            {
+                "path": screenshot_path.name,
+                "role": "quantity_state_raw_screenshot",
+                "sha256": _sha256_file(screenshot_path),
+            },
+            {
+                "path": hierarchy_path.name,
+                "role": "quantity_state_raw_hierarchy_local_only",
+                "sha256": _sha256_file(hierarchy_path),
+            },
+            {
+                "path": app_path.name,
+                "role": "quantity_state_app_identity",
+                "sha256": _sha256_file(app_path),
+            },
+        ],
+    }

client/src/cmbuyer_client/pdd/sku_reveal_spike.py

@@ -1,4 +1,4 @@
-"""T-103 尺码显示动作的一次性真机取证；不属于生产采购 Flow。"""
+"""T-103 尺码显示动作的一次性真机证据采集。"""
 
 from __future__ import annotations
 
@@ -20,32 +20,10 @@ from ..device.baseline import PDD_PACKAGE, _save_base64_screenshot, _sha256_file
 from .product_url import parse_product_url
 from .sku_selection import (
     EXPECTED_GOODS_ID,
-    _COLOR_ONLY_SUMMARY,
-    _PANEL_SURFACE,
-    _PanelProfile,
-    _REVEAL_NOT_PROVEN,
-    _S_SIZE_UI,
-    _TARGET_COLOR_UI,
-    _TARGET_SIZE_UI,
-    _action_bounds,
-    _clickable_before,
-    _descendant,
-    _exact_color_action,
-    _exact_inert,
-    _exact_live_layout,
-    _exact_readonly_text,
-    _exact_recycler,
-    _is_size_action_text,
-    _one,
     _parse_nodes,
     _require_color_only_panel,
-    _require_color_action_chain,
-    _require_color_subtree,
-    _require_exact_selected_set,
-    _require_panel_chain,
-    _require_size_wrapper,
-    _require_size_action_chain,
-    _spec_for,
+    _require_safe_reveal_path,
+    _revealed_unselected_projection,
     resolve_task_selection,
     SkuSelectionError,
     SkuSelectionFlow,
@@ -63,45 +41,54 @@ from .sku_selection_runner import (
 
 
 _TARGET_URL = f"https://mobile.yangkeduo.com/goods.html?goods_id={EXPECTED_GOODS_ID}"
-_REVEAL_START = (360, 1900)
-_REVEAL_END = (360, 1300)
-_REVEAL_STEPS = 30
+_REVEAL_FAILURE_STAGES = frozenset(
+    (
+        "reveal_precondition",
+        "reveal_attempted",
+        "reveal_candidate",
+        "reveal_after",
+        "reveal_publish",
+    )
+)
+_REVEAL_FAILURE_MARKER = object()
 
 
 class SkuRevealSpikeError(RuntimeError):
     """一次性 reveal 取证未形成可发布证据。"""
 
 
+def _annotate_reveal_failure(error: BaseException, stage: str) -> None:
+    """只记录本模块实际走到的固定阶段；入口阶段使用独立 marker，不会被覆盖。"""
+
+    if type(stage) is not str or stage not in _REVEAL_FAILURE_STAGES:
+        return
+    try:
+        setattr(error, "_cmbuyer_reveal_failure_stage", stage)
+        # marker 最后写入，任一 setter 失败都不能形成可信阶段。
+        setattr(error, "_cmbuyer_reveal_failure_marker", _REVEAL_FAILURE_MARKER)
+    except BaseException:
+        pass
+
+
+def safe_reveal_failure_stage(error: BaseException) -> str | None:
+    """读取可公开的 reveal 控制流阶段；伪造属性或 hostile getter 均失败闭合。"""
+
+    try:
+        marker = getattr(error, "_cmbuyer_reveal_failure_marker", None)
+        stage = getattr(error, "_cmbuyer_reveal_failure_stage", None)
+        if marker is not _REVEAL_FAILURE_MARKER or type(stage) is not str:
+            return None
+        return stage if stage in _REVEAL_FAILURE_STAGES else None
+    except BaseException:
+        return None
+
+
 @dataclass(frozen=True)
 class SkuRevealSpikeResult:
     output_directory: Path
     manifest_path: Path
 
 
-class _RevealEvidenceAdapter(UiautomatorSkuPanelAdapter):
-    """只为 spike 增加一个无参数、固定 profile 的一次性手势。"""
-
-    def __init__(self, device: Any, timeout_seconds: float) -> None:
-        super().__init__(device, timeout_seconds)
-        self._reveal_attempted = False
-
-    @property
-    def reveal_attempted(self) -> bool:
-        return self._reveal_attempted
-
-    def reveal_size_options_once(self) -> None:
-        if self._reveal_attempted:
-            raise SkuRevealSpikeError("规格显示动作已经尝试过，拒绝重试。")
-        # RPC 超时也可能表示手势已经送达，必须在调用前封存唯一机会。
-        self._reveal_attempted = True
-        self._call(
-            "jsonrpc_call",
-            "swipe",
-            [*_REVEAL_START, *_REVEAL_END, _REVEAL_STEPS],
-            timeout=self._timeout_seconds,
-        )
-
-
 class SkuRevealSpikeCapturer:
     """打开已取证面板、选一次目标颜色，再采集唯一 reveal 的前后证据。"""
 
@@ -127,18 +114,20 @@ class SkuRevealSpikeCapturer:
         goods_id: str,
         output_directory: Path,
     ) -> SkuRevealSpikeResult:
-        if type(goods_id) is not str or goods_id != EXPECTED_GOODS_ID:
-            raise SkuRevealSpikeError("商品不是 T-103 已取证目标，已停止取证。")
-        link = parse_product_url(_TARGET_URL)
-        target = Path(output_directory)
-        _validate_new_target(target)
+        stage = "reveal_precondition"
         staging: Path | None = None
+        adapter: UiautomatorSkuPanelAdapter | None = None
         try:
+            if type(goods_id) is not str or goods_id != EXPECTED_GOODS_ID:
+                raise SkuRevealSpikeError("商品不是 T-103 已取证目标，已停止取证。")
+            link = parse_product_url(_TARGET_URL)
+            target = Path(output_directory)
+            _validate_new_target(target)
             staging = _prepare_staging(target)
             deadline = self._clock() + self._timeout_seconds
             inspection = self._adb_client.inspect(serial)
             _require_expected_device(inspection)
-            adapter = _RevealEvidenceAdapter(self._connector(serial), self._timeout_seconds)
+            adapter = UiautomatorSkuPanelAdapter(self._connector(serial), self._timeout_seconds)
             _require_expected_version(adapter.app_info(PDD_PACKAGE))
             if adapter.display_size() != EXPECTED_SCREEN_SIZE:
                 raise SkuRevealSpikeError("设备不是已取证的竖屏坐标空间，已停止取证。")
@@ -155,13 +144,10 @@ class SkuRevealSpikeCapturer:
                 sleep_function=self._sleep,
             )
             flow.open_sku_panel(link.canonical_url, pre_intent)
-            try:
-                flow.select_sku_options(resolve_task_selection("黑色CHA(纯棉)", "M(建议100-115)"))
-            except SkuSelectionError as error:
-                if error.args != (_REVEAL_NOT_PROVEN,):
-                    raise
-            else:
-                raise SkuRevealSpikeError("规格流程未停在已取证的仅颜色状态。")
+            # spike 只复用生产 Flow 的私有前置准备，不调用完整选择流程，避免重复 reveal/M。
+            flow._prepare_reveal_precondition(
+                resolve_task_selection("黑色CHA(纯棉)", "M(建议100-115)")
+            )
 
             before_hierarchy = adapter.dump_window_hierarchy()
             before_nodes = _parse_nodes(before_hierarchy)
@@ -180,19 +166,24 @@ class SkuRevealSpikeCapturer:
             (staging / "before" / "hierarchy.xml").write_text(before_hierarchy, encoding="utf-8")
 
             rpc_outcome = "completed"
+            # 此后即属于 attempted：adapter 会在 RPC 前封存唯一机会，结果不明也只能调和。
+            stage = "reveal_attempted"
             try:
                 adapter.reveal_size_options_once()
             except SkuSelectionRunError:
                 rpc_outcome = "ambiguous_reconciled"
 
+            stage = "reveal_candidate"
             projection, after_hierarchy = self._wait_for_candidate(adapter, deadline)
+            stage = "reveal_after"
             after_directory = staging / "after"
             _capture_frame(adapter, after_directory, after_hierarchy)
             reverified = adapter.dump_window_hierarchy()
-            if _candidate_projection(_parse_nodes(reverified)) != projection:
+            if _revealed_unselected_projection(_parse_nodes(reverified)) != projection:
                 raise SkuRevealSpikeError("截图后候选状态漂移，未发布证据。")
             (after_directory / "hierarchy.xml").write_text(reverified, encoding="utf-8")
 
+            stage = "reveal_publish"
             manifest = _manifest(inspection, serial, rpc_outcome, staging)
             manifest_path = staging / "manifest.json"
             manifest_path.write_text(
@@ -201,18 +192,28 @@ class SkuRevealSpikeCapturer:
             )
             os.rename(staging, target)
             staging = None
-        except (DeviceConnectionError, SkuSelectionError, SkuSelectionRunError, SkuRevealSpikeError):
+        except (DeviceConnectionError, SkuSelectionError, SkuSelectionRunError, SkuRevealSpikeError) as error:
             _clean_staging(staging)
+            failure_stage = stage
+            if stage == "reveal_attempted" and (adapter is None or not adapter.reveal_attempted):
+                # attempted 只能在 adapter 已于 RPC 前封存唯一机会后成立。
+                failure_stage = "reveal_precondition"
+            _annotate_reveal_failure(error, failure_stage)
             raise
         except Exception as error:
             _clean_staging(staging)
-            raise SkuRevealSpikeError("规格 reveal 取证未完成，未发布本地证据目录。") from error
+            mapped = SkuRevealSpikeError("规格 reveal 取证未完成，未发布本地证据目录。")
+            failure_stage = stage
+            if stage == "reveal_attempted" and (adapter is None or not adapter.reveal_attempted):
+                failure_stage = "reveal_precondition"
+            _annotate_reveal_failure(mapped, failure_stage)
+            raise mapped from error
 
         return SkuRevealSpikeResult(target, target / "manifest.json")
 
     def _wait_for_candidate(
         self,
-        adapter: _RevealEvidenceAdapter,
+        adapter: UiautomatorSkuPanelAdapter,
         deadline: float,
     ) -> tuple[tuple[tuple[str, ...], ...], str]:
         stable: tuple[tuple[str, ...], ...] | None = None
@@ -223,7 +224,7 @@ class SkuRevealSpikeCapturer:
                 raise SkuRevealSpikeError("reveal 后拼多多不在前台，未发布证据。")
             hierarchy = adapter.dump_window_hierarchy()
             try:
-                projection = _candidate_projection(_parse_nodes(hierarchy))
+                projection = _revealed_unselected_projection(_parse_nodes(hierarchy))
             except SkuSelectionError:
                 projection = None
             if projection is not None and projection == stable:
@@ -235,137 +236,7 @@ class SkuRevealSpikeCapturer:
             self._sleep(min(0.2, remaining))
 
 
-def _require_safe_reveal_path(nodes: list[Any]) -> None:
-    # 当前真机证据证明 x=360 是两列规格卡之间的空隙；必须验证完整线段，离散采样会漏掉窄浮层。
-    surface = _one(
-        [node for node in nodes if _exact_inert(node, "android.view.ViewGroup", _PANEL_SURFACE)],
-        "固定 reveal 通道无法绑定面板内容面。",
-    )
-    _require_panel_chain(surface)
-    content = surface.parent
-    action_root = content.parent if content is not None else None
-    action_parent = action_root.parent if action_root is not None else None
-    if (
-        content is None
-        or action_root is None
-        or action_parent is None
-        or not _exact_live_layout(action_root, "android.view.ViewGroup", "[0,366][1080,2328]")
-        or not _exact_live_layout(action_parent, "android.widget.LinearLayout", "[0,120][1080,2328]")
-    ):
-        raise SkuRevealSpikeError("固定 reveal 通道祖先身份漂移，未执行手势。")
-    allowed = {id(action_root.element), id(action_parent.element)}
-    occupants: set[int] = set()
-    for node in nodes:
-        if node.element.get("clickable") != "true":
-            continue
-        try:
-            left, top, right, bottom = _action_bounds(node.bounds)
-        except SkuSelectionError as error:
-            raise SkuRevealSpikeError("可点击节点坐标不可验证，未执行手势。") from error
-        if (
-            left <= _REVEAL_START[0] < right
-            and top <= _REVEAL_START[1]
-            and bottom > _REVEAL_END[1]
-        ):
-            occupants.add(id(node.element))
-    if occupants != allowed:
-        raise SkuRevealSpikeError("固定 reveal 通道被未取证可点击节点占用，未执行手势。")
-    if _REVEAL_START[1] >= 2079 or _REVEAL_END[1] >= 2079:
-        raise SkuRevealSpikeError("固定 reveal 通道越过规格内容区，未执行手势。")
-
-
-def _candidate_projection(nodes: list[Any]) -> tuple[tuple[str, ...], ...]:
-    surface = _one(
-        [node for node in nodes if _exact_inert(node, "android.view.ViewGroup", _PANEL_SURFACE)],
-        "候选面板内容面不唯一。",
-    )
-    _require_panel_chain(surface)
-    header = _one(
-        [node for node in nodes if node.parent is surface and _exact_inert(node, "android.widget.LinearLayout", "[0,366][1080,1000]")],
-        "候选面板头部不唯一。",
-    )
-    outer = _one(
-        [node for node in nodes if node.parent is surface and _exact_recycler(node, "[0,1000][1080,2079]")],
-        "候选维度容器不唯一。",
-    )
-    price_row = _one(
-        [node for node in nodes if _descendant(node, header) and _exact_inert(node, "android.widget.LinearLayout", "[396,498][895,570]")],
-        "候选价格行不唯一。",
-    )
-    current = _one(
-        [node for node in nodes if node.parent is price_row and _exact_readonly_text(node, "快卖完 ¥12.88", "[396,503][712,570]")],
-        "候选当前价不唯一。",
-    )
-    original = _one(
-        [node for node in nodes if node.parent is price_row and _exact_readonly_text(node, "¥29.88", "[730,503][895,570]")],
-        "候选原价不唯一。",
-    )
-    if _clickable_before(current, surface):
-        raise SkuSelectionError("候选当前价位于可点击内容祖先下。")
-    summary = _one(
-        [node for node in nodes if _descendant(node, header) and _exact_readonly_text(node, _COLOR_ONLY_SUMMARY, "[396,654][1053,716]")],
-        "候选摘要不唯一。",
-    )
-    color_region = _one(
-        [node for node in nodes if _descendant(node, outer) and _exact_recycler(node, "[36,1000][1080,1483]")],
-        "候选颜色容器不唯一。",
-    )
-    color = _one(
-        [node for node in nodes if node.parent is color_region and _exact_color_action(node, "[372,1000][684,1024]", True)],
-        "候选目标颜色不唯一。",
-    )
-    rolled_spec = _spec_for(_PanelProfile.TARGETS_SELECTED)
-    selected_color_nodes = _require_color_subtree(color, rolled_spec)
-    _require_color_action_chain(color, color_region, outer, surface, rolled_spec)
-    size_label = _one(
-        [node for node in nodes if _descendant(node, outer) and _exact_readonly_text(node, "尺码", "[36,1506][114,1552]")],
-        "候选尺码标题不唯一。",
-    )
-    size_header = size_label.parent
-    if size_header is None or not _exact_live_layout(size_header, "android.widget.LinearLayout", "[36,1489][1044,1570]"):
-        raise SkuSelectionError("候选尺码标题父结构漂移。")
-    size_options = _one(
-        [node for node in nodes if _descendant(node, outer) and _exact_inert(node, "android.view.ViewGroup", "[36,1582][1044,1897]")],
-        "候选尺码 options 根不唯一。",
-    )
-    actions = [node for node in nodes if _descendant(node, size_options) and _is_size_action_text(node)]
-    s_action = _one(
-        [node for node in actions if node.text == _S_SIZE_UI and node.bounds == "[36,1582][409,1667]"],
-        "候选 S action 不唯一。",
-    )
-    m_action = _one(
-        [node for node in actions if node.text == _TARGET_SIZE_UI and node.bounds == "[439,1582][831,1667]"],
-        "候选 M action 不唯一。",
-    )
-    _require_size_wrapper(s_action, size_options)
-    _require_size_wrapper(m_action, size_options)
-    _require_size_action_chain(s_action, size_options, outer, surface)
-    _require_size_action_chain(m_action, size_options, outer, surface)
-    if any(node.element.get("selected") == "true" for node in actions):
-        raise SkuSelectionError("reveal 候选态已有尺码被选中。")
-    _require_exact_selected_set(nodes, surface, selected_color_nodes)
-    dangerous = [
-        node for node in nodes
-        if "提交订单" in node.text
-        and node.element.get("package") == PDD_PACKAGE
-        and node.element.get("class") == "android.widget.TextView"
-    ]
-    if len(dangerous) != 1 or _action_bounds(dangerous[0].bounds)[1] < 2079:
-        raise SkuSelectionError("提交硬拒绝区位置不唯一。")
-    return tuple(
-        (
-            node.element.get("class", ""),
-            node.bounds,
-            node.text,
-            node.desc,
-            node.element.get("selected", ""),
-            node.element.get("clickable", ""),
-        )
-        for node in (surface, header, outer, price_row, current, original, summary, color_region, color, size_label, size_options, s_action, m_action, dangerous[0])
-    )
-
-
-def _capture_frame(adapter: _RevealEvidenceAdapter, directory: Path, hierarchy: str) -> None:
+def _capture_frame(adapter: UiautomatorSkuPanelAdapter, directory: Path, hierarchy: str) -> None:
     directory.mkdir()
     hierarchy_path = directory / "hierarchy.xml"
     hierarchy_path.write_text(hierarchy, encoding="utf-8")

client/src/cmbuyer_client/pdd/sku_selection.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 from enum import Enum
+from functools import partial
 import re
 from time import monotonic, sleep
 from typing import Any, Callable, Protocol
@@ -17,6 +18,9 @@ EXPECTED_UNIT_PRICE = "12.88"
 # 任务值不是页面判据；右侧是 v5 取证的唯一 accessibility 文案（空格/全角括号均有意义）。
 TASK_TO_UI_SELECTION = {("黑色CHA(纯棉)", "M(建议100-115)"): ("黑色 CHA (纯棉）", "M（建议100-115）")}
 _TARGET_COLOR_UI, _TARGET_SIZE_UI = next(iter(TASK_TO_UI_SELECTION.values()))
+_TARGET_COLOR_UNROLLED_BOUNDS = "[372,1188][684,1587]"
+_TARGET_COLOR_ROLLED_ALT_BOUNDS = "[126,1000][438,1024]"
+_TARGET_SIZE_BOUNDS = "[439,1582][831,1667]"
 _ENTRY = "快要抢光 ¥ 12.88"
 _ENTRY_PROMOTION_LABEL = "快要抢光"
 _ENTRY_TEXT_BOUNDS = "[688,2184][1042,2253]"
@@ -24,6 +28,12 @@ _ENTRY_ACTION_DESC = "快要抢光¥12.88"
 _ENTRY_ACTION_BOUNDS = "[446,2166][1080,2328]"
 _ENTRY_SIBLING = "免拼购买"
 _ENTRY_SIBLING_BOUNDS = "[688,2256][856,2305]"
+_PRODUCT_TITLE_DESC = "2026年新款高档重工潮流烫钻中长款T恤显瘦宽松上衣淡人穿搭"
+_PRODUCT_TITLE_FIRST_LINE = "2026年新款高档重工潮流烫钻中长款T恤显瘦宽松"
+_PRODUCT_TITLE_SECOND_LINE = "上衣淡人穿搭"
+_PRODUCT_TITLE_RESOURCE_ID = "com.xunmeng.pinduoduo:id/tv_title"
+_PRODUCT_TITLE_BOUNDS = "[36,1571][1044,1689]"
+_DANGEROUS_EXIT_ACTION_TERMS = ("提交订单", "确认订单", "立即支付", "去支付", "付款")
 _FORBIDDEN_ENTRY_ACTION_DESC = (
     "购买", "下单", "付款", "订单", "单独购买", "直接拼成", "提交订单", "支付",
     "先用后付", "0元下单", "0 元下单",
@@ -36,10 +46,11 @@ _COLOR_ONLY_SUMMARY = "请选择： 尺码"
 _S_SIZE_UI = "S（建议80-100）"
 _S_SUMMARY = f"已选： {_TARGET_COLOR_UI} {_S_SIZE_UI}"
 _TARGET_SUMMARY = f"已选： {_TARGET_COLOR_UI} {_TARGET_SIZE_UI}"
-_REVEAL_NOT_PROVEN = "尺码仍在已取证视口外；受控显示动作尚未取证，已停止后续点击。"
 _BOUNDS = re.compile(r"^\[(\d+),(\d+)\]\[(\d+),(\d+)\]$")
 _ROLLED_CURRENT_PRICE = "快卖完 ¥12.88"
 _ROLLED_ORIGINAL_PRICE = "¥29.88"
+_REVEALED_CURRENT_PRICE = "限1件 ¥12.88 "
+_REVEAL_GESTURE = (360, 1900, 360, 1300, 30)
 _BAD_PRICE_ROLE = ("提交订单", "支付", "优惠", "券", "会员", "补贴", "区间", "实付", "到手", "原价", "划线价", "最低", "低至", "起价", "下单", "先用后付", "预估")
 
 
@@ -90,6 +101,7 @@ class SkuPanelDevice(Protocol):
     def dump_window_hierarchy(self) -> str: ...
     def tap_sku_entry(self, bounds: str) -> None: ...
     def tap_sku_option(self, bounds: str) -> None: ...
+    def reveal_size_options_once(self) -> None: ...
     def leave_sku_panel(self) -> None: ...
 
 
@@ -121,20 +133,38 @@ class _Node:
 class _PanelProfile(Enum):
     PANEL_OPEN_EMPTY = "panel_open_empty"
     COLOR_SELECTED_SIZE_HIDDEN = "color_selected_size_hidden"
+    SIZE_VISIBLE_UNSELECTED = "size_visible_unselected"
     SIZE_VISIBLE_NON_TARGET = "size_visible_non_target"
     TARGETS_SELECTED = "targets_selected"
 
 
+@dataclass(frozen=True)
+class _DualPriceLayout:
+    row_bounds: str
+    current_text: str
+    current_bounds: str
+    original_text: str
+    original_bounds: str
+
+
+@dataclass(frozen=True)
+class _CurrentOnlyPriceLayout:
+    # 同一 App 版本会把原价整段移除；这是独立证据布局，不是“原价可选”。
+    frame_bounds: str
+    row_bounds: str
+    current_text: str
+    current_bounds: str
+
+
+_PriceLayout = _DualPriceLayout | _CurrentOnlyPriceLayout
+
+
 @dataclass(frozen=True)
 class _PanelSpec:
     profile: _PanelProfile
     header_bounds: str
     outer_bounds: str
-    price_row_bounds: str
-    current_text: str
-    current_bounds: str
-    original_text: str
-    original_bounds: str
+    price_layout: _PriceLayout
     summary_text: str
     summary_bounds: str
     color_label_bounds: str | None
@@ -149,26 +179,54 @@ _PANEL_SPECS = (
     _PanelSpec(
         _PanelProfile.PANEL_OPEN_EMPTY,
         "[0,366][1080,1077]", "[0,1077][1080,2079]",
-        "[396,575][912,647]", "限1件 ¥12.88 ", "[396,580][675,647]",
-        "券前¥29.88", "[693,580][912,647]",
+        _DualPriceLayout(
+            "[396,575][912,647]", "限1件 ¥12.88 ", "[396,580][675,647]",
+            "券前¥29.88", "[693,580][912,647]",
+        ),
         _EMPTY_SUMMARY, "[396,731][1053,793]", "[36,1106][192,1159]",
-        "[36,1188][1080,2046]", "[372,1188][684,1587]", False,
+        "[36,1188][1080,2046]", _TARGET_COLOR_UNROLLED_BOUNDS, False,
         "[36,2069][114,2079]", None,
     ),
     _PanelSpec(
         _PanelProfile.COLOR_SELECTED_SIZE_HIDDEN,
         "[0,366][1080,1077]", "[0,1077][1080,2079]",
-        "[396,575][912,647]", "限1件 ¥12.88 ", "[396,580][675,647]",
-        "券前¥29.88", "[693,580][912,647]",
+        _DualPriceLayout(
+            "[396,575][912,647]", "限1件 ¥12.88 ", "[396,580][675,647]",
+            "券前¥29.88", "[693,580][912,647]",
+        ),
         _COLOR_ONLY_SUMMARY, "[396,731][1053,793]", "[36,1106][192,1159]",
-        "[36,1188][1080,2046]", "[372,1188][684,1587]", True,
+        "[36,1188][1080,2046]", _TARGET_COLOR_UNROLLED_BOUNDS, True,
+        "[36,2069][114,2079]", None,
+    ),
+    _PanelSpec(
+        _PanelProfile.PANEL_OPEN_EMPTY,
+        "[0,366][1080,1077]", "[0,1077][1080,2079]",
+        _CurrentOnlyPriceLayout(
+            "[396,575][1053,647]", "[396,575][693,647]",
+            "限1件 ¥12.88 ", "[396,580][675,647]",
+        ),
+        _EMPTY_SUMMARY, "[396,731][1053,793]", "[36,1106][192,1159]",
+        "[36,1188][1080,2046]", _TARGET_COLOR_UNROLLED_BOUNDS, False,
+        "[36,2069][114,2079]", None,
+    ),
+    _PanelSpec(
+        _PanelProfile.COLOR_SELECTED_SIZE_HIDDEN,
+        "[0,366][1080,1077]", "[0,1077][1080,2079]",
+        _CurrentOnlyPriceLayout(
+            "[396,575][1053,647]", "[396,575][693,647]",
+            "限1件 ¥12.88 ", "[396,580][675,647]",
+        ),
+        _COLOR_ONLY_SUMMARY, "[396,731][1053,793]", "[36,1106][192,1159]",
+        "[36,1188][1080,2046]", _TARGET_COLOR_UNROLLED_BOUNDS, True,
         "[36,2069][114,2079]", None,
     ),
     _PanelSpec(
         _PanelProfile.SIZE_VISIBLE_NON_TARGET,
         "[0,366][1080,1000]", "[0,1000][1080,2079]",
-        "[396,498][895,570]", _ROLLED_CURRENT_PRICE, "[396,503][712,570]",
-        _ROLLED_ORIGINAL_PRICE, "[730,503][895,570]",
+        _DualPriceLayout(
+            "[396,498][895,570]", _ROLLED_CURRENT_PRICE, "[396,503][712,570]",
+            _ROLLED_ORIGINAL_PRICE, "[730,503][895,570]",
+        ),
         _S_SUMMARY, "[396,654][1053,716]", None,
         "[36,1000][1080,1483]", "[372,1000][684,1024]", True,
         "[36,1506][114,1552]", _S_SIZE_UI,
@@ -176,12 +234,40 @@ _PANEL_SPECS = (
     _PanelSpec(
         _PanelProfile.TARGETS_SELECTED,
         "[0,366][1080,1000]", "[0,1000][1080,2079]",
-        "[396,498][895,570]", _ROLLED_CURRENT_PRICE, "[396,503][712,570]",
-        _ROLLED_ORIGINAL_PRICE, "[730,503][895,570]",
+        _DualPriceLayout(
+            "[396,498][895,570]", _ROLLED_CURRENT_PRICE, "[396,503][712,570]",
+            _ROLLED_ORIGINAL_PRICE, "[730,503][895,570]",
+        ),
         _TARGET_SUMMARY, "[396,654][1053,716]", None,
         "[36,1000][1080,1483]", "[372,1000][684,1024]", True,
         "[36,1506][114,1552]", _TARGET_SIZE_UI,
     ),
+    # T-104 真机证据证明：人工重新打开已选面板时，颜色横向列表可把同一目标卡片精确滚到
+    # 左侧；只增加该证据坐标的完整 profile，不放宽文字、selected、价格或其余结构。
+    _PanelSpec(
+        _PanelProfile.TARGETS_SELECTED,
+        "[0,366][1080,1000]", "[0,1000][1080,2079]",
+        _DualPriceLayout(
+            "[396,498][895,570]", _ROLLED_CURRENT_PRICE, "[396,503][712,570]",
+            _ROLLED_ORIGINAL_PRICE, "[730,503][895,570]",
+        ),
+        _TARGET_SUMMARY, "[396,654][1053,716]", None,
+        "[36,1000][1080,1483]", _TARGET_COLOR_ROLLED_ALT_BOUNDS, True,
+        "[36,1506][114,1552]", _TARGET_SIZE_UI,
+    ),
+)
+
+
+_REVEALED_UNSELECTED_SPEC = _PanelSpec(
+    _PanelProfile.SIZE_VISIBLE_UNSELECTED,
+    "[0,366][1080,1000]", "[0,1000][1080,2079]",
+    _CurrentOnlyPriceLayout(
+        "[396,498][1053,570]", "[396,498][693,570]",
+        _REVEALED_CURRENT_PRICE, "[396,503][675,570]",
+    ),
+    _COLOR_ONLY_SUMMARY, "[396,654][1053,716]", None,
+    "[36,1000][1080,1483]", "[372,1000][684,1024]", True,
+    "[36,1506][114,1552]", None,
 )
 
 
@@ -193,9 +279,12 @@ class SkuSelectionFlow:
             raise ValueError("入口等待参数无效。")
         self._device, self._entry_timeout, self._poll = device, entry_wait_timeout_seconds, entry_poll_interval_seconds
         self._clock, self._sleep = monotonic_clock, sleep_function
-        self._pending: tuple[str, Callable[[list[_Node]], Any]] | None = None
+        self._pending: tuple[str, Callable[[list[_Node]], Any], bool] | None = None
+        self._terminal = False
+        self._color_selected_by_flow = False
 
     def open_sku_panel(self, product_url: str, pre_intent_hierarchy: str | None = None) -> None:
+        self._require_active()
         try:
             if parse_product_url(product_url).goods_id != EXPECTED_GOODS_ID:
                 raise SkuSelectionError("商品不是已取证目标，已停止操作。")
@@ -217,84 +306,181 @@ class SkuSelectionFlow:
             raise
 
         try:
-            self._pending = (before, _require_empty_panel)
+            self._pending = (before, _require_empty_panel, False)
             self._device.tap_sku_entry(entry.bounds)
         except BaseException as error:
+            self._terminal = True
             _annotate_sku_entry_failure(error, "sku_entry_click")
             raise
 
         try:
             self._wait_after_action(before, _require_empty_panel)
         except BaseException as error:
+            self._terminal = True
             _annotate_sku_entry_failure(error, "sku_entry_panel_verify")
             raise
 
     def select_sku_options(self, selection: SkuSelection) -> None:
+        self._require_active()
+        if selection != SkuSelection(_TARGET_COLOR_UI, _TARGET_SIZE_UI):
+            raise SkuSelectionError("规格 UI 文案不是获准目标，已停止操作。")
+        nodes = self._verified_nodes()
+        initial_profile = _classify_panel(nodes).profile
+        if initial_profile is _PanelProfile.TARGETS_SELECTED:
+            return
+        if initial_profile is _PanelProfile.SIZE_VISIBLE_NON_TARGET:
+            self._require_foreground()
+            before = self._read_hierarchy()
+            nodes = _parse_nodes(before)
+            target = _target_size_action(nodes, selected=False)
+            _action_bounds(target.bounds)
+            _require_action_occupants(nodes, target)
+            self._perform_mutation(
+                before,
+                _require_target_panel,
+                partial(self._device.tap_sku_option, target.bounds),
+            )
+            return
+
+        self._prepare_reveal_precondition(selection)
+        self._require_foreground()
+        before = self._read_hierarchy()
+        nodes = _parse_nodes(before)
+        spec = _require_profile(nodes, _PanelProfile.COLOR_SELECTED_SIZE_HIDDEN)
+        if not isinstance(spec.price_layout, _CurrentOnlyPriceLayout):
+            # 真机动作证据只覆盖 current-only；dual 仅颜色态必须在 reveal 前零动作停止。
+            raise SkuSelectionError("规格显示前置不是已取证单价格布局，已停止操作。")
+        _require_safe_reveal_path(nodes)
+        self._perform_mutation(
+            before,
+            _revealed_unselected_projection,
+            self._device.reveal_size_options_once,
+            require_stable=True,
+        )
+
+        self._require_foreground()
+        before = self._read_hierarchy()
+        nodes = _parse_nodes(before)
+        _revealed_unselected_projection(nodes)
+        target = _target_size_action(nodes, selected=False)
+        _action_bounds(target.bounds)
+        _require_action_occupants(nodes, target)
+        self._perform_mutation(
+            before,
+            _require_target_panel,
+            partial(self._device.tap_sku_option, target.bounds),
+        )
+
+    def _prepare_reveal_precondition(self, selection: SkuSelection) -> None:
+        """只把 current-only 初态推进到仅颜色态，供生产 Flow 与证据 spike 共用。"""
+
+        self._require_active()
         if selection != SkuSelection(_TARGET_COLOR_UI, _TARGET_SIZE_UI):
             raise SkuSelectionError("规格 UI 文案不是获准目标，已停止操作。")
         self._require_foreground()
         before = self._read_hierarchy()
         nodes = _parse_nodes(before)
-        profile = _classify_panel(nodes)
-
-        if profile is _PanelProfile.PANEL_OPEN_EMPTY:
-            target = _target_color_action(nodes, selected=False)
-            _action_bounds(target.bounds)
-            _require_action_occupants(nodes, target)
-            self._pending = (before, _require_color_only_panel)
-            self._device.tap_sku_option(target.bounds)
-            self._wait_after_action(before, _require_color_only_panel)
-            # 当前证据只证明颜色选择；尺码仍在视口外。没有动作证据时必须在此停住，
-            # 不能把一次通用 swipe 或下一次规格点击伪装成已验证流程。
-            raise SkuSelectionError(_REVEAL_NOT_PROVEN)
-        if profile is _PanelProfile.COLOR_SELECTED_SIZE_HIDDEN:
-            raise SkuSelectionError(_REVEAL_NOT_PROVEN)
-        if profile is _PanelProfile.SIZE_VISIBLE_NON_TARGET:
-            target = _target_size_action(nodes, selected=False)
-            _action_bounds(target.bounds)
-            _require_action_occupants(nodes, target)
-            self._pending = (before, _require_target_panel)
-            self._device.tap_sku_option(target.bounds)
-            self._wait_after_action(before, _require_target_panel)
+        spec = _classify_panel(nodes)
+        if spec.profile is _PanelProfile.COLOR_SELECTED_SIZE_HIDDEN:
+            if not isinstance(spec.price_layout, _CurrentOnlyPriceLayout):
+                raise SkuSelectionError("规格显示前置不是已取证单价格布局，已停止操作。")
+            if not self._color_selected_by_flow:
+                raise SkuSelectionError("目标颜色不是本次 Flow 精确选中，未执行 reveal。")
             return
-        if profile is _PanelProfile.TARGETS_SELECTED:
-            return
-        raise SkuSelectionError("规格面板状态不属于已取证 profile，已停止操作。")
+        if spec.profile is not _PanelProfile.PANEL_OPEN_EMPTY or not isinstance(
+            spec.price_layout, _CurrentOnlyPriceLayout
+        ):
+            raise SkuSelectionError("规格面板不属于获准的单价格初态，已停止操作。")
+        target = _target_color_action(nodes, selected=False)
+        _action_bounds(target.bounds)
+        _require_action_occupants(nodes, target)
+        color_postcondition = partial(
+            _require_profile_with_price_layout,
+            expected=_PanelProfile.COLOR_SELECTED_SIZE_HIDDEN,
+            expected_price_layout=spec.price_layout,
+        )
+        self._perform_mutation(
+            before,
+            color_postcondition,
+            partial(self._device.tap_sku_option, target.bounds),
+        )
+        self._color_selected_by_flow = True
 
     def read_sku_unit_price(self) -> str:
+        self._require_active()
         return _unit_price(self._verified_nodes())
 
     def verify_target_selection_and_read_price(self, selection: SkuSelection) -> str:
+        self._require_active()
         if selection != SkuSelection(_TARGET_COLOR_UI, _TARGET_SIZE_UI):
             raise SkuSelectionError("规格 UI 文案不是获准目标，已停止读取。")
         nodes = self._verified_nodes()
         return _unit_price(nodes)
 
     def exit_sku_panel_safely(self) -> None:
+        self._require_active()
         self._require_foreground()
         before = self._read_hierarchy()
-        _classify_panel(_parse_nodes(before))
-        self._device.leave_sku_panel()
+        # 截图重证与 Back 之间仍可能漂移；只有目标双规格和已验单价同时保持时才允许返回。
+        _unit_price(_parse_nodes(before))
+        try:
+            self._device.leave_sku_panel()
+        except BaseException:
+            self._terminal = True
+            raise
         deadline = self._clock() + self._entry_timeout
-        while True:
-            self._require_foreground()
-            raw = self._read_hierarchy()
-            if raw != before:
+        stable: tuple[object, ...] | None = None
+        try:
+            while True:
+                self._require_foreground()
+                raw = self._read_hierarchy()
                 try:
-                    _classify_panel(_parse_nodes(raw))
+                    projection = _product_exit_projection(_parse_nodes(raw))
                 except SkuSelectionError:
-                    return
-            remaining = deadline - self._clock()
-            if remaining <= 0:
-                raise SkuSelectionError("安全退出后未确认离开规格面板，未重试返回。")
-            self._sleep(min(self._poll, remaining))
+                    stable = None
+                else:
+                    # 用前台/版本检查夹住第二棵候选树；页面在 dump 后漂移时不能成功。
+                    self._require_foreground()
+                    if stable == projection:
+                        self._terminal = True
+                        return
+                    stable = projection
+                remaining = deadline - self._clock()
+                if remaining <= 0:
+                    raise SkuSelectionError("安全退出后未确认离开规格面板，未重试返回。")
+                self._sleep(min(self._poll, remaining))
+        except BaseException:
+            self._terminal = True
+            raise
 
     def reconcile_pending_action(self) -> None:
         """仅只读调和一次已发出但尚未得到后置条件确认的动作。"""
         if self._pending is None:
             return
-        before, condition = self._pending
-        self._wait_after_action(before, condition)
+        before, condition, require_stable = self._pending
+        self._wait_after_action(before, condition, require_stable=require_stable)
+
+    def _perform_mutation(
+        self,
+        before: str,
+        condition: Callable[[list[_Node]], Any],
+        mutation: Callable[[], None],
+        *,
+        require_stable: bool = False,
+    ) -> list[_Node]:
+        # 后置条件连同唯一动作机会必须在 RPC 前封存；超时可能表示已送达，不能重发。
+        self._pending = (before, condition, require_stable)
+        try:
+            mutation()
+            return self._wait_after_action(before, condition, require_stable=require_stable)
+        except BaseException:
+            # 结果不明时只允许 reconcile_pending_action 读回；即使调和成功，本 Flow 也不再继续。
+            self._terminal = True
+            raise
+
+    def _require_active(self) -> None:
+        if self._terminal:
+            raise SkuSelectionError("规格流程已进入不可重入终止态，已停止操作。")
 
     def _wait_for_entry(self, previous: str | None) -> tuple[_Node, str]:
         deadline, stable = self._clock() + self._entry_timeout, None
@@ -326,19 +512,31 @@ class SkuSelectionFlow:
                 raise SkuSelectionError("等待已取证规格入口超时，未执行点击。")
             self._sleep(min(self._poll, remaining))
 
-    def _wait_after_action(self, previous: str, condition: Callable[[list[_Node]], Any]) -> list[_Node]:
+    def _wait_after_action(
+        self,
+        previous: str,
+        condition: Callable[[list[_Node]], Any],
+        *,
+        require_stable: bool = False,
+    ) -> list[_Node]:
         deadline = self._clock() + self._entry_timeout
+        stable: Any = None
+        has_stable = False
         while True:
             self._require_foreground()
             raw = self._read_hierarchy()
             if raw != previous:
                 nodes = _parse_nodes(raw)
                 try:
-                    condition(nodes)
-                    self._pending = None
-                    return nodes
+                    projection = condition(nodes)
+                    if not require_stable or (has_stable and projection == stable):
+                        self._pending = None
+                        return nodes
+                    stable = projection
+                    has_stable = True
                 except SkuSelectionError:
-                    pass
+                    stable = None
+                    has_stable = False
             remaining = deadline - self._clock()
             if remaining <= 0:
                 raise SkuSelectionError("动作后页面未在限定时间内满足已取证后置条件，未重试动作。")
@@ -383,14 +581,20 @@ def _parse_nodes(raw: str) -> list[_Node]:
     return result
 
 
-def _classify_panel(nodes: list[_Node]) -> _PanelProfile:
-    matches: list[_PanelProfile] = []
+def _classify_panel(nodes: list[_Node]) -> _PanelSpec:
+    matches: list[_PanelSpec] = []
     for spec in _PANEL_SPECS:
         try:
             _match_panel_profile(nodes, spec)
         except SkuSelectionError:
             continue
-        matches.append(spec.profile)
+        matches.append(spec)
+    try:
+        _revealed_unselected_projection(nodes)
+    except SkuSelectionError:
+        pass
+    else:
+        matches.append(_REVEALED_UNSELECTED_SPEC)
     if len(matches) != 1:
         raise SkuSelectionError("规格面板不符合唯一完整取证 profile，已停止操作。")
     return matches[0]
@@ -408,9 +612,23 @@ def _require_target_panel(nodes: list[_Node]) -> None:
     _require_profile(nodes, _PanelProfile.TARGETS_SELECTED)
 
 
-def _require_profile(nodes: list[_Node], expected: _PanelProfile) -> None:
-    if _classify_panel(nodes) is not expected:
+def _require_profile(nodes: list[_Node], expected: _PanelProfile) -> _PanelSpec:
+    spec = _classify_panel(nodes)
+    if spec.profile is not expected:
         raise SkuSelectionError("规格面板动作后状态与已取证 profile 不一致，已停止操作。")
+    return spec
+
+
+def _require_profile_with_price_layout(
+    nodes: list[_Node],
+    *,
+    expected: _PanelProfile,
+    expected_price_layout: _PriceLayout,
+) -> None:
+    spec = _require_profile(nodes, expected)
+    # 同一次颜色点击不得跨价格证据 variant；完整 dataclass identity 同时绑定类型与全部 exact 字段。
+    if spec.price_layout != expected_price_layout:
+        raise SkuSelectionError("规格面板动作后价格布局发生跨变体漂移，已停止操作。")
 
 
 def _match_panel_profile(nodes: list[_Node], spec: _PanelSpec) -> None:
@@ -427,24 +645,24 @@ def _match_panel_profile(nodes: list[_Node], spec: _PanelSpec) -> None:
         [node for node in nodes if node.parent is surface and _exact_recycler(node, spec.outer_bounds)],
         "规格面板维度容器不唯一。",
     )
-    price_row = _one(
-        [node for node in nodes if _descendant(node, header) and _exact_inert(node, "android.widget.LinearLayout", spec.price_row_bounds)],
-        "规格面板价格行不唯一。",
-    )
-    if len([child for child in price_row.element if child.tag == "node"]) != 2:
-        raise SkuSelectionError("规格面板价格行子节点数量漂移。")
-    current = _one(
-        [node for node in nodes if node.parent is price_row and _exact_readonly_text(node, spec.current_text, spec.current_bounds)],
-        "规格面板当前价角色不唯一。",
-    )
-    _one(
-        [node for node in nodes if node.parent is price_row and _exact_readonly_text(node, spec.original_text, spec.original_bounds)],
-        "规格面板原价角色不唯一。",
+    current, summary_anchor, summary_is_direct = _match_price_layout(
+        nodes,
+        header,
+        spec.price_layout,
     )
     if _clickable_before(current, surface):
         raise SkuSelectionError("规格面板价格角色位于可点击内容祖先下。")
     _one(
-        [node for node in nodes if _descendant(node, header) and _exact_readonly_text(node, spec.summary_text, spec.summary_bounds)],
+        [
+            node
+            for node in nodes
+            if (
+                node.parent is summary_anchor
+                if summary_is_direct
+                else _descendant(node, summary_anchor)
+            )
+            and _exact_readonly_text(node, spec.summary_text, spec.summary_bounds)
+        ],
         "规格面板摘要不唯一。",
     )
 
@@ -506,12 +724,185 @@ def _match_panel_profile(nodes: list[_Node], spec: _PanelSpec) -> None:
     _require_exact_selected_set(nodes, surface, [*selected_nodes, expected_action])
 
 
+def _require_safe_reveal_path(nodes: list[_Node]) -> None:
+    """证明固定手势整条线段仍是已取证的两列卡片间安全通道。"""
+
+    surface = _one(
+        [node for node in nodes if _exact_inert(node, "android.view.ViewGroup", _PANEL_SURFACE)],
+        "固定 reveal 通道无法绑定面板内容面。",
+    )
+    _require_panel_chain(surface)
+    content = surface.parent
+    action_root = content.parent if content is not None else None
+    action_parent = action_root.parent if action_root is not None else None
+    if (
+        content is None
+        or action_root is None
+        or action_parent is None
+        or not _exact_live_layout(action_root, "android.view.ViewGroup", "[0,366][1080,2328]")
+        or not _exact_live_layout(action_parent, "android.widget.LinearLayout", "[0,120][1080,2328]")
+    ):
+        raise SkuSelectionError("固定 reveal 通道祖先身份漂移，未执行手势。")
+    start_x, start_y, end_x, end_y, _steps = _REVEAL_GESTURE
+    allowed = {id(action_root.element), id(action_parent.element)}
+    occupants: set[int] = set()
+    for node in nodes:
+        if node.element.get("clickable") != "true":
+            continue
+        try:
+            left, top, right, bottom = _action_bounds(node.bounds)
+        except SkuSelectionError as error:
+            raise SkuSelectionError("可点击节点坐标不可验证，未执行手势。") from error
+        if (
+            left <= start_x < right
+            and top <= start_y
+            and bottom > end_y
+        ):
+            occupants.add(id(node.element))
+    if occupants != allowed:
+        raise SkuSelectionError("固定 reveal 通道被未取证可点击节点占用，未执行手势。")
+    if start_y >= 2079 or end_y >= 2079:
+        raise SkuSelectionError("固定 reveal 通道越过规格内容区，未执行手势。")
+
+
+def _revealed_unselected_projection(nodes: list[_Node]) -> tuple[tuple[str, ...], ...]:
+    """唯一生产判据：current-only reveal 后，目标颜色已选且 S/M 均未选。"""
+
+    surface = _one(
+        [node for node in nodes if _exact_inert(node, "android.view.ViewGroup", _PANEL_SURFACE)],
+        "reveal 后面板内容面不唯一。",
+    )
+    _require_panel_chain(surface)
+    header = _one(
+        [node for node in nodes if node.parent is surface and _exact_inert(node, "android.widget.LinearLayout", "[0,366][1080,1000]")],
+        "reveal 后面板头部不唯一。",
+    )
+    if len([child for child in header.element if child.tag == "node"]) != 4:
+        raise SkuSelectionError("reveal 后面板头部子节点数量漂移。")
+    outer = _one(
+        [node for node in nodes if node.parent is surface and _exact_recycler(node, "[0,1000][1080,2079]")],
+        "reveal 后维度容器不唯一。",
+    )
+    content_frame = _one(
+        [node for node in nodes if node.parent is header and _exact_inert(node, "android.widget.FrameLayout", "[0,474][1080,863]")],
+        "reveal 后价格内容外框不唯一。",
+    )
+    if len([child for child in content_frame.element if child.tag == "node"]) != 1:
+        raise SkuSelectionError("reveal 后价格内容外框子节点数量漂移。")
+    relative = _one(
+        [node for node in nodes if node.parent is content_frame and _exact_inert(node, "android.widget.RelativeLayout", "[0,474][1080,863]")],
+        "reveal 后价格 RelativeLayout 父子关系漂移。",
+    )
+    if len([child for child in relative.element if child.tag == "node"]) != 1:
+        raise SkuSelectionError("reveal 后价格 RelativeLayout 子节点数量漂移。")
+    content = _one(
+        [node for node in nodes if node.parent is relative and _exact_inert(node, "android.view.ViewGroup", "[0,474][1080,863]")],
+        "reveal 后价格内容 ViewGroup 父子关系漂移。",
+    )
+    if len([child for child in content.element if child.tag == "node"]) != 8:
+        raise SkuSelectionError("reveal 后价格内容 ViewGroup 子节点数量漂移。")
+    price_frame = _one(
+        [node for node in nodes if node.parent is content and _exact_inert(node, "android.widget.FrameLayout", "[396,498][1053,570]")],
+        "reveal 后价格 FrameLayout 父子关系漂移。",
+    )
+    if len([child for child in price_frame.element if child.tag == "node"]) != 1:
+        raise SkuSelectionError("reveal 后价格 FrameLayout 子节点数量漂移。")
+    price_row = _one(
+        [node for node in nodes if node.parent is price_frame and _exact_inert(node, "android.widget.LinearLayout", "[396,498][693,570]")],
+        "reveal 后单价格行父子关系漂移。",
+    )
+    if len([child for child in price_row.element if child.tag == "node"]) != 1:
+        raise SkuSelectionError("reveal 后单价格行子节点数量漂移。")
+    current = _one(
+        [node for node in nodes if node.parent is price_row and _exact_readonly_text(node, _REVEALED_CURRENT_PRICE, "[396,503][675,570]") and len(node.element) == 0],
+        "reveal 后单价格当前价不唯一。",
+    )
+    if _clickable_before(current, surface):
+        raise SkuSelectionError("reveal 后单价格当前价位于可点击内容祖先下。")
+    if any(
+        node.text in {_ROLLED_CURRENT_PRICE, _ROLLED_ORIGINAL_PRICE, "券前¥29.88"}
+        or (node.bounds == "[396,498][895,570]" and node.element.get("class") == "android.widget.LinearLayout")
+        for node in nodes
+    ):
+        raise SkuSelectionError("reveal 后单价格布局混入双价格角色。")
+    summary = _one(
+        [node for node in nodes if node.parent is content and _exact_readonly_text(node, _COLOR_ONLY_SUMMARY, "[396,654][1053,716]") and len(node.element) == 0],
+        "reveal 后摘要不唯一。",
+    )
+    color_region = _one(
+        [node for node in nodes if _descendant(node, outer) and _exact_recycler(node, "[36,1000][1080,1483]")],
+        "reveal 后颜色容器不唯一。",
+    )
+    color = _one(
+        [node for node in nodes if node.parent is color_region and _exact_color_action(node, "[372,1000][684,1024]", True)],
+        "reveal 后目标颜色不唯一。",
+    )
+    selected_color_nodes = _require_color_subtree(color, _REVEALED_UNSELECTED_SPEC)
+    _require_color_action_chain(color, color_region, outer, surface, _REVEALED_UNSELECTED_SPEC)
+    size_label = _one(
+        [node for node in nodes if _descendant(node, outer) and _exact_readonly_text(node, _SIZE, "[36,1506][114,1552]")],
+        "reveal 后尺码标题不唯一。",
+    )
+    size_header = size_label.parent
+    if size_header is None or not _exact_live_layout(size_header, "android.widget.LinearLayout", "[36,1489][1044,1570]"):
+        raise SkuSelectionError("reveal 后尺码标题父结构漂移。")
+    size_options = _one(
+        [node for node in nodes if _descendant(node, outer) and _exact_inert(node, "android.view.ViewGroup", "[36,1582][1044,1897]")],
+        "reveal 后尺码 options 根不唯一。",
+    )
+    actions = [node for node in nodes if _descendant(node, size_options) and _is_size_action_text(node)]
+    s_action = _one(
+        [node for node in actions if node.text == _S_SIZE_UI and node.bounds == "[36,1582][409,1667]" and node.element.get("selected") == "false"],
+        "reveal 后 S action 不唯一。",
+    )
+    m_action = _one(
+        [node for node in actions if node.text == _TARGET_SIZE_UI and node.bounds == _TARGET_SIZE_BOUNDS and node.element.get("selected") == "false"],
+        "reveal 后 M action 不唯一。",
+    )
+    _require_size_wrapper(s_action, size_options)
+    _require_size_wrapper(m_action, size_options)
+    _require_size_action_chain(s_action, size_options, outer, surface)
+    _require_size_action_chain(m_action, size_options, outer, surface)
+    if any(node.element.get("selected") == "true" for node in actions):
+        raise SkuSelectionError("reveal 后已有尺码被选中。")
+    _require_exact_selected_set(nodes, surface, selected_color_nodes)
+    dangerous = [
+        node
+        for node in nodes
+        if node.element.get("package") == PDD_PACKAGE
+        and node.element.get("class") == "android.widget.TextView"
+        and "提交订单" in node.text
+    ]
+    danger = _one(dangerous, "提交硬拒绝区位置不唯一。")
+    if (
+        not _exact_readonly_text(danger, "选择尺码后，提交订单", "[285,2225][795,2284]")
+        or len(danger.element) != 0
+    ):
+        raise SkuSelectionError("提交硬拒绝区结构漂移。")
+    return tuple(
+        (
+            node.element.get("class", ""),
+            node.bounds,
+            node.text,
+            node.desc,
+            node.element.get("selected", ""),
+            node.element.get("clickable", ""),
+        )
+        for node in (
+            surface, header, outer, price_frame, price_row, current, summary,
+            color_region, color, size_label, size_options, s_action, m_action, danger,
+        )
+    )
+
+
 def _unit_price(nodes: list[_Node]) -> str:
-    _require_profile(nodes, _PanelProfile.TARGETS_SELECTED)
-    spec = _spec_for(_PanelProfile.TARGETS_SELECTED)
+    spec = _classify_panel(nodes)
+    if spec.profile is not _PanelProfile.TARGETS_SELECTED:
+        raise SkuSelectionError("规格面板动作后状态与已取证 profile 不一致，已停止操作。")
+    current_bounds = spec.price_layout.current_bounds
     candidates = [
         node for node in nodes
-        if _exact_readonly_text(node, _ROLLED_CURRENT_PRICE, spec.current_bounds)
+        if _exact_readonly_text(node, _ROLLED_CURRENT_PRICE, current_bounds)
     ]
     current = _one(candidates, "规格面板现价不唯一，已停止读取。")
     surface = _one([node for node in nodes if _exact_inert(node, "android.view.ViewGroup", _PANEL_SURFACE)], "规格面板内容面不唯一。")
@@ -521,27 +912,126 @@ def _unit_price(nodes: list[_Node]) -> str:
 
 
 def _target_color_action(nodes: list[_Node], *, selected: bool) -> _Node:
-    profile = _classify_panel(nodes)
+    spec = _classify_panel(nodes)
+    profile = spec.profile
     expected_profile = _PanelProfile.COLOR_SELECTED_SIZE_HIDDEN if selected else _PanelProfile.PANEL_OPEN_EMPTY
     if profile is not expected_profile:
         raise SkuSelectionError("目标颜色 action 不属于预期 profile。")
-    spec = _spec_for(profile)
     return _one([node for node in nodes if _exact_color_action(node, spec.color_bounds, selected)], "目标颜色 action 不唯一。")
 
 
 def _target_size_action(nodes: list[_Node], *, selected: bool) -> _Node:
-    profile = _classify_panel(nodes)
-    expected_profile = _PanelProfile.TARGETS_SELECTED if selected else _PanelProfile.SIZE_VISIBLE_NON_TARGET
-    if profile is not expected_profile:
+    profile = _classify_panel(nodes).profile
+    expected_profiles = (
+        {_PanelProfile.TARGETS_SELECTED}
+        if selected
+        else {_PanelProfile.SIZE_VISIBLE_UNSELECTED, _PanelProfile.SIZE_VISIBLE_NON_TARGET}
+    )
+    if profile not in expected_profiles:
         raise SkuSelectionError("目标尺码 action 不属于预期 profile。")
     return _one(
-        [node for node in nodes if _is_size_action_text(node) and node.text == _TARGET_SIZE_UI and node.bounds == "[439,1582][831,1667]" and node.element.get("selected") == str(selected).lower()],
+        [node for node in nodes if _is_size_action_text(node) and node.text == _TARGET_SIZE_UI and node.bounds == _TARGET_SIZE_BOUNDS and node.element.get("selected") == str(selected).lower()],
         "目标尺码 action 不唯一。",
     )
 
 
 def _spec_for(profile: _PanelProfile) -> _PanelSpec:
-    return next(spec for spec in _PANEL_SPECS if spec.profile is profile)
+    matches = [spec for spec in _PANEL_SPECS if spec.profile is profile]
+    if len(matches) != 1:
+        raise SkuSelectionError("该 profile 没有唯一静态 spec。")
+    return matches[0]
+
+
+def _match_price_layout(
+    nodes: list[_Node],
+    header: _Node,
+    layout: _PriceLayout,
+) -> tuple[_Node, _Node, bool]:
+    if isinstance(layout, _DualPriceLayout):
+        price_row = _one(
+            [
+                node
+                for node in nodes
+                if _descendant(node, header)
+                and _exact_inert(node, "android.widget.LinearLayout", layout.row_bounds)
+            ],
+            "规格面板双价格行不唯一。",
+        )
+        if len([child for child in price_row.element if child.tag == "node"]) != 2:
+            raise SkuSelectionError("规格面板双价格行子节点数量漂移。")
+        current = _one(
+            [
+                node
+                for node in nodes
+                if node.parent is price_row
+                and _exact_readonly_text(node, layout.current_text, layout.current_bounds)
+            ],
+            "规格面板双价格当前价角色不唯一。",
+        )
+        _one(
+            [
+                node
+                for node in nodes
+                if node.parent is price_row
+                and _exact_readonly_text(node, layout.original_text, layout.original_bounds)
+            ],
+            "规格面板双价格原价角色不唯一。",
+        )
+        # 历史已批准 raw 的双价格行和摘要位于 header 内的嵌套内容容器，
+        # 旧证据只允许后代关系，不能套用 current-only 的直接父链。
+        return current, header, False
+
+    frame = _one(
+        [
+            node
+            for node in nodes
+            if _descendant(node, header)
+            and _exact_inert(node, "android.widget.FrameLayout", layout.frame_bounds)
+        ],
+        "规格面板单价格外层不唯一。",
+    )
+    if len([child for child in frame.element if child.tag == "node"]) != 1:
+        raise SkuSelectionError("规格面板单价格外层子节点数量漂移。")
+    content = frame.parent
+    relative = content.parent if content is not None else None
+    content_frame = relative.parent if relative is not None else None
+    if (
+        content is None
+        or relative is None
+        or content_frame is None
+        or content_frame.parent is not header
+        or not _exact_inert(content, "android.view.ViewGroup", "[0,551][1080,940]")
+        or not _exact_inert(relative, "android.widget.RelativeLayout", "[0,551][1080,940]")
+        or not _exact_inert(content_frame, "android.widget.FrameLayout", "[0,551][1080,940]")
+    ):
+        raise SkuSelectionError("规格面板单价格外层父链漂移。")
+    price_row = _one(
+        [
+            node
+            for node in nodes
+            if node.parent is frame
+            and _exact_inert(node, "android.widget.LinearLayout", layout.row_bounds)
+        ],
+        "规格面板单价格行父子关系漂移。",
+    )
+    if len([child for child in price_row.element if child.tag == "node"]) != 1:
+        raise SkuSelectionError("规格面板单价格行子节点数量漂移。")
+    current = _one(
+        [
+            node
+            for node in nodes
+            if node.parent is price_row
+            and _exact_readonly_text(node, layout.current_text, layout.current_bounds)
+        ],
+        "规格面板单价格当前价角色不唯一。",
+    )
+    if any(
+        _descendant(node, header)
+        and node.text == "券前¥29.88"
+        for node in nodes
+    ):
+        raise SkuSelectionError("规格面板单价格变体出现原价角色。")
+    return current, content, True
 
 
 def _exact_inert(node: _Node, class_name: str, bounds: str) -> bool:
@@ -660,7 +1150,7 @@ def _require_color_subtree(color: _Node, spec: _PanelSpec) -> list[_Node]:
     selected = str(spec.color_selected).lower()
     children = [child for child in color.element if child.tag == "node"]
     expected_selected: list[_Node] = [color] if spec.color_selected else []
-    if spec.color_bounds == "[372,1188][684,1587]":
+    if spec.color_bounds == _TARGET_COLOR_UNROLLED_BOUNDS:
         if len(children) != 4:
             raise SkuSelectionError("目标颜色完整卡片子树数量漂移。")
         child_nodes = [node for node in _walk_direct_children(color)]
@@ -704,7 +1194,7 @@ def _require_color_action_chain(
 ) -> None:
     if color.parent is not color_region:
         raise SkuSelectionError("目标颜色 action 不属于已取证颜色容器。")
-    if spec.color_bounds == "[372,1188][684,1587]":
+    if spec.color_bounds == _TARGET_COLOR_UNROLLED_BOUNDS:
         expected = (
             ("android.widget.FrameLayout", "[0,1188][1080,2046]"),
             ("android.widget.LinearLayout", "[0,1188][1080,2052]"),
@@ -916,6 +1406,62 @@ def _entry_projection(node: _Node, nodes: list[_Node]) -> tuple[object, ...] | N
     )
 
 
+def _product_exit_projection(nodes: list[_Node]) -> tuple[object, ...]:
+    """返回 T-104 人验同商品详情页的最小稳定投影；不读取页面价格。"""
+
+    if any(
+        _is_live_clickable(node)
+        and any(term in value for value in (node.text, node.desc) for term in _DANGEROUS_EXIT_ACTION_TERMS)
+        for node in nodes
+    ):
+        # T-106/T-107 前只把这些结构当保守拒绝，不宣称它们是完整确认/支付页分类器。
+        raise SkuSelectionError("退出后出现危险动作语义，不能确认安全退出。")
+
+    entries = _eligible_entries(nodes)
+    if len(entries) != 1:
+        raise SkuSelectionError("退出后商品规格入口不唯一。")
+    entry = _entry_projection(entries[0], nodes)
+    if entry is None:
+        raise SkuSelectionError("退出后商品规格入口结构失效。")
+
+    titles = [
+        node
+        for node in nodes
+        if _exact_common(
+            node,
+            "android.view.ViewGroup",
+            _PRODUCT_TITLE_BOUNDS,
+            clickable="true",
+            selected="false",
+            scrollable="false",
+        )
+        and node.element.get("resource-id") == _PRODUCT_TITLE_RESOURCE_ID
+        and node.element.get("long-clickable") == "true"
+        and not node.text
+        and node.desc == _PRODUCT_TITLE_DESC
+    ]
+    title = _one(titles, "退出后同商品标题正锚不唯一。")
+    children = _walk_direct_children(title)
+    expected_children = (
+        (_PRODUCT_TITLE_FIRST_LINE, "[36,1571][1023,1624]"),
+        (_PRODUCT_TITLE_SECOND_LINE, "[36,1636][306,1689]"),
+    )
+    if len(children) != len(expected_children) or any(
+        not _exact_readonly_text(child, text, bounds)
+        for child, (text, bounds) in zip(children, expected_children, strict=True)
+    ):
+        raise SkuSelectionError("退出后同商品标题子结构漂移。")
+
+    return (
+        "product_exit_8_17_0",
+        entry,
+        _entry_node_projection(title),
+        tuple(_entry_node_projection(child) for child in children),
+        title.element.get("resource-id", ""),
+        title.element.get("long-clickable", ""),
+    )
+
+
 def _entry_node_projection(node: _Node) -> tuple[str, ...]:
     return (
         node.element.tag,

client/src/cmbuyer_client/pdd/sku_selection_runner.py

@@ -21,7 +21,13 @@ from adbutils.errors import AdbTimeout
 from uiautomator2.exceptions import HTTPTimeoutError
 
 from ..device.adb import AdbClient, DeviceConnectionError, DeviceInspection
-from ..device.baseline import PDD_PACKAGE, SCREENSHOT_PARAMS, _save_base64_screenshot, _sha256_file
+from ..device.baseline import (
+    PDD_PACKAGE,
+    SCREENSHOT_PARAMS,
+    _save_base64_screenshot,
+    _sha256_file,
+    _validate_hierarchy,
+)
 from .product_open import EXPECTED_PDD_VERSION
 from .product_url import ProductUrl, ProductUrlError, parse_product_url
 from .sku_selection import (
@@ -31,9 +37,15 @@ from .sku_selection import (
     SkuSelectionError,
     SkuSelectionFlow,
     _SKU_ENTRY_FAILURE_STAGES,
+    _REVEAL_GESTURE,
+    _ENTRY_TEXT_BOUNDS,
+    _TARGET_COLOR_UNROLLED_BOUNDS,
+    _TARGET_SIZE_BOUNDS,
     _action_bounds,
     _annotate_sku_entry_failure,
+    _parse_nodes,
     _safe_sku_entry_failure_stage,
+    _unit_price,
     resolve_task_selection,
 )
 
@@ -82,6 +94,10 @@ class SkuSelectionDeviceAdapterError(SkuSelectionRunError):
     """第三方设备接口失败的脱敏映射。"""
 
 
+class SkuExitSpikeError(SkuSelectionRunError):
+    """T-104 阶段 A 未形成完整的本机退出证据。"""
+
+
 def safe_failure_stage(error: BaseException) -> str:
     """返回允许公开的固定阶段码，绝不回显异常正文。"""
 
@@ -132,12 +148,21 @@ class SkuSelectionRunResult:
     screenshot_path: Path
     manifest_path: Path
     unit_price: str
+    captured_at: datetime
+
+
+@dataclass(frozen=True)
+class SkuExitSpikeResult:
+    """已原子发布、仍需人工判断页面身份的 T-104 证据。"""
+
+    output_directory: Path
+    manifest_path: Path
 
 
 class UiautomatorSkuPanelAdapter(SkuPanelDevice):
-    """把 uiautomator2 缩为 T-103 所需的读取与三种命名操作。
+    """把 uiautomator2 缩为 T-103 所需的读取与四种命名操作。
 
-    ``tap_sku_entry``、``tap_sku_option`` 和 ``leave_sku_panel`` 是仅有的状态改变方法；
+    四个命名方法是仅有的状态改变入口；reveal 的手势参数固定且不向 Flow 暴露；
     坐标由 Flow 和本类双重检查后才计算中心点，每次调用只执行一次底层动作。
     """
 
@@ -147,7 +172,14 @@ class UiautomatorSkuPanelAdapter(SkuPanelDevice):
         self._device = device
         self._timeout_seconds = timeout_seconds
         self._entry_was_tapped = False
+        self._entry_bounds_attempted: str | None = None
+        self._entry_rpc_outcome = "not_attempted"
+        self._option_bounds_attempted: set[str] = set()
+        self._option_rpc_outcomes: dict[str, str] = {}
+        self._reveal_attempted = False
+        self._reveal_rpc_outcome = "not_attempted"
         self._left_panel = False
+        self._back_rpc_outcome = "not_attempted"
 
     @property
     def entry_was_tapped(self) -> bool:
@@ -159,6 +191,38 @@ class UiautomatorSkuPanelAdapter(SkuPanelDevice):
     def left_panel(self) -> bool:
         return self._left_panel
 
+    @property
+    def reveal_attempted(self) -> bool:
+        return self._reveal_attempted
+
+    @property
+    def entry_rpc_outcome(self) -> str:
+        return self._entry_rpc_outcome
+
+    @property
+    def entry_bounds_attempted(self) -> str | None:
+        return self._entry_bounds_attempted
+
+    @property
+    def option_rpc_outcomes(self) -> tuple[tuple[str, str], ...]:
+        return tuple(sorted(self._option_rpc_outcomes.items()))
+
+    @property
+    def reveal_rpc_outcome(self) -> str:
+        return self._reveal_rpc_outcome
+
+    @property
+    def option_attempts(self) -> int:
+        return len(self._option_bounds_attempted)
+
+    @property
+    def back_attempts(self) -> int:
+        return int(self._left_panel)
+
+    @property
+    def back_rpc_outcome(self) -> str:
+        return self._back_rpc_outcome
+
     def app_info(self, package_name: str) -> dict[str, Any]:
         value = self._call("app_info", package_name)
         if not isinstance(value, dict):
@@ -178,19 +242,46 @@ class UiautomatorSkuPanelAdapter(SkuPanelDevice):
         return value
 
     def tap_sku_entry(self, bounds: str) -> None:
+        if self._entry_was_tapped:
+            raise SkuSelectionDeviceAdapterError("规格入口已经尝试过，拒绝重试。")
         # 超时也可能表示底层事件已经送达；必须先封存 attempt，后续绝不重试该入口。
         self._entry_was_tapped = True
+        self._entry_bounds_attempted = bounds
+        self._entry_rpc_outcome = "ambiguous"
         self._tap_bounds_once(bounds)
+        self._entry_rpc_outcome = "completed"
 
     def tap_sku_option(self, bounds: str) -> None:
+        if bounds in self._option_bounds_attempted:
+            raise SkuSelectionDeviceAdapterError("同一规格选项已经尝试过，拒绝重试。")
+        # 规格 RPC 也可能送达后超时；按 exact bounds 封存本次唯一机会。
+        self._option_bounds_attempted.add(bounds)
+        self._option_rpc_outcomes[bounds] = "ambiguous"
         self._tap_bounds_once(bounds)
+        self._option_rpc_outcomes[bounds] = "completed"
+
+    def reveal_size_options_once(self) -> None:
+        if self._reveal_attempted:
+            raise SkuSelectionDeviceAdapterError("规格显示动作已经尝试过，拒绝重试。")
+        # 手势唯一机会在 RPC 前封存；生产 API 不接受方向、坐标或步数参数。
+        self._reveal_attempted = True
+        self._reveal_rpc_outcome = "ambiguous"
+        self._call(
+            "jsonrpc_call",
+            "swipe",
+            list(_REVEAL_GESTURE),
+            timeout=self._timeout_seconds,
+        )
+        self._reveal_rpc_outcome = "completed"
 
     def leave_sku_panel(self) -> None:
         if self._left_panel:
             raise SkuSelectionDeviceAdapterError("规格面板已经执行过返回，已停止操作。")
         # 底层调用即使报错也可能已把返回事件送达；先封存本次机会，finally 不得再次返回。
         self._left_panel = True
+        self._back_rpc_outcome = "ambiguous"
         self._call("jsonrpc_call", "pressKey", ["back"], timeout=self._timeout_seconds)
+        self._back_rpc_outcome = "completed"
 
     def capture_screenshot(self) -> str:
         value = self._call("jsonrpc_call", "takeScreenshot", SCREENSHOT_PARAMS, timeout=self._timeout_seconds)
@@ -222,6 +313,210 @@ class UiautomatorSkuPanelAdapter(SkuPanelDevice):
             raise SkuSelectionDeviceAdapterError("规格面板设备操作失败，已停止操作。") from error
 
 
+class UiautomatorSkuExitAdapter:
+    """T-104 阶段 A 的窄设备边界：只读能力加唯一一次命名 Back。
+
+    取证脚本不能取得 T-103 的入口、规格选项或 reveal 方法。Back 的唯一机会在
+    JSON-RPC 前封存，因为超时无法证明事件没有送达，任何结果不明都不得重发。
+    """
+
+    def __init__(self, device: Any, timeout_seconds: float) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._device = device
+        self._timeout_seconds = timeout_seconds
+        self._back_attempted = False
+        self._back_rpc_outcome = "not_attempted"
+
+    @property
+    def back_attempts(self) -> int:
+        return int(self._back_attempted)
+
+    @property
+    def back_rpc_outcome(self) -> str:
+        return self._back_rpc_outcome
+
+    def app_info(self, package_name: str) -> dict[str, Any]:
+        value = self._call("app_info", package_name)
+        if not isinstance(value, dict):
+            raise SkuSelectionDeviceAdapterError("无法读取应用版本，已停止取证。")
+        return value
+
+    def app_current(self) -> dict[str, Any]:
+        value = self._call("app_current")
+        if not isinstance(value, dict):
+            raise SkuSelectionDeviceAdapterError("无法读取前台应用，已停止取证。")
+        return value
+
+    def dump_window_hierarchy(self) -> str:
+        value = self._call(
+            "jsonrpc_call",
+            "dumpWindowHierarchy",
+            [False, 50],
+            timeout=self._timeout_seconds,
+        )
+        if not isinstance(value, str):
+            raise SkuSelectionDeviceAdapterError("节点树读取失败，已停止取证。")
+        return value
+
+    def capture_screenshot(self) -> str:
+        value = self._call(
+            "jsonrpc_call",
+            "takeScreenshot",
+            SCREENSHOT_PARAMS,
+            timeout=self._timeout_seconds,
+        )
+        if not isinstance(value, str):
+            raise SkuSelectionScreenshotError("退出后截图读取失败，未发布任何证据产物。")
+        return value
+
+    def display_size(self) -> tuple[int, int]:
+        value = self._call("window_size")
+        if (
+            not isinstance(value, tuple)
+            or len(value) != 2
+            or any(not isinstance(item, int) for item in value)
+        ):
+            raise SkuSelectionDeviceAdapterError("无法读取屏幕坐标空间，已停止取证。")
+        return value
+
+    def leave_sku_panel(self) -> None:
+        if self._back_attempted:
+            raise SkuSelectionDeviceAdapterError("本次取证已经尝试过返回，拒绝重试。")
+        self._back_attempted = True
+        self._back_rpc_outcome = "ambiguous"
+        self._call(
+            "jsonrpc_call",
+            "pressKey",
+            ["back"],
+            timeout=self._timeout_seconds,
+        )
+        self._back_rpc_outcome = "completed"
+
+    def _call(self, method: str, *args: Any, **kwargs: Any) -> Any:
+        try:
+            operation = getattr(self._device, method)
+            return operation(*args, **kwargs)
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            raise SkuSelectionRunTimeoutError("T-104 设备操作超时，已停止操作。") from error
+        except SkuSelectionRunError:
+            raise
+        except Exception as error:
+            raise SkuSelectionDeviceAdapterError("T-104 设备操作失败，已停止操作。") from error
+
+
+class SkuExitSpikeCapturer:
+    """从人工停驻的已验证目标面板执行一次 Back，再只读采集阶段 A 证据。"""
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], Any],
+        timeout_seconds: float,
+    ) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._timeout_seconds = timeout_seconds
+        self._started = False
+
+    def capture(self, serial: str, output_directory: Path) -> SkuExitSpikeResult:
+        if self._started:
+            raise SkuExitSpikeError("同一取证器不可重复调用。")
+        self._started = True
+
+        staging: Path | None = None
+        adapter: UiautomatorSkuExitAdapter | None = None
+        try:
+            if type(serial) is not str or not serial.strip():
+                raise SkuExitSpikeError("必须显式提供非空设备通道。")
+            target = Path(output_directory)
+            _validate_new_target(target)
+            staging = _prepare_staging(target)
+
+            inspection = self._adb_client.inspect(serial)
+            _require_expected_device(inspection)
+            adapter = UiautomatorSkuExitAdapter(
+                self._connector(serial),
+                self._timeout_seconds,
+            )
+
+            # 第一次只读核验拒绝把任意页面带入 Back 边界；第二次紧邻 Back，覆盖核验期间漂移。
+            _require_t104_exit_precondition(adapter)
+            _require_t104_exit_precondition(adapter)
+
+            rpc_outcome = "completed"
+            try:
+                adapter.leave_sku_panel()
+            except SkuSelectionRunError:
+                if adapter.back_attempts != 1 or adapter.back_rpc_outcome != "ambiguous":
+                    raise
+                # RPC 失败不能证明 Back 未送达。只读采集可供人调和，但绝不再发第二次动作。
+                rpc_outcome = "ambiguous_reconciled"
+
+            if adapter.back_attempts != 1:
+                raise SkuExitSpikeError("返回动作审计不完整，未发布任何证据产物。")
+            if rpc_outcome == "completed" and adapter.back_rpc_outcome != "completed":
+                raise SkuExitSpikeError("返回动作结果不完整，未发布任何证据产物。")
+
+            # Back 后先确认仍是已取证版本的 PDD；不能先把其他前台应用写进本地证据。
+            initial_app = _require_t104_post_app(adapter)
+
+            screenshot_path = staging / "post_exit_screenshot.png"
+            _save_base64_screenshot(adapter.capture_screenshot(), screenshot_path)
+            _require_screenshot_size(screenshot_path)
+
+            hierarchy = adapter.dump_window_hierarchy()
+            _validate_hierarchy(hierarchy)
+            hierarchy_path = staging / "post_exit_hierarchy.xml"
+            hierarchy_path.write_text(hierarchy, encoding="utf-8")
+
+            current_app = _require_t104_post_app(adapter)
+            if current_app != initial_app:
+                raise SkuExitSpikeError("退出后应用摘要在采集期间漂移，未发布任何证据产物。")
+            app_path = staging / "post_exit_app.json"
+            app_path.write_text(
+                json.dumps(current_app, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
+                encoding="utf-8",
+            )
+
+            manifest_path = staging / "manifest.json"
+            manifest_path.write_text(
+                json.dumps(
+                    _t104_exit_manifest(
+                        inspection,
+                        serial,
+                        rpc_outcome,
+                        screenshot_path,
+                        hierarchy_path,
+                        app_path,
+                    ),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            os.rename(staging, target)
+            staging = None
+        except (DeviceConnectionError, SkuSelectionError, SkuSelectionRunError):
+            _clean_staging(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            _clean_staging(staging)
+            raise SkuExitSpikeError("T-104 取证超时，未发布任何证据产物。") from error
+        except OSError as error:
+            _clean_staging(staging)
+            raise SkuExitSpikeError("T-104 证据目录无法发布，未发布任何证据产物。") from error
+        except Exception as error:
+            _clean_staging(staging)
+            raise SkuExitSpikeError("T-104 取证未完成，未发布任何证据产物。") from error
+
+        return SkuExitSpikeResult(target, target / "manifest.json")
+
+
 class SkuSelectionRunner:
     """只运行 T-103 目标规格恢复、价格确认、原始截图和一次安全退出。"""
 
@@ -295,7 +590,9 @@ class SkuSelectionRunner:
             stage = "screenshot_capture"
             screenshot_path = staging / "screenshot.png"
             try:
-                _save_base64_screenshot(adapter.capture_screenshot(), screenshot_path)
+                screenshot_payload = adapter.capture_screenshot()
+                captured_at = datetime.now(UTC)
+                _save_base64_screenshot(screenshot_payload, screenshot_path)
                 _require_screenshot_size(screenshot_path)
             except SkuSelectionRunError:
                 raise
@@ -312,9 +609,26 @@ class SkuSelectionRunner:
             stage = "safe_exit"
             flow.exit_sku_panel_safely()
 
+            _require_completed_action_audit(adapter)
+
             stage = "publish"
             manifest_path.write_text(
-                json.dumps(_manifest(inspection, serial, link, screenshot_path, task_color, task_size), ensure_ascii=False, indent=2, sort_keys=True) + "\n",
+                json.dumps(
+                    _manifest(
+                        inspection,
+                        serial,
+                        link,
+                        screenshot_path,
+                        task_color,
+                        task_size,
+                        adapter,
+                        captured_at,
+                    ),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
                 encoding="utf-8",
             )
             # Windows 的 rename 不替换既有目标；并发创建 target 时保留其内容并把本次运行判失败。
@@ -340,11 +654,10 @@ class SkuSelectionRunner:
             _annotate_mapped_failure(mapped, error, stage)
             raise mapped from error
         finally:
-            # 失败路径只能复用 Flow 的版本、前台和面板证明；证明不了便停止，绝不盲目返回。
-            if flow is not None and adapter is not None and adapter.entry_was_tapped and not adapter.left_panel:
+            # 结果不明只允许读回 pending；失败路径绝不继续后续动作或自动 Back。
+            if flow is not None:
                 try:
                     flow.reconcile_pending_action()
-                    flow.exit_sku_panel_safely()
                 except (SkuSelectionRunError, SkuSelectionError):
                     pass
 
@@ -353,6 +666,7 @@ class SkuSelectionRunner:
             screenshot_path=target / "screenshot.png",
             manifest_path=target / "manifest.json",
             unit_price=EXPECTED_UNIT_PRICE,
+            captured_at=captured_at,
         )
 
 
@@ -399,6 +713,87 @@ def _require_expected_device(inspection: DeviceInspection) -> None:
         raise SkuSelectionRunError("设备型号或 Android 版本不是已取证组合，已停止操作。")
 
 
+def _require_t104_exit_precondition(adapter: UiautomatorSkuExitAdapter) -> None:
+    """fresh 核验 T-103 已人验的唯一 Back 前置，不产生任何页面动作。"""
+
+    _require_expected_version(adapter.app_info(PDD_PACKAGE))
+    current = adapter.app_current()
+    if current.get("package") != PDD_PACKAGE:
+        raise SkuExitSpikeError("Back 前拼多多不在前台，已停止取证。")
+    if adapter.display_size() != EXPECTED_SCREEN_SIZE:
+        raise SkuExitSpikeError("屏幕坐标空间不是已取证尺寸，已停止取证。")
+    if _unit_price(_parse_nodes(adapter.dump_window_hierarchy())) != EXPECTED_UNIT_PRICE:
+        raise SkuExitSpikeError("Back 前目标规格或当前价不匹配，已停止取证。")
+
+
+def _post_exit_app_evidence(value: object) -> dict[str, str]:
+    """只保留页面身份复核需要的应用字段，不把第三方返回整体写盘。"""
+
+    if not isinstance(value, dict):
+        raise SkuExitSpikeError("退出后应用摘要无效，未发布任何证据产物。")
+    package = value.get("package")
+    activity = value.get("activity")
+    if not isinstance(package, str) or not package.strip():
+        raise SkuExitSpikeError("退出后应用包名缺失，未发布任何证据产物。")
+    if not isinstance(activity, str) or not activity.strip():
+        raise SkuExitSpikeError("退出后 Activity 缺失，未发布任何证据产物。")
+    return {"package": package, "activity": activity}
+
+
+def _require_t104_post_app(adapter: UiautomatorSkuExitAdapter) -> dict[str, str]:
+    current = _post_exit_app_evidence(adapter.app_current())
+    if current["package"] != PDD_PACKAGE:
+        raise SkuExitSpikeError("Back 后拼多多不在前台，未采集页面证据。")
+    _require_expected_version(adapter.app_info(PDD_PACKAGE))
+    return current
+
+
+def _t104_exit_manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    rpc_outcome: str,
+    screenshot_path: Path,
+    hierarchy_path: Path,
+    app_path: Path,
+) -> dict[str, Any]:
+    """阶段 A 只写事实与哈希；不声明退出成功，也不授予价格证据角色。"""
+
+    return {
+        "schema_version": 1,
+        "captured_at": datetime.now(UTC).isoformat(),
+        "operation": "t104-sku-exit-evidence",
+        "product": {"goods_id": EXPECTED_GOODS_ID},
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": EXPECTED_PDD_VERSION,
+        },
+        "back_attempts": 1,
+        "rpc_outcome": rpc_outcome,
+        "post_exit_status": "human_review_required",
+        "artifacts": [
+            {
+                "path": screenshot_path.name,
+                "role": "post_exit_human_review_only",
+                "sha256": _sha256_file(screenshot_path),
+            },
+            {
+                "path": hierarchy_path.name,
+                "role": "post_exit_raw_hierarchy_local_only",
+                "sha256": _sha256_file(hierarchy_path),
+            },
+            {
+                "path": app_path.name,
+                "role": "post_exit_app_identity_human_review_only",
+                "sha256": _sha256_file(app_path),
+            },
+        ],
+    }
+
+
 def _require_screenshot_size(screenshot_path: Path) -> None:
     try:
         with Image.open(screenshot_path) as image:
@@ -411,20 +806,83 @@ def _require_screenshot_size(screenshot_path: Path) -> None:
         raise SkuSelectionScreenshotError("原始截图无效，未发布任何证据产物。") from error
 
 
-def _manifest(inspection: DeviceInspection, serial: str, link: ProductUrl, screenshot_path: Path, task_color: str, task_size: str) -> dict[str, Any]:
+def _require_completed_action_audit(adapter: UiautomatorSkuPanelAdapter) -> None:
+    """发布只接受完整正常链；测试替身或缺动作结果不能伪造真机闭环。"""
+
+    if (
+        not adapter.entry_was_tapped
+        or adapter.entry_bounds_attempted != _ENTRY_TEXT_BOUNDS
+        or adapter.entry_rpc_outcome != "completed"
+        or adapter.option_rpc_outcomes
+        != tuple(
+            sorted(
+                (
+                    (_TARGET_COLOR_UNROLLED_BOUNDS, "completed"),
+                    (_TARGET_SIZE_BOUNDS, "completed"),
+                )
+            )
+        )
+        or not adapter.reveal_attempted
+        or adapter.reveal_rpc_outcome != "completed"
+        or adapter.back_attempts != 1
+        or adapter.back_rpc_outcome != "completed"
+    ):
+        raise SkuSelectionRunError("规格动作审计链不完整，未发布任何证据产物。")
+
+
+def _manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    link: ProductUrl,
+    screenshot_path: Path,
+    task_color: str,
+    task_size: str,
+    adapter: UiautomatorSkuPanelAdapter,
+    captured_at: datetime,
+) -> dict[str, Any]:
     """仅写可审计摘要；原始 serial、节点树、页面文案和实际截图内容均不写入 manifest。"""
 
+    option_outcomes = dict(adapter.option_rpc_outcomes)
     return {
         "schema_version": 1,
-        "captured_at": datetime.now(UTC).isoformat(),
+        "captured_at": captured_at.isoformat(),
         "operation": "t103-sku-selection",
         "product": {"goods_id": link.goods_id, "canonical_url": link.canonical_url},
         "target_selection": {"color": task_color, "size": task_size},
         "unit_price": EXPECTED_UNIT_PRICE,
         "selection_status": "restored",
-        "panel_status": "verified",
+        "panel_status": "verified_before_back",
+        "back_attempts": adapter.back_attempts,
+        "back_rpc_outcome": adapter.back_rpc_outcome,
+        "actions": {
+            "sku_entry": {
+                "attempts": int(adapter.entry_was_tapped),
+                "rpc_outcome": adapter.entry_rpc_outcome,
+            },
+            "target_color": {
+                "attempts": int(_TARGET_COLOR_UNROLLED_BOUNDS in option_outcomes),
+                "rpc_outcome": option_outcomes.get(
+                    _TARGET_COLOR_UNROLLED_BOUNDS, "not_attempted"
+                ),
+            },
+            "size_reveal": {
+                "attempts": int(adapter.reveal_attempted),
+                "rpc_outcome": adapter.reveal_rpc_outcome,
+            },
+            "target_size": {
+                "attempts": int(_TARGET_SIZE_BOUNDS in option_outcomes),
+                "rpc_outcome": option_outcomes.get(
+                    _TARGET_SIZE_BOUNDS, "not_attempted"
+                ),
+            },
+            "back": {
+                "attempts": adapter.back_attempts,
+                "rpc_outcome": adapter.back_rpc_outcome,
+            },
+        },
+        "post_exit_status": "same_product_verified",
         "safe_exit": "completed",
-        "page_identity": "human_review_required",
+        "page_identity": "same_goods_evidence_bound",
         "channel": "wifi" if ":" in serial else "usb",
         "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
         "device": {

client/tests/pdd/fixtures/product_exit_8_17_0.xml

@@ -0,0 +1,12 @@
+<hierarchy rotation="0">
+  <!-- T-104 同商品正锚：只保留人工确认 post-exit XML 中的标题容器及两个直接文本子节点。 -->
+  <node resource-id="com.xunmeng.pinduoduo:id/tv_title" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[36,1571][1044,1689]" content-desc="2026年新款高档重工潮流烫钻中长款T恤显瘦宽松上衣淡人穿搭" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" long-clickable="true">
+    <node text="2026年新款高档重工潮流烫钻中长款T恤显瘦宽松" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[36,1571][1023,1624]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+    <node text="上衣淡人穿搭" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[36,1636][306,1689]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+  </node>
+  <!-- 同一份 post-exit XML 中的底部规格入口；只证明页面身份，不在安全退出中点击。 -->
+  <node content-desc="快要抢光¥12.88" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[446,2166][1080,2328]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node text="快要抢光 ¥ 12.88" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[688,2184][1042,2253]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+    <node text="免拼购买" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[688,2256][856,2305]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+  </node>
+</hierarchy>

client/tests/pdd/fixtures/quantity_gate2_initial_8_17_0.xml

@@ -0,0 +1,30 @@
+<hierarchy rotation="0">
+  <!-- T-105 只保留人工确认数量 1 证据中的规格、顶部金额与数量控件。 -->
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[0,474][1080,863]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,498][1053,570]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,498][895,570]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+        <node text="快卖完 ¥12.88" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,503][712,570]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+      </node>
+    </node>
+    <node text="已选： 黑色 CHA (纯棉） M（建议100-115）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,654][1053,716]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" resource-id="com.xunmeng.pinduoduo:id/gnl" bounds="[396,752][645,827]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[396,752][645,827]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+        <node content-desc="减少数量" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,752][474,827]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+        <node text="1" package="com.xunmeng.pinduoduo" class="android.widget.EditText" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[480,752][561,827]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+        <node content-desc="增加数量" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[567,752][645,827]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+      </node>
+    </node>
+  </node>
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[126,1000][438,1024]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false">
+    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[126,1000][438,1024]" clickable="false" enabled="true" visible-to-user="true" selected="true" scrollable="false">
+      <node text="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/tv_content" bounds="[126,1000][438,1024]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+    </node>
+  </node>
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[439,1582][831,1667]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node text="M（建议100-115）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[439,1582][831,1667]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+  </node>
+  <!-- 底部金额故意保留为反例；生产读取器只认上方证据角色。 -->
+  <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[0,2181][1080,2328]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node text="提交订单 ¥12.88" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[369,2225][710,2284]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+  </node>
+</hierarchy>

client/tests/pdd/fixtures/quantity_gate2_target_8_17_0.xml

@@ -0,0 +1,30 @@
+<hierarchy rotation="0">
+  <!-- T-105 只保留人工确认数量 2 证据中的规格、顶部金额与数量控件。 -->
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[0,474][1080,861]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,498][1053,570]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,498][740,570]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+        <node text="快卖完 ¥32.76" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,503][722,570]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+      </node>
+    </node>
+    <node text="已选： 黑色 CHA (纯棉） M（建议100-115）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,582][1053,644]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" resource-id="com.xunmeng.pinduoduo:id/gnl" bounds="[396,750][645,825]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[396,750][645,825]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+        <node content-desc="减少数量" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[396,750][474,825]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+        <node text="2" package="com.xunmeng.pinduoduo" class="android.widget.EditText" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[480,750][561,825]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+        <node content-desc="增加数量" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[567,750][645,825]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+      </node>
+    </node>
+  </node>
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[126,998][438,1024]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false">
+    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[126,998][438,1024]" clickable="false" enabled="true" visible-to-user="true" selected="true" scrollable="false">
+      <node text="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/tv_content" bounds="[126,998][438,1024]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+    </node>
+  </node>
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[439,1582][831,1667]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node text="M（建议100-115）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[439,1582][831,1667]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+  </node>
+  <!-- 与 Gate2 值相同也不能成为读取候选。 -->
+  <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[0,2181][1080,2328]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node text="提交订单 ¥32.76" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[366,2225][714,2284]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+  </node>
+</hierarchy>

client/tests/pdd/fixtures/sku_panel_color_selected_size_hidden_current_only_8_17_0.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<hierarchy>
+  <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,0][1080,2376]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,0][1080,2328]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,120][1080,2328]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+        <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,120][1080,2328]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+          <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,120][1080,2328]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+            <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,366][1080,2328]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+              <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,366][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,366][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                  <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,366][1080,1077]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                    <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,551][1080,940]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.RelativeLayout" bounds="[0,551][1080,940]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,551][1080,940]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                          <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[396,575][1053,647]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                            <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[396,575][693,647]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                              <node text="限1件 ¥12.88 " package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[396,580][675,647]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                            </node>
+                          </node>
+                          <node text="请选择： 尺码" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[396,731][1053,793]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                        </node>
+                      </node>
+                    </node>
+                  </node>
+                  <node package="com.xunmeng.pinduoduo" class="androidx.recyclerview.widget.RecyclerView" bounds="[0,1077][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="true">
+                    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,1077][1080,2052]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,1077][1080,1188]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node text="颜色分类" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[36,1106][192,1159]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                      </node>
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,1188][1080,2052]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,1188][1080,2046]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                          <node package="com.xunmeng.pinduoduo" class="androidx.recyclerview.widget.RecyclerView" bounds="[36,1188][1080,2046]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="true">
+                            <node content-desc="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[372,1188][684,1587]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false">
+                              <node package="com.xunmeng.pinduoduo" class="android.view.View" bounds="[372,1188][684,1587]" clickable="false" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+                              <node content-desc="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" bounds="[372,1188][684,1500]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+                              <node content-desc="打开大图" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" bounds="[372,1188][483,1299]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+                              <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[372,1479][684,1587]" clickable="false" enabled="true" visible-to-user="true" selected="true" scrollable="false">
+                                <node text="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[372,1479][684,1587]" clickable="true" enabled="true" visible-to-user="true" selected="true" scrollable="false" />
+                              </node>
+                            </node>
+                          </node>
+                        </node>
+                      </node>
+                    </node>
+                    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,2052][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[36,2052][1044,2079]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node text="尺码" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[36,2069][114,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                      </node>
+                    </node>
+                  </node>
+                </node>
+              </node>
+            </node>
+          </node>
+        </node>
+      </node>
+    </node>
+  </node>
+</hierarchy>

client/tests/pdd/fixtures/sku_panel_empty_current_only_8_17_0.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<hierarchy>
+  <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,0][1080,2376]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,0][1080,2328]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,120][1080,2328]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+        <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,120][1080,2328]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+          <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,120][1080,2328]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+            <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,366][1080,2328]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+              <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,366][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,366][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                  <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,366][1080,1077]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                    <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,551][1080,940]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.RelativeLayout" bounds="[0,551][1080,940]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,551][1080,940]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                          <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[396,575][1053,647]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                            <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[396,575][693,647]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                              <node text="限1件 ¥12.88 " package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[396,580][675,647]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                            </node>
+                          </node>
+                          <node text="请选择： 颜色分类 尺码" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[396,731][1053,793]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                        </node>
+                      </node>
+                    </node>
+                  </node>
+                  <node package="com.xunmeng.pinduoduo" class="androidx.recyclerview.widget.RecyclerView" bounds="[0,1077][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="true">
+                    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,1077][1080,2052]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,1077][1080,1188]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node text="颜色分类" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[36,1106][192,1159]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                      </node>
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,1188][1080,2052]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[0,1188][1080,2046]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                          <node package="com.xunmeng.pinduoduo" class="androidx.recyclerview.widget.RecyclerView" bounds="[36,1188][1080,2046]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="true">
+                            <node content-desc="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[372,1188][684,1587]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                              <node package="com.xunmeng.pinduoduo" class="android.view.View" bounds="[372,1188][684,1587]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                              <node content-desc="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" bounds="[372,1188][684,1500]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                              <node content-desc="打开大图" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" bounds="[372,1188][483,1299]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                              <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[372,1479][684,1587]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                                <node text="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[372,1479][684,1587]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                              </node>
+                            </node>
+                          </node>
+                        </node>
+                      </node>
+                    </node>
+                    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[0,2052][1080,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[36,2052][1044,2079]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false">
+                        <node text="尺码" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[36,2069][114,2079]" clickable="false" enabled="true" visible-to-user="true" selected="false" scrollable="false" />
+                      </node>
+                    </node>
+                  </node>
+                </node>
+              </node>
+            </node>
+          </node>
+        </node>
+      </node>
+    </node>
+  </node>
+</hierarchy>

client/tests/pdd/test_order_confirm_spike.py

@@ -0,0 +1,597 @@
+"""T-106 确认页四态纯只读取证的离线测试。"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import base64
+from contextlib import redirect_stderr, redirect_stdout
+from functools import lru_cache
+from importlib.util import module_from_spec, spec_from_file_location
+from io import BytesIO, StringIO
+import json
+from pathlib import Path
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+from unittest.mock import patch
+
+from PIL import Image
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbDevice, CommandResult, DeviceInspection
+from cmbuyer_client.pdd.order_confirm_spike import (
+    Android16ForegroundReader,
+    DECLARED_STATES,
+    EXPECTED_GOODS_ID,
+    OrderConfirmEvidenceCapturer,
+    OrderConfirmEvidenceError,
+    OrderConfirmEvidenceTimeoutError,
+    OrderConfirmForegroundReader,
+    OrderConfirmReadDevice,
+)
+
+
+SERIAL = "192.168.0.173:5555"
+HIERARCHY = (
+    "<?xml version='1.0' encoding='UTF-8'?><hierarchy rotation='0'>"
+    "<node text='local raw page' /></hierarchy>"
+)
+TOP_RESUMED = (
+    "  topResumedActivity=ActivityRecord{101034589 u0 "
+    "com.xunmeng.pinduoduo/.activity.NewPageActivity t1816}\n"
+)
+
+
+@lru_cache(maxsize=1)
+def _png_base64() -> str:
+    raw = BytesIO()
+    Image.new("RGB", (1080, 2376), color="white").save(raw, format="PNG")
+    return base64.b64encode(raw.getvalue()).decode("ascii")
+
+
+class FakeAdbClient:
+    def __init__(self, *, model: str = "PKG110", android_version: str = "16") -> None:
+        self.calls: list[str] = []
+        self.inspection = DeviceInspection(
+            device=AdbDevice(serial=SERIAL, state="device", model=model),
+            model=model,
+            android_version=android_version,
+        )
+
+    def inspect(self, serial: str) -> DeviceInspection:
+        self.calls.append(serial)
+        return self.inspection
+
+
+class FakeReadDevice:
+    def __init__(
+        self,
+        *,
+        version: str = "8.17.0",
+        screen_size: tuple[int, int] = (1080, 2376),
+        screenshot: object | None = None,
+        hierarchy: object = HIERARCHY,
+    ) -> None:
+        self.version = version
+        self.screen_size = screen_size
+        self.screenshot = _png_base64() if screenshot is None else screenshot
+        self.hierarchy = hierarchy
+        self.calls: list[tuple[object, ...]] = []
+        self.app_info_reads = 0
+        self.window_reads = 0
+        self.post_version: str | None = None
+        self.post_screen_size: tuple[int, int] | None = None
+
+    def app_info(self, package_name: str) -> dict[str, str]:
+        self.calls.append(("app_info", package_name))
+        self.app_info_reads += 1
+        version = self.post_version if self.app_info_reads > 1 and self.post_version else self.version
+        return {"versionName": version}
+
+    def window_size(self) -> tuple[int, int]:
+        self.calls.append(("window_size",))
+        self.window_reads += 1
+        if self.window_reads > 1 and self.post_screen_size is not None:
+            return self.post_screen_size
+        return self.screen_size
+
+    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> object:
+        self.calls.append(("jsonrpc", method, params, timeout))
+        if method == "takeScreenshot":
+            return self.screenshot
+        if method == "dumpWindowHierarchy":
+            return self.hierarchy
+        raise AssertionError("unexpected read RPC")
+
+
+class FakeForegroundReader:
+    def __init__(
+        self,
+        *,
+        package: str = "com.xunmeng.pinduoduo",
+        activity: str = ".activity.NewPageActivity",
+    ) -> None:
+        self.package = package
+        self.activity = activity
+        self.post_package: str | None = None
+        self.post_activity: str | None = None
+        self.calls: list[str] = []
+
+    def read(self, serial: str) -> dict[str, str]:
+        self.calls.append(serial)
+        package = self.post_package if len(self.calls) > 1 and self.post_package else self.package
+        activity = self.post_activity if len(self.calls) > 1 and self.post_activity else self.activity
+        return {"package": package, "activity": activity}
+
+
+class FakeCommandRunner:
+    def __init__(self, result: CommandResult) -> None:
+        self.result = result
+        self.calls: list[tuple[tuple[str, ...], float]] = []
+
+    def run(self, arguments: tuple[str, ...], timeout_seconds: float) -> CommandResult:
+        self.calls.append((arguments, timeout_seconds))
+        return self.result
+
+
+def _load_script() -> object:
+    path = CLIENT_ROOT / "scripts" / "capture_order_confirm_spike.py"
+    specification = spec_from_file_location("capture_order_confirm_spike_for_test", path)
+    assert specification is not None and specification.loader is not None
+    module = module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+def _namespace(**changes: object) -> argparse.Namespace:
+    values: dict[str, object] = {
+        "serial": SERIAL,
+        "goods_id": EXPECTED_GOODS_ID,
+        "state": DECLARED_STATES[0],
+        "output_dir": Path("evidence"),
+        "timeout": 10.0,
+        "adb": "adb",
+    }
+    values.update(changes)
+    return argparse.Namespace(**values)
+
+
+class Android16ForegroundReaderTests(unittest.TestCase):
+    def test_reads_exact_unique_top_resumed_activity(self) -> None:
+        runner = FakeCommandRunner(CommandResult(stdout=TOP_RESUMED))
+        reader = Android16ForegroundReader(runner, timeout_seconds=7)
+
+        self.assertEqual(
+            reader.read(SERIAL),
+            {
+                "package": "com.xunmeng.pinduoduo",
+                "activity": ".activity.NewPageActivity",
+            },
+        )
+        self.assertEqual(
+            runner.calls,
+            [
+                (
+                    ("-s", SERIAL, "shell", "dumpsys", "activity", "activities"),
+                    7,
+                )
+            ],
+        )
+
+    def test_missing_legacy_duplicate_or_failed_summary_is_rejected(self) -> None:
+        outputs = (
+            "",
+            "mResumedActivity: ActivityRecord{1 u0 com.xunmeng.pinduoduo/.Main t1}\n",
+            TOP_RESUMED + TOP_RESUMED,
+            "topResumedActivity=null\n",
+        )
+        for output in outputs:
+            with self.subTest(output=output):
+                reader = Android16ForegroundReader(
+                    FakeCommandRunner(CommandResult(stdout=output)),
+                    timeout_seconds=7,
+                )
+                with self.assertRaises(OrderConfirmEvidenceError):
+                    reader.read(SERIAL)
+
+        reader = Android16ForegroundReader(
+            FakeCommandRunner(CommandResult(stdout=TOP_RESUMED, returncode=1)),
+            timeout_seconds=7,
+        )
+        with self.assertRaises(OrderConfirmEvidenceError):
+            reader.read(SERIAL)
+        with self.assertRaises(OrderConfirmEvidenceError):
+            reader.read(f" {SERIAL}")
+
+
+class OrderConfirmEvidenceTests(unittest.TestCase):
+    def _capturer(
+        self,
+        adb: FakeAdbClient,
+        device: FakeReadDevice,
+        *,
+        foreground: FakeForegroundReader | None = None,
+        connector_calls: list[str] | None = None,
+    ) -> OrderConfirmEvidenceCapturer:
+        def connect(serial: str) -> FakeReadDevice:
+            if connector_calls is not None:
+                connector_calls.append(serial)
+            return device
+
+        return OrderConfirmEvidenceCapturer(
+            adb,  # type: ignore[arg-type]
+            connect,
+            foreground or FakeForegroundReader(),
+            timeout_seconds=2,
+        )
+
+    def test_all_four_human_states_publish_only_raw_read_evidence(self) -> None:
+        self.assertEqual(len(DECLARED_STATES), 4)
+        for state in DECLARED_STATES:
+            with self.subTest(state=state), TemporaryDirectory() as temporary:
+                adb = FakeAdbClient()
+                device = FakeReadDevice()
+                foreground = FakeForegroundReader()
+                connector_calls: list[str] = []
+                target = Path(temporary) / state
+
+                result = self._capturer(
+                    adb,
+                    device,
+                    foreground=foreground,
+                    connector_calls=connector_calls,
+                ).capture(SERIAL, EXPECTED_GOODS_ID, state, target)
+
+                manifest_text = result.manifest_path.read_text(encoding="utf-8")
+                manifest = json.loads(manifest_text)
+                app = json.loads(result.app_path.read_text(encoding="utf-8"))
+                self.assertEqual(adb.calls, [SERIAL])
+                self.assertEqual(connector_calls, [SERIAL])
+                self.assertEqual(foreground.calls, [SERIAL, SERIAL])
+                self.assertEqual(
+                    [call[1] for call in device.calls if call[0] == "jsonrpc"],
+                    ["takeScreenshot", "dumpWindowHierarchy"],
+                )
+                self.assertEqual(manifest["operation"], "t106-order-confirm-readonly-evidence")
+                self.assertEqual(manifest["human_declared_state"], state)
+                self.assertEqual(manifest["review_status"], "human_review_required")
+                self.assertEqual(manifest["product"]["goods_id"], EXPECTED_GOODS_ID)
+                self.assertEqual(app["package"], "com.xunmeng.pinduoduo")
+                self.assertEqual(
+                    {path.name for path in target.iterdir()},
+                    {"screenshot.png", "hierarchy.xml", "app.json", "manifest.json"},
+                )
+                self.assertNotIn(SERIAL, manifest_text)
+                self.assertNotIn("NewPageActivity", manifest_text)
+                self.assertNotIn("local raw page", manifest_text)
+                for artifact in manifest["artifacts"]:
+                    self.assertEqual(len(artifact["sha256"]), 64)
+
+    def test_invalid_inputs_and_existing_target_stop_before_device_access(self) -> None:
+        scenarios = (
+            ("", EXPECTED_GOODS_ID, DECLARED_STATES[0]),
+            (f" {SERIAL}", EXPECTED_GOODS_ID, DECLARED_STATES[0]),
+            (SERIAL, "958756616606", DECLARED_STATES[0]),
+            (SERIAL, EXPECTED_GOODS_ID, "unknown"),
+        )
+        for serial, goods_id, state in scenarios:
+            with self.subTest(state=state), TemporaryDirectory() as temporary:
+                adb = FakeAdbClient()
+                connector_calls: list[str] = []
+                with self.assertRaises(OrderConfirmEvidenceError):
+                    self._capturer(
+                        adb,
+                        FakeReadDevice(),
+                        connector_calls=connector_calls,
+                    ).capture(serial, goods_id, state, Path(temporary) / "evidence")
+                self.assertEqual(adb.calls, [])
+                self.assertEqual(connector_calls, [])
+
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            target.mkdir()
+            sentinel = target / "sentinel.txt"
+            sentinel.write_text("keep", encoding="utf-8")
+            adb = FakeAdbClient()
+            with self.assertRaises(OrderConfirmEvidenceError):
+                self._capturer(adb, FakeReadDevice()).capture(
+                    SERIAL, EXPECTED_GOODS_ID, DECLARED_STATES[0], target
+                )
+            self.assertEqual(adb.calls, [])
+            self.assertEqual(sentinel.read_text(encoding="utf-8"), "keep")
+
+    def test_device_version_package_activity_and_screen_mismatch_fail_closed(self) -> None:
+        scenarios = (
+            (FakeAdbClient(model="OTHER"), FakeReadDevice(), FakeForegroundReader()),
+            (FakeAdbClient(android_version="15"), FakeReadDevice(), FakeForegroundReader()),
+            (FakeAdbClient(), FakeReadDevice(version="8.17.1"), FakeForegroundReader()),
+            (FakeAdbClient(), FakeReadDevice(), FakeForegroundReader(package="com.example.other")),
+            (FakeAdbClient(), FakeReadDevice(), FakeForegroundReader(activity="")),
+            (FakeAdbClient(), FakeReadDevice(screen_size=(1080, 2400)), FakeForegroundReader()),
+        )
+        for adb, device, foreground in scenarios:
+            with self.subTest(device=device.__dict__), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(OrderConfirmEvidenceError):
+                    self._capturer(adb, device, foreground=foreground).capture(
+                        SERIAL, EXPECTED_GOODS_ID, DECLARED_STATES[0], target
+                    )
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+                self.assertEqual([call for call in device.calls if call[0] == "jsonrpc"], [])
+
+    def test_invalid_screenshot_or_hierarchy_never_publishes(self) -> None:
+        devices = (
+            FakeReadDevice(screenshot="not base64"),
+            FakeReadDevice(screenshot=123),
+            FakeReadDevice(hierarchy="<not-hierarchy />"),
+            FakeReadDevice(hierarchy=123),
+        )
+        for device in devices:
+            with self.subTest(value=device.screenshot), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(OrderConfirmEvidenceError):
+                    self._capturer(FakeAdbClient(), device).capture(
+                        SERIAL, EXPECTED_GOODS_ID, DECLARED_STATES[0], target
+                    )
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_timeout_and_unexpected_failure_are_redacted(self) -> None:
+        class BrokenDevice(FakeReadDevice):
+            def __init__(self, failure: BaseException) -> None:
+                super().__init__()
+                self.failure = failure
+
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> object:
+                raise self.failure
+
+        failures = (
+            (TimeoutError(f"secret {SERIAL} C:\\private\\raw.xml"), OrderConfirmEvidenceTimeoutError),
+            (RuntimeError(f"secret {SERIAL} C:\\private\\raw.xml"), OrderConfirmEvidenceError),
+        )
+        for failure, expected in failures:
+            with self.subTest(expected=expected), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(expected) as raised:
+                    self._capturer(FakeAdbClient(), BrokenDevice(failure)).capture(
+                        SERIAL, EXPECTED_GOODS_ID, DECLARED_STATES[0], target
+                    )
+                self.assertNotIn(SERIAL, str(raised.exception))
+                self.assertNotIn("private", str(raised.exception))
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_post_capture_identity_drift_never_publishes(self) -> None:
+        mutators = (
+            lambda device, foreground: setattr(device, "post_version", "8.17.1"),
+            lambda device, foreground: setattr(foreground, "post_package", "com.example.other"),
+            lambda device, foreground: setattr(foreground, "post_activity", "OtherActivity"),
+            lambda device, foreground: setattr(device, "post_screen_size", (1080, 2400)),
+        )
+        for mutate in mutators:
+            with TemporaryDirectory() as temporary:
+                device = FakeReadDevice()
+                foreground = FakeForegroundReader()
+                mutate(device, foreground)
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(OrderConfirmEvidenceError):
+                    self._capturer(
+                        FakeAdbClient(), device, foreground=foreground
+                    ).capture(SERIAL, EXPECTED_GOODS_ID, DECLARED_STATES[0], target)
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_atomic_publish_failure_cleans_staging(self) -> None:
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            with (
+                patch(
+                    "cmbuyer_client.pdd.order_confirm_spike.os.rename",
+                    side_effect=OSError(f"private {SERIAL}"),
+                ),
+                self.assertRaises(OrderConfirmEvidenceError) as raised,
+            ):
+                self._capturer(FakeAdbClient(), FakeReadDevice()).capture(
+                    SERIAL, EXPECTED_GOODS_ID, DECLARED_STATES[0], target
+                )
+            self.assertNotIn(SERIAL, str(raised.exception))
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_capturer_is_one_shot_even_after_rejection(self) -> None:
+        capturer = self._capturer(FakeAdbClient(), FakeReadDevice())
+        with TemporaryDirectory() as temporary:
+            with self.assertRaises(OrderConfirmEvidenceError):
+                capturer.capture("", EXPECTED_GOODS_ID, DECLARED_STATES[0], Path(temporary) / "bad")
+            with self.assertRaises(OrderConfirmEvidenceError):
+                capturer.capture(
+                    SERIAL, EXPECTED_GOODS_ID, DECLARED_STATES[0], Path(temporary) / "good"
+                )
+
+    def test_public_boundaries_expose_reading_only(self) -> None:
+        forbidden = {
+            "click",
+            "swipe",
+            "press",
+            "pressKey",
+            "send_keys",
+            "set_text",
+            "start_pdd_view_intent",
+            "open_product",
+            "open_sku_panel",
+            "set_quantity",
+            "go_to_order_confirm",
+            "submit_order_once",
+            "pay",
+        }
+        self.assertTrue(forbidden.isdisjoint(OrderConfirmReadDevice.__dict__))
+        self.assertTrue(forbidden.isdisjoint(OrderConfirmForegroundReader.__dict__))
+        self.assertEqual(
+            {name for name in Android16ForegroundReader.__dict__ if not name.startswith("_")},
+            {"read"},
+        )
+        self.assertEqual(
+            {name for name in OrderConfirmEvidenceCapturer.__dict__ if not name.startswith("_")},
+            {"capture"},
+        )
+
+
+class OrderConfirmCliAndStaticBoundaryTests(unittest.TestCase):
+    def test_cli_parses_each_approved_state(self) -> None:
+        script = _load_script()
+        for state in DECLARED_STATES:
+            arguments = script.parse_arguments(  # type: ignore[attr-defined]
+                [
+                    "--serial",
+                    SERIAL,
+                    "--goods-id",
+                    EXPECTED_GOODS_ID,
+                    "--state",
+                    state,
+                    "--output-dir",
+                    f"evidence-{state}",
+                ]
+            )
+            script.validate_arguments(arguments)  # type: ignore[attr-defined]
+
+    def test_cli_validation_rejects_unapproved_values(self) -> None:
+        script = _load_script()
+        invalid = (
+            _namespace(serial=""),
+            _namespace(serial=f" {SERIAL}"),
+            _namespace(goods_id="958756616606"),
+            _namespace(state="unknown"),
+            _namespace(output_dir=Path("")),
+            _namespace(timeout=0),
+            _namespace(timeout=float("inf")),
+        )
+        for arguments in invalid:
+            with self.subTest(arguments=arguments), self.assertRaises(ValueError):
+                script.validate_arguments(arguments)  # type: ignore[attr-defined]
+
+    def test_cli_runtime_failure_never_echoes_sensitive_values(self) -> None:
+        script = _load_script()
+        fake_capturer = unittest.mock.Mock()
+        fake_capturer.capture.side_effect = OrderConfirmEvidenceError(
+            f"secret {SERIAL} C:\\private\\raw.xml body"
+        )
+        stderr = StringIO()
+        with (
+            patch.object(script, "OrderConfirmEvidenceCapturer", return_value=fake_capturer),
+            patch.dict(
+                sys.modules,
+                {"adbutils": unittest.mock.Mock(), "uiautomator2": unittest.mock.Mock()},
+            ),
+            redirect_stderr(stderr),
+        ):
+            result = script.main(  # type: ignore[attr-defined]
+                [
+                    "--serial",
+                    SERIAL,
+                    "--goods-id",
+                    EXPECTED_GOODS_ID,
+                    "--state",
+                    DECLARED_STATES[0],
+                    "--output-dir",
+                    "C:\\private\\evidence",
+                ]
+            )
+        self.assertEqual(result, 1)
+        self.assertNotIn(SERIAL, stderr.getvalue())
+        self.assertNotIn("private", stderr.getvalue())
+        self.assertNotIn("body", stderr.getvalue())
+
+    def test_cli_success_does_not_echo_local_path_or_device(self) -> None:
+        script = _load_script()
+        fake_capturer = unittest.mock.Mock()
+        stdout = StringIO()
+        with (
+            patch.object(script, "OrderConfirmEvidenceCapturer", return_value=fake_capturer),
+            patch.dict(
+                sys.modules,
+                {"adbutils": unittest.mock.Mock(), "uiautomator2": unittest.mock.Mock()},
+            ),
+            redirect_stdout(stdout),
+        ):
+            result = script.main(  # type: ignore[attr-defined]
+                [
+                    "--serial",
+                    SERIAL,
+                    "--goods-id",
+                    EXPECTED_GOODS_ID,
+                    "--state",
+                    DECLARED_STATES[0],
+                    "--output-dir",
+                    "C:\\private\\evidence",
+                ]
+            )
+        self.assertEqual(result, 0)
+        self.assertNotIn(SERIAL, stdout.getvalue())
+        self.assertNotIn("private", stdout.getvalue())
+        fake_capturer.capture.assert_called_once()
+
+    def test_sources_have_only_approved_read_rpc_literals_and_no_ui_mutators(self) -> None:
+        expected_by_source = {
+            Path("src/cmbuyer_client/pdd/order_confirm_spike.py"): {
+                "takeScreenshot",
+                "dumpWindowHierarchy",
+            },
+            Path("scripts/capture_order_confirm_spike.py"): set(),
+        }
+        forbidden_attributes = {
+            "click",
+            "swipe",
+            "press",
+            "pressKey",
+            "send_keys",
+            "set_text",
+            "start_pdd_view_intent",
+            "open_product",
+            "open_sku_panel",
+            "set_quantity_and_readback",
+            "go_to_order_confirm",
+            "submit_order_once",
+        }
+        forbidden_import_fragments = {
+            "quantity_gate2_runner",
+            "sku_selection_runner",
+            "submission",
+            "payment",
+        }
+        for relative, expected_rpc in expected_by_source.items():
+            source = (CLIENT_ROOT / relative).read_text(encoding="utf-8")
+            tree = ast.parse(source)
+            rpc_literals = {
+                node.args[1].value
+                for node in ast.walk(tree)
+                if isinstance(node, ast.Call)
+                and isinstance(node.func, ast.Name)
+                and node.func.id == "_read_rpc"
+                and len(node.args) > 1
+                and isinstance(node.args[1], ast.Constant)
+                and isinstance(node.args[1].value, str)
+            }
+            self.assertEqual(rpc_literals, expected_rpc)
+            observed_attributes = {
+                node.attr
+                for node in ast.walk(tree)
+                if isinstance(node, ast.Attribute) and node.attr in forbidden_attributes
+            }
+            self.assertEqual(observed_attributes, set())
+            imported_modules = {
+                alias.name
+                for node in ast.walk(tree)
+                if isinstance(node, (ast.Import, ast.ImportFrom))
+                for alias in node.names
+            }
+            for fragment in forbidden_import_fragments:
+                self.assertTrue(all(fragment not in module for module in imported_modules))
+
+
+if __name__ == "__main__":
+    unittest.main()

client/tests/pdd/test_quantity_gate2.py

@@ -0,0 +1,944 @@
+"""T-105 数量两态只读取证与后续生产边界的离线测试。"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import base64
+from contextlib import redirect_stderr
+from datetime import UTC, datetime
+from functools import lru_cache
+from importlib.util import module_from_spec, spec_from_file_location
+from io import BytesIO, StringIO
+import json
+from pathlib import Path
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+from unittest.mock import patch
+
+from PIL import Image
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbDevice, CommandResult, DeviceInspection
+from cmbuyer_client.pdd.quantity_gate2_spike import (
+    Android16TopResumedForegroundReader,
+    DECLARED_QUANTITIES,
+    EXPECTED_GOODS_ID,
+    QuantityGate2EvidenceCapturer,
+    QuantityGate2EvidenceError,
+    QuantityGate2EvidenceTimeoutError,
+    QuantityGate2ForegroundReader,
+    QuantityGate2ReadDevice,
+)
+from cmbuyer_client.pdd.quantity_gate2 import (
+    Gate1Observation,
+    QuantityGate2Device,
+    QuantityGate2Error,
+    QuantityGate2Flow,
+    QuantityGate2OverCapError,
+)
+from cmbuyer_client.pdd.quantity_gate2_runner import QuantityGate2Runner
+
+
+SERIAL = "192.168.0.173:5555"
+HIERARCHY = "<?xml version='1.0' encoding='UTF-8'?><hierarchy rotation='0'><node text='local raw page' /></hierarchy>"
+TOP_RESUMED = (
+    "  topResumedActivity=ActivityRecord{101034589 u0 "
+    "com.xunmeng.pinduoduo/.activity.NewPageActivity t1816}\n"
+)
+
+
+@lru_cache(maxsize=1)
+def _png_base64() -> str:
+    raw = BytesIO()
+    Image.new("RGB", (1080, 2376), color="white").save(raw, format="PNG")
+    return base64.b64encode(raw.getvalue()).decode("ascii")
+
+
+class FakeAdbClient:
+    def __init__(self, *, model: str = "PKG110", android_version: str = "16") -> None:
+        self.calls: list[str] = []
+        self.inspection = DeviceInspection(
+            device=AdbDevice(serial=SERIAL, state="device", model=model),
+            model=model,
+            android_version=android_version,
+        )
+
+    def inspect(self, serial: str) -> DeviceInspection:
+        self.calls.append(serial)
+        return self.inspection
+
+
+class FakeReadDevice:
+    def __init__(
+        self,
+        *,
+        version: str = "8.17.0",
+        screen_size: tuple[int, int] = (1080, 2376),
+        screenshot: object | None = None,
+        hierarchy: object = HIERARCHY,
+    ) -> None:
+        self.version = version
+        self.screen_size = screen_size
+        self.screenshot = _png_base64() if screenshot is None else screenshot
+        self.hierarchy = hierarchy
+        self.calls: list[tuple[object, ...]] = []
+        self.app_info_reads = 0
+        self.window_reads = 0
+        self.post_version: str | None = None
+        self.post_screen_size: tuple[int, int] | None = None
+
+    def app_info(self, package_name: str) -> dict[str, str]:
+        self.calls.append(("app_info", package_name))
+        self.app_info_reads += 1
+        version = self.post_version if self.app_info_reads > 1 and self.post_version is not None else self.version
+        return {"versionName": version}
+
+    def window_size(self) -> tuple[int, int]:
+        self.calls.append(("window_size",))
+        self.window_reads += 1
+        if self.window_reads > 1 and self.post_screen_size is not None:
+            return self.post_screen_size
+        return self.screen_size
+
+    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> object:
+        self.calls.append(("jsonrpc", method, params, timeout))
+        if method == "takeScreenshot":
+            return self.screenshot
+        if method == "dumpWindowHierarchy":
+            return self.hierarchy
+        raise AssertionError(f"unexpected RPC {method}")
+
+
+class FakeForegroundReader:
+    def __init__(
+        self,
+        *,
+        package: str = "com.xunmeng.pinduoduo",
+        activity: str = ".activity.NewPageActivity",
+    ) -> None:
+        self.package = package
+        self.activity = activity
+        self.post_package: str | None = None
+        self.post_activity: str | None = None
+        self.calls: list[str] = []
+
+    def read(self, serial: str) -> dict[str, str]:
+        self.calls.append(serial)
+        package = self.post_package if len(self.calls) > 1 and self.post_package is not None else self.package
+        activity = self.post_activity if len(self.calls) > 1 and self.post_activity is not None else self.activity
+        return {"package": package, "activity": activity}
+
+
+class FakeCommandRunner:
+    def __init__(self, result: CommandResult) -> None:
+        self.result = result
+        self.calls: list[tuple[tuple[str, ...], float]] = []
+
+    def run(self, arguments: tuple[str, ...], timeout_seconds: float) -> CommandResult:
+        self.calls.append((arguments, timeout_seconds))
+        return self.result
+
+
+def _load_script() -> object:
+    script_path = CLIENT_ROOT / "scripts" / "capture_quantity_gate2_spike.py"
+    spec = spec_from_file_location("capture_quantity_gate2_spike_for_test", script_path)
+    assert spec is not None and spec.loader is not None
+    module = module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _load_run_script() -> object:
+    script_path = CLIENT_ROOT / "scripts" / "run_t105_quantity_gate2.py"
+    spec = spec_from_file_location("run_t105_quantity_gate2_for_test", script_path)
+    assert spec is not None and spec.loader is not None
+    module = module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _namespace(**changes: object) -> argparse.Namespace:
+    values: dict[str, object] = {
+        "serial": SERIAL,
+        "goods_id": EXPECTED_GOODS_ID,
+        "state": "initial",
+        "declared_quantity": 1,
+        "output_dir": Path("evidence"),
+        "timeout": 10.0,
+        "adb": "adb",
+    }
+    values.update(changes)
+    return argparse.Namespace(**values)
+
+
+class Android16TopResumedForegroundReaderTests(unittest.TestCase):
+    def test_reads_exact_unique_android16_top_resumed_activity(self) -> None:
+        runner = FakeCommandRunner(CommandResult(stdout=TOP_RESUMED))
+        reader = Android16TopResumedForegroundReader(runner, timeout_seconds=7)
+
+        self.assertEqual(
+            reader.read(SERIAL),
+            {
+                "package": "com.xunmeng.pinduoduo",
+                "activity": ".activity.NewPageActivity",
+            },
+        )
+        self.assertEqual(
+            runner.calls,
+            [
+                (
+                    (
+                        "-s",
+                        SERIAL,
+                        "shell",
+                        "dumpsys",
+                        "activity",
+                        "activities",
+                    ),
+                    7,
+                )
+            ],
+        )
+
+    def test_missing_legacy_or_duplicate_top_resumed_activity_is_rejected(self) -> None:
+        rejected_outputs = (
+            "",
+            (
+                "mResumedActivity: ActivityRecord{101034589 u0 "
+                "com.xunmeng.pinduoduo/.activity.NewPageActivity t1816}\n"
+            ),
+            TOP_RESUMED + TOP_RESUMED,
+            "topResumedActivity=null\n",
+        )
+        for output in rejected_outputs:
+            with self.subTest(output=output):
+                reader = Android16TopResumedForegroundReader(
+                    FakeCommandRunner(CommandResult(stdout=output)),
+                    timeout_seconds=7,
+                )
+                with self.assertRaises(QuantityGate2EvidenceError):
+                    reader.read(SERIAL)
+
+    def test_command_failure_and_invalid_serial_are_rejected(self) -> None:
+        runner = FakeCommandRunner(CommandResult(stdout=TOP_RESUMED, returncode=1))
+        reader = Android16TopResumedForegroundReader(runner, timeout_seconds=7)
+        with self.assertRaises(QuantityGate2EvidenceError):
+            reader.read(SERIAL)
+        with self.assertRaises(QuantityGate2EvidenceError):
+            reader.read(f" {SERIAL}")
+        self.assertEqual(len(runner.calls), 1)
+
+
+class QuantityGate2EvidenceTests(unittest.TestCase):
+    def _capturer(
+        self,
+        adb: FakeAdbClient,
+        device: FakeReadDevice,
+        *,
+        foreground: FakeForegroundReader | None = None,
+        connector_calls: list[str] | None = None,
+    ) -> QuantityGate2EvidenceCapturer:
+        def connect(serial: str) -> FakeReadDevice:
+            if connector_calls is not None:
+                connector_calls.append(serial)
+            return device
+
+        return QuantityGate2EvidenceCapturer(
+            adb,
+            connect,
+            foreground or FakeForegroundReader(),
+            timeout_seconds=2,
+        )
+
+    def test_initial_and_target_states_publish_only_raw_read_evidence(self) -> None:
+        for state, quantity in DECLARED_QUANTITIES.items():
+            with self.subTest(state=state), TemporaryDirectory() as temporary:
+                adb = FakeAdbClient()
+                device = FakeReadDevice()
+                foreground = FakeForegroundReader()
+                connector_calls: list[str] = []
+                target = Path(temporary) / state
+
+                result = self._capturer(
+                    adb,
+                    device,
+                    foreground=foreground,
+                    connector_calls=connector_calls,
+                ).capture(
+                    SERIAL,
+                    EXPECTED_GOODS_ID,
+                    state,
+                    quantity,
+                    target,
+                )
+
+                manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+                app = json.loads(result.app_path.read_text(encoding="utf-8"))
+                self.assertEqual(adb.calls, [SERIAL])
+                self.assertEqual(connector_calls, [SERIAL])
+                self.assertEqual(foreground.calls, [SERIAL, SERIAL])
+                self.assertEqual(
+                    [call[1] for call in device.calls if call[0] == "jsonrpc"],
+                    ["takeScreenshot", "dumpWindowHierarchy"],
+                )
+                self.assertEqual(manifest["operation"], "t105-quantity-gate2-readonly-evidence")
+                self.assertEqual(manifest["human_declared_state"], state)
+                self.assertEqual(manifest["human_declared_quantity"], quantity)
+                self.assertEqual(
+                    manifest["human_declared_selection"],
+                    {"color": "黑色CHA(纯棉)", "size": "M(建议100-115)"},
+                )
+                self.assertEqual(manifest["review_status"], "human_review_required")
+                self.assertEqual(manifest["product"]["goods_id"], EXPECTED_GOODS_ID)
+                self.assertEqual(app["package"], "com.xunmeng.pinduoduo")
+                self.assertEqual(
+                    {path.name for path in target.iterdir()},
+                    {"screenshot.png", "hierarchy.xml", "app.json", "manifest.json"},
+                )
+                serialized = result.manifest_path.read_text(encoding="utf-8")
+                self.assertNotIn(SERIAL, serialized)
+                self.assertNotIn("NewPageActivity", serialized)
+                self.assertNotIn("local raw page", serialized)
+                for artifact in manifest["artifacts"]:
+                    self.assertEqual(len(artifact["sha256"]), 64)
+
+    def test_invalid_inputs_and_existing_target_fail_before_device_access(self) -> None:
+        scenarios = (
+            ("", EXPECTED_GOODS_ID, "initial", 1),
+            (f" {SERIAL}", EXPECTED_GOODS_ID, "initial", 1),
+            (SERIAL, "958756616606", "initial", 1),
+            (SERIAL, EXPECTED_GOODS_ID, "unknown", 1),
+            (SERIAL, EXPECTED_GOODS_ID, "initial", 2),
+            (SERIAL, EXPECTED_GOODS_ID, "target", 1),
+            (SERIAL, EXPECTED_GOODS_ID, "initial", True),
+        )
+        for serial, goods_id, state, quantity in scenarios:
+            with self.subTest(state=state, quantity=quantity), TemporaryDirectory() as temporary:
+                adb = FakeAdbClient()
+                connector_calls: list[str] = []
+                with self.assertRaises(QuantityGate2EvidenceError):
+                    self._capturer(adb, FakeReadDevice(), connector_calls=connector_calls).capture(
+                        serial,
+                        goods_id,
+                        state,
+                        quantity,
+                        Path(temporary) / "evidence",
+                    )
+                self.assertEqual(adb.calls, [])
+                self.assertEqual(connector_calls, [])
+
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            target.mkdir()
+            sentinel = target / "sentinel.txt"
+            sentinel.write_text("keep", encoding="utf-8")
+            adb = FakeAdbClient()
+            with self.assertRaises(QuantityGate2EvidenceError):
+                self._capturer(adb, FakeReadDevice()).capture(
+                    SERIAL, EXPECTED_GOODS_ID, "initial", 1, target
+                )
+            self.assertEqual(adb.calls, [])
+            self.assertEqual(sentinel.read_text(encoding="utf-8"), "keep")
+
+    def test_device_version_package_activity_and_screen_mismatch_fail_closed(self) -> None:
+        scenarios = (
+            (FakeAdbClient(model="OTHER"), FakeReadDevice(), FakeForegroundReader()),
+            (FakeAdbClient(android_version="15"), FakeReadDevice(), FakeForegroundReader()),
+            (FakeAdbClient(), FakeReadDevice(version="8.17.1"), FakeForegroundReader()),
+            (FakeAdbClient(), FakeReadDevice(), FakeForegroundReader(package="com.example.other")),
+            (FakeAdbClient(), FakeReadDevice(), FakeForegroundReader(activity="")),
+            (FakeAdbClient(), FakeReadDevice(screen_size=(1080, 2400)), FakeForegroundReader()),
+        )
+        for adb, device, foreground in scenarios:
+            with self.subTest(device=device.__dict__), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(QuantityGate2EvidenceError):
+                    self._capturer(adb, device, foreground=foreground).capture(
+                        SERIAL, EXPECTED_GOODS_ID, "initial", 1, target
+                    )
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+                self.assertEqual(
+                    [call for call in device.calls if call[0] == "jsonrpc"],
+                    [],
+                )
+
+    def test_invalid_screenshot_or_hierarchy_leaves_no_partial_evidence(self) -> None:
+        scenarios = (
+            FakeReadDevice(screenshot="not base64"),
+            FakeReadDevice(screenshot=123),
+            FakeReadDevice(hierarchy="<not-hierarchy />"),
+            FakeReadDevice(hierarchy=123),
+        )
+        for device in scenarios:
+            with self.subTest(value=device.screenshot), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(QuantityGate2EvidenceError):
+                    self._capturer(FakeAdbClient(), device).capture(
+                        SERIAL, EXPECTED_GOODS_ID, "initial", 1, target
+                    )
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_timeout_is_redacted_and_cleans_staging(self) -> None:
+        class TimeoutDevice(FakeReadDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> object:
+                self.calls.append(("jsonrpc", method, params, timeout))
+                if method == "takeScreenshot":
+                    raise TimeoutError(f"secret {SERIAL} C:\\private\\evidence")
+                return super().jsonrpc_call(method, params, timeout)
+
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            with self.assertRaises(QuantityGate2EvidenceTimeoutError) as raised:
+                self._capturer(FakeAdbClient(), TimeoutDevice()).capture(
+                    SERIAL, EXPECTED_GOODS_ID, "initial", 1, target
+                )
+            self.assertNotIn(SERIAL, str(raised.exception))
+            self.assertNotIn("private", str(raised.exception))
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_post_capture_app_or_screen_drift_does_not_publish(self) -> None:
+        drift_mutators = (
+            lambda device, foreground: setattr(device, "post_version", "8.17.1"),
+            lambda device, foreground: setattr(foreground, "post_package", "com.example.other"),
+            lambda device, foreground: setattr(foreground, "post_activity", "OtherActivity"),
+            lambda device, foreground: setattr(device, "post_screen_size", (1080, 2400)),
+        )
+        for mutate in drift_mutators:
+            with TemporaryDirectory() as temporary:
+                device = FakeReadDevice()
+                foreground = FakeForegroundReader()
+                mutate(device, foreground)
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(QuantityGate2EvidenceError):
+                    self._capturer(
+                        FakeAdbClient(),
+                        device,
+                        foreground=foreground,
+                    ).capture(
+                        SERIAL, EXPECTED_GOODS_ID, "initial", 1, target
+                    )
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_capturer_is_one_shot_even_after_rejection(self) -> None:
+        capturer = self._capturer(FakeAdbClient(), FakeReadDevice())
+        with TemporaryDirectory() as temporary:
+            with self.assertRaises(QuantityGate2EvidenceError):
+                capturer.capture("", EXPECTED_GOODS_ID, "initial", 1, Path(temporary) / "bad")
+            with self.assertRaises(QuantityGate2EvidenceError):
+                capturer.capture(SERIAL, EXPECTED_GOODS_ID, "initial", 1, Path(temporary) / "good")
+
+    def test_read_protocol_and_capturer_expose_no_page_actions(self) -> None:
+        forbidden = {
+            "click",
+            "swipe",
+            "press",
+            "pressKey",
+            "send_keys",
+            "set_text",
+            "open_product",
+            "open_sku_panel",
+            "set_quantity",
+            "go_to_order_confirm",
+            "submit_order_once",
+            "pay",
+        }
+        self.assertTrue(forbidden.isdisjoint(QuantityGate2ReadDevice.__dict__))
+        self.assertTrue(forbidden.isdisjoint(QuantityGate2ForegroundReader.__dict__))
+        self.assertEqual(
+            {
+                name
+                for name in Android16TopResumedForegroundReader.__dict__
+                if not name.startswith("_")
+            },
+            {"read"},
+        )
+        self.assertEqual(
+            {name for name in QuantityGate2EvidenceCapturer.__dict__ if not name.startswith("_")},
+            {"capture"},
+        )
+
+
+class QuantityGate2CliAndStaticBoundaryTests(unittest.TestCase):
+    def test_cli_validation_rejects_all_unapproved_combinations(self) -> None:
+        script = _load_script()
+        invalid = (
+            _namespace(serial=""),
+            _namespace(serial=f" {SERIAL}"),
+            _namespace(goods_id="958756616606"),
+            _namespace(state="unknown"),
+            _namespace(declared_quantity=2),
+            _namespace(state="target", declared_quantity=1),
+            _namespace(output_dir=Path("")),
+            _namespace(timeout=0),
+            _namespace(timeout=float("inf")),
+        )
+        for arguments in invalid:
+            with self.subTest(arguments=arguments), self.assertRaises(ValueError):
+                script.validate_arguments(arguments)  # type: ignore[attr-defined]
+
+    def test_cli_parses_exact_initial_and_target_arguments(self) -> None:
+        script = _load_script()
+        for state, quantity in DECLARED_QUANTITIES.items():
+            arguments = script.parse_arguments(  # type: ignore[attr-defined]
+                [
+                    "--serial",
+                    SERIAL,
+                    "--goods-id",
+                    EXPECTED_GOODS_ID,
+                    "--state",
+                    state,
+                    "--declared-quantity",
+                    str(quantity),
+                    "--output-dir",
+                    f"evidence-{state}",
+                ]
+            )
+            script.validate_arguments(arguments)  # type: ignore[attr-defined]
+
+    def test_cli_runtime_failure_does_not_echo_sensitive_values(self) -> None:
+        script = _load_script()
+        error = QuantityGate2EvidenceError(f"secret {SERIAL} C:\\private\\evidence raw body")
+        stderr = StringIO()
+        fake_capturer = unittest.mock.Mock()
+        fake_capturer.capture.side_effect = error
+        with (
+            patch.object(script, "QuantityGate2EvidenceCapturer", return_value=fake_capturer),
+            patch.dict(sys.modules, {"adbutils": unittest.mock.Mock(), "uiautomator2": unittest.mock.Mock()}),
+            redirect_stderr(stderr),
+        ):
+            result = script.main(
+                [
+                    "--serial",
+                    SERIAL,
+                    "--goods-id",
+                    EXPECTED_GOODS_ID,
+                    "--state",
+                    "initial",
+                    "--declared-quantity",
+                    "1",
+                    "--output-dir",
+                    "C:\\private\\evidence",
+                ]
+            )
+        self.assertEqual(result, 1)
+        self.assertNotIn(SERIAL, stderr.getvalue())
+        self.assertNotIn("private", stderr.getvalue())
+        self.assertNotIn("raw body", stderr.getvalue())
+
+    def test_stage_one_sources_contain_only_approved_rpc_method_literals(self) -> None:
+        expected_by_source = {
+            Path("src/cmbuyer_client/pdd/quantity_gate2_spike.py"): {
+                "takeScreenshot",
+                "dumpWindowHierarchy",
+            },
+            Path("scripts/capture_quantity_gate2_spike.py"): set(),
+        }
+        for relative, expected in expected_by_source.items():
+            tree = ast.parse((CLIENT_ROOT / relative).read_text(encoding="utf-8"))
+            rpc_literals = {
+                node.args[1].value
+                for node in ast.walk(tree)
+                if isinstance(node, ast.Call)
+                and isinstance(node.func, ast.Name)
+                and node.func.id == "_read_rpc"
+                and len(node.args) > 1
+                and isinstance(node.args[1], ast.Constant)
+                and isinstance(node.args[1].value, str)
+            }
+            self.assertEqual(rpc_literals, expected)
+            forbidden_attributes = {
+                node.attr
+                for node in ast.walk(tree)
+                if isinstance(node, ast.Attribute)
+                and node.attr in {"click", "swipe", "press", "pressKey", "set_text", "send_keys", "start_pdd_view_intent"}
+            }
+            self.assertEqual(forbidden_attributes, set())
+
+    def test_t103_and_t104_sources_do_not_import_quantity_gate2(self) -> None:
+        forbidden_import = "quantity_gate2"
+        sources = (
+            CLIENT_ROOT / "src/cmbuyer_client/pdd/sku_selection.py",
+            CLIENT_ROOT / "src/cmbuyer_client/pdd/sku_selection_runner.py",
+        )
+        for source in sources:
+            self.assertNotIn(forbidden_import, source.read_text(encoding="utf-8"))
+
+
+_INITIAL_FIXTURE = CLIENT_ROOT / "tests" / "pdd" / "fixtures" / "quantity_gate2_initial_8_17_0.xml"
+_TARGET_FIXTURE = CLIENT_ROOT / "tests" / "pdd" / "fixtures" / "quantity_gate2_target_8_17_0.xml"
+_EXIT_FIXTURE = CLIENT_ROOT / "tests" / "pdd" / "fixtures" / "product_exit_8_17_0.xml"
+
+
+def _gate1(path: Path = Path("gate1.png")) -> Gate1Observation:
+    return Gate1Observation(
+        color="黑色CHA(纯棉)",
+        size="M(建议100-115)",
+        quantity=1,
+        gate1_unit_price="12.88",
+        screenshot_path=path,
+        captured_at=datetime(2026, 8, 6, 0, 53, tzinfo=UTC),
+    )
+
+
+class FakeQuantityFlowDevice:
+    def __init__(self, initial: str | None = None, target: str | None = None) -> None:
+        self.initial = initial or _INITIAL_FIXTURE.read_text(encoding="utf-8")
+        self.target = target or _TARGET_FIXTURE.read_text(encoding="utf-8")
+        self.exit = _EXIT_FIXTURE.read_text(encoding="utf-8")
+        self.current = self.initial
+        self.version = "8.17.0"
+        self.foreground = {"package": "com.xunmeng.pinduoduo", "activity": ".activity.NewPageActivity"}
+        self.screen_size = (1080, 2376)
+        self.increment_calls: list[str] = []
+        self.back_calls = 0
+        self.dump_calls = 0
+        self.raise_increment: BaseException | None = None
+
+    def app_info(self, package_name: str) -> dict[str, str]:
+        return {"versionName": self.version}
+
+    def current_foreground(self) -> dict[str, str]:
+        return dict(self.foreground)
+
+    def display_size(self) -> tuple[int, int]:
+        return self.screen_size
+
+    def dump_window_hierarchy(self) -> str:
+        self.dump_calls += 1
+        return self.current
+
+    def increment_quantity_once(self, bounds: str) -> None:
+        self.increment_calls.append(bounds)
+        if self.raise_increment is not None:
+            raise self.raise_increment
+        self.current = self.target
+
+    def capture_screenshot(self) -> str:
+        return _png_base64()
+
+    def leave_sku_panel_once(self) -> None:
+        self.back_calls += 1
+        self.current = self.exit
+
+
+class QuantityGate2FlowTests(unittest.TestCase):
+    def test_quantity_two_reads_nonlinear_panel_total_and_exits_once(self) -> None:
+        device = FakeQuantityFlowDevice()
+        flow = QuantityGate2Flow(device, wait_timeout_seconds=0.1, poll_interval_seconds=0.01)
+        verified = flow.set_quantity_and_verify(_gate1(), 2, "40.00")
+        observation = flow.build_observation(
+            _gate1(),
+            2,
+            "40.00",
+            Path("gate2.png"),
+            datetime(2026, 8, 6, 1, 10, tzinfo=UTC),
+        )
+        flow.exit_sku_panel_safely()
+
+        self.assertEqual(verified.quantity, 2)
+        self.assertEqual(observation.quantity_read, 2)
+        self.assertEqual(observation.gate1_unit_price, "12.88")
+        self.assertEqual(observation.gate2_panel_total_price, "32.76")
+        self.assertEqual(observation.max_total_price, "40.00")
+        self.assertEqual(device.increment_calls, ["[567,752][645,827]"])
+        self.assertEqual(device.back_calls, 1)
+        self.assertTrue(flow.exited)
+
+    def test_quantity_one_is_zero_click_and_still_uses_panel_amount(self) -> None:
+        device = FakeQuantityFlowDevice()
+        flow = QuantityGate2Flow(device)
+        verified = flow.set_quantity_and_verify(_gate1(), 1, "12.88")
+        self.assertEqual((verified.quantity, verified.panel_total_price), (1, "12.88"))
+        self.assertEqual(device.increment_calls, [])
+
+    def test_only_evidenced_quantities_and_canonical_decimal_cap_are_allowed(self) -> None:
+        for quantity in (0, 3, -1, True, "2"):
+            with self.subTest(quantity=quantity):
+                device = FakeQuantityFlowDevice()
+                with self.assertRaises(QuantityGate2Error):
+                    QuantityGate2Flow(device).set_quantity_and_verify(_gate1(), quantity, "40.00")  # type: ignore[arg-type]
+                self.assertEqual(device.increment_calls, [])
+        for cap in ("0.00", "40", "040.00", 40.0, "NaN"):
+            with self.subTest(cap=cap):
+                device = FakeQuantityFlowDevice()
+                with self.assertRaises(QuantityGate2Error):
+                    QuantityGate2Flow(device).set_quantity_and_verify(_gate1(), 2, cap)  # type: ignore[arg-type]
+                self.assertEqual(device.increment_calls, [])
+
+    def test_over_cap_stops_after_exact_readback_without_fabricated_math(self) -> None:
+        device = FakeQuantityFlowDevice()
+        flow = QuantityGate2Flow(device)
+        with self.assertRaises(QuantityGate2OverCapError):
+            flow.set_quantity_and_verify(_gate1(), 2, "30.00")
+        self.assertEqual(device.increment_calls, ["[567,752][645,827]"])
+        self.assertTrue(flow.can_exit_safely)
+
+    def test_increment_timeout_is_sealed_and_cannot_be_retried(self) -> None:
+        device = FakeQuantityFlowDevice()
+        device.raise_increment = TimeoutError("ambiguous delivery")
+        flow = QuantityGate2Flow(device, wait_timeout_seconds=0.01, poll_interval_seconds=0.005)
+        with self.assertRaises(TimeoutError):
+            flow.set_quantity_and_verify(_gate1(), 2, "40.00")
+        with self.assertRaises(QuantityGate2Error):
+            flow.set_quantity_and_verify(_gate1(), 2, "40.00")
+        self.assertEqual(len(device.increment_calls), 1)
+        self.assertFalse(flow.can_exit_safely)
+
+    def test_missing_duplicate_drift_and_overlay_fail_before_click(self) -> None:
+        initial = _INITIAL_FIXTURE.read_text(encoding="utf-8")
+        plus = '<node content-desc="增加数量" package="com.xunmeng.pinduoduo" class="android.widget.ImageView" resource-id="com.xunmeng.pinduoduo:id/pdd" bounds="[567,752][645,827]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" />'
+        variants = (
+            initial.replace('content-desc="增加数量"', 'content-desc="数量加一"', 1),
+            initial.replace(plus, plus + plus),
+            initial.replace('text="M（建议100-115）"', 'text="S（建议80-100）"', 1),
+            initial.replace(
+                "</hierarchy>",
+                '<node package="com.example.overlay" class="android.view.ViewGroup" bounds="[560,740][660,840]" clickable="true" enabled="true" visible-to-user="true" selected="false" scrollable="false" /></hierarchy>',
+            ),
+        )
+        for hierarchy in variants:
+            with self.subTest(marker=hierarchy[-180:]):
+                device = FakeQuantityFlowDevice(initial=hierarchy)
+                with self.assertRaises(QuantityGate2Error):
+                    QuantityGate2Flow(device).set_quantity_and_verify(_gate1(), 2, "40.00")
+                self.assertEqual(device.increment_calls, [])
+
+    def test_foreground_version_and_screen_drift_are_zero_click(self) -> None:
+        devices = (FakeQuantityFlowDevice(), FakeQuantityFlowDevice(), FakeQuantityFlowDevice())
+        devices[0].foreground = {"package": "com.android.systemui", "activity": ".Keyguard"}
+        devices[1].version = "8.17.1"
+        devices[2].screen_size = (1080, 2400)
+        for device in devices:
+            with self.subTest(device=device):
+                with self.assertRaises(QuantityGate2Error):
+                    QuantityGate2Flow(device).set_quantity_and_verify(_gate1(), 2, "40.00")
+                self.assertEqual(device.increment_calls, [])
+
+    def test_bottom_submit_amount_is_never_a_gate2_candidate(self) -> None:
+        target = _TARGET_FIXTURE.read_text(encoding="utf-8").replace("提交订单 ¥32.76", "提交订单 ¥999.99")
+        device = FakeQuantityFlowDevice(target=target)
+        result = QuantityGate2Flow(device).set_quantity_and_verify(_gate1(), 2, "40.00")
+        self.assertEqual(result.panel_total_price, "32.76")
+
+    def test_gate1_target_spec_and_timestamp_are_strict(self) -> None:
+        invalid = (
+            {"color": "白色"},
+            {"size": "L"},
+            {"quantity": 2},
+            {"gate1_unit_price": "12.89"},
+            {"captured_at": datetime(2026, 8, 6, 0, 53)},
+        )
+        base = _gate1().__dict__
+        for change in invalid:
+            with self.subTest(change=change), self.assertRaises(QuantityGate2Error):
+                Gate1Observation(**{**base, **change})
+
+
+class FakeRawQuantityDevice:
+    def __init__(self, *, click_timeout: bool = False) -> None:
+        self.current = _INITIAL_FIXTURE.read_text(encoding="utf-8")
+        self.target = _TARGET_FIXTURE.read_text(encoding="utf-8")
+        self.exit = _EXIT_FIXTURE.read_text(encoding="utf-8")
+        self.calls: list[tuple[object, ...]] = []
+        self.click_timeout = click_timeout
+
+    def app_info(self, package: str) -> dict[str, str]:
+        self.calls.append(("app_info", package))
+        return {"versionName": "8.17.0"}
+
+    def window_size(self) -> tuple[int, int]:
+        self.calls.append(("window_size",))
+        return (1080, 2376)
+
+    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> object:
+        self.calls.append(("jsonrpc", method, params, timeout))
+        if method == "dumpWindowHierarchy":
+            return self.current
+        if method == "click":
+            self.current = self.target
+            if self.click_timeout:
+                raise TimeoutError("may have been delivered")
+            return None
+        if method == "takeScreenshot":
+            return _png_base64()
+        if method == "pressKey":
+            self.current = self.exit
+            return None
+        raise AssertionError(method)
+
+
+class QuantityGate2RunnerTests(unittest.TestCase):
+    def test_runner_publishes_gate2_evidence_then_one_safe_exit(self) -> None:
+        with TemporaryDirectory() as temporary:
+            base = Path(temporary)
+            gate1_path = base / "gate1.png"
+            gate1_path.write_bytes(base64.b64decode(_png_base64()))
+            target = base / "gate2"
+            raw = FakeRawQuantityDevice()
+            result = QuantityGate2Runner(
+                FakeAdbClient(),
+                lambda serial: raw,
+                FakeForegroundReader(),
+                timeout_seconds=0.1,
+            ).run(SERIAL, EXPECTED_GOODS_ID, _gate1(gate1_path), 2, "40.00", target)
+
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+            methods = [call[1] for call in raw.calls if call[0] == "jsonrpc"]
+            self.assertEqual(methods.count("click"), 1)
+            self.assertEqual(methods.count("pressKey"), 1)
+            self.assertEqual(methods.count("takeScreenshot"), 1)
+            self.assertEqual(result.observation.gate2_panel_total_price, "32.76")
+            self.assertEqual(manifest["prices"]["gate1_unit_price"], "12.88")
+            self.assertEqual(manifest["prices"]["gate2_panel_total_price"], "32.76")
+            self.assertEqual(manifest["prices"]["max_total_price"], "40.00")
+            self.assertEqual(manifest["action_audit"]["increment_attempts"], 1)
+            self.assertEqual(manifest["action_audit"]["back_attempts"], 1)
+            self.assertEqual(manifest["safe_exit"], "completed")
+            self.assertEqual(manifest["review_status"], "human_review_required")
+            serialized = result.manifest_path.read_text(encoding="utf-8")
+            self.assertNotIn(SERIAL, serialized)
+            self.assertNotIn(str(gate1_path), serialized)
+
+    def test_over_cap_attempts_one_safe_exit_and_publishes_nothing(self) -> None:
+        with TemporaryDirectory() as temporary:
+            base = Path(temporary)
+            gate1_path = base / "gate1.png"
+            gate1_path.write_bytes(base64.b64decode(_png_base64()))
+            raw = FakeRawQuantityDevice()
+            target = base / "gate2"
+            with self.assertRaises(QuantityGate2OverCapError):
+                QuantityGate2Runner(
+                    FakeAdbClient(), lambda serial: raw, FakeForegroundReader(), timeout_seconds=0.1
+                ).run(SERIAL, EXPECTED_GOODS_ID, _gate1(gate1_path), 2, "30.00", target)
+            methods = [call[1] for call in raw.calls if call[0] == "jsonrpc"]
+            self.assertEqual(methods.count("click"), 1)
+            self.assertEqual(methods.count("pressKey"), 1)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(base.glob(".gate2.staging-*")), [])
+
+    def test_ambiguous_increment_is_never_retried_or_followed_by_back(self) -> None:
+        with TemporaryDirectory() as temporary:
+            base = Path(temporary)
+            gate1_path = base / "gate1.png"
+            gate1_path.write_bytes(base64.b64decode(_png_base64()))
+            raw = FakeRawQuantityDevice(click_timeout=True)
+            with self.assertRaises(QuantityGate2Error):
+                QuantityGate2Runner(
+                    FakeAdbClient(), lambda serial: raw, FakeForegroundReader(), timeout_seconds=0.1
+                ).run(SERIAL, EXPECTED_GOODS_ID, _gate1(gate1_path), 2, "40.00", base / "gate2")
+            methods = [call[1] for call in raw.calls if call[0] == "jsonrpc"]
+            self.assertEqual(methods.count("click"), 1)
+            self.assertEqual(methods.count("pressKey"), 0)
+
+
+class QuantityGate2ProductionStaticBoundaryTests(unittest.TestCase):
+    def test_protocol_has_only_named_t105_actions(self) -> None:
+        public = {name for name in QuantityGate2Device.__dict__ if not name.startswith("_")}
+        self.assertEqual(
+            public,
+            {
+                "app_info",
+                "current_foreground",
+                "display_size",
+                "dump_window_hierarchy",
+                "increment_quantity_once",
+                "capture_screenshot",
+                "leave_sku_panel_once",
+            },
+        )
+
+    def test_production_sources_have_no_old_gate2_field_or_forbidden_capability(self) -> None:
+        paths = (
+            CLIENT_ROOT / "src/cmbuyer_client/pdd/quantity_gate2.py",
+            CLIENT_ROOT / "src/cmbuyer_client/pdd/quantity_gate2_runner.py",
+            CLIENT_ROOT / "scripts/run_t105_quantity_gate2.py",
+        )
+        forbidden_attributes = {
+            "go_to_order_confirm",
+            "submit_order_once",
+            "start_pdd_view_intent",
+            "pay",
+            "swipe",
+            "set_text",
+            "send_keys",
+        }
+        for path in paths:
+            source = path.read_text(encoding="utf-8")
+            tree = ast.parse(source)
+            self.assertNotIn("gate2_unit_price", source)
+            self.assertFalse(
+                {
+                    node.attr
+                    for node in ast.walk(tree)
+                    if isinstance(node, ast.Attribute) and node.attr in forbidden_attributes
+                }
+            )
+        quantity_tree = ast.parse(paths[0].read_text(encoding="utf-8"))
+        self.assertFalse(any(isinstance(node, ast.Mult) for node in ast.walk(quantity_tree)))
+
+    def test_t103_and_t104_still_do_not_import_t105(self) -> None:
+        for relative in (
+            "src/cmbuyer_client/pdd/sku_selection.py",
+            "src/cmbuyer_client/pdd/sku_selection_runner.py",
+        ):
+            self.assertNotIn("quantity_gate2", (CLIENT_ROOT / relative).read_text(encoding="utf-8"))
+
+    def test_live_cli_fixes_the_human_review_case_and_redacts_runtime_failure(self) -> None:
+        script = _load_run_script()
+        with TemporaryDirectory() as temporary:
+            screenshot = Path(temporary) / "gate1.png"
+            screenshot.write_bytes(base64.b64decode(_png_base64()))
+            arguments = script.parse_arguments(  # type: ignore[attr-defined]
+                [
+                    "--serial", SERIAL,
+                    "--goods-id", EXPECTED_GOODS_ID,
+                    "--color", "黑色CHA(纯棉)",
+                    "--size", "M(建议100-115)",
+                    "--target-quantity", "2",
+                    "--gate1-unit-price", "12.88",
+                    "--gate1-screenshot", str(screenshot),
+                    "--gate1-captured-at", "2026-08-06T00:53:00.023935+00:00",
+                    "--max-total-price", "40.00",
+                    "--output-dir", str(Path(temporary) / "gate2"),
+                ]
+            )
+            script.validate_arguments(arguments)  # type: ignore[attr-defined]
+
+            stderr = StringIO()
+            fake_runner = unittest.mock.Mock()
+            fake_runner.run.side_effect = QuantityGate2Error(f"secret {SERIAL} {temporary}")
+            with (
+                patch.object(script, "QuantityGate2Runner", return_value=fake_runner),
+                patch.dict(sys.modules, {"adbutils": unittest.mock.Mock(), "uiautomator2": unittest.mock.Mock()}),
+                redirect_stderr(stderr),
+            ):
+                result = script.main(  # type: ignore[attr-defined]
+                    [
+                        "--serial", SERIAL,
+                        "--goods-id", EXPECTED_GOODS_ID,
+                        "--color", "黑色CHA(纯棉)",
+                        "--size", "M(建议100-115)",
+                        "--target-quantity", "2",
+                        "--gate1-unit-price", "12.88",
+                        "--gate1-screenshot", str(screenshot),
+                        "--gate1-captured-at", "2026-08-06T00:53:00.023935+00:00",
+                        "--max-total-price", "40.00",
+                        "--output-dir", str(Path(temporary) / "gate2"),
+                    ]
+                )
+            self.assertEqual(result, 1)
+            self.assertNotIn(SERIAL, stderr.getvalue())
+            self.assertNotIn(temporary, stderr.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()

client/tests/pdd/test_sku_reveal_spike.py

@@ -14,22 +14,51 @@ from xml.etree import ElementTree
 
 from PIL import Image
 
+import cmbuyer_client.pdd.sku_reveal_spike as reveal_module
 from cmbuyer_client.device.adb import AdbDevice, DeviceInspection
 from cmbuyer_client.pdd.sku_reveal_spike import (
+    _annotate_reveal_failure,
+    safe_reveal_failure_stage,
     SkuRevealSpikeCapturer,
     SkuRevealSpikeError,
-    _require_safe_reveal_path,
 )
-from cmbuyer_client.pdd.sku_selection import SkuSelectionError, _parse_nodes
+from cmbuyer_client.pdd.sku_selection import (
+    SkuSelectionError,
+    _annotate_sku_entry_failure,
+    _parse_nodes,
+    _require_safe_reveal_path,
+    _revealed_unselected_projection as _candidate_projection,
+)
+from cmbuyer_client.pdd.sku_selection_runner import (
+    UiautomatorSkuPanelAdapter as _RevealEvidenceAdapter,
+)
 
 
 _FIXTURES = Path(__file__).with_name("fixtures")
 _PRODUCT = (_FIXTURES / "product_entry_8_17_0.xml").read_text(encoding="utf-8")
 _EMPTY = (_FIXTURES / "sku_panel_empty_8_17_0.xml").read_text(encoding="utf-8")
 _COLOR_ONLY = (_FIXTURES / "sku_panel_color_selected_size_hidden_8_17_0.xml").read_text(encoding="utf-8")
+_CURRENT_ONLY_EMPTY = (_FIXTURES / "sku_panel_empty_current_only_8_17_0.xml").read_text(encoding="utf-8")
+_CURRENT_ONLY_COLOR = (_FIXTURES / "sku_panel_color_selected_size_hidden_current_only_8_17_0.xml").read_text(encoding="utf-8")
 _M_SELECTED = (_FIXTURES / "sku_panel_size_m_restored_8_17_0.xml").read_text(encoding="utf-8")
 
 
+def _inert_node(class_name: str, bounds: str) -> ElementTree.Element:
+    return ElementTree.Element(
+        "node",
+        {
+            "package": "com.xunmeng.pinduoduo",
+            "class": class_name,
+            "bounds": bounds,
+            "clickable": "false",
+            "enabled": "true",
+            "visible-to-user": "true",
+            "selected": "false",
+            "scrollable": "false",
+        },
+    )
+
+
 def _candidate_unselected() -> str:
     root = ElementTree.fromstring(_M_SELECTED)
     parents = {child: parent for parent in root.iter() for child in parent}
@@ -42,6 +71,38 @@ def _candidate_unselected() -> str:
             for child in list(wrapper):
                 if child.get("class") == "android.view.View":
                     wrapper.remove(child)
+    parents = {child: parent for parent in root.iter() for child in parent}
+    header = next(
+        node for node in root.iter("node")
+        if node.get("class") == "android.widget.LinearLayout"
+        and node.get("bounds") == "[0,366][1080,1000]"
+    )
+    price_row = next(
+        node for node in root.iter("node")
+        if node.get("class") == "android.widget.LinearLayout"
+        and node.get("bounds") == "[396,498][895,570]"
+    )
+    summary = next(
+        node for node in root.iter("node")
+        if node.get("class") == "android.widget.TextView"
+        and node.get("bounds") == "[396,654][1053,716]"
+    )
+    parents[price_row].remove(price_row)
+    parents[summary].remove(summary)
+    content_frame = _inert_node("android.widget.FrameLayout", "[0,474][1080,863]")
+    relative = _inert_node("android.widget.RelativeLayout", "[0,474][1080,863]")
+    content = _inert_node("android.view.ViewGroup", "[0,474][1080,863]")
+    price_frame = _inert_node("android.widget.FrameLayout", "[396,498][1053,570]")
+    header.append(content_frame)
+    content_frame.append(relative)
+    relative.append(content)
+    content.append(price_frame)
+    price_frame.append(price_row)
+    content.append(summary)
+    for index in range(6):
+        content.append(_inert_node("android.view.View", f"[{index},474][{index + 1},475]"))
+    for index in range(3):
+        header.append(_inert_node("android.view.View", f"[{index},366][{index + 1},367]"))
     action_root = next(
         node
         for node in root.iter("node")
@@ -100,6 +161,238 @@ def _candidate_unselected() -> str:
     return ElementTree.tostring(root, encoding="unicode")
 
 
+def _candidate_current_only() -> str:
+    root = ElementTree.fromstring(_candidate_unselected())
+    parents = {child: parent for parent in root.iter() for child in parent}
+    dual_row = next(
+        node for node in root.iter("node")
+        if node.get("class") == "android.widget.LinearLayout"
+        and node.get("bounds") == "[396,498][895,570]"
+    )
+    price_frame = parents[dual_row]
+    price_frame.remove(dual_row)
+    row = _inert_node("android.widget.LinearLayout", "[396,498][693,570]")
+    current = _inert_node("android.widget.TextView", "[396,503][675,570]")
+    current.set("text", "限1件 ¥12.88 ")
+    price_frame.append(row)
+    row.append(current)
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _candidate_price_drift(variant: str, kind: str) -> str:
+    root = ElementTree.fromstring(
+        _candidate_unselected() if variant == "dual" else _candidate_current_only()
+    )
+    parents = {child: parent for parent in root.iter() for child in parent}
+    if variant == "dual":
+        row = next(
+            node for node in root.iter("node")
+            if node.get("class") == "android.widget.LinearLayout"
+            and node.get("bounds") == "[396,498][895,570]"
+        )
+        current = next(node for node in row if node.get("text") == "快卖完 ¥12.88")
+        original = next(node for node in row if node.get("text") == "¥29.88")
+        if kind == "hybrid":
+            current.set("text", "限1件 ¥12.88 ")
+            current.set("bounds", "[396,503][675,570]")
+            row.remove(original)
+        elif kind == "duplicate":
+            row.append(ElementTree.fromstring(ElementTree.tostring(current, encoding="unicode")))
+        elif kind == "unknown":
+            current.set("text", "未知候选价格")
+        elif kind == "unknown_child":
+            row.append(ElementTree.Element("node", dict(current.attrib) | {"text": "未知子节点"}))
+        elif kind == "parent_drift":
+            row.remove(current)
+            parents[row].append(current)
+        else:
+            raise AssertionError(kind)
+    elif variant == "current_only":
+        frame = next(
+            node for node in root.iter("node")
+            if node.get("class") == "android.widget.FrameLayout"
+            and node.get("bounds") == "[396,498][1053,570]"
+        )
+        row = next(node for node in frame if node.get("bounds") == "[396,498][693,570]")
+        current = next(node for node in row if node.get("text") == "限1件 ¥12.88 ")
+        if kind == "hybrid":
+            current.set("text", "快卖完 ¥12.88")
+            current.set("bounds", "[396,503][712,570]")
+            original = ElementTree.Element(
+                "node",
+                dict(current.attrib)
+                | {
+                    "text": "¥29.88",
+                    "bounds": "[730,503][895,570]",
+                },
+            )
+            row.append(original)
+        elif kind == "duplicate":
+            parents[frame].append(
+                ElementTree.fromstring(ElementTree.tostring(frame, encoding="unicode"))
+            )
+        elif kind == "unknown":
+            current.set("bounds", "[396,502][675,570]")
+        elif kind == "unknown_child":
+            row.append(ElementTree.Element("node", dict(current.attrib) | {"text": "未知子节点"}))
+        elif kind in {"original", "coupon_original"}:
+            original = _inert_node("android.widget.TextView", "[730,503][895,570]")
+            original.set("text", "¥29.88" if kind == "original" else "券前¥29.88")
+            # 放在候选 header 之外，证明单价格分支检查整棵树，而非只看价格容器。
+            root.append(original)
+        elif kind == "parent_drift":
+            frame.remove(row)
+            parents[frame].append(row)
+        else:
+            raise AssertionError(kind)
+    else:
+        raise AssertionError(variant)
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _candidate_chain_drift(role: str, kind: str) -> str:
+    root = ElementTree.fromstring(_candidate_current_only())
+    parents = {child: parent for parent in root.iter() for child in parent}
+    header = next(
+        node for node in root.iter("node")
+        if node.get("class") == "android.widget.LinearLayout"
+        and node.get("bounds") == "[0,366][1080,1000]"
+    )
+    surface = parents[header]
+    content_frame = next(
+        node for node in header
+        if node.get("class") == "android.widget.FrameLayout"
+        and node.get("bounds") == "[0,474][1080,863]"
+    )
+    relative = next(iter(content_frame))
+    content = next(iter(relative))
+    price_frame = next(
+        node for node in content
+        if node.get("class") == "android.widget.FrameLayout"
+        and node.get("bounds") == "[396,498][1053,570]"
+    )
+    row = next(iter(price_frame))
+    current = next(iter(row))
+    summary = next(
+        node for node in content
+        if node.get("class") == "android.widget.TextView"
+        and node.get("bounds") == "[396,654][1053,716]"
+    )
+    roles = {
+        "header": header,
+        "content_frame": content_frame,
+        "relative": relative,
+        "content": content,
+        "price_frame": price_frame,
+        "row": row,
+        "current": current,
+        "summary": summary,
+    }
+    target = roles[role]
+    if kind == "attrs":
+        target.set("enabled", "false")
+    elif kind == "children":
+        target.append(_inert_node("android.view.View", "[1,1][2,2]"))
+    elif kind == "parent":
+        new_parents = {
+            "header": next(
+                node for node in surface
+                if node.get("class") == "androidx.recyclerview.widget.RecyclerView"
+            ),
+            "content_frame": surface,
+            "relative": header,
+            "content": content_frame,
+            "price_frame": header,
+            "row": content,
+            "current": price_frame,
+            "summary": header,
+        }
+        parents[target].remove(target)
+        new_parents[role].append(target)
+    else:
+        raise AssertionError(kind)
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _candidate_cross_variant_residue(variant: str, kind: str) -> str:
+    root = ElementTree.fromstring(
+        _candidate_unselected() if variant == "dual" else _candidate_current_only()
+    )
+    content = next(
+        node for node in root.iter("node")
+        if node.get("class") == "android.view.ViewGroup"
+        and node.get("bounds") == "[0,474][1080,863]"
+    )
+    filler = next(node for node in content if node.get("class") == "android.view.View")
+    content.remove(filler)
+    if variant == "dual":
+        row = _inert_node("android.widget.LinearLayout", "[396,498][693,570]")
+        current = _inert_node("android.widget.TextView", "[396,503][675,570]")
+        current.set("text", "限1件 ¥12.88 ")
+        row.append(current)
+        fragments = {"row": row, "current": current}
+    elif variant == "current_only":
+        row = _inert_node("android.widget.LinearLayout", "[396,498][895,570]")
+        current = _inert_node("android.widget.TextView", "[396,503][712,570]")
+        current.set("text", "快卖完 ¥12.88")
+        original = _inert_node("android.widget.TextView", "[730,503][895,570]")
+        original.set("text", "¥29.88")
+        row.extend((current, original))
+        fragments = {"row": row, "current": current, "original": original}
+    else:
+        raise AssertionError(variant)
+    if kind == "complete":
+        frame = _inert_node("android.widget.FrameLayout", "[396,498][1053,570]")
+        frame.append(row)
+        content.append(frame)
+    else:
+        # 只插入一段精确 opposing role，且维持 content 原 child-count，防止由计数检查掩盖残片检查。
+        content.append(ElementTree.fromstring(ElementTree.tostring(fragments[kind], encoding="unicode")))
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _candidate_with_color_unselected() -> str:
+    root = ElementTree.fromstring(_candidate_current_only())
+    target = next(
+        node
+        for node in root.iter("node")
+        if node.get("class") == "android.view.ViewGroup"
+        and node.get("content-desc") == "黑色 CHA (纯棉）"
+        and node.get("bounds") == "[372,1000][684,1024]"
+    )
+    for node in target.iter("node"):
+        node.set("selected", "false")
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _candidate_with_submit_risk(kind: str) -> str:
+    root = ElementTree.fromstring(_candidate_current_only())
+    parents = {child: parent for parent in root.iter() for child in parent}
+    submit = next(
+        node
+        for node in root.iter("node")
+        if "提交订单" in node.get("text", "")
+        and node.get("class") == "android.widget.TextView"
+    )
+    parent = parents[submit]
+    if kind == "missing":
+        parent.remove(submit)
+    elif kind == "duplicate":
+        parent.append(ElementTree.fromstring(ElementTree.tostring(submit, encoding="unicode")))
+    elif kind == "moved_up":
+        submit.set("bounds", "[285,1900][795,1959]")
+    elif kind in {"extra_altered", "extra_moved_up"}:
+        extra = ElementTree.fromstring(ElementTree.tostring(submit, encoding="unicode"))
+        if kind == "extra_altered":
+            extra.set("text", "异常提交订单文案")
+        else:
+            extra.set("bounds", "[285,1900][795,1959]")
+        parent.append(extra)
+    else:
+        raise AssertionError(kind)
+    return ElementTree.tostring(root, encoding="unicode")
+
+
 def _with_clickable_overlay(package: str, class_name: str, bounds: str) -> str:
     root = ElementTree.fromstring(_COLOR_ONLY)
     container = next(root.iter("node"))
@@ -132,7 +425,9 @@ def _png() -> str:
 class _FakeDevice:
     def __init__(self) -> None:
         self.hierarchy = "<hierarchy />"
-        self.after_hierarchy = _candidate_unselected()
+        self.empty_hierarchy = _CURRENT_ONLY_EMPTY
+        self.color_hierarchy = _CURRENT_ONLY_COLOR
+        self.after_hierarchy = _candidate_current_only()
         self.calls: list[tuple[object, ...]] = []
         self.swipe_error = False
 
@@ -156,10 +451,10 @@ class _FakeDevice:
             return _png()
         if method == "click":
             if params == [865, 2218]:
-                self.hierarchy = _EMPTY
+                self.hierarchy = self.empty_hierarchy
                 return ""
             if params == [528, 1387]:
-                self.hierarchy = _COLOR_ONLY
+                self.hierarchy = self.color_hierarchy
                 return ""
             raise AssertionError(params)
         if method == "swipe":
@@ -200,6 +495,22 @@ class SkuRevealSpikeTests(unittest.TestCase):
             sleep_function=lambda seconds: now.__setitem__(0, now[0] + seconds),
         )
 
+    def _assert_after_rejected_once(self, after_hierarchy: str, *, ambiguous: bool = False) -> None:
+        device = _FakeDevice()
+        device.after_hierarchy = after_hierarchy
+        device.swipe_error = ambiguous
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "evidence"
+            with self.assertRaises(SkuRevealSpikeError):
+                self._capturer(device).capture(
+                    "192.168.0.173:5555",
+                    "937122477375",
+                    target,
+                )
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
+
     def test_success_publishes_before_after_and_exactly_one_reveal(self) -> None:
         device = _FakeDevice()
         with TemporaryDirectory() as directory:
@@ -227,6 +538,107 @@ class SkuRevealSpikeTests(unittest.TestCase):
             self.assertNotIn("start", manifest)
             self.assertNotIn("end", manifest)
 
+    def test_current_only_candidate_publishes_without_changing_other_candidate_rules(self) -> None:
+        device = _FakeDevice()
+        device.after_hierarchy = _candidate_current_only()
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "evidence"
+            result = self._capturer(device).capture(
+                "192.168.0.173:5555",
+                "937122477375",
+                target,
+            )
+
+            self.assertEqual(result.output_directory, target)
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertTrue((target / "after" / "hierarchy.xml").is_file())
+
+    def test_candidate_price_variants_reject_hybrid_duplicate_unknown_and_parent_drift(self) -> None:
+        # 生产只放行 current-only；历史 dual 及任意混搭、额外节点、父链漂移均拒绝。
+        with self.assertRaises(SkuSelectionError):
+            _candidate_projection(_parse_nodes(_candidate_unselected()))
+        _candidate_projection(_parse_nodes(_candidate_current_only()))
+        for variant in ("dual", "current_only"):
+            kinds = ["hybrid", "duplicate", "unknown", "unknown_child", "parent_drift"]
+            if variant == "current_only":
+                kinds.extend(("original", "coupon_original"))
+            for kind in kinds:
+                with self.subTest(variant=variant, kind=kind), self.assertRaises(SkuSelectionError):
+                    _candidate_projection(
+                        _parse_nodes(_candidate_price_drift(variant, kind))
+                    )
+
+    def test_candidate_real_container_chain_rejects_every_parent_attribute_and_child_drift(self) -> None:
+        roles = (
+            "header",
+            "content_frame",
+            "relative",
+            "content",
+            "price_frame",
+            "row",
+            "current",
+            "summary",
+        )
+        for role in roles:
+            for kind in ("parent", "attrs", "children"):
+                with self.subTest(role=role, kind=kind), self.assertRaises(SkuSelectionError):
+                    _candidate_projection(_parse_nodes(_candidate_chain_drift(role, kind)))
+
+    def test_candidate_price_variants_reject_complete_and_partial_opposing_shapes(self) -> None:
+        for variant, kinds in (
+            ("dual", ("complete", "row", "current")),
+            ("current_only", ("complete", "row", "current", "original")),
+        ):
+            for kind in kinds:
+                with self.subTest(variant=variant, kind=kind), self.assertRaises(SkuSelectionError):
+                    _candidate_projection(
+                        _parse_nodes(_candidate_cross_variant_residue(variant, kind))
+                    )
+
+    def test_current_only_empty_and_color_only_are_accepted_before_reveal(self) -> None:
+        device = _FakeDevice()
+        device.empty_hierarchy = _CURRENT_ONLY_EMPTY
+        device.color_hierarchy = _CURRENT_ONLY_COLOR
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "evidence"
+            result = self._capturer(device).capture(
+                "192.168.0.173:5555",
+                "937122477375",
+                target,
+            )
+
+            self.assertEqual(result.output_directory, target)
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertEqual(
+                (target / "before" / "hierarchy.xml").read_text(encoding="utf-8"),
+                _CURRENT_ONLY_COLOR,
+            )
+
+    def test_cross_price_variant_after_color_click_is_precondition_failure_without_reveal(self) -> None:
+        for empty_hierarchy, color_hierarchy in (
+            (_CURRENT_ONLY_EMPTY, _COLOR_ONLY),
+            (_EMPTY, _CURRENT_ONLY_COLOR),
+        ):
+            with self.subTest():
+                device = _FakeDevice()
+                device.empty_hierarchy = empty_hierarchy
+                device.color_hierarchy = color_hierarchy
+                with TemporaryDirectory() as directory:
+                    target = Path(directory) / "evidence"
+                    with self.assertRaises(SkuSelectionError) as raised:
+                        self._capturer(device).capture(
+                            "192.168.0.173:5555",
+                            "937122477375",
+                            target,
+                        )
+                    self.assertEqual(
+                        safe_reveal_failure_stage(raised.exception),
+                        "reveal_precondition",
+                    )
+                    self.assertEqual(_swipes(device), [])
+                    self.assertFalse(target.exists())
+                    self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
+
     def test_ambiguous_rpc_is_read_only_reconciled_without_retry(self) -> None:
         device = _FakeDevice()
         device.swipe_error = True
@@ -274,6 +686,20 @@ class SkuRevealSpikeTests(unittest.TestCase):
                 )
         self.assertEqual(_swipes(device), [])
 
+    def test_hidden_sizes_after_swipe_are_not_published_or_retried(self) -> None:
+        self._assert_after_rejected_once(_COLOR_ONLY)
+
+    def test_post_reveal_color_selected_drift_is_not_published_or_retried(self) -> None:
+        self._assert_after_rejected_once(_candidate_with_color_unselected())
+
+    def test_submit_hard_reject_zone_risk_is_not_published_or_retried(self) -> None:
+        for kind in ("missing", "duplicate", "moved_up", "extra_altered", "extra_moved_up"):
+            with self.subTest(kind=kind):
+                self._assert_after_rejected_once(_candidate_with_submit_risk(kind))
+
+    def test_ambiguous_rpc_with_unchanged_page_is_not_published_or_retried(self) -> None:
+        self._assert_after_rejected_once(_COLOR_ONLY, ambiguous=True)
+
     def test_invalid_goods_and_existing_target_are_zero_action(self) -> None:
         device = _FakeDevice()
         with TemporaryDirectory() as directory:
@@ -298,7 +724,7 @@ class SkuRevealSpikeTests(unittest.TestCase):
         device.jsonrpc_call = drift  # type: ignore[method-assign]
         with TemporaryDirectory() as directory:
             target = Path(directory) / "evidence"
-            with self.assertRaises(SkuSelectionError):
+            with self.assertRaises(SkuSelectionError) as raised:
                 self._capturer(device).capture(
                     "192.168.0.173:5555",
                     "937122477375",
@@ -306,6 +732,115 @@ class SkuRevealSpikeTests(unittest.TestCase):
                 )
             self.assertFalse(target.exists())
         self.assertEqual(_swipes(device), [])
+        self.assertEqual(safe_reveal_failure_stage(raised.exception), "reveal_precondition")
+
+    def test_after_screenshot_current_only_to_dual_drift_is_not_published(self) -> None:
+        device = _FakeDevice()
+        current_only = _candidate_current_only()
+        device.after_hierarchy = current_only
+        original_call = device.jsonrpc_call
+
+        def drift(method: str, params: object = None, timeout: float = 10) -> str:
+            value = original_call(method, params, timeout)
+            if method == "takeScreenshot" and device.hierarchy == current_only:
+                device.hierarchy = _candidate_unselected()
+            return value
+
+        device.jsonrpc_call = drift  # type: ignore[method-assign]
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "evidence"
+            with self.assertRaises((SkuRevealSpikeError, SkuSelectionError)) as raised:
+                self._capturer(device).capture(
+                    "192.168.0.173:5555",
+                    "937122477375",
+                    target,
+                )
+            self.assertEqual(safe_reveal_failure_stage(raised.exception), "reveal_after")
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
+
+    def test_reveal_failure_stages_bind_attempt_candidate_after_and_publish(self) -> None:
+        device = _FakeDevice()
+
+        def fail_before_seal(adapter: _RevealEvidenceAdapter) -> None:
+            raise SkuRevealSpikeError("private pre-seal detail")
+
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "pre-seal"
+            with (
+                patch.object(_RevealEvidenceAdapter, "reveal_size_options_once", fail_before_seal),
+                self.assertRaises(SkuRevealSpikeError) as pre_seal,
+            ):
+                self._capturer(device).capture("192.168.0.173:5555", "937122477375", target)
+            self.assertEqual(safe_reveal_failure_stage(pre_seal.exception), "reveal_precondition")
+            self.assertEqual(_swipes(device), [])
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
+
+        # attempted 只可能在 adapter 已封存并发送唯一手势后报告。
+        device = _FakeDevice()
+        original_reveal = _RevealEvidenceAdapter.reveal_size_options_once
+
+        def fail_after_attempt(adapter: _RevealEvidenceAdapter) -> None:
+            original_reveal(adapter)
+            raise SkuRevealSpikeError("private attempted detail")
+
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "attempted"
+            with (
+                patch.object(_RevealEvidenceAdapter, "reveal_size_options_once", fail_after_attempt),
+                self.assertRaises(SkuRevealSpikeError) as attempted,
+            ):
+                self._capturer(device).capture("192.168.0.173:5555", "937122477375", target)
+            self.assertEqual(safe_reveal_failure_stage(attempted.exception), "reveal_attempted")
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
+
+        device = _FakeDevice()
+        device.after_hierarchy = _COLOR_ONLY
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "candidate"
+            with self.assertRaises(SkuRevealSpikeError) as candidate:
+                self._capturer(device).capture("192.168.0.173:5555", "937122477375", target)
+            self.assertEqual(safe_reveal_failure_stage(candidate.exception), "reveal_candidate")
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
+
+        device = _FakeDevice()
+        original_capture = reveal_module._capture_frame
+
+        def fail_after_capture(adapter: object, directory: Path, hierarchy: str) -> None:
+            if directory.name == "after":
+                raise OSError("private after path")
+            original_capture(adapter, directory, hierarchy)
+
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "after"
+            with (
+                patch.object(reveal_module, "_capture_frame", fail_after_capture),
+                self.assertRaises(SkuRevealSpikeError) as after,
+            ):
+                self._capturer(device).capture("192.168.0.173:5555", "937122477375", target)
+            self.assertEqual(safe_reveal_failure_stage(after.exception), "reveal_after")
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
+
+        device = _FakeDevice()
+        with TemporaryDirectory() as directory:
+            target = Path(directory) / "publish"
+            with (
+                patch.object(reveal_module.os, "rename", side_effect=OSError("private publish path")),
+                self.assertRaises(SkuRevealSpikeError) as publish,
+            ):
+                self._capturer(device).capture("192.168.0.173:5555", "937122477375", target)
+            self.assertEqual(safe_reveal_failure_stage(publish.exception), "reveal_publish")
+            self.assertEqual(len(_swipes(device)), 1)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(directory).glob(".*.staging-*")), [])
 
     def test_complete_reveal_segment_rejects_narrow_impostor_and_invalid_bounds(self) -> None:
         for hierarchy in (
@@ -325,7 +860,7 @@ class SkuRevealSpikeTests(unittest.TestCase):
                 "not-a-bound",
             ),
         ):
-            with self.subTest(), self.assertRaises(SkuRevealSpikeError):
+            with self.subTest(), self.assertRaises((SkuRevealSpikeError, SkuSelectionError)):
                 _require_safe_reveal_path(_parse_nodes(hierarchy))
 
 
@@ -377,10 +912,93 @@ class SkuRevealSpikeCliTests(unittest.TestCase):
             )
         output = stderr.getvalue()
         self.assertEqual(status, 1)
+        self.assertIn("stage=unknown", output)
         self.assertNotIn("Traceback", output)
         self.assertNotIn("192.168.0.173:5555", output)
         self.assertNotIn("private", output)
 
+    def test_cli_reports_only_formally_annotated_entry_stage(self) -> None:
+        script = _load_reveal_script()
+        secret = "SERIAL=192.168.0.173:5555 <hierarchy>private</hierarchy>"
+
+        def run_with(error: BaseException) -> str:
+            class FailingCapturer:
+                def __init__(self, *args: object, **kwargs: object) -> None:
+                    return None
+
+                def capture(self, *args: object, **kwargs: object) -> object:
+                    raise error
+
+            stderr = io.StringIO()
+            with patch.object(script, "SkuRevealSpikeCapturer", FailingCapturer), redirect_stderr(stderr):
+                status = script.main(
+                    [
+                        "--serial", "192.168.0.173:5555",
+                        "--goods-id", "937122477375",
+                        "--output-dir", "evidence",
+                    ]
+                )
+            self.assertEqual(status, 1)
+            output = stderr.getvalue()
+            self.assertNotIn("Traceback", output)
+            self.assertNotIn("192.168.0.173:5555", output)
+            self.assertNotIn("private", output)
+            return output
+
+        annotated = SkuSelectionError(secret)
+        _annotate_sku_entry_failure(annotated, "sku_entry_panel_verify")
+        _annotate_reveal_failure(annotated, "reveal_precondition")
+        self.assertIn("stage=sku_entry_panel_verify", run_with(annotated))
+
+        spoofed = SkuSelectionError(secret)
+        setattr(spoofed, "_cmbuyer_failure_stage", "sku_entry_panel_verify")
+        self.assertIn("stage=unknown", run_with(spoofed))
+
+    def test_cli_reports_only_formally_annotated_reveal_stage(self) -> None:
+        script = _load_reveal_script()
+        secret = "SERIAL=192.168.0.173:5555 <hierarchy>private</hierarchy>"
+
+        def run_with(error: BaseException) -> str:
+            class FailingCapturer:
+                def __init__(self, *args: object, **kwargs: object) -> None:
+                    return None
+
+                def capture(self, *args: object, **kwargs: object) -> object:
+                    raise error
+
+            stderr = io.StringIO()
+            with patch.object(script, "SkuRevealSpikeCapturer", FailingCapturer), redirect_stderr(stderr):
+                self.assertEqual(
+                    script.main(
+                        [
+                            "--serial", "192.168.0.173:5555",
+                            "--goods-id", "937122477375",
+                            "--output-dir", "evidence",
+                        ]
+                    ),
+                    1,
+                )
+            output = stderr.getvalue()
+            self.assertNotIn("192.168.0.173:5555", output)
+            self.assertNotIn("private", output)
+            return output
+
+        annotated = SkuRevealSpikeError(secret)
+        _annotate_reveal_failure(annotated, "reveal_candidate")
+        self.assertIn("stage=reveal_candidate", run_with(annotated))
+
+        spoofed = SkuRevealSpikeError(secret)
+        setattr(spoofed, "_cmbuyer_reveal_failure_stage", "reveal_candidate")
+        self.assertIn("stage=unknown", run_with(spoofed))
+
+        class HostileGetterError(SkuRevealSpikeError):
+            def __getattribute__(self, name: str) -> object:
+                if name.startswith("_cmbuyer_reveal_"):
+                    raise RuntimeError(secret)
+                return super().__getattribute__(name)
+
+        self.assertIn("stage=unknown", run_with(HostileGetterError(secret)))
+
 
 def _load_reveal_script() -> object:
     path = Path(__file__).resolve().parents[2] / "scripts" / "capture_sku_reveal_spike.py"

docs/02-requirements.md

@@ -104,8 +104,10 @@ US-004 的试选后人工确认已从 MVP 删除。US-006 在 MVP 为：系统
   等于任务值。缺失、重复、禁用、前缀碰撞、读回不一致都停止，不选相近项。
 - **F-006 三道价格闸门**：价格只从规格面板和订单确认页读取，金额使用十进制字符串。
   1. 选中目标规格后读取当前 SKU 单价，计算 `单价 × 数量`，不得超过授权最高总价。
-  2. 设置并复核数量后再次读取同一规格与单价；规格必须仍相同，单价必须与闸门一完全相等。
-  3. 订单确认页核对规格、数量与应付总额；总额不得超过授权最高总价。
+  2. 设置并复核数量后再次核对同一规格，并唯一读取规格面板的目标数量总额；总额不得超过授权
+     最高总价。多件优惠可能非线性，不用闸门一金额乘数量猜总额，也不要求目标数量总额等于闸门一。
+  3. 订单确认页核对规格、数量与应付总额；应付总额必须与闸门二面板总额严格相等，且再次不超过
+     授权最高总价。
   任一道读不到、有歧义或不通过都停止并转人工，不从详情页、搜索页或按钮文字凑价格。
 - 同一设备会话连续完成上述步骤；不退出商品再等采购服务确认，也不把旧截图或旧页面读数当作
   当前提交依据。
@@ -127,13 +129,13 @@ US-004 的试选后人工确认已从 MVP 删除。US-006 在 MVP 为：系统
 
 ### 结果、证据与异常
 
-- **F-007**：按步骤回传实际规格、两次规格面板价格、数量读回、确认页总额、判定、时间和截图。
+- **F-007**：按步骤回传实际规格、闸门一单价、数量读回、闸门二面板总额、确认页总额、判定、时间和截图。
   截图是内部审计证据，不是提交前审批前置。
 - 内部系统允许上传规格面板与订单确认页的原始截图，截图中可保留页面已显示的地址和手机号；只允许
   已认证设备显式上传、已登录管理员查看。完整 XML 只留采购工具本机，不上传；地址/手机号不解析为
   业务字段或日志；外部支付页、支付凭据永不上传。
 - **F-011**：至少区分设备未连接、版本失配、商品打不开、面板打不开、规格不匹配、价格不可读、
-  两次价格不一致、数量复核失败、金额超上限、确认页不一致、提交控件不唯一、围栏失败、页面识别
+  规格漂移、数量复核失败、闸门二总额不可读或超上限、确认页与闸门二不一致、提交控件不唯一、围栏失败、页面识别
   失败、安全校验、外部支付交接和超时。
 - 运行时拼多多 App 版本与已取证版本不一致时停止领取真机任务，提示重新取证。
 - 订单明确创建后展示截图、商品、规格、数量和授权金额；人在拼多多付款后手工标记完成。

docs/04-architecture.md

@@ -81,9 +81,9 @@ MVP 只做任务自带商品链接的 A 路径。创建任务与开始采购分
       │  3. 按维度精确选择并读回颜色、尺码
       │  4. 【闸门一】读 SKU 单价；单价×数量不得超过最高总价
       │  5. 设置数量并精确读回
-      │  6. 【闸门二】重读规格与单价；规格不变且价格等于闸门一
+      │  6. 【闸门二】重读规格、数量与面板总额；总额不超最高总价
       │  7. 进入订单确认页
-      │  8. 【闸门三】规格/数量一致，应付总额不超最高总价
+      │  8. 【闸门三】规格/数量一致，应付总额等于闸门二且不超最高总价
       │  9. 上传验证摘要并申请服务端提交围栏
       │ 10. 仅在 click_permitted=true 且提交控件唯一时点击一次
       │ 11. 回传观察结果；不确定时只调和，不重试
@@ -135,14 +135,20 @@ T-103 最新真机证据表明：拼多多 `8.17.0`、goods_id `937122477375`、
 | 闸门 | 当前页面 | 判据 | 拒绝条件 |
 | --- | --- | --- | --- |
 | 一 | 规格面板，选中目标规格后 | 单价唯一可读；`单价 × 授权数量 <= 最高总价` | 不可读、有歧义或超上限 |
-| 二 | 规格面板，数量读回后 | 颜色、尺码仍正确；重读单价与闸门一完全相等 | 规格漂移或价格变化 |
-| 三 | 订单确认页 | 规格、数量正确；应付总额唯一可读且不超最高总价 | 任一不一致、不可读或超上限 |
+| 二 | 规格面板，数量读回后 | 颜色、尺码仍正确；目标数量面板总额唯一可读且不超最高总价 | 规格/数量漂移、总额不可读/有歧义或超上限 |
+| 三 | 订单确认页 | 规格、数量正确；应付总额唯一可读、严格等于闸门二且不超最高总价 | 任一不一致、不可读、有歧义或超上限 |
 
 金额一律使用十进制字符串和十进制定点运算，不用浮点数。价格只从规格面板和订单确认页读取；
 详情正文、搜索卡片、底部购买/提交按钮的数字不作为价格来源。
 
-闸门一与闸门二发生在同一设备会话中。它们用于发现选择或设置数量造成的页面变化，不需要管理员
-在中间确认。旧截图、缓存值和发布前 dry-run 都不能替代这次实时读取。
+2026-08-06 的拼多多 `8.17.0` 真机证据证明同一规格的多件优惠是非线性的：数量 1 时规格面板顶部
+当前金额为 `12.88`，数量 2 时变为 `32.76`，而不是 `12.88 × 2`。因此闸门一仍是设置数量前的单价
+预检，闸门二必须读取设置后的**面板总额** `gate2_panel_total_price` 并直接比较最高总价；不得把
+Gate1 乘数量、不得要求 Gate2 等于 Gate1，也不得把底部“提交订单 ¥...”金额作为价格候选或兜底。
+Gate3 再要求确认页应付总额与 Gate2 面板总额严格相等，这比只检查上限多一道跨页防漂移约束。
+
+闸门一与闸门二发生在同一设备会话中，不需要管理员在中间确认。旧截图、缓存值和发布前 dry-run
+都不能替代这次实时读取。
 
 ### B 路径（V2）
 
@@ -176,8 +182,8 @@ T-103 最新真机证据表明：拼多多 `8.17.0`、goods_id `937122477375`、
 
 1. **一次性授权有效且服务端提交围栏已建立**：围栏把授权、任务、领取和本次验证摘要原子绑定到
    唯一 `order_submission`；明确响应包含 `click_permitted=true`。
-2. **闸门二通过**：目标规格未漂移，第二次规格面板单价等于第一次。
-3. **闸门三通过**：确认页规格、数量正确，应付总额不超过授权最高总价。
+2. **闸门二通过**：目标规格和数量未漂移，目标数量面板总额唯一可读且不超过授权最高总价。
+3. **闸门三通过**：确认页规格、数量正确，应付总额严格等于闸门二面板总额，且不超过授权最高总价。
 4. **提交控件唯一**：文本精确等于“提交订单”，可点击祖先唯一。
 
 围栏请求超时、断网、冲突或响应不明时不得点击。围栏建立后：
@@ -246,7 +252,7 @@ CREATE TABLE purchase_attempts (
   claim_generation   INTEGER NOT NULL,
   status             TEXT NOT NULL,
   gate1_unit_price   TEXT,
-  gate2_unit_price   TEXT,
+  gate2_panel_total_price TEXT,
   quantity_read      INTEGER,
   confirm_amount     TEXT,
   failure_code       TEXT,
@@ -296,7 +302,7 @@ CREATE TABLE order_submissions (
   attempt_id         TEXT NOT NULL REFERENCES purchase_attempts(id),
   status             TEXT NOT NULL,              -- FENCED | SUBMITTED | RECONCILIATION_REQUIRED | MANUAL_RESOLVED
   gate1_unit_price   TEXT NOT NULL,
-  gate2_unit_price   TEXT NOT NULL,
+  gate2_panel_total_price TEXT NOT NULL,
   quantity_read      INTEGER NOT NULL,
   confirm_amount     TEXT NOT NULL,
   created_at         TEXT NOT NULL,
@@ -458,7 +464,7 @@ DRAFT / PENDING / NEEDS_MANUAL ─管理员取消（围栏前）→ CANCELED
 | 页面结构随版本变化 | 旧选择器误点新页面 | 每条判据先真机取证，记录 App 版本、截图、XML、goods_id |
 | 购买语义入口才打开面板 | 能力范围易扩散 | 只批准证据绑定的精确唯一入口；每种文案单独取证 |
 | 当前价与原价/按钮价混杂 | 读错价格 | 限定已取证结构和语义；价格只在面板/确认页读，歧义即停 |
-| 单趟页面状态变化 | 数量或促销导致价格变化 | 同一趟两次读规格面板价，再以确认页总额兜底 |
+| 单趟页面状态变化 | 数量或促销导致金额非线性变化 | 同一趟读 Gate1 单价与 Gate2 面板总额，再要求确认页总额与 Gate2 严格相等 |
 | WiFi ADB / 双通道 | 断连或操作错设备 | serial 必填；USB/WiFi 同设备或身份不明时 fail closed |
 | 不可逆动作超时 | 可能已创建订单 | 服务端围栏 + 点击一次 + 只调和，不重试 |
 | 双端契约漂移 | 静默不兼容 | [api.md](api.md) 唯一权威；契约改动跑完整双端门禁 |

docs/05-coding-rules.md

@@ -45,8 +45,9 @@
 - 价格**只在规格面板（闸门一 / 二）和订单确认页（闸门三）读**。
 - **不从商品详情页正文、搜索结果卡片或任何其他位置读价格。**
 - 读不到就转人工，**不用别处的数字凑合**。
-- 同一趟设置并复核数量后，闸门二重读的规格必须不变、单价必须与闸门一完全一致；授权锁定的是
-  最高总价而不是旧观察价。价格变化即停。
+- 同一趟设置并复核数量后，闸门二重读的规格必须不变，并唯一读取目标数量的规格面板总额，直接
+  验证不超授权最高总价；后续闸门三应付总额必须与该面板总额严格相等并再次不超上限。2026-08-06
+  真机已证明多件优惠非线性，不得用闸门一金额乘数量猜 Gate2 总额，也不得要求 Gate2 等于 Gate1。
 - 图片搜索（V2）的唯一产出是 `goods_id`，同样不读价。
 
 ### 1.4 安全与隐私

docs/06-tasks.md

@@ -60,7 +60,7 @@ Phase 是里程碑分组，不是整段串行栅栏。推荐波次：
 | T-102 | 验证按链接打开商品详情页 | T-101 | canonical goods 链接进入对应商品；前台包与 goods_id 有证据 |
 | T-103 | 验证受控规格面板、精确选择与 SKU 单价 | T-102, T-110, T-111 | 精确唯一入口、维度内等值选择/读回、防前缀碰撞、当前价唯一读取；隔离 capability 不含数量/确认/提交 |
 | T-104 | 验证规格选择能力安全退出 | T-103 | 完成选择/读价/截图后可关闭面板或退出；不进入确认页、不提交 |
-| T-105 | 验证数量设置、读回与闸门二 | T-104 | 先只读取证并由人确认，再设置数量、精确读回并复核规格/单价；不一致即停 |
+| T-105 | 验证数量设置、读回与闸门二 | T-104 | 先只读取证并由人确认，再设置数量、精确读回并复核规格/目标数量面板总额；规格或数量不一致、总额不可读/超上限即停 |
 | T-106 | dry-run：确认页与闸门三取证 | T-105 | 只读采集导航前、确认页、最终控件及一次人工 Back 状态；agent 不执行页面动作 |
 | T-107 | 固化确认页与提交控件安全判据 | T-106 | 只点已取证导航控件一次；最终控件只读观察；一次 Back；静态不可达提交 |
 | T-110 | 批准证据绑定的受控规格入口 | T-103 no-go 决策 | 仅批准拼多多 8.17.0 已取证的精确唯一“快要抢光”，不泛化 |

docs/07-user-stories.md

@@ -58,7 +58,7 @@
 
 - 启动前同时校验采购服务、ADB 设备和已取证拼多多版本；任一不满足则不启动。
 - 顶部始终显示会话状态；当前任务、图片、滚动日志和倒序采购记录实时更新。
-- 精确规格、两次单价、数量读回、确认页总额或提交控件任一不合格时停止该任务。
+- 精确规格、闸门一单价、数量读回、闸门二面板总额、确认页同额校验或提交控件任一不合格时停止该任务。
 - 围栏明确成功后只点一次“提交订单”；系统绝不点击付款。
 - 连续轮询失败达到阈值自动停止；停止轮询不取消正在执行或已围栏的任务。
 

docs/08-interaction-checklist.md

@@ -57,7 +57,8 @@
 
 ### IX-006 待付款核对与标记完成
 
-- 页面显示商品、目标与实际规格、数量、授权上限、两次单价、确认页总额和三闸门内部证据；MVP
+- 页面显示商品、目标与实际规格、数量、授权上限、闸门一单价、闸门二面板总额、确认页同额校验和
+  三闸门内部证据；MVP
   没有提交后结果截图类型，不把确认页图片冒充订单结果图。
 - 首屏警示：“订单已创建，系统尚未付款。请在拼多多人工核对并付款。”
 - “标记为已付款并完成”只写系统状态，不打开支付页面、不触发手机操作。

docs/api.md

@@ -326,17 +326,21 @@ claim/renew 的格式错误固定为 `400 {"error":"invalid_request"}`，超限
   "selected_color": "黑色CHA(纯棉)",
   "selected_size": "M(建议100-115)",
   "gate1_unit_price": "12.88",
-  "gate2_unit_price": "12.88",
+  "gate2_panel_total_price": "32.76",
   "quantity_read": 2,
-  "confirm_page_amount": "25.76",
+  "confirm_page_amount": "32.76",
   "submit_control_match_count": 1
 }
 ```
 
 服务端在一个事务中校验：任务/版本/claim/attempt 一致；授权有效未消费且字段等于任务快照；
-规格与授权相等；数量相等；两个单价相等；计算金额及确认页金额均不超过 `total_price_cap`；提交控件
-计数为一；此前不存在该授权或 attempt 的 submission。随后创建唯一 `order_submission`，授权转
-`FENCED`，任务保持不可重领。
+规格与授权相等；数量相等；闸门一单价预检通过；闸门二目标数量面板总额不超过 `total_price_cap`；
+确认页金额严格等于闸门二面板总额且再次不超过上限；提交控件计数为一；此前不存在该授权或 attempt
+的 submission。随后创建唯一 `order_submission`，授权转 `FENCED`，任务保持不可重领。
+
+`gate2_panel_total_price` 是目标数量下规格面板顶部证据角色的总额，不是单价。拼多多多件优惠可能
+非线性，禁止用 `gate1_unit_price × quantity_read` 推导它，也禁止继续用旧字段名
+`gate2_unit_price` 承载总额。底部“提交订单 ¥...”文字不属于价格来源。
 
 首次明确成功响应：
 
@@ -443,6 +447,7 @@ events/fail/fence/result 或完整 `ResultSink`。T-304/T-306 必须通过 `Dura
 | `select_sku_options()` | 维度 → 精确值 | 选中态摘要 | 维度内唯一匹配并读回 |
 | `read_sku_unit_price()` | 已确认规格面板 | 十进制单价 | 排除原价、按钮价和歧义候选 |
 | `set_quantity_and_readback()` | 授权数量 | 实际数量 | 精确读回，否则停 |
+| `read_sku_panel_total_price()` | 已读回目标数量 | 十进制面板总额 | 只读证据绑定的顶部当前金额；排除底部提交按钮金额和歧义候选 |
 | `go_to_order_confirm()` | 已通过闸门二 | 确认页摘要 | 后续真机任务取证后才实现 |
 | `submit_order_once()` | 不可伪造的首次 `SubmissionPermit` | 观察结果 | 许可、闸门、唯一控件全校验；点前持久化；绝不重试 |
 

docs/current-state.md

@@ -11,8 +11,8 @@
 
 ## 当前快照
 
-- 日期：2026-08-05
-- 阶段：**Phase 1 · T-103 规格选择/读价与 Phase 2 安全服务端任务并行**
+- 日期：2026-08-06
+- 阶段：**Phase 1 · T-106 确认页只读取证与 Phase 2 安全服务端任务并行**
 - MVP 形态：手工填链接建单 → 批量“开始采购”并签发一次性授权 → 定时领取 → 同一趟精确
   选规格 / 三道价格闸门 / 提交围栏 / 点击一次 → 待付款。管理员点击“开始采购”即授权桌面端
   创建待付款订单；不再有试选后确认，系统绝不自动付款。
@@ -22,15 +22,15 @@
 - 生产代码：`admin/` 已有登录/会话、手工 DRAFT 建单、批量开始采购与一次性授权、任务详情、内部
   原始截图、设备身份，以及已授权任务的原子领取/幂等重放/租约续期；
   `client/` 已有 Python 包、PySide6 最小入口、运行目录与日志脱敏策略，以及显式 serial 的 ADB
-  连接边界、本地基线取证 CLI、受限商品链接打开取证 CLI、人工声明规格面板状态的只读取证 CLI，
+  连接边界、本地基线取证 CLI、受限商品链接打开取证 CLI、人工声明规格面板与数量两态的只读取证 CLI，
   绑定 PKG110 / Android 16 / 拼多多 8.17.0 的证据工具，以及受控规格入口、精确规格选择、SKU 当前价
   读取、原始截图和一次安全退出能力；并已具备严格 localhost claim/renew/evidence HTTP、Windows DPAPI
   凭据保护、SQLite append-only 恢复状态图、Global named mutex 与 durable gateway。原生桌面主界面、
   显式本地配置、停止/重启会话边界和安全轮询协调器已实现；未注入单趟执行 consumer 时保持零领取。
-  独立的一次性尺码 reveal 取证脚本已就绪，但尚未成为生产 Flow；真机能力与桌面界面仍待最终人工
-  验收，数量/确认页/提交仍未开放。
+  已取证的固定尺码 reveal、精确 M 选择、规格面板单价 `12.88` 与一次 Back 已进入生产 Flow 并完成
+  真机人工验收；T-104 已把同商品详情页安全退出收紧为版本绑定、连续两帧稳定判据，数量/确认页/提交仍未开放。
 - 测试：采购服务已覆盖登录、建单、授权、详情/证据、设备身份、迁移、原子 claim/renew 与竞态；
-  采购工具 255 项离线单元测试（全部 mock，不连接真机）。
+  采购工具 346 项离线单元测试（全部 mock，不连接真机）。
 - 数据：受保护迁移已落到 `00005_task_claims.sql`。旧两趟模型已移除；开始采购会锁定任务快照并签发
   一次性授权，领取会创建唯一 attempt/claim、HMAC claim token 与有界租约。T-211 已统一 title、SKU、
   goods_id 与金额的双端 wire 上限，并证明最坏合法 claim 响应小于 32 KiB。仓库不含业务实例数据。
@@ -41,7 +41,7 @@
   editable install / 包导入 / unittest / compileall，以及仓库上下文校验。可单独运行两端命令诊断。
 - 当前设备门禁：人工已确认拼多多 8.17.0、goods_id `937122477375` 的衣服商品只能通过“快要抢光”
   打开规格面板；T-110 已获项目所有者批准，只把该证据/版本绑定的精确唯一入口作为受控导航。
-  T-103 的隔离 capability 仍不得包含数量、确认页、提交订单、付款或通用点击；这些动作由后续任务
+  T-103 的隔离 capability 不包含数量、确认页、提交订单、付款或通用点击；这些动作由后续任务
   分别取证后才接入生产单趟流程。T-103 旧 v5 派生 XML 中的“打开即目标预选”已被 2026-08-05
   五组最新 live 证据纠正：真实初态为颜色与尺码均未选，目标颜色选中后尺码仍未选且不在视口；
   S 非目标值与恢复目标 M 的前后态已由人确认。底部“提交订单 ¥12.88”继续属于硬拒绝区。项目已停止
@@ -49,11 +49,11 @@
   最新失败证据已纠正入口绑定：此前实现误点商品内容区同名促销小字；真实入口是底部购买区第一行
   `快要抢光 + 金额` 的精确文本叶节点中心。第二行“免拼购买”只能作为不可点击的证据绑定兄弟节点
   校验结构，绝不作为选择器或目标；按钮金额不作为价格来源。提交 `2f1380d` 已把入口改为只点击
-  第一行中心 `(865,2218)`，旧内容区小字为零点击反例并保留一次点击无重试。T-103 还缺一组窄动作
-  证据：颜色已选且尺码未选/隐藏时执行一次受控 reveal，动作后 M 仍未选但已可见。提交 `e8ca738`
-  已增加与生产 Flow 隔离的固定一次 reveal 证据脚本：只在完整前置与安全通道两次重证后发送一次，
-  RPC 结果不明只读调和且不重试，成功不 Back 并等待人工核对；在该证据获人确认前仍不把 reveal
-  接入生产 Flow。之后才进行入口、颜色、reveal、目标 M、读取 `12.88` 和一次 Back 的最终人工真机验收。
+  第一行中心 `(865,2218)`，旧内容区小字为零点击反例并保留一次点击无重试。T-103 已完成固定一次
+  reveal 的原子证据、人审和生产化：同一 Flow 只允许 current-only 初态依次执行目标颜色、reveal、
+  exact M，随后复用既有 dual 目标态读取 `12.88`；入口、颜色、reveal、M、Back 各一次的生产真机
+  manifest 与 Back 前后截图已由项目所有者完成三项人工确认。T-104 又用独立 post-exit 真机证据，
+  把“Back 后仍为同一商品”收紧为完整标题正锚、底部入口、连续两帧与版本绑定的自动判据。
   完整事件链必须等待 T-107 与 T-210：先让 Gate2/Gate3 证据进入真实 schema，再实现 T-205 事件，
   不用 mock 或无证据成功事件抢跑。
 
@@ -62,11 +62,11 @@
 | 路径 | 状态 | 说明 |
 | --- | --- | --- |
 | `docs/` | 已有 | 项目规范化文档，本次已完整生成 |
-| `docs/tasks/` | 已有（含 T-001～T-111、T-201～T-211、T-301～T-308、T-400～T-405） | T-303、T-211 已完成；T-304 代码完成后保持 DOING 等人工 UI 复核；T-103 等最终真机验收；双端围栏、真实提交、调和、打包与只读验收均已落成任务 |
+| `docs/tasks/` | 已有（含 T-001～T-111、T-201～T-211、T-301～T-308、T-400～T-405） | T-103～T-105、T-303、T-211 已完成；T-304 代码完成后保持 DOING 等人工 UI 复核；T-106 已领取并完成只读取证代码，等待四态真机人工验收；双端围栏、真实提交、调和、打包与只读验收均已落成任务 |
 | `docs/design/` | 已有（6 个原型） | web 登录 / 建单 / 工作台 / 详情，desk 采购执行 / 配置；均已人工确认 |
 | `scripts/` | 已有 | 上下文门禁、Vikunja 单向导出与 MCP 启动包装 |
 | `admin/` | 已初始化 | Go 1.23+ / gin / SQLite，含建单/授权/详情/证据/设备身份与原子 claim/renew；不执行真机动作 |
-| `client/` | 已初始化 | Python 3.11+、PySide6/uiautomator2、固定双 Tab 主界面、安全轮询、严格 HTTP/DPAPI/SQLite 恢复底座及受控规格选择/读价/安全退出；数量、确认页和提交未开放 |
+| `client/` | 已初始化 | Python 3.11+、PySide6/uiautomator2、固定双 Tab 主界面、安全轮询、严格 HTTP/DPAPI/SQLite 恢复底座及受控规格选择/读价/数量 Gate2/安全退出；T-106 确认页四态仅开放纯只读取证，确认页生产导航和提交仍未开放 |
 | `init.ps1` / `init.sh` | 已完成 | 统一安装与离线验证入口；PowerShell 优先复用合规 venv，缺失时自动选择最高的 Python 3.11+，Unix 缺工具链明确失败 |
 
 ## 任务状态
@@ -84,12 +84,18 @@
   `DRAFT`，未实现授权、设备领取或采购执行。
 - 已完成 T-110、T-111、T-203、T-204、T-301 与 T-302。服务端已能授权、认证设备、原子领取、
   稳定重放和续租；claim token 不是提交许可，尚无事件、提交围栏或结果 API。
-- T-103 四态 classifier、精确颜色/S→M 选择、滚动态读价与独立一次性 reveal 取证脚本已实现并通过
-  独立审计，仍为 `DOING` 等人工真机验收；T-104～T-107 按数量/确认页风险逐段开放。真机运行要求
+- T-103 已完成受控入口、精确颜色、固定 reveal、exact M、规格面板 `12.88` 读价、一次 Back 和最终
+  人工真机验收；T-104 已完成同商品安全退出，T-105 已完成数量/Gate2，T-106～T-107 继续按确认页风险逐段开放。真机运行要求
   同一物理手机只保留一个 ADB 通道；CLI 已增加不回显页面
   正文的固定白名单失败阶段码；`sku_entry` 动态页面误判已按最新真机证据修复，覆盖点击中心的浮窗
   会保持零点击，入口失败也已细分为前置、发现、点击和面板后置验证四个固定子阶段。服务端后续顺序已收紧为
   T-210 → T-205 → T-206 → T-207 → T-208。
+- T-105 已完成。阶段一数量 1/2 两态 screenshot/XML/App/设备摘要已完成四项人工确认。真机证明同一规格
+  数量 1 面板金额为 `12.88`、数量 2 为 `32.76`，多件优惠非线性；Gate2 已改为唯一读取目标数量
+  面板总额并直接比较最高总价，后续 Gate3 必须与其严格相等。阶段二的一次加号、精确读回、Gate2
+  原始截图和 T-104 一次安全退出已实现并通过 330 项离线测试及完整 `init.ps1`。最终生产运行精确
+  完成一次加号与一次 Back，项目所有者确认数量 2、目标规格、`12.88/32.76`、同商品安全退出，且未进入
+  确认/提交/支付页、未创建订单。底部“提交订单”金额继续排除且禁止点击；T-106 依赖已解除。
 - T-303 已完成并通过三重审查；T-304 的轮询会话、配置页和固定双 Tab 主界面已通过两轮独立代码审计，
   当前 255 项客户端测试与根门禁通过，继续保持 `DOING` 等原生 Windows DPI、主题、高对比度、
   Narrator 和纯键盘人工验收。客户端后续按依赖推进 T-306/T-307/T-308，再与 T-305 汇合到
@@ -187,6 +193,60 @@ T-103 已确认当前衣服商品只能从精确文案“快要抢光”进入
 classifier、颜色与 S→M 精确选择、滚动态价格判据和独立一次性 reveal 证据脚本已经落地；生产 Flow
 中的受控 reveal 仍必须等待动作前后 M 均未选的真机证据和人工确认，最终完整链路也必须由人验收。
 
+T-105 阶段一只读取证命令如下。脚本不打开页面，也不点击数量、返回、确认、提交或付款控件；必须由人
+先把目标商品规格面板准备为“黑色CHA(纯棉) + M(建议100-115) + 数量 1”，完成初态取证后再由人只点
+一次数量 `+` 准备数量 2，随后运行目标态取证：
+
+```powershell
+# 仓库根目录；当前只保留已人工确认的 WiFi ADB 通道
+.\client\.venv\Scripts\python.exe client\scripts\capture_quantity_gate2_spike.py --serial 192.168.0.173:5555 --goods-id 937122477375 --state initial --declared-quantity 1 --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-105\quantity-initial-937122477375" --timeout 10 --adb D:\Portable\adb\adb.exe
+.\client\.venv\Scripts\python.exe client\scripts\capture_quantity_gate2_spike.py --serial 192.168.0.173:5555 --goods-id 937122477375 --state target --declared-quantity 2 --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-105\quantity-target-937122477375" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+两次成功目录只保存在本机。人工需核对截图/XML 确实对应数量 1/2、目标颜色和尺码、规格面板顶部金额，
+并确认过程中未进入确认/提交/支付页且未创建订单；确认前 T-105 保持 `DOING`。
+
+2026-08-06 两态已经完成上述人工确认。初态目录为
+`%LOCALAPPDATA%\cmbuyer\artifacts\T-105\quantity-initial-937122477375-20260806-v3`，目标态目录为
+`%LOCALAPPDATA%\cmbuyer\artifacts\T-105\quantity-target-937122477375-20260806`。数量节点精确读回
+`1 → 2`，唯一加号的 `content-desc` 为“增加数量”，目标颜色和 M 均未漂移；顶部当前金额
+`12.88 → 32.76`。旧 `gate2_unit_price` 语义已废止，T-210/T-205 消费前必须把 API/存储迁移为
+`gate2_panel_total_price`，迁移未完成不得建立提交围栏。
+
+T-105 阶段二生产验收已在人工确认的同一手机、拼多多 `8.17.0`、目标颜色/尺码和数量 1 面板完成。
+脚本自己只点一次证据绑定的数量加号到 2，读回 `32.76`、保存 Gate2 原图并执行一次安全 Back；不打开
+确认页，不点击底部“提交订单”，不创建订单。输出目录必须不存在：
+
+```powershell
+.\client\.venv\Scripts\python.exe client\scripts\run_t105_quantity_gate2.py --serial 192.168.0.173:5555 --goods-id 937122477375 --color "黑色CHA(纯棉)" --size "M(建议100-115)" --target-quantity 2 --gate1-unit-price 12.88 --gate1-screenshot "$env:LOCALAPPDATA\cmbuyer\artifacts\T-105\quantity-initial-937122477375-20260806-v3\screenshot.png" --gate1-captured-at "2026-08-06T00:53:00.023935+00:00" --max-total-price 40.00 --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-105\quantity-gate2-live-937122477375-20260806" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+成功证据目录为 `%LOCALAPPDATA%\cmbuyer\artifacts\T-105\quantity-gate2-live-937122477375-20260806`；
+项目所有者已确认数量精确为 2、颜色尺码未变、Gate1/Gate2 分别为 `12.88/32.76`、Gate2 截图正确、
+一次 Back 回到同一商品详情，且未进入确认/提交/支付页、未创建订单。该命令只作已验运行记录，不再重跑。
+
+T-106 已提供四态纯只读取证命令。每次运行都会重新核对设备、拼多多 `8.17.0`、前台包和
+1080×2376 屏幕，只调用截图与 `compressed=false` XML；不会打开页面、点击、返回、滑动、输入或识别
+确认页业务字段。四个输出目录必须均不存在，完整 XML 只留本机：
+
+```powershell
+# 1. 人工准备：Gate2 已通过、尚未进入确认页；运行后再由人记录实际进入确认页的精确控件文本/容器/匹配数
+.\client\.venv\Scripts\python.exe client\scripts\capture_order_confirm_spike.py --serial 192.168.0.173:5555 --goods-id 937122477375 --state gate2-navigation-source --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-106\gate2-navigation-source-937122477375" --timeout 10 --adb D:\Portable\adb\adb.exe
+
+# 2. 人工只点击已核对的确认页入口并停在 Gate3 页面；绝不点击最终“提交订单”
+.\client\.venv\Scripts\python.exe client\scripts\capture_order_confirm_spike.py --serial 192.168.0.173:5555 --goods-id 937122477375 --state confirm-gate3 --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-106\confirm-gate3-937122477375" --timeout 10 --adb D:\Portable\adb\adb.exe
+
+# 3. 人工把最终“提交订单”控件准备为可见但不点击；记录精确文案、匹配数和启用态
+.\client\.venv\Scripts\python.exe client\scripts\capture_order_confirm_spike.py --serial 192.168.0.173:5555 --goods-id 937122477375 --state submit-control-visible --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-106\submit-control-visible-937122477375" --timeout 10 --adb D:\Portable\adb\adb.exe
+
+# 4. 人工只返回一次并停手；结果不明时不再返回，直接停止
+.\client\.venv\Scripts\python.exe client\scripts\capture_order_confirm_spike.py --serial 192.168.0.173:5555 --goods-id 937122477375 --state returned-safe-page --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-106\returned-safe-page-937122477375" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+四态都必须由项目所有者本地核对截图/XML：规格、数量、Gate3 应付总额、最终控件精确文案/匹配数/
+启用态、一次返回后的页面身份；同时确认未点击最终提交、未创建订单、未进入支付或安全验证页面。
+满足全部人工验收前 T-106 保持 `DOING`，这些人工观察也不能在 T-106 中直接变成生产 selector。
+
 ## 关键背景
 
 本项目是 `cmroubao`（Go 后端 + Android AccessibilityService）与 `cmpdd`
@@ -201,14 +261,13 @@ classifier、颜色与 S→M 精确选择、滚动态价格判据和独立一次
 
 ## 已知风险（开工前须知）
 
-1. **M2 是生死线**：真机能按链接打开商品、精确勾选颜色分类和尺码、**读到该 SKU 单价**
-   （T-103）。M2 前可以写不依赖页面字段的管理员会话、DRAFT 建单和服务端授权事务；不能写
-   依赖未取证选择器的生产执行代码。真机结论改变字段时先回修契约与原型。
+1. **M2 已通过**：T-103 已在真机按链接打开商品、精确勾选颜色分类和尺码并读到该 SKU 单价；
+   后续页面能力仍必须逐任务先取证。真机结论改变字段时先回修契约与原型。
 2. **拼多多页面结构随版本变化**，已观察到详情页无独立规格入口、价格节点被拆分等情况。
 3. **授权卡死**：前序项目出现过 `EXECUTING` 授权永不推进导致任务锁死。本项目在 T-207
    实现围栏前超时 / 放弃，在 T-208 实现围栏后调和；围栏后不得释放或重试。
-4. **规格面板读价尚未形成生产判据**：已人工观察当前价与原价，但 T-103 仍需把证据固化为
-   唯一、版本绑定且排除按钮价的读取规则；失败就转人工，不删价格闸门。
+4. **确认页能力仍未开放**：T-105 已按本项目真机证据开放数量 1→2、readback 与 Gate2；确认页导航、
+   Gate3 和最终控件仍必须依次等待 T-106/T-107 取证，不能从旧项目或推理直接实现。
 5. **MVP 已收窄**：只做手工填链接、批量开始采购和单趟创建待付款订单。Excel、ERP、图搜、
    批量顺序编排 / 暂停接管、订单自动核对、AI 辅助全部推到 V2（见 `06-tasks.md` 的
    T-501~T-508）。

docs/design/desk-execution.html

@@ -470,6 +470,7 @@
                   <div><dt>颜色分类</dt><dd id="color">—</dd></div>
                   <div><dt>尺码 / 数量</dt><dd id="size-qty">—</dd></div>
                   <div><dt>闸门一单价</dt><dd id="gate1-price">—</dd></div>
+                  <div><dt>闸门二面板总额</dt><dd id="gate2-total">—</dd></div>
                   <div><dt>金额上限</dt><dd id="price-cap">—</dd></div>
                   <div class="span-2"><dt>提交围栏</dt><dd id="submission">未建立</dd></div>
                 </dl>
@@ -583,7 +584,7 @@
       const task = {
         id: 'CB-20260803-0042',
         product: '纯棉圆领短袖 T 恤（原型假数据）',
-        color: '白色', sizeQty: 'XL / 2 件', gate1Price: 'CNY 32.50', cap: 'CNY 80.00'
+        color: '白色', sizeQty: 'XL / 2 件', gate1Price: 'CNY 32.50', gate2Total: 'CNY 65.00', cap: 'CNY 80.00'
       };
       const records = [
         {
@@ -604,15 +605,15 @@
           id:'REC-DEMO-0038', taskId:'CB-20260803-0038', title:'标签打印纸补货（原型假数据）', collectedAt:'2026-08-03T10:06:42+08:00',
           status:'WAITING_PAYMENT', spec:'白色 | 50×30 | 1 件', cap:'CNY 50.00', submission:'SUB-DEMO-0038 · SUBMITTED',
           note:'已明确创建待付款订单，自动化已停止，等待人核对后自行付款。', evidence:['订单确认页内部原始截图（内联假证据）'],
-          timeline:['10:04:22 同一趟精确选择规格','10:05:10 两次价格与数量复核通过','10:05:36 获得唯一围栏许可','10:06:42 明确创建待付款订单'],
+          timeline:['10:04:22 同一趟精确选择规格','10:05:10 Gate1 单价、Gate2 面板总额与 Gate3 确认金额通过','10:05:36 获得唯一围栏许可','10:06:42 明确创建待付款订单'],
           result:'已创建待付款订单：白色 | 50×30 | CNY 46.00 | 1 件', resultNote:'系统只创建待付款订单，付款始终由人完成。'
         },
         {
           id:'REC-DEMO-0032', taskId:'CB-20260803-0032', title:'仓库打包胶带（原型假数据）', collectedAt:'2026-08-03T09:18:05+08:00',
           status:'NEEDS_MANUAL', spec:'透明 | 45mm | 4 件', cap:'CNY 55.00', submission:'未建立',
-          note:'设置数量后规格面板价格与闸门一不一致，已在围栏前转人工。', evidence:[],
-          timeline:['09:16:40 打开商品','09:17:22 匹配透明 / 45mm','09:18:05 价格闸门二不通过，停止自动流程'],
-          result:'未采购：闸门一 CNY 12.00 | 闸门二 CNY 13.50', resultNote:'没有建立围栏、创建订单或付款。'
+          note:'目标数量的规格面板总额超过授权上限，已在围栏前转人工。', evidence:[],
+          timeline:['09:16:40 打开商品','09:17:22 匹配透明 / 45mm','09:18:05 闸门二面板总额超限，停止自动流程'],
+          result:'未采购：闸门一单价 CNY 12.00 | 闸门二面板总额 CNY 58.00 > 上限 CNY 55.00', resultNote:'没有建立围栏、创建订单或付款。'
         }
       ].sort((a, b) => b.collectedAt.localeCompare(a.collectedAt));
       const recordStatus = {
@@ -627,7 +628,7 @@
       let detailRequestId = 0;
       const baseSteps = {
         idle: [],
-        single: ['核对一次性授权并打开商品', '精确选择颜色分类与尺码', '闸门一：读取 SKU 单价并校验上限', '设置数量、读回并执行闸门二', '确认页执行闸门三与控件唯一校验', '申请服务端提交围栏', '首次许可后持久化并内部点击一次', '调和同一提交结果']
+        single: ['核对一次性授权并打开商品', '精确选择颜色分类与尺码', '闸门一：读取 SKU 单价并校验上限', '设置数量、读回并读取闸门二面板总额', '确认页执行闸门三同额与控件唯一校验', '申请服务端提交围栏', '首次许可后持久化并内部点击一次', '调和同一提交结果']
       };
       const scenarios = {
         not_ready: { tone:'critical', title:'web 服务不可达', text:'未开始轮询。检查本地网络和服务地址；已完成的本地证据会保留待补传。', web:'bad', device:'ok', version:'ok', leg:'未就绪', legTone:'critical', action:'开始轮询', enabled:false, reason:'web 服务未就绪，不能领取任务。', session:'未启动', step:'连接检查', kind:'idle', active:-1, countdown:'—', fail:'1 / 3' },
@@ -637,8 +638,8 @@
         claimed: { tone:'info', title:'已领取管理员授权的采购任务', text:'任务字段与最高总价已锁定；当前只准备打开目标商品，尚未建立提交围栏。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 已领取', legTone:'info', action:'真机步骤执行中', enabled:false, reason:'当前任务已开始，停止轮询只应阻止下一次领取，不能硬取消本任务。', session:'运行中', step:'核对授权与商品', kind:'single', active:0, countdown:'暂停', fail:'0 / 3', lease:'04:48' },
         selecting: { tone:'info', title:'正在精确选择颜色与尺码', text:'只在已取证维度容器内精确唯一匹配并读回；缺失、重复或版本变化立即停止。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 选择规格', legTone:'info', action:'真机步骤执行中', enabled:false, reason:'当前受控步骤不能被硬取消。', session:'运行中', step:'精确选择规格', kind:'single', active:1, countdown:'暂停', fail:'0 / 3', lease:'04:18' },
         gate1: { tone:'info', title:'闸门一：读取 SKU 单价', text:'当前规格单价必须唯一可读，单价乘数量不得超过管理员授权的最高总价。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门一', legTone:'info', action:'安全校验进行中', enabled:false, reason:'价格不可读或超上限时立即停止。', session:'运行中', step:'闸门一：读取 SKU 单价', kind:'single', active:2, countdown:'暂停', fail:'0 / 3', lease:'03:58' },
-        quantity_gate2: { tone:'info', title:'数量复核与闸门二', text:'数量必须读回为 2；目标规格不能漂移，第二次单价必须等于闸门一 CNY 32.50。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门二', legTone:'info', action:'安全校验进行中', enabled:false, reason:'数量、规格或价格变化都停止。', session:'运行中', step:'数量读回与闸门二', kind:'single', active:3, countdown:'暂停', fail:'0 / 3', lease:'03:31' },
-        confirm_gate3: { tone:'caution', title:'确认页与闸门三', text:'正在核对规格、数量、应付总额与提交控件唯一；此时没有点击许可。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门三', legTone:'caution', action:'安全校验进行中', enabled:false, reason:'没有服务端围栏许可，绝不能点击提交订单。', session:'运行中', step:'闸门三：核对应付总额', kind:'single', active:4, countdown:'暂停', fail:'0 / 3', lease:'02:58' },
+        quantity_gate2: { tone:'info', title:'数量复核与闸门二', text:'数量必须读回为 2；目标规格不能漂移，面板总额 CNY 65.00 必须唯一可读且不超过 CNY 80.00。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门二', legTone:'info', action:'安全校验进行中', enabled:false, reason:'数量、规格、总额歧义或超限都停止。', session:'运行中', step:'数量读回与闸门二', kind:'single', active:3, countdown:'暂停', fail:'0 / 3', lease:'03:31' },
+        confirm_gate3: { tone:'caution', title:'确认页与闸门三', text:'正在核对规格、数量、应付总额严格等于闸门二面板总额，并确认提交控件唯一；此时没有点击许可。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门三', legTone:'caution', action:'安全校验进行中', enabled:false, reason:'没有服务端围栏许可，绝不能点击提交订单。', session:'运行中', step:'闸门三：核对应付总额', kind:'single', active:4, countdown:'暂停', fail:'0 / 3', lease:'02:58' },
         fencing: { tone:'caution', title:'正在申请服务端提交围栏', text:'等待首次明确的 click_permitted。超时、冲突、网络失败或响应不明都不会点击。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 申请围栏', legTone:'caution', action:'等待围栏响应', enabled:false, reason:'申请中禁止取消、关闭或换 key 重复申请。', session:'运行中', step:'申请唯一提交围栏', kind:'single', active:5, countdown:'暂停', fail:'0 / 3', lease:'02:31' },
         fence_failed: { tone:'critical', title:'未获得首次明确点击许可', text:'围栏失败或响应不明：没有点击提交订单。只核查同一幂等键，不能直接重试。', web:'bad', device:'ok', version:'ok', leg:'单趟 · 未获许可', legTone:'critical', action:'打开围栏核查说明', enabled:true, safeAction:'review', reason:'只核查围栏状态，不触发提交。', session:'已停止', step:'核查幂等键', kind:'single', active:5, countdown:'—', fail:'1 / 3', submission:'围栏状态未知 · 幂等键 DEMO-FENCE-042' },
         fenced: { tone:'caution', title:'围栏已建立，只核对同一提交', text:'submission_id 已固定。内部流程至多点击一次；界面不提供提交、重领、放弃或重试。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 已围栏', legTone:'caution', action:'打开同一提交核查说明', enabled:true, safeAction:'review', reason:'只能查看与调和同一提交记录。', session:'受控执行', step:'调和订单结果', kind:'single', active:7, countdown:'暂停', fail:'0 / 3', lease:'01:49', submission:'SUB-DEMO-0042 · FENCED' },
@@ -646,7 +647,7 @@
         uncertain: { tone:'critical', title:'订单可能已创建，结果不明确', text:'保持金额预留和永久围栏，只核查 SUB-DEMO-0042；禁止重新领取、释放授权或再次点击。', web:'ok', device:'ok', version:'ok', leg:'RECONCILIATION_REQUIRED', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'review', reason:'核查不会发起新的下单。可另行导出假证据摘要。', session:'已停止', step:'人工核查同一提交', kind:'single', active:7, countdown:'—', fail:'0 / 3', submission:'SUB-DEMO-0042 · 结果不明确' },
         security: { tone:'critical', title:'检测到安全校验，已停止', text:'不绕过验证码、风控、人脸或短信。若已围栏，只调和同一提交；围栏前转人工。', web:'ok', device:'ok', version:'ok', leg:'待人工 · 安全校验', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'review', reason:'只显示核查说明，不提供绕过或继续。', session:'已停止', step:'等待人工处理', kind:'single', active:7, countdown:'—', fail:'1 / 3', submission:'SUB-DEMO-0042 · RECONCILIATION_REQUIRED' },
         payment_handoff: { tone:'critical', title:'进入外部支付交接，已停止', text:'订单可能已创建、支付未完成。不会读取或输入支付凭据，也没有“继续付款”按钮。', web:'ok', device:'ok', version:'ok', leg:'待人工 · 外部支付', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'paymentInfo', reason:'只显示人工核查与付款边界。', session:'已停止', step:'人工核查同一提交', kind:'single', active:7, countdown:'—', fail:'0 / 3', submission:'SUB-DEMO-0042 · HANDED_OFF' },
-        manual: { tone:'caution', title:'任务已转人工：闸门二价格变化', text:'闸门一 CNY 32.50，数量设置后重读 CNY 35.00。围栏未建立，没有创建订单；需管理员核查后重置。', web:'ok', device:'ok', version:'ok', leg:'NEEDS_MANUAL', legTone:'caution', action:'导出假诊断摘要', enabled:true, safeAction:'export', reason:'导出只生成本地假文本，不含完整 XML、页面全文或敏感字段。', session:'继续轮询其他任务', step:'当前任务已移交', kind:'single', active:3, countdown:'00:11', fail:'0 / 3', submission:'未建立' },
+        manual: { tone:'caution', title:'任务已转人工：闸门二总额超限', text:'目标数量面板总额 CNY 85.00 超过最高总价 CNY 80.00。围栏未建立，没有创建订单；需管理员核查后重置。', web:'ok', device:'ok', version:'ok', leg:'NEEDS_MANUAL', legTone:'caution', action:'导出假诊断摘要', enabled:true, safeAction:'export', reason:'导出只生成本地假文本，不含完整 XML、页面全文或敏感字段。', session:'继续轮询其他任务', step:'当前任务已移交', kind:'single', active:3, countdown:'00:11', fail:'0 / 3', submission:'未建立' },
         failed_stop: { tone:'critical', title:'连续失败达到阈值，轮询已停止', text:'最近三次均为服务连接失败。检查设置和网络；修复后重新开始普通轮询，不会重试任何提交点击。', web:'bad', device:'ok', version:'ok', leg:'自动停止', legTone:'critical', action:'前往配置', enabled:true, safeAction:'settings', reason:'先修复连接；不会自动恢复轮询。', session:'已停止', step:'等待修复', kind:'idle', active:-1, countdown:'—', fail:'3 / 3', count:4 }
       };
       const sessionControls = {
@@ -834,7 +835,9 @@
         $('task-id').textContent = hasTask ? task.id : '—'; $('lease').textContent = s.lease || '—';
         $('product').textContent = hasTask ? task.product : '暂无商品；轮询会在安全就绪后领取一条任务';
         $('color').textContent = hasTask ? task.color : '—'; $('size-qty').textContent = hasTask ? task.sizeQty : '—';
-        $('gate1-price').textContent = hasTask && ['gate1','quantity_gate2','confirm_gate3','fencing','fence_failed','fenced','waiting_payment','uncertain','security','payment_handoff','manual'].includes($('scenario').value) ? task.gate1Price : '—'; $('price-cap').textContent = hasTask ? task.cap : '—';
+        $('gate1-price').textContent = hasTask && ['gate1','quantity_gate2','confirm_gate3','fencing','fence_failed','fenced','waiting_payment','uncertain','security','payment_handoff','manual'].includes($('scenario').value) ? task.gate1Price : '—';
+        $('gate2-total').textContent = hasTask && ['quantity_gate2','confirm_gate3','fencing','fence_failed','fenced','waiting_payment','uncertain','security','payment_handoff'].includes($('scenario').value) ? task.gate2Total : '—';
+        $('price-cap').textContent = hasTask ? task.cap : '—';
         $('submission').textContent = s.submission || '未建立';
         $('preview-empty').hidden = hasTask; $('product-preview-image').hidden = !hasTask;
         $('preview-source').textContent = hasTask ? '来源：内部原始商品截图（内联假证据）' : '来源：尚无可信图片';

docs/design/web-task-detail.html

@@ -26,22 +26,22 @@
 
         <article class="state-panel" data-panel="draft">
           <header class="panel-head"><h2>待开始</h2><p>任务已保存，但尚未授权采购工具领取或创建订单。</p></header>
-          <div class="panel-body"><div class="notice"><strong>创建不等于授权</strong>请返回任务列表勾选任务，并点击“开始采购（只创建待付款订单）”。</div><dl class="summary"><div><dt>商品</dt><dd>goods_id 937122477375</dd></div><div><dt>颜色 / 尺码</dt><dd>黑色CHA(纯棉) / M(建议100-115)</dd></div><div><dt>数量</dt><dd>2 件</dd></div><div><dt>最高总价</dt><dd>¥30.00</dd></div></dl><div class="actions"><a class="button primary" href="web-task-workbench.html">返回列表选择并开始采购</a></div></div>
+          <div class="panel-body"><div class="notice"><strong>创建不等于授权</strong>请返回任务列表勾选任务，并点击“开始采购（只创建待付款订单）”。</div><dl class="summary"><div><dt>商品</dt><dd>goods_id 937122477375</dd></div><div><dt>颜色 / 尺码</dt><dd>黑色CHA(纯棉) / M(建议100-115)</dd></div><div><dt>数量</dt><dd>2 件</dd></div><div><dt>最高总价</dt><dd>¥40.00</dd></div></dl><div class="actions"><a class="button primary" href="web-task-workbench.html">返回列表选择并开始采购</a></div></div>
         </article>
 
         <article class="state-panel" data-panel="pending" hidden>
           <header class="panel-head"><h2>已授权，等待采购工具领取</h2><p>管理员的开始采购动作已锁定任务字段和最高总价。</p></header>
-          <div class="panel-body"><div class="notice ok"><strong>一次性授权已创建</strong>允许采购工具按本任务创建一笔待付款订单；不授权付款。</div><dl class="summary"><div><dt>授权编号</dt><dd class="mono">AUTH-018-V2</dd></div><div><dt>任务版本</dt><dd>2</dd></div><div><dt>最高总价</dt><dd>¥30.00</dd></div><div><dt>提交围栏</dt><dd>尚未建立</dd></div></dl><p>本状态没有“机器选对了吗”按钮。规格与价格将在设备执行时实时校验。</p></div>
+          <div class="panel-body"><div class="notice ok"><strong>一次性授权已创建</strong>允许采购工具按本任务创建一笔待付款订单；不授权付款。</div><dl class="summary"><div><dt>授权编号</dt><dd class="mono">AUTH-018-V2</dd></div><div><dt>任务版本</dt><dd>2</dd></div><div><dt>最高总价</dt><dd>¥40.00</dd></div><div><dt>提交围栏</dt><dd>尚未建立</dd></div></dl><p>本状态没有“机器选对了吗”按钮。规格与价格将在设备执行时实时校验。</p></div>
         </article>
 
         <article class="state-panel" data-panel="ordering" hidden>
           <header class="panel-head"><h2>单趟采购执行中</h2><p>采购工具正在同一设备会话中完成规格、价格、数量和确认页校验。</p></header>
-          <div class="panel-body"><ol class="timeline"><li><strong>已打开目标商品</strong>App 8.17.0；goods_id 已核对</li><li><strong>已精确选择规格</strong>黑色CHA(纯棉) / M(建议100-115)</li><li><strong>闸门一通过</strong>SKU 单价 ¥12.88；预计总额 ¥25.76</li><li><strong>数量已读回</strong>2 件；正在执行闸门二</li><li><strong>尚未建立提交围栏</strong>不会点击提交订单</li></ol><div class="notice warn"><strong>无需中途人工确认</strong>任一读数变化或有歧义，系统会停止并转人工。</div></div>
+          <div class="panel-body"><ol class="timeline"><li><strong>已打开目标商品</strong>App 8.17.0；goods_id 已核对</li><li><strong>已精确选择规格</strong>黑色CHA(纯棉) / M(建议100-115)</li><li><strong>闸门一通过</strong>SKU 单价 ¥12.88；数量前预检通过</li><li><strong>闸门二通过</strong>数量读回 2 件；面板总额 ¥32.76 ≤ ¥40.00</li><li><strong>尚未建立提交围栏</strong>不会点击提交订单</li></ol><div class="notice warn"><strong>无需中途人工确认</strong>任一读数变化或有歧义，系统会停止并转人工。</div></div>
         </article>
 
         <article class="state-panel" data-panel="fenced" hidden>
           <header class="panel-head"><h2>提交围栏已建立</h2><p>只允许处理这一个 submission，不允许释放或再次提交。</p></header>
-          <div class="panel-body"><div class="notice danger"><strong>禁止重试</strong>唯一提交记录 <span class="mono">SUB-018-5A7C</span> 已占用本授权；关闭页面也不会释放。</div><table class="gates"><thead><tr><th>门禁</th><th>读取值</th><th>结论</th></tr></thead><tbody><tr><td>闸门一</td><td>¥12.88 × 2 = ¥25.76</td><td class="good">通过</td></tr><tr><td>闸门二</td><td>规格不变；¥12.88</td><td class="good">通过</td></tr><tr><td>闸门三</td><td>确认页 ¥25.76 ≤ ¥30.00</td><td class="good">通过</td></tr><tr><td>提交控件</td><td>精确唯一 1 个</td><td class="good">通过</td></tr></tbody></table><div class="actions"><button class="button primary" type="button" data-state="reconcile">查看同一提交的调和页</button></div></div>
+          <div class="panel-body"><div class="notice danger"><strong>禁止重试</strong>唯一提交记录 <span class="mono">SUB-018-5A7C</span> 已占用本授权；关闭页面也不会释放。</div><table class="gates"><thead><tr><th>门禁</th><th>读取值</th><th>结论</th></tr></thead><tbody><tr><td>闸门一</td><td>单价 ¥12.88；数量前预检通过</td><td class="good">通过</td></tr><tr><td>闸门二</td><td>规格 / 数量不变；面板总额 ¥32.76 ≤ ¥40.00</td><td class="good">通过</td></tr><tr><td>闸门三</td><td>确认页 ¥32.76 = 闸门二；≤ ¥40.00</td><td class="good">通过</td></tr><tr><td>提交控件</td><td>精确唯一 1 个</td><td class="good">通过</td></tr></tbody></table><div class="actions"><button class="button primary" type="button" data-state="reconcile">查看同一提交的调和页</button></div></div>
         </article>
 
         <article class="state-panel" data-panel="reconcile" hidden>
@@ -51,12 +51,12 @@
 
         <article class="state-panel" data-panel="payment" hidden>
           <header class="panel-head"><h2>待付款</h2><p>订单已创建，系统尚未付款；请人工核对。</p></header>
-          <div class="panel-body"><figure class="evidence"><svg viewBox="0 0 760 260" role="img" aria-labelledby="ev-title ev-desc"><title id="ev-title">内部订单截图假数据</title><desc id="ev-desc">只表示证据位置，不代表真实拼多多布局。</desc><rect width="760" height="260" fill="#e8eef7"/><rect x="30" y="25" width="700" height="210" rx="10" fill="#fff" stroke="#b8c4d5"/><text x="55" y="65" fill="#526079" font-size="18">INTERNAL_RAW 截图占位 · 假数据</text><text x="55" y="115" fill="#172033" font-size="19">黑色CHA(纯棉) · M(建议100-115) · 2 件</text><text x="55" y="165" fill="#172033" font-size="24">确认页金额 ¥25.76</text><text x="55" y="205" fill="#9a5b00" font-size="18">订单已创建，尚未付款</text></svg><figcaption>原始截图只供已登录管理员查看；完整 XML 和支付凭据不上传。</figcaption></figure><div class="checks"><label><input type="checkbox" data-pay-check>商品与任务一致</label><label><input type="checkbox" data-pay-check>规格和数量一致</label><label><input type="checkbox" data-pay-check>金额不超过授权上限 ¥30.00</label><label><input type="checkbox" data-pay-check>我已在拼多多人工完成付款</label></div><div class="actions"><button class="button primary" id="mark-paid" type="button" disabled>标记为已付款并完成</button></div></div>
+          <div class="panel-body"><figure class="evidence"><svg viewBox="0 0 760 260" role="img" aria-labelledby="ev-title ev-desc"><title id="ev-title">内部订单截图假数据</title><desc id="ev-desc">只表示证据位置，不代表真实拼多多布局。</desc><rect width="760" height="260" fill="#e8eef7"/><rect x="30" y="25" width="700" height="210" rx="10" fill="#fff" stroke="#b8c4d5"/><text x="55" y="65" fill="#526079" font-size="18">INTERNAL_RAW 截图占位 · 假数据</text><text x="55" y="115" fill="#172033" font-size="19">黑色CHA(纯棉) · M(建议100-115) · 2 件</text><text x="55" y="165" fill="#172033" font-size="24">确认页金额 ¥32.76</text><text x="55" y="205" fill="#9a5b00" font-size="18">订单已创建，尚未付款</text></svg><figcaption>原始截图只供已登录管理员查看；完整 XML 和支付凭据不上传。</figcaption></figure><div class="checks"><label><input type="checkbox" data-pay-check>商品与任务一致</label><label><input type="checkbox" data-pay-check>规格和数量一致</label><label><input type="checkbox" data-pay-check>金额不超过授权上限 ¥40.00</label><label><input type="checkbox" data-pay-check>我已在拼多多人工完成付款</label></div><div class="actions"><button class="button primary" id="mark-paid" type="button" disabled>标记为已付款并完成</button></div></div>
         </article>
 
         <article class="state-panel" data-panel="manual" hidden>
           <header class="panel-head"><h2>围栏前需要人工处理</h2><p>系统已经停止，未申请围栏、未点击提交订单。</p></header>
-          <div class="panel-body"><div class="notice danger"><strong>闸门二未通过</strong>闸门一 ¥12.88，数量设置后重读 ¥13.20；不使用新价格继续。</div><dl class="summary"><div><dt>失败阶段</dt><dd>规格面板 · 闸门二</dd></div><div><dt>原因码</dt><dd class="mono">SKU_PRICE_CHANGED</dd></div><div><dt>安全处置</dt><dd>停止并保留证据</dd></div><div><dt>可用动作</dt><dd>人工核查后重置为待开始或取消</dd></div></dl><div class="actions"><button class="button danger" id="reset-button" type="button">关闭旧授权并重置为待开始</button></div></div>
+          <div class="panel-body"><div class="notice danger"><strong>闸门二未通过</strong>目标数量面板总额 ¥42.00 超过最高总价 ¥40.00；围栏未建立。</div><dl class="summary"><div><dt>失败阶段</dt><dd>规格面板 · 闸门二</dd></div><div><dt>原因码</dt><dd class="mono">GATE2_TOTAL_OVER_CAP</dd></div><div><dt>安全处置</dt><dd>停止并保留证据</dd></div><div><dt>可用动作</dt><dd>人工核查后重置为待开始或取消</dd></div></dl><div class="actions"><button class="button danger" id="reset-button" type="button">关闭旧授权并重置为待开始</button></div></div>
         </article>
 
         <article class="state-panel" data-panel="succeeded" hidden><header class="panel-head"><h2>任务已完成</h2><p>人工付款并核对后才进入终态。</p></header><div class="panel-body"><div class="notice ok"><strong>人工付款事实已记录</strong>系统没有执行付款，也没有读取支付凭据。</div><div class="actions"><a class="button primary" href="web-task-workbench.html">返回任务列表</a></div></div></article>
@@ -66,7 +66,7 @@
 
       <aside class="panel side" aria-label="原型状态与任务摘要">
         <section><h2>原型状态</h2><p>只切换假数据，不发送请求。</p><label class="field-label" for="state-select">业务状态</label><select id="state-select"><option value="draft">DRAFT</option><option value="pending">PENDING</option><option value="ordering">ORDERING</option><option value="fenced">FENCED</option><option value="reconcile">RECONCILIATION_REQUIRED</option><option value="payment">WAITING_PAYMENT</option><option value="manual">NEEDS_MANUAL</option><option value="succeeded">SUCCEEDED</option><option value="failed">FAILED</option><option value="canceled">CANCELED</option></select></section>
-        <section><h2>任务要求</h2><p>黑色CHA(纯棉)<br>M(建议100-115)<br>2 件<br>最高总价 ¥30.00</p></section>
+        <section><h2>任务要求</h2><p>黑色CHA(纯棉)<br>M(建议100-115)<br>2 件<br>最高总价 ¥40.00</p></section>
         <section><h2>固定边界</h2><p>单趟实时三闸门；服务端围栏；提交一次；系统不付款。</p></section>
       </aside>
     </div>

docs/routes.md

@@ -75,7 +75,7 @@
 1. 任务要求：商品链接 / goods_id、颜色、尺码、数量、最高总价、版本。
 2. 开始采购授权：授权 id、授权人、锁定任务版本、创建/有效期、当前状态。
 3. 设备执行：attempt、设备、App 版本、步骤时间线和失败 code。
-4. 三道闸门：两次规格面板单价、规格/数量读回、确认页总额与判定。
+4. 三道闸门：闸门一规格面板单价、规格/数量读回、闸门二面板总额、确认页同额校验与判定。
 5. 内部截图：三道闸门已批准的规格面板/确认页证据；只经受保护端点读取。MVP 不存在提交后结果
    截图类型，不展示外部支付页，也不把 Gate3 图片冒充结果图。
 6. 提交围栏：submission id、是否首次明确许可、唯一点击和调和记录。

docs/tasks/T-103.md

@@ -3,7 +3,7 @@ id: T-103
 title: 验证规格面板精确选择与 SKU 单价
 phase: 1
 deps: [T-102, T-110, T-111]
-status: DOING
+status: DONE
 created: 2026-08-04
 vikunja_task_id: 23
 context_ref: 1dc8308
@@ -25,7 +25,7 @@ write_paths:
   - docs/current-state.md
 ---
 
-<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-05T04:46:50Z sha256=f225a9770923a004a3bae956e052e0cecdccee2e475b220c0487f534589bfb39 -->
+<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-05T09:03:05Z sha256=2a81aa73a233e09b2b9418aba9a6f298428bba12371110205a0f782fb90787ca -->
 ## 问题 / 背景
 
 T-102 已证明 canonical 链接可进入目标商品。T-103 在 PKG110 / Android 16 / 拼多多 8.17.0、goods_id `937122477375` 上确认：详情页底部购买区第一行“快要抢光 + 金额”是唯一获准的受控规格入口；商品内容区同名小字和第二行“免拼购买”都不得点击。
@@ -278,6 +278,108 @@ T-103 sanitizer v2 坐标修正与主审：提交 44c027a 将 screenshot space
 ### 2026-08-05T04:45:40Z · ila
 
 2026-08-05 T-011 方案 B 由 T-103 所有者就地完成 pdd/device 测试提速：仅修改测试。`test_sku_selection` 保持 47 项，无删除/合并/skip，使用生产既有时钟注入缝和 runner 测试工厂，把 4.029s 降至 1.725s（≤2s）；`test_sku_evidence_sanitizer` 保持 25 项，确认根因不是时钟而是重复编码 1080×2376 合成 PNG，改为按尺寸缓存同一确定性 PNG bytes，把 5.383s 降至 4.360s。两模块合计 72/72 PASS；与 T-304 所有者的 polling 改动合并后 client 全量仍为 255/255，12.892s（≤15s），compileall/diff-check/agent-context 均通过。未修改生产代码或任何规格/价格/提交安全断言。T-103 仍因真机 reveal 与最终完整链路人工验收保持 Doing。
+
+### 2026-08-05T04:56:30Z · ila
+
+2026-08-05 T-103 reveal 放行前独立审计返修：实现未发现生产缺陷，但原测试未永久覆盖验收条目中的四类后置失败。仅修改 client/tests/pdd/test_sku_reveal_spike.py，新增端到端反例：swipe 后页面不变/尺码仍隐藏、目标颜色 selected 漂移、提交硬拒绝区文本缺失/重复/上移、RPC 结果不明且页面不变。每例均断言 swipe 恰好一次且不重试、target/manifest 不发布、staging 无残留。受托 agent 聚焦 59/59 PASS；主 agent 独立逐行审查并复跑 client 全量 259/259（13.883s）、compileall、agent-context、diff-check 全部 PASS。未改生产代码，未引入数量、确认页、围栏、提交或支付能力。T-103 继续保持 Doing；可在该修复提交推送后放行项目所有者执行唯一一次真机 reveal。
+
+### 2026-08-05T06:19:03Z · ila
+
+2026-08-05 T-103 第二次真机失败诊断：项目所有者确认从拼多多首页运行后已进入目标商品并弹出规格面板，但面板保留此前人工选择的“白色 + 其他尺码”，脚本没有选择“黑色CHA(纯棉)”或目标尺码。按调用链，入口后置只接受 PANEL_OPEN_EMPTY；非目标规格使 `sku_entry_panel_verify` 失败，尚未进入 `select_sku_options`，因此 zero target-color click / zero reveal swipe / zero submit。为避免统一错误再次丢失控制流事实，仅修改 capture_sku_reveal_spike.py 复用既有 safe_failure_stage，输出白名单 stage 或 unknown；异常正文、页面文本、serial、XML、路径仍不回显，伪造 stage 无正式 marker 时降级 unknown。独立审计与主审均确认未改 Capturer/Flow/判据/动作；聚焦 60/60、client 全量 260/260（14.788s）、compileall、agent-context、diff-check PASS。T-103 继续 Doing，下一步先由人把该商品规格面板恢复为颜色/尺码均未选，再从首页执行全新 output-dir。
+
+### 2026-08-05T06:50:08Z · ila
+
+2026-08-05 T-103 同版本单价格节点变体真机证据与实施方案（先证据、后判据）：第一次正式 reveal 在 `sku_entry_panel_verify` fail closed。项目所有者已确认 force-stop 后颜色/尺码恢复未选；root 只读检查证明 PDD 8.17.0/PKG110/Android16/1080×2376/前台正确、summary=`请选择： 颜色分类 尺码`、selected-count=0、目标颜色 bounds `[372,1188][684,1587]` selected=false。证据目录 `C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-panel-empty-current-only-20260805-143741`，screenshot SHA-256 `7f3143d7fab42b41a088e27a4b2d9f8dbdf31b5ecc9ba02b148ca021304026f6`，XML SHA-256 `d3dbf217b4567069feccb30ab43124c5fa7da3734659ca5452b98c2e0a7ff158`。根因不是 selected，而是价格行由旧双节点变为 exact 单节点：current 仍为 `限1件 ¥12.88 ` `[396,580][675,647]`，其唯一 LinearLayout 为 `[396,575][693,647]` 且仅一 child，外层 FrameLayout `[396,575][1053,647]`；`券前¥29.88` count=0。项目所有者随后在同一 goods_id 937122477375 面板人工选择目标颜色并明确完成第二态确认；目录 `...\sku-panel-color-only-current-only-20260805-144550`，screenshot `931dc2d31f4e34872fdd97879abd076e414b6494569e8a587353266011610545`，XML `c686737942e5fdcebc76c2bc1d5cd9ae90a45f4a921297119ddaa4313758a034`；summary=`请选择： 尺码`，目标颜色 selected=true，未选尺码，current count=1/original count=0，固定 reveal 通道用现有代码只读验证 PASS，未发送 swipe。实施只允许新增两个 exact 单价格前置 spec（PANEL_OPEN_EMPTY / COLOR_SELECTED_SIZE_HIDDEN），旧双价格 spec 继续保留；不得把 original 泛化为 optional、不得接受任意 row/bounds/child count/price text，也不得修改 rolled candidate、数量、确认页、提交或支付。正式再跑前新增带正式 marker 的 reveal 白名单阶段码，至少能明确 `reveal_not_attempted` 与 `reveal_attempted/candidate/after/publish` 边界，异常正文和页面内容仍不外泄；补 cross-variant/duplicate/unknown/伪造 stage 失败测试。T-103 继续 Doing，先提交此证据计划，再实现并独立主审。
+
+### 2026-08-05T07:19:02Z · ila
+
+2026-08-05 第二态由用户人工确认：目标颜色“黑色 CHA（纯棉）”已选，尺码选项已显示且尚未选尺码。实现已按两组新 raw 证据收紧：新增 PANEL_OPEN_EMPTY / COLOR_SELECTED_SIZE_HIDDEN 的 exact current-only 价格布局；历史 dual 布局继续按已取证嵌套后代关系匹配；颜色点击后的后置条件绑定点击前完整 price_layout，禁止 dual 与 current-only 双向漂移。reveal 失败阶段新增不可伪造 marker，precondition 保证零 swipe，attempted 及以后仅在唯一 RPC 机会已封存后报告。两名独立 agent 审计均 PASS；根代理直接读取六组真实 raw 验证唯一命中：dual empty/color/S/M 与 current-only empty/color 均正确，M 读价 12.88。根代理完整门禁：client unittest 269/269 PASS，compileall PASS，validate_agent_context PASS，git diff --check PASS。未新增数量、确认页、围栏、提交订单或付款能力。T-103 仍保持 DOING，下一步仅允许强停重置后运行一次真机 reveal，并等待人工验收。
+
+### 2026-08-05T07:23:56Z · ila
+
+2026-08-05 15:23（Asia/Shanghai）唯一一次真机 reveal 运行结果：从拼多多 MainFrameActivity 首页、显式 Wi-Fi serial 192.168.0.173:5555、全新 output-dir `C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-reveal-current-only-20260805-152300` 启动；CLI 返回 `stage=reveal_precondition`，exit 1，未发布目录。按正式 marker，reveal swipe 未发生；禁止自动重跑。随后准备以 `capture_device_baseline.py` 对保持不动的页面做只读取证，但 `adb devices` 同时出现 Wi-Fi `192.168.0.173:5555` 与 USB `3B65BD02H7F00000`，基线脚本按同一物理手机多通道门禁拒绝，未采集。等待项目所有者拔掉 USB，仅保留 Wi-Fi；手机保持失败后的当前页面。之后只做一次只读截图/XML，不重跑 reveal，再根据首个真实漂移决定最小修复。T-103 保持 DOING。
+
+### 2026-08-05T07:29:22Z · ila
+
+2026-08-05 15:26-15:27（Asia/Shanghai）T-103 唯一真实 reveal 动作与失败后只读取证：仅 Wi-Fi ADB，拼多多 MainFrameActivity 首页，显式 goods_id 937122477375，全新 output-dir `...\sku-reveal-current-only-20260805-152636`。App 版本在本次运行重新检查为 8.17.0。脚本在 47 秒后返回 `stage=reveal_candidate`，证明唯一 reveal RPC 已发出；未发布 staging，未重试。手机保持不动后用只读 baseline 采集到 `C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\reveal-candidate-failure-20260805-152636`：screenshot SHA-256 `5c86a922b1064c1a3bf175182340703ad0a78c6f96d9ccee25ffbee336afdf68`，XML SHA-256 `840ef3e59aa3f19c5c9521d92ff5af769c9e19d348a68b79cce74e83e5f38295`。只读代码诊断 `_candidate_projection` 的首个错误为“候选价格行不唯一”。新 raw 显示目标颜色 exact selected=true，摘要 `请选择： 尺码`，S/M 可见且 selected=false，提交文字仍在 `[285,2225][795,2284]` 的硬拒绝区；滚动态价格是独立 exact current-only 变体：Frame `[396,498][1053,570]` 唯一 child，LinearLayout `[396,498][693,570]` 唯一 child，current=`限1件 ¥12.88 ` `[396,503][675,570]`，`¥29.88` count=0。旧 rolled dual 证据保持不变，不得把 original 泛化为 optional。等待项目所有者对当前手机画面确认：目标黑色仍选、S/M 均可见且均未选、仍在规格面板而非确认页。确认前不改判据、不再操作手机；T-103 保持 DOING。
+
+### 2026-08-05T07:31:25Z · ila
+
+2026-08-05 项目所有者完成人工确认：真实 reveal 后目标颜色已选中，未选中任何尺码。结合失败后保持不动采集的截图/XML，S/M 已显示，页面仍是规格面板而非订单确认页；因此唯一固定 reveal 动作已证明不会误选尺码，也未触发提交区。实施方案收紧为：只在独立 spike 的 rolled candidate 中新增与 raw 完全一致的 current-only 价格布局（Frame `[396,498][1053,570]` → 唯一 row `[396,498][693,570]` → 唯一 current `限1件 ¥12.88 ` `[396,503][675,570]`，原价 count=0）；旧 dual candidate `快卖完 ¥12.88` + `¥29.88` 原样保留。两种布局必须分别完整唯一匹配，禁止 optional original、跨布局拼装、未知文字/坐标/父链/child count；候选其余颜色、摘要、S/M 未选、提交硬拒绝区判据不变。补 dual/current-only 双向混合、duplicate、unknown、parent drift 失败测试；不得改生产 Flow 的 reveal，不得新增数量、确认页、围栏、提交或支付能力。先提交本计划投影，再由唯一 client 写入者实现、独立审计、根代理重跑真实 raw 与完整客户端门禁。T-103 保持 DOING；代码通过后是否需要再次运行 spike 以形成原子 before/after 发布证据，仍以任务验收全集为准。
+
+### 2026-08-05T07:53:16Z · ila
+
+2026-08-05 T-103 rolled current-only candidate 实现与双轮审计完成。唯一 client 写入者只修改 `sku_reveal_spike.py` 与对应测试：candidate 现在绑定两份真实 raw 共有的 exact header→Frame→Relative→ViewGroup→price Frame 链、各层 child count、summary direct parent；旧 dual row/current/original 与新 current-only row/current 是完整互斥 variant，原价绝非 optional，双向 complete/partial/hybrid/duplicate/unknown/parent drift 和已知 `¥29.88`/`券前¥29.88` 残片全部拒绝。首轮审计发现并退回两个 P1（current-only 任意 descendant、dual+current 共存仍通过）；返修后根代理及独立审计均复现为 REJECT。真实 current-only after raw projection PASS（14 roles）；历史 dual M raw 仅内存机械恢复未选尺码态后 PASS（14 roles）。截图后 current-only→dual 漂移永久测试证明 `stage=reveal_after`、唯一 swipe=1、target/staging 均不发布。根代理完整门禁：client unittest 274/274 PASS，compileall PASS，agent-context PASS，git diff-check PASS；生产新增行只有 clickability 只读检查，无新 tap/swipe/数量/确认页/授权/围栏/提交或支付能力。T-103 仍保持 DOING；下一步需按验收全集形成可发布的原子 before/after spike 证据并由人终验，代码提交后不得复用旧 output-dir。
+
+### 2026-08-05T07:56:33Z · ila
+
+2026-08-05 15:55（Asia/Shanghai）T-103 修复后原子 reveal 证据成功发布。前置：仅 Wi-Fi ADB、从拼多多 MainFrameActivity 首页、force-stop 清除持久选择、脚本本次重新核验 PDD 8.17.0 / PKG110 / Android 16 / 1080×2376。命令使用全新目录 `C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-reveal-accepted-20260805-155502`，33.5 秒完成；manifest `rpc_outcome=completed`、`reveal_attempts=1`、`candidate_status=human_review_required`。哈希：before screenshot `01d3c5a3c39635389d5ff5ec86809fd10dae897d8bc39c6aa5840da8b25f6e60`，before XML `8e318edf578e404d1e2de317d3c206cb7c481378e0b6b60927047d033b867adc`，after screenshot `fa3024167aaf7d5719b0916de8f22c27b83a0b200bc38c750af410ed85cac7d1`，after XML `539e76856c175a973f81a0e879b8d5c4103767a7464858f7a0977d6ffa47ce0f`。根代理只读重证：before exact COLOR_SELECTED_SIZE_HIDDEN + 固定安全通道 PASS；after candidate projection 14 roles PASS，目标颜色 selected 子树唯一，S 与 M 均可见且 selected=false，未发布外部证据/未 Back。截图显示仍为规格面板，提交硬拒绝区在底部；等待项目所有者查看手机/after screenshot 后最终人工确认“目标颜色保持选中、S/M 均未选、未进入订单确认页”。确认前 T-103 保持 DOING，不推进生产 reveal 或后续规格点击。
+
+### 2026-08-05T08:09:05Z · ila
+
+2026-08-05 项目所有者对第二次原子 reveal 证据完成三项人工终验并明确回复“是的，3个确认”：1) 目标黑色保持选中；2) 未选中任何尺码；3) 仍在规格面板，未进入订单确认页。证据目录 `C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-reveal-human-review-20260805-160655`；manifest 为 Wi-Fi / PDD 8.17.0 / PKG110 / Android 16 / goods_id 937122477375 / `reveal_attempts=1` / `rpc_outcome=completed`。哈希：before screenshot `7f1fb74ce91d67054deb462a02f4306128889ec7d04194ba2fb07bb90b664169`，before XML `314257333a50cd3be3a9e883d5a33e5b7da763224210f350b95c6593be7cd710`，after screenshot `e9b628821d1e39b8b501efd21a88e43a5f8e6eda9332c44159c38b0a8a5eb38a`，after XML `e17e0a789f53b33fa564b678511ba633bfb969861fc32417b81e5545e309e9a1`。根代理机器重证 before color-only+safe-path PASS，after projection 14 roles PASS，S/M selected=false。reveal 动作证据门禁现已满足。T-103 仍保持 DOING，因为验收全集还要求将已证固定 reveal 收入生产 Flow，并由人完成入口→目标颜色→固定 reveal→目标 M→读取 12.88→一次安全 Back 的最终真机闭环；不得把本次三项确认误当成整个 T-103 DONE。下一步先做只读设计审计与方案记录，再编码；不新增数量、确认页、提交或支付能力。
+
+### 2026-08-05T08:20:30Z · ila
+
+2026-08-05 16:14（Asia/Shanghai）T-103 目标 M 真实后置证据与生产 Flow 实施计划：
+
+项目所有者在原子 reveal 人审通过后的当前规格面板中，手工点击了 exact M（M(建议100-115)）。root 随即只读采集全新证据目录 C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-target-m-current-only-20260805-161434；manifest 绑定 Wi-Fi / 拼多多 8.17.0 / PKG110 / Android 16 / goods_id 937122477375 / 1080×2376。screenshot SHA-256=74e006b25c8618f0b283ff2472ef331e9628306877088b760c103f15f629e1e7，XML SHA-256=6887322d2ba9309e82442aa57b9a4ac4540f2850f6931a2631edbf899138aad1。现有代码只读重证：唯一命中 TARGETS_SELECTED / _DualPriceLayout；仅 exact M selected=true，目标颜色保持 selected=true；_unit_price 精确返回十进制字符串 12.88。截图显示仍为规格面板。
+
+该证据补齐的唯一获准真实转移是：CURRENT_ONLY COLOR_SELECTED_SIZE_HIDDEN → 固定无参 reveal 一次 → CURRENT_ONLY SIZE_VISIBLE_UNSELECTED（S/M 均 false）→ exact M 一次 → 既有 DUAL TARGETS_SELECTED → 既有价格节点读取 12.88。不得泛化为任意跨 variant；DUAL color-only 在 reveal 前必须零动作失败；不得新增 current-only TARGETS_SELECTED、不得把原价改为 optional、不得修改既有 target classifier 或读价语义。
+
+生产化方案经两名只读 agent 独立审计后由 root 收敛：
+1. sku_selection.py 成为 profile/revealed-unselected 判据唯一权威，新增 current-only 可见未选尺码窄状态和显式转移白名单；从 spike 提取共用纯判据，生产模块不得 import spike。
+2. Protocol 只新增无参数 reveal_size_options_once；绝不公开 swipe/scroll/坐标。Flow 在 RPC 前封存 pending/attempt，固定 reveal 最多一次；fresh hierarchy 连续两帧稳定证明 target color=true、summary=请选择尺码、S/M exact 可见且均 false、硬拒绝区未漂移后，才允许 exact M 一次。M 后继续复用既有 _require_target_panel 与 _unit_price。
+3. sku_selection_runner.py 的 adapter 固定唯一 reveal 手势并在 RPC 前封存。RPC timeout/结果不明只读调和，resolved 或 unresolved 均不重发；无法证明后置时进入终止态，不得继续 M、读价、Back 或发布。正常完整链才允许 Back 一次。
+4. sku_reveal_spike.py 删除重复手势/候选判据并单向复用生产 matcher；改造后不得因 Flow 已生产化而重复 reveal。
+5. T-103 退出证据只记录 back_attempts/RPC outcome 和 post_exit_status=human_review_required；“面板消失”不得自动写 safe_exit=completed。同 goods 商品页自动 post-exit 判据仍留给 T-104。
+6. 补正反例：dual color-only 零 reveal、variant/hybrid/父链/child-count/summary/selected/硬拒绝区漂移、exact M 缺失/重复/禁用/近似/已有其他尺码、reveal/M delivered-timeout 与 undelivered-timeout、重入二次调用零 RPC、截图后漂移、Back 不明、原子发布竞态、静态 API/AST 不可达数量/确认页/围栏/提交/支付。
+
+实现仅限 T-103 write_paths，任务继续 DOING。代码与完整 client 门禁通过后，必须再从首页、单 Wi-Fi、全新 output-dir 跑一次生产 runner，并由项目所有者人工核对：入口/颜色/reveal/M 各最多一次、仅 M 选中、规格面板价 12.88、Back 一次后仍为同 goods 商品详情页且未进入确认/提交/支付页。
+
+### 2026-08-05T08:55:34Z · ila
+
+2026-08-05 T-103 生产 Flow 离线实现与双重终审完成，提交 60cf05b 已推送 main。
+
+唯一 client 写入者仅修改 5 个 T-103 文件：sku_selection.py、sku_selection_runner.py、sku_reveal_spike.py 及两份对应测试；未操作真机，未修改共享文档或用户文件。
+
+实现结果：
+- 生产只放行同一 Flow 的 current-only empty → exact 目标颜色一次 → 固定无参 reveal 一次 → 连续两帧稳定的 current-only S/M 均未选 → exact M 一次 → 复用既有 dual TARGETS_SELECTED / 12.88。dual color-only、非本 Flow 已选颜色和 fresh revealed-unselected 均在后续 mutation 前零动作失败；已验 S=true→exact M 恢复路径保留。
+- sku_selection.py 成为 safe path/revealed-unselected 唯一判据；spike 删除重复手势和 300+ 行候选 matcher，单向复用生产判据与正式 adapter，且不调用完整选择流程，避免双 reveal/M。
+- reveal 手势只有一份不可变 tuple；Protocol 仅新增无参数命名动作，不暴露 swipe/scroll/坐标。entry/option/reveal/Back 均在 RPC 前封存，结果不明只读调和；Flow terminal 防重入，失败 finally 不再自动 Back。
+- reveal 后提交硬拒绝区要求全局所有 PDD TextView 中包含“提交订单”的集合恰好等于唯一 exact 底部证据节点；额外、上移、改文案、混合价格/父链/child-count/selected 漂移均失败关闭。
+- 每个 S/reveal/M mutation 前 fresh 重查版本、前台和完整 hierarchy。截图后重证目标规格/12.88；Back 前再用 fresh tree 通过既有 dual TARGETS_SELECTED 与 _unit_price，才封存并发送一次 Back。
+- 发布前强制 entry/color/reveal/M/Back 各 exactly 1 且 RPC outcome=completed。manifest 移除 safe_exit=completed，记录五个命名 actions 的 attempts/outcome，以及 post_exit_status=human_review_required；T-104 前不自动宣称同商品安全退出。
+- 调用链未引入数量、确认页、授权、围栏、提交订单或支付能力。
+
+审查与验证：
+- 实现 agent 首轮后，独立审计先后发现并退回：S→M 回归、手势双常量、动作审计不足、提交硬拒绝全局唯一缺口；root 另退回 Back 前 target/price 不够精确、mutation 前台未 fresh 重证、manifest 缺五类动作明细。全部补测并修复。
+- 独立终审最终 PASS，无 P1/P2；额外注入上移/改文案“提交订单”节点均 REJECT。
+- root 使用 client/.venv 独立复跑：聚焦 84/84 PASS；client 全量 284/284 PASS，13.434 秒（≤15 秒）；compileall(src/tests/scripts) PASS；wheel build 与 requirements metadata PASS；validate_agent_context PASS；git diff-check PASS。测试提速只缓存不可变的同一白色 PNG Base64，未删/合并/skip 测试。
+
+T-103 仍保持 DOING。下一步必须从拼多多首页、仅 Wi-Fi ADB、全新 output-dir 运行生产 run_t103_sku_selection.py，并由项目所有者人工核对：目标颜色与 M、规格面板价 12.88、五类动作均一次、Back 后仍为 goods_id 937122477375 商品详情且未进入确认/提交/支付页。
+
+### 2026-08-05T08:59:04Z · ila
+
+2026-08-05 16:57（Asia/Shanghai）T-103 生产 runner 最终真机闭环已单次执行成功，等待项目所有者最终人工确认；任务继续 DOING。
+
+运行前只读门禁：adb devices 仅有 Wi-Fi serial 192.168.0.173:5555；本次重新读取拼多多 versionName=8.17.0；force-stop 清除手工 M 状态后显式启动 MainFrameActivity，最终前台为 HomeActivity。随后从首页以 canonical goods_id 937122477375、任务颜色“黑色CHA(纯棉)”、尺码“M(建议100-115)”、全新目录执行 production run_t103_sku_selection.py，一次运行 53.9 秒、exit 0；未重跑。
+
+生产证据目录：C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-selection-production-20260805-final。runner 返回目标规格正确、规格面板单价 12.88。manifest 的五类 actions 全部为 attempts=1 / rpc_outcome=completed：sku_entry、target_color、size_reveal、target_size、back；channel=wifi、PDD 8.17.0、PKG110、Android16、unit_price=12.88、post_exit_status=human_review_required。Back 前 screenshot SHA-256=c0f6a4225c1a59195672ea6ff45a360f33886571c9566b6b6b66c4d7a59abb53，复算一致。root 只读查看该截图：规格面板仍在，已选摘要显示目标黑色与 M，M 有唯一红色选中框，顶部规格面板现价 12.88；底部“提交订单 ¥12.88”仅可见，未点击。
+
+Back 后不再进行任何 mutation，只用 baseline 只读采集：C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\sku-selection-after-back-20260805-final。前台为 com.xunmeng.pinduoduo/.activity.NewPageActivity；screenshot SHA-256=477fdf4202a6cef9d615bd37defd473b0e18fc6312469b1061b45fb8c00034f4，XML SHA-256=1aefe2b73ec27aa32c00b601c74f208b69675c8807ac91ce28e6997a75624da2，均与 manifest 一致。root 只读查看截图：已返回商品详情页，商品主图/标题与 goods_id 937122477375 证据一致，底部仍是“快要抢光 ¥12.88 / 免拼购买”，没有进入订单确认、提交结果或支付页。
+
+按 needs_device=true 规则，以上 agent/机器检查不能替代人验收。等待项目所有者在手机或两张本地截图上明确确认三项：1) Back 前目标颜色与 M 正确且规格面板价为 12.88；2) manifest 五类动作各一次；3) Back 后仍是该商品详情页，未进入确认/提交/支付页。确认前不得将 T-103 标 DONE。
+
+### 2026-08-05T09:00:34Z · ila
+
+2026-08-05 项目所有者完成 T-103 最终人工真机验收并明确回复“三项确认”：
+
+1. Back 前目标颜色与 M 正确，规格面板当前价为 12.88；
+2. manifest 中 sku_entry、target_color、size_reveal、target_size、back 五类动作均为 attempts=1 / rpc_outcome=completed；
+3. Back 后仍为 goods_id 937122477375 商品详情页，未进入订单确认、提交结果或支付页。
+
+至此 T-103 的验收要点全集全部满足：已取证页面判据、离线 284/284 与构建/元数据/上下文门禁、生产单次真机闭环和人类最终确认均具备。系统未设置数量、未进入确认页、未提交订单、未创建待付款订单、未触及任何付款能力。现将线上 done 与本地 git status 同步为 DONE；T-104 依赖解除。
 <!-- END VIKUNJA EXPORT -->
 
 ## 边界

docs/tasks/T-104.md

@@ -3,10 +3,10 @@ id: T-104
 title: 验证规格选择能力安全退出
 phase: 1
 deps: [T-103]
-status: TODO
+status: DONE
 created: 2026-08-04
 vikunja_task_id: 32
-context_ref: 3a0a41d
+context_ref: 29fb528
 work_branch: task/t-104-safe-exit
 needs_device: true
 needs_human_review: true
@@ -21,7 +21,7 @@ write_paths:
   - docs/current-state.md
 ---
 
-<!-- BEGIN VIKUNJA EXPORT id=32 synced=2026-08-04T15:33:56Z sha256=cd649f78ae8d79edcfe94fb3702f8dbf99b12d1d4cbf2c0069b14cffa8703464 -->
+<!-- BEGIN VIKUNJA EXPORT id=32 synced=2026-08-05T09:57:21Z sha256=8469785af6c7ffd0d42dd7f2bb56bad15996a1f696c854823074304739bf652e -->
 ## 问题 / 背景
 
 T-103 已实现受控规格选择、闸门一读价、规格面板原始截图和单次 Back，但当前 `exit_sku_panel_safely()` 只要 hierarchy 变化且规格面板判据不再成立就返回成功。现有纯 mock 测试还把 Back 后的空 hierarchy 当成成功并允许 runner 发布 `safe_exit=completed`。2026-08-04 的只读诊断同时证明：通知栏覆盖时 `app_current` 仍可能报告拼多多，而节点树全部属于 SystemUI。因此“面板消失”或“前台包仍是 PDD”都不是安全退出的充分条件；T-104 必须先取得独立 post-exit 真机证据，再把后置条件收紧为稳定回到同一目标商品详情页。
@@ -62,6 +62,70 @@ T-103 已实现受控规格选择、闸门一读价、规格面板原始截图
 ### 2026-08-04T13:46:33Z · ila
 
 2026-08-04 T-306 预研反向约束 T-104：成功 SkuSelectionRunResult 必须显式携带规格面板原始 screenshot_path 与实际 UTC captured_at；只有规格选择、闸门一读价、截图和严格安全退出全成功才返回。T-306 不枚举目录、不读 manifest 猜文件/时间，post-exit 商品详情截图不得冒充 gate1 证据。
+
+### 2026-08-05T09:04:13Z · ila
+
+2026-08-05 T-103 已在 git/线上完成，T-104 依赖解除，现由 root 领取并转 DOING；领取基线 29fb528，沿用工作路径 task/t-104-safe-exit。
+
+先证据后判据的实施顺序保持不变：
+1. 先只读审计 T-103 最新生产 Flow、最终 Back 前/后本地证据与 T-104 任务边界。T-103 的 sku-selection-production-20260805-final 与 sku-selection-after-back-20260805-final 已获人确认，可用于设计窄取证脚本和寻找候选正锚；但它们不是同一 T-104 原子 manifest，不能直接冒充阶段 A 验收证据。
+2. 唯一 client 写入者先实现 capture_sku_exit_spike.py：输入只允许显式 serial 与全新 output-dir；无商品 intent、页面 click、坐标、规格动作、数量、确认、提交或支付能力。前置复用 T-103 已证目标颜色/M/12.88 classifier；唯一 mutation 为 RPC 前封存且最多一次的 Android Back。
+3. Back 后只读连续采集 screenshot/XML/App/版本并原子发布本机证据；manifest 仅记录 back_attempts=1、RPC outcome、哈希和 human_review_required，人工确认前绝不写 safe_exit=completed。结果不明不重试、不发送任何后续 mutation。
+4. 离线脚本、原子性、超时/重入、静态 API/AST 测试经独立审计和 root 门禁通过后，才由项目所有者把手机手工停在已验目标规格面板并执行阶段 A；人确认同 goods 商品详情、面板关闭、未进入确认/提交/支付且未创建订单。
+5. 只有上述人验后，才从新 raw 提取 privacy-safe 的 product_exit_8_17_0.xml 最小 fixture，并设计阶段 B。若 raw 不含唯一同商品正锚，保持 DOING，不编造 selector、不放宽为任意 PDD 商品页。
+6. 阶段 B 收紧现有 Flow/runner：版本/PDD 包、同 goods 正锚、无危险页与连续两帧稳定全部成立才返回安全退出；空 hierarchy/SystemUI/锁屏/其他 PDD 页/面板未退/锚点漂移全部失败。成功结果同时补齐规格面板 screenshot_path 与截图附近 UTC captured_at，post-exit 图不得冒充 Gate1。
+
+写路径严格限于 T-104 frontmatter；共享 current-state 由 root 合入。needs_device/needs_human_review 保持，agent 不得自行 DONE。
+
+### 2026-08-05T09:27:14Z · ila
+
+2026-08-05 阶段 A 离线实现与独立审查完成，代码 commit 43fd8ce 已推送 main。
+
+仅新增窄取证器/CLI/测试：人工先停驻目标规格面板，内存中连续两次核验 PDD 8.17.0、PKG110/Android 16/1080x2376、目标颜色+M+12.88；唯一 mutation 为 RPC 前封存且最多一次的命名 Android Back。Back 响应不明不重试，只允许发布 ambiguous_reconciled + human_review_required。Back 后在任何截图/XML 前先核验仍为 PDD 8.17.0，采集后复核 package/activity/version 稳定；外部包、版本或页面漂移、PNG/XML/读取/发布失败均清 staging、零 target。
+
+manifest 不含 safe_exit 或 Gate1 资格；post-exit 图/XML 仅本地人工复核。静态检查证明脚本不可达 intent、页面 click、规格动作、数量、确认、围栏、提交或支付能力。
+
+root 独立门禁：focused 71/71、client full 293/293、compileall、validate_agent_context、git diff --check、完整 init.ps1 全部通过。独立 reviewer 终审 PASS，无 P1/P2。
+
+任务保持 DOING，下一步等待项目所有者把手机手工停在 goods_id 937122477375 的目标规格面板（黑色CHA(纯棉)、M(建议100-115)、12.88），执行一次阶段 A 脚本并人工确认 Back 后为同一商品详情、面板关闭、未进入确认/提交/支付、未创建订单。
+
+### 2026-08-05T09:38:22Z · ila
+
+2026-08-05 阶段 A 首次真机尝试在唯一 Back 前置核验处 fail closed，未发布 target/staging。项目所有者随后人工确认规格面板仍打开，因此本次 Back 没有送达；后续仅做只读诊断。
+
+只读诊断在 PDD 8.17.0、PKG110、Android 16、1080x2376、Wi-Fi 设备上证明：目标颜色与 M 均为 selected=true，尺码仍为既有精确 bounds `[439,1582][831,1667]`；同一目标颜色卡片因横向列表滚动，从既有 `[372,1000][684,1024]` 精确移动为 `[126,1000][438,1024]`，其余完整 TARGETS_SELECTED profile 与 12.88 双价格布局均未漂移。
+
+新本地只读证据：`%LOCALAPPDATA%\cmbuyer\artifacts\T-104\sku-exit-precondition-color-shift-937122477375-20260805`。screenshot SHA-256 `aef1281c09e72990f06ef5a301d701efc37eaeb0f3ed5866f617e81313b22028`；hierarchy SHA-256 `3ffd7fa673e3b83e288c37eecaf65ab03480f9471814dd18019480fdeff0a41e`；captured_at `2026-08-05T09:35:40.312763+00:00`。项目所有者在运行前已按要求声明已选“黑色CHA(纯棉)”与“M(建议100-115)”、价格 12.88 并保持面板打开。
+
+最小兼容边界：只新增上述第二个 exact color bounds 的完整 TARGETS_SELECTED spec；文字、selected、价格、摘要、尺码和其余结构继续全部精确匹配，任意相邻/未知 bounds 仍在 Back 前零动作失败。真机只读双 precheck 已通过；尚未再次发送 Back。
+
+### 2026-08-05T09:47:20Z · ila
+
+2026-08-05 T-104 阶段 A 真机取证完成并通过项目所有者人工复核。
+
+最终证据目录：`%LOCALAPPDATA%\cmbuyer\artifacts\T-104\sku-exit-phase-a-937122477375-20260805-final-v3`；captured_at `2026-08-05T09:44:33.891598+00:00`；Wi-Fi；PKG110；Android 16；PDD 8.17.0；goods_id `937122477375`。manifest 明确 `back_attempts=1`、`rpc_outcome=completed`、`post_exit_status=human_review_required`，不含 safe_exit 或 Gate1 资格。
+
+原子产物：post_exit_screenshot.png SHA-256 `2b9d931d8dfa7325629f53a996d65dc2e95bfa185ddeae174110fa1237221e2e`；post_exit_hierarchy.xml SHA-256 `d57e835e9d4b1b7ac1b96d6178ed5d9de09f53b2b64ec2ef76740980fc9243bc`；post_exit_app.json SHA-256 `b86205c3a7a865ce14eb57e4776184fcf7cc8aefe6d5f7442839be6218f6abf5`。
+
+生产 capturer 外仅包了一层只记录方法名的诊断代理，调用序列证明：两次前置核验 → 唯一一次 pressKey → 前台/版本 → screenshot → XML → 前台/版本；没有 intent、页面 click、规格、数量、确认、提交或支付动作，也没有第二次 Back。
+
+项目所有者完成三项人工确认：①手机与截图均为 goods_id 937122477375 的同一商品详情；②规格面板已关闭，未进入确认、提交或支付页面；③未创建订单。截图/XML 由同一 staging 原子发布且前后 package/activity/version 稳定。
+
+阶段 A 达标。任务保持 DOING，下一步只从上述本项目真实 post-exit XML 提取无个人信息/支付凭据的最小 `product_exit_8_17_0.xml`，再实现版本绑定、同商品正锚、连续两帧稳定的阶段 B 判据。
+
+### 2026-08-05T09:56:55Z · ila
+
+2026-08-05 T-104 阶段 B 完成，代码 commit `1bb5492` 已推送 main。
+
+从已人工确认 raw XML 提取最小 `client/tests/pdd/fixtures/product_exit_8_17_0.xml`：同商品正锚为唯一 exact `tv_title` 容器、完整标题 content-desc、两段直接只读文本及固定属性；同时要求已取证底部规格入口完整投影唯一。安全退出不解析或返回商品页价格，规格入口中的金额只保持既有身份常量，Gate1 仍只来自规格面板原始截图。
+
+`exit_sku_panel_safely()` 现在每帧重查 PDD 8.17.0/前台包，要求同商品投影连续两次一致；单次命中后发生漂移会清空稳定计数。空 hierarchy、面板仍在、SystemUI、锁屏、非 PDD overlay、PDD 其他页、正锚缺失/重复/属性漂移、版本/前台漂移与合成危险动作语义全部失败关闭，所有路径 Back≤1。
+
+runner 只有在精确规格、Gate1 读价、原始规格 PNG、严格同商品退出和完整动作审计全部成功后才发布 `safe_exit=completed`；`SkuSelectionRunResult` 明确返回原始规格 `screenshot_path` 与截图 RPC 成功附近的 UTC-aware `captured_at`，manifest 使用同一时间。post-exit 图不进入 runner 结果，也无 Gate1 资格。
+
+验证：真实 post-exit raw 与最小 fixture 均被新投影命中；focused 76/76、client full 298/298、compileall、validate_agent_context、git diff --check、完整 init.ps1 全部通过。静态边界继续证明 T-104 不可达数量、确认、授权、提交围栏、submit_order_once 或支付能力。
+
+结合阶段 A 的最终 manifest 与项目所有者三项人工确认，T-104 全部验收要点已满足，可转 DONE。
 <!-- END VIKUNJA EXPORT -->
 
 ## 边界

docs/tasks/T-105.md

@@ -3,15 +3,25 @@ id: T-105
 title: 数量设置、读回与闸门二
 phase: 1
 deps: [T-104]
-status: TODO
+status: DONE
 created: 2026-08-04
 vikunja_task_id: 40
-context_ref: 8c50e15
+context_ref: 67b4278
 work_branch: task/t-105-quantity-gate2
 needs_device: true
 needs_human_review: true
 write_paths:
   - docs/tasks/T-105.md
+  - docs/02-requirements.md
+  - docs/04-architecture.md
+  - docs/05-coding-rules.md
+  - docs/api.md
+  - docs/06-tasks.md
+  - docs/07-user-stories.md
+  - docs/08-interaction-checklist.md
+  - docs/routes.md
+  - docs/design/desk-execution.html
+  - docs/design/web-task-detail.html
   - client/src/cmbuyer_client/pdd/quantity_gate2_spike.py
   - client/src/cmbuyer_client/pdd/quantity_gate2.py
   - client/src/cmbuyer_client/pdd/quantity_gate2_runner.py
@@ -23,7 +33,7 @@ write_paths:
   - docs/current-state.md
 ---
 
-<!-- BEGIN VIKUNJA EXPORT id=40 synced=2026-08-04T13:59:13Z sha256=86e0079c5db57033818f75763d3e9012764e11f805a1ab12cafbe58a8ba9a526 -->
+<!-- BEGIN VIKUNJA EXPORT id=40 synced=2026-08-06T01:53:44Z sha256=fcc45a75560c145044787020f8e994751c203763df3a4a46d0cdb765958a71f2 -->
 ## 问题 / 背景
 
 T-104 将把规格选择、闸门一读价、原始截图和安全退出固化为受控能力。T-105 先对当前真机数量控件和读回位置取证，再实现规格面板内的数量设置、精确读回与闸门二；不进入确认页、不接触最终提交。
@@ -42,8 +52,8 @@ T-104 将把规格选择、闸门一读价、原始截图和安全退出固化
 2. 阶段二从本项目证据提取最小 fixture，固化数量显示、增减控件、选中规格和价格节点的精确唯一结构；版本/包/面板/规格/控件任一失配都零点击。
 3. QuantityGate2Flow 接受 T-104 Gate1Observation、目标数量和最高总价。数量必须为服务端任务正整数，不接受浮点、字符串猜测或超上限值。
 4. 每次数量修改只点击证据证明的唯一控件一次，并等待明确后置条件；超时或结果不明不得重试该次点击。达到目标前每一步都重新定位和读回，不使用裸坐标或缓存节点。
-5. 闸门二重新读取颜色、尺码、数量和规格面板单价；颜色/尺码必须等于目标，数量精确等于请求，gate2 单价逐字规范化后等于 gate1 单价，并用十进制运算确认单价×数量不超最高总价。
-6. 成功结果是不可变 Gate2Observation，包含请求/实际规格、quantity_read、gate1/gate2_unit_price、max_total_price、规格面板原始 screenshot_path 与 UTC captured_at。
+5. 闸门二重新读取颜色、尺码、数量和规格面板目标数量总额；颜色/尺码必须等于目标，数量精确等于请求，`gate2_panel_total_price` 必须唯一可读且以十进制比较不超最高总价。2026-08-06 真机证明多件优惠非线性，数量 1 为 12.88、数量 2 为 32.76，因此不得把 gate1 金额乘数量、不得要求 gate2 等于 gate1，也不得用底部“提交订单”金额作为候选或兜底。后续闸门三必须与该 Gate2 面板总额严格相等并再次不超上限，否则转人工。
+6. 成功结果是不可变 Gate2Observation，包含请求/实际规格、quantity_read、gate1_unit_price、gate2_panel_total_price、max_total_price、规格面板原始 screenshot_path 与 UTC captured_at；旧 `gate2_unit_price` 语义已被真机证据否定，后续服务端契约与存储必须在 T-210/T-205 前改名迁移，禁止以旧字段名承载总额。
 7. 失败、价格不可读/多候选、规格漂移、数量不符或超价都安全停止并使用 T-104 一次性安全退出；Back 结果不明不重试。
 8. 能力与 T-103/T-104 分层：T-103 不能反向导入本任务；本任务不暴露确认页导航、通用 click、最终提交控件、围栏或付款能力。
 
@@ -51,9 +61,9 @@ T-104 将把规格选择、闸门一读价、原始截图和安全退出固化
 
 - 先证据后实现，执行记录包含两态截图/XML/hash、版本、设备、goods_id 与人工确认。
 - 离线覆盖数量边界、每步单击一次、后置条件、超时不重试、节点缺失/重复、SystemUI/锁屏/版本漂移。
-- 覆盖闸门二规格不变、价格严格相等、Decimal 总价、数量读回及所有失败分支零确认页动作。
+- 覆盖闸门二规格不变、数量读回、Gate2 面板总额唯一可读、Decimal 上限比较、非线性优惠反例，以及节点缺失/重复/漂移和所有失败分支零确认页动作；静态禁止把 Gate1 乘数量、底部“提交订单”金额或旧 `gate2_unit_price` 当作 Gate2 事实。
 - 静态证明 T-103 不导入数量，本任务不可达确认页、围栏、submit_order_once 或付款。
-- 真机人工确认目标数量、规格、两次价格、截图、一次安全退出，且未进入确认/提交/支付页、未创建订单。
+- 真机人工确认目标数量、规格、Gate1 单价与 Gate2 面板总额、截图、一次安全退出，且未进入确认/提交/支付页、未创建订单。
 - client 全量 unittest、compileall、完整 init、上下文校验、Vikunja 导出与 diff-check 通过；agent 保持 DOING 等人工验收。
 
 ## 执行记录
@@ -61,6 +71,47 @@ T-104 将把规格选择、闸门一读价、原始截图和安全退出固化
 ### 2026-08-04T13:58:34Z · ila
 
 2026-08-04 预研定值：T-105 依赖 T-104 的一次安全退出，严格分“数量两态只读取证”和“人工确认后实现”两个门禁；闸门二输出显式 screenshot_path/captured_at，且不可达确认页、提交或付款。
+
+### 2026-08-05T09:58:46Z · ila
+
+2026-08-05 T-104 已在 git/线上完成，T-105 依赖解除，现由 root 领取；领取基线 `67b4278`，沿用工作路径 `task/t-105-quantity-gate2`。
+
+严格按两阶段门禁：
+1. 先实现只读 `quantity_gate2_spike.py` 与 CLI，只接受显式 serial、goods_id、human-declared state/quantity 和全新 output-dir；核验 PKG110/Android16/PDD8.17.0/PDD 前台/1080x2376 后，仅采 screenshot/XML/App/设备摘要并原子发布。不得 intent、页面 click、坐标、数量修改、Back、确认、提交或支付。
+2. 项目所有者分别把目标商品规格面板停在黑色CHA(纯棉)+M(建议100-115)+数量1，以及相同规格+数量2；各运行一次只读取证并人工确认控件、读回、价格、规格和页面对应性。
+3. 只有两态人验后才从本项目 raw 提取最小 fixture，实现逐步单击一次、每步 fresh 定位/readback、Gate2 Decimal 总价和 T-104 一次性安全退出。任一失败不进入确认页。
+
+写路径严格限于 T-105 frontmatter；共享 current-state 由 root 合入。needs_device/needs_human_review 保持，未完成人工验收前不得 DONE。
+
+### 2026-08-05T10:08:24Z · ila
+
+2026-08-05 T-105 阶段一只读取证代码完成并推送，代码 commit `994b6c8`。新增 `quantity_gate2_spike.py` 与 CLI：只接受显式 serial、固定 goods_id 937122477375、人工声明 initial=1 / target=2 和全新目录；每次重新核验 PKG110 / Android 16 / PDD 8.17.0 / PDD 前台 / 1080×2376，只调用 `takeScreenshot` 与 `dumpWindowHierarchy`，保存 screenshot/XML/App 摘要/manifest，前后台或版本漂移不发布。接口与静态测试证明无 intent、click、swipe、Back、数量修改、确认、提交或支付能力。专项 13/13、客户端全量 311/311、compileall、agent-context、完整 `init.ps1` 均通过。下一步必须由人分别准备同一商品、黑色CHA(纯棉)+M(建议100-115) 的数量 1 和数量 2 两态并运行只读取证；两态人工确认前不实现数量点击、readback 或 Gate2 判据。任务保持 DOING。
+
+### 2026-08-06T01:00:27Z · ila
+
+2026-08-06 T-105 阶段一两态真机证据与四项人工确认完成。设备 PKG110 / Android16 / WiFi，PDD 8.17.0，goods_id 937122477375，目标规格均为黑色CHA(纯棉)+M(建议100-115)。
+
+初态目录：`C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-105\quantity-initial-937122477375-20260806-v3`；captured_at `2026-08-06T00:53:00.023935+00:00`；screenshot SHA-256 `959c62f90d05a4d2a8e212b0286d7ad7e958e00e56915ddf733ce7fd9b11f9c0`；XML SHA-256 `f31d15ef0763d9685448aba0086b6f67b459e4991b5d01a5daae333dd3b9c16d`。人工确认数量1、目标规格、金额12.88。
+
+目标态目录：`C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-105\quantity-target-937122477375-20260806`；captured_at `2026-08-06T00:55:30.898374+00:00`；screenshot SHA-256 `1954d9f8dbbc80b73ef5b93ae941c0501baa3f35c3f040e0cd4ef9723eb40057`；XML SHA-256 `e6ffcdc71119b8e0ac35e135afac54517f9c28c4d9da1070168901dce1988b81`。人工确认数量2、目标规格不变、金额32.76。
+
+人工四项确认：两态数量分别1/2；颜色尺码均未变化；金额分别12.88/32.76；未进入确认/支付页、未点击“提交订单”、未创建订单。
+
+XML 允许字段摘要：数量节点为唯一 clickable/enabled EditText，`1 [480,752][561,827]` → `2 [480,750][561,825]`；唯一加号为 clickable/enabled ImageView、content-desc 精确“增加数量”、初态 bounds `[567,752][645,827]`、目标态 `[567,750][645,825]`；顶部价格角色 `快卖完 ¥12.88` → `快卖完 ¥32.76`；底部 `提交订单 ¥...` 继续排除且禁止点击。真机事实证明多件优惠非线性，Gate2 必须读取目标数量面板总额并与最高总价比较，不能继续用旧 gate2_unit_price 等值假设。任务进入阶段二，仍保持 DOING。
+
+### 2026-08-06T01:04:25Z · ila
+
+2026-08-06 T-105 初态首次只读取证阻塞取证：人工已确认规格面板为目标颜色/尺码/数量1，并关闭 OPPO 游戏助手视觉层；`dumpsys window` 的 mCurrentFocus/mFocusedApp 与 `dumpsys activity activities` 的唯一 topResumedActivity 均为 `com.xunmeng.pinduoduo/.activity.NewPageActivity`，PDD versionName=8.17.0、PKG110、Android16、1080×2376 均正确，但 uiautomator2 `app_current()` 误报 `com.oplus.games`。根因是当前 adbutils 2.12.0 先执行 `dumpsys window windows`（本机 Android16 无对应焦点行），随后只识别旧式 `mResumedActivity:`，不识别实际 `topResumedActivity=`，最终错误退回 `dumpsys activity top` 的最后一项。
+
+最小修复计划：不放宽“PDD 必须前台”，也不接受 `com.oplus.games`。T-105 阶段一改用仅限 PKG110/Android16 的窄只读 foreground reader，执行固定的 adb 参数数组：指定 serial、shell、dumpsys activity activities；只接受恰好一个 `topResumedActivity` 且 package 精确为 PDD、activity 非空；缺失/重复/其他包/命令失败全部不截图、不发布。通用 shell 不暴露给 capturer，既有只读设备协议反而移除错误的 `app_current`。离线补齐真实 Android16 行、旧格式拒绝、重复/缺失/其他包/命令失败、前后漂移测试；验证后再重跑数量1初态。任务仍 DOING。
+
+### 2026-08-06T01:28:33Z · ila
+
+2026-08-06 T-105 阶段二离线实现已完成并推送，代码 commit `21628a4`。从本项目两态证据提取最小 fixture，生产 Flow 只允许数量 1 零点击或数量 1→2 的唯一加号一次点击；每次 fresh 核验 PKG110 / Android 16 / PDD 8.17.0 / PDD 前台 / 1080×2376、目标颜色尺码、数量读回与顶部面板总额。数量 2 的 Gate2 事实为 `gate2_panel_total_price=32.76`，直接以 Decimal 比较 `max_total_price`；未使用 Gate1×数量推导 Gate2，底部“提交订单”金额不是候选，旧 gate2_unit_price 未进入生产代码。动作 RPC 前封存，超时/结果不明不重试；只有已知精确状态才执行 T-104 一次 Back，同商品详情需连续两帧稳定。模块不可达确认页、围栏、提交或付款。专项 32/32、客户端全量 330/330、compileall、agent-context、diff-check 与完整 init.ps1 均通过。下一步仅需项目所有者把目标面板手工恢复到数量1后运行生产验收；人工确认数量2、目标规格、12.88/32.76、Gate2 原图、一次安全退出，以及未进入确认/提交/支付页、未创建订单。任务保持 DOING。
+
+### 2026-08-06T01:52:14Z · ila
+
+2026-08-06 T-105 最终生产真机验收完成。证据目录：`C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-105\quantity-gate2-live-937122477375-20260806`；manifest：同目录 `manifest.json`；captured_at `2026-08-06T01:33:33.818765+00:00`；Gate2 screenshot SHA-256 `6b52c73f933934d270f0c2f5c9e37c67f7fba443ce03340807a764f80a2bf299`。manifest 固定事实：PKG110 / Android 16 / WiFi / PDD 8.17.0 / goods_id 937122477375；数量请求与读回均为2；黑色CHA(纯棉)+M(建议100-115)；Gate1 单价12.88；Gate2 面板总额32.76；最高总价40.00；加号1次且 completed；Back 1次且 completed；safe_exit=completed。项目所有者随后明确完成四项人工确认：Gate2 截图显示数量2、目标规格与顶部32.76；Back 后回到同一商品详情且面板关闭；未进入确认/提交/支付页；未创建订单且无异常操作。T-105 全部验收要点满足，达到条件即停止，不追加真机测试。
 <!-- END VIKUNJA EXPORT -->
 
 ## 边界
@@ -68,15 +119,20 @@ T-104 将把规格选择、闸门一读价、原始截图和安全退出固化
 - 必须先由人在拼多多 8.17.0 的目标规格面板分别准备初始数量与目标数量状态，只读采集并人工确认
   screenshot/XML/版本/goods_id/规格/数量的对应性，之后才允许从本项目证据编写数量判据和点击代码。
   不得从前序项目、旧 XML、控件常识、OCR、裸坐标或推理直接实现。
-- 数量控件、读回位置、规格选中态和两次价格都必须证据绑定且精确唯一。每次修改数量最多点击已批准
+- 数量控件、读回位置、规格选中态、Gate1 单价和 Gate2 面板总额都必须证据绑定且精确唯一。每次修改数量最多点击已批准
   控件一次并等待明确后置条件；超时或结果不明不得重试同一次点击，不得缓存节点跨状态继续操作。
-- 闸门二必须重新核对颜色/尺码未漂移、数量精确等于任务、gate2 单价严格等于 gate1 单价，并以
-  十进制运算验证单价乘数量不超最高总价。价格只从规格面板读取，不用详情页或其他数字兜底。
+- 闸门二必须重新核对颜色/尺码未漂移、数量精确等于任务，并从证据绑定的规格面板顶部当前金额
+  角色唯一读取 `gate2_panel_total_price`，以十进制直接验证其不超最高总价。2026-08-06 真机已证明
+  多件优惠非线性：数量 1 为 `12.88`、数量 2 为 `32.76`；不得用 gate1 金额乘数量猜总额、不得要求
+  gate2 等于 gate1，也不得把底部“提交订单”金额作为候选或兜底。后续闸门三必须与 Gate2 面板总额
+  严格相等且再次不超上限；任一不符即转人工。
 - 只有规格、数量、价格、总价上限和原始截图全部通过后才返回不可变 Gate2Observation；它必须显式
   携带 `screenshot_path` 与 UTC `captured_at`，不得让后续任务枚举目录或读取 manifest 猜证据。
 - 任一判据失败、规格漂移、数量不符、价格不可读/多候选/变化或超价都停止前进，只能调用 T-104
   已验证的一次性安全退出；Back 超时或结果不明不重试，不把“面板消失”当作退出成功。
 - T-103/T-104 不得反向导入本任务。本任务不进入确认页、不观察或获取最终提交控件，不实现通用 click、
   事件、证据上传、围栏或结果接口；不编写或引用点击“提交订单”的代码，不编写任何付款能力。
-- `needs_device: true`：agent 完成离线实现后仍保持 DOING。只有人确认真机数量、规格、两次价格、
+- 旧 `gate2_unit_price` 字段名已被本项目真机证据否定，不能用旧名字承载总额来掩盖语义变化；API 与
+  服务端存储必须在 T-210/T-205 消费 Gate2 前迁移为 `gate2_panel_total_price`，迁移未完成时不得建立围栏。
+- `needs_device: true`：agent 完成离线实现后仍保持 DOING。只有人确认真机数量、规格、Gate1 单价与 Gate2 面板总额、
   截图和安全退出，且未进入确认/提交/支付页、未创建订单，才可完成任务。

docs/tasks/T-106.md

@@ -3,10 +3,10 @@ id: T-106
 title: 确认页、闸门三与返回路径真机取证
 phase: 1
 deps: [T-105]
-status: TODO
+status: DOING
 created: 2026-08-04
 vikunja_task_id: 41
-context_ref: 0144054
+context_ref: db2b781
 work_branch: task/t-106-confirm-evidence
 needs_device: true
 needs_human_review: true
@@ -18,7 +18,7 @@ write_paths:
   - docs/current-state.md
 ---
 
-<!-- BEGIN VIKUNJA EXPORT id=41 synced=2026-08-04T14:02:41Z sha256=1b7fda4d3b4951f20504d45b88676fda9271f1aaeaacb67b0674e4a6357ca3cc -->
+<!-- BEGIN VIKUNJA EXPORT id=41 synced=2026-08-06T02:20:32Z sha256=3e585159a2607c63f54d72b84d9779699cce3cc79805ebc7c2bbd08cb80b815f -->
 ## 问题 / 背景
 
 T-105 验证规格面板数量与闸门二后，下一步会进入更高风险的订单确认页。T-106 只由人手工准备确认页、最终提交控件可见态和一次返回后的页面，再用完全只读脚本采集真机事实；本任务不自动导航、不写确认页判据。
@@ -58,6 +58,16 @@ T-105 验证规格面板数量与闸门二后，下一步会进入更高风险
 ### 2026-08-04T14:02:39Z · ila
 
 2026-08-04 主审补齐导航来源事实：T-106 必须采集四态——闸门二后的确认页导航前状态、确认页闸门三、最终提交控件可见态、人工一次返回后状态；人记录进入确认页时实际单击的精确控件/容器与匹配数，agent 仍只读取证。缺少来源态时 T-107 不得从目标页反推入口。
+
+### 2026-08-06T02:12:17Z · ila
+
+2026-08-06T02:12:16.724Z · Codex
+已领取 T-106。基线 init.ps1 通过（client 330 tests）；按任务边界只实现四态纯只读取证，禁止 click/press/back/swipe/input/intent，代码完成后等待人工真机准备与验收。
+
+### 2026-08-06T02:20:23Z · ila
+
+2026-08-06T02:20:23.748Z · Codex
+T-106 四态纯只读取证代码已完成：新增 order_confirm_spike、capture_order_confirm_spike.py 与 16 项专项测试。静态 AST 证明生产模块/CLI 只允许 takeScreenshot、dumpWindowHierarchy，且不可达页面修改、确认页导航、提交、围栏或付款能力。client 全量 346 tests、compileall、validate_agent_context 与完整 init.ps1 均通过。任务保持 DOING，等待项目所有者依次人工准备并确认 Gate2 导航前、Gate3、最终控件可见、一次返回后四态；绝不点击最终提交。
 <!-- END VIKUNJA EXPORT -->
 
 ## 边界